UPDATE: 6.6.140

[fepitre-bot]

Update to 6.6.140

Details

Changes since previous version:
gregkh/linux@ab5ba9fd1387 ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
gregkh/linux@610ba605a4f7 ALSA: usb-audio: Avoid false E-MU sample-rate notifications
gregkh/linux@d1905dbbb7c0 ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
gregkh/linux@8429841d12ca usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
gregkh/linux@82d050713073 usb: chipidea: otg: not wait vbus drop if use role_switch
gregkh/linux@e3a0ebd80ae6 usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
gregkh/linux@8775fa6e2914 ALSA: usb-audio: Evaluate packsize caps at the right place
gregkh/linux@fa297e919d16 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
gregkh/linux@28a2e047d037 leds: qcom-lpg: Check for array overflow when selecting the high resolution
gregkh/linux@fc7e9a74e322 misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
gregkh/linux@a672682d39dd ibmasm: fix OOB reads in command_file_write due to missing size checks
gregkh/linux@fd19eb1c7504 ibmasm: fix heap over-read in ibmasm_send_i2o_message()
gregkh/linux@d0b27c41aa09 firmware: google: framebuffer: Do not mark framebuffer as busy
gregkh/linux@0b60eb04b852 Bluetooth: MGMT: Fix possible UAFs
gregkh/linux@a11a12a9880a padata: Fix pd UAF once and for all
gregkh/linux@c7f4dad62813 padata: Remove comment for reorder_work
gregkh/linux@be7c5dcfd3c7 drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
gregkh/linux@e620378aab78 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
gregkh/linux@abc6bdcbc045 regset: use kvzalloc() for regset_get_alloc()
gregkh/linux@17b399cbb9fa device property: Make modifications of fwnode "flags" thread safe
gregkh/linux@886f97fa59d0 ocfs2: split transactions in dio completion to avoid credit exhaustion
gregkh/linux@29166a0e732f driver core: Don't let a device probe until it's ready
gregkh/linux@108f2cd13577 LoongArch: Add spectre boundry for syscall dispatch table
gregkh/linux@2d1f18efccdb zram: do not forget to endio for partial discard requests
gregkh/linux@cc9b6303e7ea wifi: rtw88: check for PCI upstream bridge existence
gregkh/linux@8c43ed08643a um: drivers: call kernel_strrchr() explicitly in cow_user.c
gregkh/linux@f99165ef0677 spi: imx: fix use-after-free on unbind
gregkh/linux@9337ed5e777e f2fs: fix to detect potential corrupted nid in free_nid_list
gregkh/linux@9f1cbca178c0 crypto: pcrypt - Fix handling of MAY_BACKLOG requests
gregkh/linux@0ba03e06f037 of: unittest: fix use-after-free in testdrv_probe()
gregkh/linux@42dc622776f3 media: amphion: Fix race between m2m job_abort and device_run
gregkh/linux@1fbe46d2b727 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
gregkh/linux@914c6456fcfc net: caif: clear client service pointer on teardown
gregkh/linux@e9ae00490d47 net: strparser: fix skb_head leak in strp_abort_strp()
gregkh/linux@2209fdae5c2f media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
gregkh/linux@72099f015d3c PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
gregkh/linux@a34d96381bf8 Revert "ALSA: usb: Increase volume range that triggers a warning"
gregkh/linux@4a34fd6b04f9 lib/ts_kmp: fix integer overflow in pattern length calculation
gregkh/linux@3a5023627ab9 media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()
gregkh/linux@0f313eb6a8f6 net: qrtr: ns: Fix use-after-free in driver remove()
gregkh/linux@32e0b9255726 ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
gregkh/linux@831074ec21b4 ALSA: aoa: i2sbus: fix OF node lifetime handling
gregkh/linux@25ded535ee26 ALSA: ctxfi: Add fallback to default RSR for S/PDIF
gregkh/linux@8555d6990432 ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
gregkh/linux@222055e6b406 erofs: fix the out-of-bounds nameoff handling for trailing dirents
gregkh/linux@965d6162dd88 md/raid10: fix deadlock with check operation and nowait requests
gregkh/linux@ec7f47706269 mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
gregkh/linux@86bffea0b9f2 nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
gregkh/linux@1b4039d8f4f6 nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
gregkh/linux@c9d2f7b9c38c parisc: llseek syscall is only available for 32-bit userspace
gregkh/linux@5d1451cb2cf6 remoteproc: xlnx: Only access buffer information if IPI is buffered
gregkh/linux@1627d6060b45 selftests/mqueue: Fix incorrectly named file
gregkh/linux@2f4809a879f0 rbd: fix null-ptr-deref when device_add_disk() fails
gregkh/linux@44100ed1bdce io_uring/timeout: check unused sqe fields
gregkh/linux@89ca27d6d3b2 iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
gregkh/linux@cf522703d4f1 io_uring/poll: fix signed comparison in io_poll_get_ownership()
gregkh/linux@fafab8b3cd57 io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
gregkh/linux@e794e1763e80 ALSA: core: Fix potential data race at fasync handling
gregkh/linux@f4dfbdc1be34 ALSA: caiaq: Fix control_put() result and cache rollback
gregkh/linux@f537e3ad6960 ALSA: caiaq: Handle probe errors properly
gregkh/linux@99c8060c3b33 ALSA: 6fire: Fix input volume change detection
gregkh/linux@c21ef73713eb ALSA: pcmtest: fix reference leak on failed device registration
gregkh/linux@528763fd6bb8 ALSA: pcmtest: Fix resource leaks in module init error paths
gregkh/linux@97a97090872f iio: adc: ad7768-1: fix one-shot mode data acquisition
gregkh/linux@c4b8f32e73ea rxrpc: Fix memory leaks in rxkad_verify_response()
gregkh/linux@f1c6bd0cc786 rxrpc: Fix rxkad crypto unalignment handling
gregkh/linux@d61482be4aae rxrpc: Fix re-decryption of RESPONSE packets
gregkh/linux@4069329eeba0 tools/accounting: handle truncated taskstats netlink messages
gregkh/linux@ff78ed177a66 net: qrtr: ns: Free the node during ctrl_cmd_bye()
gregkh/linux@8fdbb6262a4a net: rds: fix MR cleanup on copy error
gregkh/linux@e98bd8888e3f net: txgbe: fix firmware version check
gregkh/linux@f0858e1d5624 net/smc: avoid early lgr access in smc_clc_wait_msg
gregkh/linux@640a7631d31d net: ks8851: Reinstate disabling of BHs around IRQ handler
gregkh/linux@fa0c4283efef net: ks8851: Avoid excess softirq scheduling
gregkh/linux@3e75d06cf3e4 drm/arcpgu: fix device node leak
gregkh/linux@2fd4f8b74930 RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
gregkh/linux@92e7c209036d ipv4: icmp: validate reply type before using icmp_pointers
gregkh/linux@4b2738b93eda libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
gregkh/linux@64282a745897 extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
gregkh/linux@41aec1d85b88 tpm: avoid -Wunused-but-set-variable
gregkh/linux@703fb43600c2 LoongArch: Show CPU vulnerabilites correctly
gregkh/linux@c03556448d47 power: supply: axp288_charger: Do not cancel work before initializing it
gregkh/linux@fdabbc881930 randomize_kstack: Maintain kstack_offset per task
gregkh/linux@0aaa43198645 mmc: block: use single block write in retry
gregkh/linux@00b1d0f4e7bb mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
gregkh/linux@a72815210182 arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
gregkh/linux@00463d5f864a crypto: talitos - fix SEC1 32k ahash request limitation
gregkh/linux@a866e2b1c65e crypto: talitos - rename first/last to first_desc/last_desc
gregkh/linux@2e0fd1cb4de4 tpm: tpm_tis: add error logging for data transfer
gregkh/linux@f92cc1d2c0b4 tpm: tpm_tis: stop transmit if retries are exhausted
gregkh/linux@d975c077fbdc rtc: ntxec: fix OF node reference imbalance
gregkh/linux@14c643ecdc42 mm/damon/core: use time_in_range_open() for damos quota window start
gregkh/linux@f3deabe0f5ac userfaultfd: allow registration of ranges below mmap_min_addr
gregkh/linux@35053cdec119 KVM: x86: Defer non-architectural deliver of exception payload to userspace read
gregkh/linux@15003179c74d KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
gregkh/linux@702ce67817de KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
gregkh/linux@1709418535a8 KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
gregkh/linux@3ac9d4241d20 KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
gregkh/linux@36f36a6e4e74 KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
gregkh/linux@263640149d81 KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
gregkh/linux@d218a0e8a63c KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
gregkh/linux@ddc242a7bb44 KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
gregkh/linux@83754e459c4b KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
gregkh/linux@c0095cef7303 KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
gregkh/linux@de6d8562a9cf KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
gregkh/linux@23ccf4affa6c KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
gregkh/linux@ddb188b88d55 KVM: nSVM: Add missing consistency check for nCR3 validity
gregkh/linux@980d6ba22747 mtd: docg3: Convert to platform remove callback returning void
gregkh/linux@d26f8c361f75 mtd: docg3: fix use-after-free in docg3_release()
gregkh/linux@8bbed28f6b42 io_uring/poll: fix multishot recv missing EOF on wakeup race
gregkh/linux@ab6da97bc310 ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
gregkh/linux@1bc1107a3a40 ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
gregkh/linux@09880592f5a9 md/raid5: fix soft lockup in retry_aligned_read()
gregkh/linux@33698bd1b2db md/raid5: validate payload size before accessing journal metadata
gregkh/linux@8bcc1cd237ab inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
gregkh/linux@ab5fdcd53564 tcp: call sk_data_ready() after listener migration
gregkh/linux@6cbf21775ee6 taskstats: set version in TGID exit notifications
gregkh/linux@204028af77a2 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
gregkh/linux@4b7d07747400 can: ucan: fix devres lifetime
gregkh/linux@d78ee361b365 crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
gregkh/linux@b63f1e2f0e31 crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
gregkh/linux@3f92c1de3bf1 crypto: atmel-ecc - Release client on allocation failure
gregkh/linux@5b71db0780f1 crypto: hisilicon - Fix dma_unmap_single() direction
gregkh/linux@3061c9bfb3f5 crypto: ccree - fix a memory leak in cc_mac_digest()
gregkh/linux@5281e6e23023 crypto: atmel-tdes - fix DMA sync direction
gregkh/linux@c5a45d14234b crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
gregkh/linux@35f6b3281efd dm mirror: fix integer overflow in create_dirty_log()
gregkh/linux@9d8fd84aab19 IB/core: Fix zero dmac race in neighbor resolution
gregkh/linux@98f4ba3480b9 ktest: Fix the month in the name of the failure directory
gregkh/linux@bf7ac4a1d3bf ntfs3: add buffer boundary checks to run_unpack()
gregkh/linux@a954061b334e ntfs3: fix integer overflow in run_unpack() volume boundary check
gregkh/linux@8a1fc8d698ac rtmutex: Use waiter::task instead of current in remove_waiter()
gregkh/linux@262152ec3710 scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
gregkh/linux@e3cebcde0114 seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
gregkh/linux@b69933e97efe crypto: authencesn - reject short ahash digests during instance creation
gregkh/linux@68532b09cbfc driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
gregkh/linux@be62c8bb03b6 ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
gregkh/linux@e4389fb74cec ALSA: caiaq: Don't abort when no input device is available
gregkh/linux@8e8be63465a5 ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
gregkh/linux@be0376affcaf drm/amdgpu: fix zero-size GDS range init on RDNA4
gregkh/linux@50c6a1f05973 ALSA: caiaq: fix usb_dev refcount leak on probe failure
gregkh/linux@6bd17925bd68 net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
gregkh/linux@bffef0acec9c netfilter: reject zero shift in nft_bitwise
gregkh/linux@1f678d13e939 scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
gregkh/linux@67c44e0deba9 ipmi: Add limits to event and receive message requests
gregkh/linux@2418e4b21fb1 ipmi: Check event message buffer response for bad data
gregkh/linux@ce905b65e649 ipmi:si: Return state to normal if message allocation fails
gregkh/linux@4f312c30f036 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
gregkh/linux@419d6c640da7 ACPI: scan: Use acpi_dev_put() in object add error paths
gregkh/linux@95242430c136 ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
gregkh/linux@3bb92bac4e27 ACPI: video: force native backlight on HP OMEN 16 (8A44)
gregkh/linux@cf3eb7c8e705 iommufd: Fix a race with concurrent allocation and unmap
gregkh/linux@327a64241f30 ASoC: SOF: Don't allow pointer operations on unconfigured streams
gregkh/linux@4a0bb8f9f71b spi: rockchip: fix controller deregistration
gregkh/linux@c79cf4232160 x86: shadow stacks: proper error handling for mmap lock
gregkh/linux@21159d8b335a drm/amd/display: Do not skip unrelated mode changes in DSC validation
gregkh/linux@e2c2b044458c x86/shstk: Prevent deadlock during shstk sigreturn
gregkh/linux@0d645c6d13fa spi: meson-spicc: Fix double-put in remove path
gregkh/linux@e3bf143b1e98 rxrpc: Fix potential UAF after skb_unshare() failure
gregkh/linux@4d08401aa13f ext4: validate p_idx bounds in ext4_ext_correct_indexes
gregkh/linux@4772032a2c62 rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
gregkh/linux@488e386484ec KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
gregkh/linux@c28c87d9a389 iommu/amd: Use atomic64_inc_return() in iommu.c
gregkh/linux@d51bf43193b1 iommu/amd: serialize sequence allocation under concurrent TLB invalidations
gregkh/linux@da54b3039d43 net: Fix icmp host relookup triggering ip_rt_bug
gregkh/linux@db104b0d8a78 flow_dissector: do not dissect PPPoE PFC frames
gregkh/linux@0305e7118451 net: txgbe: fix RTNL assertion warning when remove module
gregkh/linux@5ba95b119aa7 dmaengine: idxd: Fix crash when the event log is disabled
gregkh/linux@695b491dc3f2 dmaengine: idxd: Fix leaking event log memory
gregkh/linux@898a1751b620 KVM: SVM: check validity of VMCB controls when returning from SMM
gregkh/linux@36aa34f42cb6 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
gregkh/linux@e4da60feca4d bpf: support non-r10 register spill/fill to/from stack in precision tracking
gregkh/linux@c994886689fe selftests/bpf: add stack access precision test
gregkh/linux@57f41f1eac13 bpf: preserve STACK_ZERO slots on partial reg spills
gregkh/linux@6d40191708e1 selftests/bpf: validate STACK_ZERO is preserved on subreg spill
gregkh/linux@d3b398ee3404 bpf: preserve constant zero when doing partial register restore
gregkh/linux@9d2cf5a4a378 selftests/bpf: validate zero preservation for sub-slot loads
gregkh/linux@c05c8db19cd3 bpf: track aligned STACK_ZERO cases as imprecise spilled registers
gregkh/linux@f013c1dafe93 selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros
gregkh/linux@2fcd619caecb bpf: handle fake register spill to stack with BPF_ST_MEM instruction
gregkh/linux@aa71ab2cc929 selftests/bpf: validate fake register spill/fill precision backtracking logic
gregkh/linux@e4bbd3521db0 bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
gregkh/linux@640b4c00fb0e exit: prevent preemption of oopsing TASK_DEAD task
gregkh/linux@e451c325b000 wifi: mt76: mt7921: fix a potential clc buffer length underflow
gregkh/linux@d04bc2355392 wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
gregkh/linux@1baaeb6adecb wifi: b43legacy: enforce bounds check on firmware key index in RX path
gregkh/linux@03584528bfff wifi: mac80211: drop stray 'static' from fast-RX rx_result
gregkh/linux@95fcb436586d wifi: rsi: fix kthread lifetime race between self-exit and external-stop
gregkh/linux@83226c71af53 wifi: ath5k: do not access array OOB
gregkh/linux@fe75fa1ac9a9 wifi: mac80211: remove station if connection prep fails
gregkh/linux@c3d7b90dc950 wifi: b43: enforce bounds check on firmware key index in b43_rx()
gregkh/linux@ed4168d1a50f wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
gregkh/linux@6e29c32a2721 usb: usblp: fix heap leak in IEEE 1284 device ID via short response
gregkh/linux@d06d937b0a4c usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
gregkh/linux@a3c42466f45c ALSA: usb-audio: midi2: Restart output URBs on resume
gregkh/linux@e0e3dcf48189 ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
gregkh/linux@91c3634bc6ac ALSA: usb-audio: Fix UAC3 cluster descriptor size check
gregkh/linux@9b92535cb729 USB: omap_udc: DMA: Don't enable burst 4 mode
gregkh/linux@20284bf5cc84 USB: serial: option: add Telit Cinterion LE910Cx compositions
gregkh/linux@b0c0d44adb55 usb: ulpi: fix memory leak on ulpi_register() error paths
gregkh/linux@cdbd10975b96 ALSA: firewire-tascam: Do not drop unread control events
gregkh/linux@0f39c2626617 powerpc/kdump: fix KASAN sanitization flag for core$(BITS).o
gregkh/linux@3bf4e93ed085 xfrm: provide message size for XFRM_MSG_MAPPING
gregkh/linux@c2efc4956981 ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
gregkh/linux@ebd425067290 selinux: don't reserve xattr slot when we won't fill it
gregkh/linux@01231051fa45 selinux: shrink critical section in sel_write_load()
gregkh/linux@4aec732807c5 selinux: prune /sys/fs/selinux/disable
gregkh/linux@ed41c81d30b2 Bluetooth: virtio_bt: clamp rx length before skb_put
gregkh/linux@1e1e509b6fd2 Bluetooth: virtio_bt: validate rx pkt_type header length
gregkh/linux@6cb7f67bc28d Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
gregkh/linux@ab77c8bc3026 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
gregkh/linux@5105f3e6b2df Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
gregkh/linux@487f65651549 spi: zynqmp-gqspi: fix controller deregistration
gregkh/linux@1108b8722b9f spi: s3c64xx: fix NULL-deref on driver unbind
gregkh/linux@f39501ea776f staging: vme_user: fix root device leak on init failure
gregkh/linux@895ebbedf883 fanotify: fix false positive on permission events
gregkh/linux@9a80c458320e mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
gregkh/linux@0653c0516234 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
gregkh/linux@6162e8212e88 sound: ua101: fix division by zero at probe
gregkh/linux@d3bd80404979 net: libwx: fix VF illegal register access
gregkh/linux@eca62bb0569d ip6_gre: Use cached t->net in ip6erspan_changelink().
gregkh/linux@21d70744e6d3 net/rds: handle zerocopy send cleanup before the message is queued
gregkh/linux@f94450ce5053 net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
gregkh/linux@c9a3b2fb4003 parisc: Fix IRQ leak in LASI driver
gregkh/linux@66daaf79de20 hwmon: (ltc2992) Clamp threshold writes to hardware range
gregkh/linux@0fc5303fa33d hwmon: (ltc2992) Fix u32 overflow in power read path
gregkh/linux@39f0604bf1ae clk: rk808: fix OF node reference imbalance
gregkh/linux@d6c7f32094d6 hwmon: (corsair-psu) Close HID device on probe errors
gregkh/linux@0d7e7235bc54 af_unix: Reject SIOCATMARK on non-stream sockets
gregkh/linux@3d2ecbd444b0 block: add pgmap check to biovec_phys_mergeable
gregkh/linux@ff519f87c36b cifs: abort open_cached_dir if we don't request leases
gregkh/linux@2a5ed5055d1e cifs: change_conf needs to be called for session setup
gregkh/linux@476254a6c87c extcon: ptn5150: handle pending IRQ events during system resume
gregkh/linux@a0ea2ee6ec05 gpio: of: clear OF_POPULATED on hog nodes in remove path
gregkh/linux@9415a3fbf677 hv_sock: fix ARM64 support
gregkh/linux@82bc89fbb82d ibmveth: Disable GSO for packets with small MSS
gregkh/linux@50dfaf4a0277 udf: reject descriptors with oversized CRC length
gregkh/linux@c040f6c5402c thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
gregkh/linux@5f08cbdce0f3 thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
gregkh/linux@d79e92161b65 spi: topcliff-pch: fix use-after-free on unbind
gregkh/linux@be8af24ff376 clk: imx: imx8-acm: fix flags for acm clocks
gregkh/linux@47bc7a03449c clk: microchip: mpfs-ccc: fix out of bounds access during output registration
gregkh/linux@88f32a6806c8 cpuidle: powerpc: avoid double clear when breaking snooze
gregkh/linux@d91e616474c6 ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
gregkh/linux@a06bd365a587 ASoC: fsl_easrc: fix comment typo
gregkh/linux@ef1b78a68675 ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
gregkh/linux@cb25b46a8dbe ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
gregkh/linux@3141d8b00cad ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
gregkh/linux@f7126b0b2455 ASoC: qcom: q6apm: remove child devices when apm is removed
gregkh/linux@c2670ec4aa49 btrfs: fix double free in create_space_info() error path
gregkh/linux@12161e03d33a dm-thin: fix metadata refcount underflow
gregkh/linux@16fc9f57b5d7 dm: don't report warning when doing deferred remove
gregkh/linux@f0b0b09d9840 dm: fix a buffer overflow in ioctl processing
gregkh/linux@ae9cd0b46b18 eventfs: Hold eventfs_mutex and SRCU when remount walks events
gregkh/linux@2e28bb9cc39f dm-verity-fec: correctly reject too-small FEC devices
gregkh/linux@5489c98bc681 dm-verity-fec: correctly reject too-small hash devices
gregkh/linux@c9b37c8b73f6 isofs: validate Rock Ridge CE continuation extent against volume size
gregkh/linux@bb0988ed4f2e isofs: validate block number from NFS file handle in isofs_export_iget
gregkh/linux@2aa77a18dc7f lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
gregkh/linux@3f17500e86d7 lib/scatterlist: fix length calculations in extract_kvec_to_sg
gregkh/linux@470822125b62 lib/scatterlist: fix temp buffer in extract_user_to_sg()
gregkh/linux@2ae0afd98432 libceph: Fix slab-out-of-bounds access in auth message processing
gregkh/linux@4af2e558e6fd md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
gregkh/linux@d525ecf92228 nvme-apple: drop invalid put of admin queue reference count
gregkh/linux@9a4d7222c095 nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
gregkh/linux@c741433f6c8d openvswitch: vport: fix self-deadlock on release of tunnel ports
gregkh/linux@fb4ae739811d RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
gregkh/linux@e5c93847bf03 s390/debug: Reject zero-length input in debug_input_flush_fn()
gregkh/linux@dffb44b2e06a smb/client: fix out-of-bounds read in smb2_compound_op()
gregkh/linux@ef6495d4df6e smb/client: fix out-of-bounds read in symlink_data()
gregkh/linux@ba7f71b6161c smb: client: validate dacloffset before building DACL pointers
gregkh/linux@971f17f5d910 KVM: x86: check for nEPT/nNPT in slow flush hypercalls
gregkh/linux@b1e9f2d58707 mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
gregkh/linux@3937fa851992 PCI/AER: Clear only error bits in PCIe Device Status
gregkh/linux@27f7c024ede4 PCI/AER: Stop ruling out unbound devices as error source
gregkh/linux@92582c6978d9 power: supply: max17042: avoid overflow when determining health
gregkh/linux@c5dc30da9900 RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
gregkh/linux@a13c2ac4d480 RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
gregkh/linux@e01a957561f6 RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
gregkh/linux@539cabb7b2d8 RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
gregkh/linux@e3dc3a2fb05f RDMA/rxe: Reject unknown opcodes before ICRC processing
gregkh/linux@ecc36a82ecfc RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
gregkh/linux@114b4a6d4ede mptcp: fastclose msk when linger time is 0
gregkh/linux@23e881c7fedb mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
gregkh/linux@bd36fb4f9446 mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
gregkh/linux@a79bafdd4b63 mptcp: sockopt: set timestamp flags on subflow socket, not msk
gregkh/linux@ebeb70e29e37 mptcp: fix scheduling with atomic in timestamp sockopt
gregkh/linux@a2bcf16cdf79 f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
gregkh/linux@72ec0749a1ba f2fs: fix fiemap boundary handling when read extent cache is incomplete
gregkh/linux@88b98e3cfb92 f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
gregkh/linux@42dd1c91f993 f2fs: fix node_cnt race between extent node destroy and writeback
gregkh/linux@70d12291805a KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
gregkh/linux@db7f65df10bd KVM: arm64: Fix initialisation order in _pkvm_init_finalise()
gregkh/linux@07d190e4ec68 LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
gregkh/linux@0b8167e83647 LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
gregkh/linux@df870e104571 exit: Sleep at TASK_IDLE when waiting for application core dump
gregkh/linux@0bc4cf1a6ba0 HID: playstation: Clamp num_touch_reports
gregkh/linux@6467d656e689 media: uvcvideo: Enable VB2_DMABUF for metadata stream
gregkh/linux@fd10fb4c33bd media: i2c: ov8856: free control handler on error in ov8856_init_controls()
gregkh/linux@725b90ce70a7 spi: bcm63xx: fix controller deregistration
gregkh/linux@f367ddf1299e spi: atmel: fix controller deregistration
gregkh/linux@8c7a281a9922 staging: media: atomisp: Disallow all private IOCTLs
gregkh/linux@e46b3b0c9c44 regulator: mt6357: fix OF node reference imbalance
gregkh/linux@cd8f1633c3e8 regulator: max77650: fix OF node reference imbalance
gregkh/linux@0cc9251833bf media: rc: xbox_remote: heed DMA restrictions
gregkh/linux@5b7471dce523 media: rc: streamzap: Error handling in probe
gregkh/linux@da769e8f8e34 regulator: rk808: fix OF node reference imbalance
gregkh/linux@feb17524aa4e media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
gregkh/linux@0da216314247 regulator: act8945a: fix OF node reference imbalance
gregkh/linux@38321b03b8c2 regulator: bd9571mwv: fix OF node reference imbalance
gregkh/linux@5a531cbb3bce spi: lantiq-ssc: fix controller deregistration
gregkh/linux@70c2ee9cab5c spi: qup: fix controller deregistration
gregkh/linux@55be73783f11 spi: at91-usart: fix controller deregistration
gregkh/linux@3ce8f3057c51 media: saa7164: add ioremap return checks and cleanups
gregkh/linux@f3290d970bbe platform/x86: hp-wmi: Ignore backlight and FnLock events
gregkh/linux@492c5292540f media: pci: zoran: fix potential memory leak in zoran_probe()
gregkh/linux@97dbf8e69f3a media: dib8000: avoid division by 0 in dib8000_set_dds()
gregkh/linux@2dde85b42abd media: i2c: imx412: Assert reset GPIO during probe
gregkh/linux@0b49f5dabc3a media: staging: imx: request mbus_config in csi_start
gregkh/linux@e85f1e23168f media: i2c: ov08d10: fix image vertical start setting
gregkh/linux@951694f9fab9 media: omap3isp: drop the use count of v4l2 pipeline
gregkh/linux@b9d4b9c3457c spi: dln2: fix controller deregistration
gregkh/linux@2be39222d6ca spi: s3c64xx: fix controller deregistration
gregkh/linux@89c0a7762104 spi: fsl-espi: fix controller deregistration
gregkh/linux@4ea9a1ad663c spi: omap2-mcspi: fix controller deregistration
gregkh/linux@863edec24c1d spi: mtk-nor: fix controller deregistration
gregkh/linux@59da4cdd0c7b spi: sh-hspi: fix controller deregistration
gregkh/linux@562d954a1449 spi: fsl: fix controller deregistration
gregkh/linux@3ad32a7140eb spi: bcmbca-hsspi: fix controller deregistration
gregkh/linux@6dd37ce42ac7 spi: coldfire-qspi: fix controller deregistration
gregkh/linux@c6f82bd90a71 spi: sprd: fix controller deregistration
gregkh/linux@77defd64b405 spi: rspi: fix controller deregistration
gregkh/linux@17aa64b8fe3e spi: img-spfi: fix controller deregistration
gregkh/linux@1f120e1a3e1e spi: imx: fix runtime pm leak on probe deferral
gregkh/linux@678a461af304 spi: orion: fix runtime pm leak on unbind
gregkh/linux@59abb878f5a6 spi: orion: fix clock imbalance on registration failure
gregkh/linux@bb6b50f709c5 spi: mpc52xx: fix use-after-free on unbind
gregkh/linux@31e7dd252bf7 spi: cadence: fix controller deregistration
gregkh/linux@01eea4d12fb6 spi: cadence: fix unclocked access on unbind
gregkh/linux@1db431380879 drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
gregkh/linux@4a8093c7def1 drm/amdkfd: Add upper bound check for num_of_nodes
gregkh/linux@0fb5cb556b24 drm/amdgpu: Add bounds checking to ib{get,set}value
gregkh/linux@1dc005775fb5 drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
gregkh/linux@944db9cfa537 drm/amdgpu/vce: Prevent partial address patches
gregkh/linux@c72a8b4dc6d5 drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
gregkh/linux@638d3e0b9eb7 drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
gregkh/linux@6b992591e04f drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
gregkh/linux@91c6dc5a4169 drm/amdkfd: validate SVM ioctl nattr against buffer size
gregkh/linux@b8cbc52c73fa drm/radeon: add missing revision check for CI
gregkh/linux@91fbb5e635c8 drm/amdgpu: zero-initialize GART table on allocation
gregkh/linux@b5de35bafcd3 drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
gregkh/linux@4f7ca00fa91d drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
gregkh/linux@a103f1192dc7 drm/amdgpu/pm: add missing revision check for CI
gregkh/linux@ee4c7a919761 drm/amdgpu/pm: align Hawaii mclk workaround with radeon
gregkh/linux@1bfb06ecb00f sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
gregkh/linux@f61499359fa5 batman-adv: fix integer overflow on buff_pos
gregkh/linux@e4a3c4a4c8f6 batman-adv: reject new tp_meter sessions during teardown
gregkh/linux@aafcbaf1159e batman-adv: stop caching unowned originator pointers in BAT IV
gregkh/linux@368449e467d5 batman-adv: bla: prevent use-after-free when deleting claims
gregkh/linux@7b8fbcee3184 batman-adv: bla: only purge non-released claims
gregkh/linux@65419eb4259a batman-adv: bla: put backbone reference on failed claim hash insert
gregkh/linux@795dddb10687 smb: move some duplicate definitions to common/smbacl.h
gregkh/linux@1593ddb37bd1 smb: common: change the data type of num_aces to le16
gregkh/linux@325d4ac11f52 ksmbd: require minimum ACE size in smb_check_perm_dacl()
gregkh/linux@8e47d297e7cf smb: client: validate the whole DACL before rewriting it in cifsacl
gregkh/linux@1171f329cf1c f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
gregkh/linux@b0b3d62d7230 ksmbd: use msleep instaed of schedule_timeout_interruptible()
gregkh/linux@35baa66a8cd7 ksmbd: replace connection list with hash table
gregkh/linux@7edd983e42ee f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
gregkh/linux@11869ce402d9 wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
gregkh/linux@bf477abd448c lib: test_hmm: evict device pages on file close to avoid use-after-free
gregkh/linux@8dc5b98c20aa arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
gregkh/linux@b968db3b8b4f wifi: mt76: connac: introduce helper for mt7925 chipset
gregkh/linux@b3303d6e92f6 wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
gregkh/linux@801000afc9c9 wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
gregkh/linux@78509c488c5d PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
gregkh/linux@37a430a2d4e6 thermal: core: Fix thermal zone governor cleanup issues
gregkh/linux@1f5e011fc8c8 ipmi:ssif: Fix a shutdown race
gregkh/linux@07f9bff69da8 ipmi:ssif: Clean up kthread on errors
gregkh/linux@a045146109ea ALSA: aoa: Use guard() for mutex locks
gregkh/linux@35bcafc82254 ALSA: aoa: i2sbus: clear stale prepared state
gregkh/linux@32fbdb6d6718 media: rc: ttusbir: respect DMA coherency rules
gregkh/linux@69b3a50dee62 ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
gregkh/linux@18d6a7c9e4e6 media: rc: igorplugusb: heed coherency rules
gregkh/linux@ede9eca9701d block: relax pgmap check in bio_add_page for compatible zone device pages
gregkh/linux@8d4edc89bf71 sched: Use u64 for bandwidth ratio calculations
gregkh/linux@6a2d6273b6c3 RDMA/mana_ib: Disable RX steering on RSS QP destroy
gregkh/linux@218b772e4815 net: mctp: fix don't require received header reserved bits to be zero
gregkh/linux@0b9e4bbfb7c9 net: bridge: use a stable FDB dst snapshot in RCU readers
gregkh/linux@e6f6cd501fb5 net: qrtr: ns: Limit the maximum server registration per node
gregkh/linux@0dbec101a707 net: qrtr: ns: Limit the maximum number of lookups
gregkh/linux@4c4641366143 net: qrtr: ns: Limit the total number of nodes
gregkh/linux@a2c817c62943 spi: fix resource leaks on device setup failure
gregkh/linux@2a40f8bc9bb7 fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
gregkh/linux@401a49b7f26e firmware: google: framebuffer: Do not unregister platform device
gregkh/linux@058b451b1039 udf: fix partition descriptor append bookkeeping
gregkh/linux@b58baa1d50aa mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
gregkh/linux@82fb9da6477d xfs: fix a resource leak in xfs_alloc_buftarg()
gregkh/linux@61a790974ff7 hfsplus: fix uninit-value by validating catalog record size
gregkh/linux@3ca80e3012c8 hfsplus: fix held lock freed on hfsplus_fill_super()
gregkh/linux@e1c24ce7573d wifi: rtl8xxxu: fix potential use of uninitialized value
gregkh/linux@bf96052d617b ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
gregkh/linux@c5fa7465794c crypto: nx - Avoid -Wflex-array-member-not-at-end warning
gregkh/linux@268ae55a4c4f crypto: nx - Migrate to scomp API
gregkh/linux@6923cde8dc1d crypto: nx - fix bounce buffer leaks in nx842_crypto{alloc,free}_ctx
gregkh/linux@43a878639b90 erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
gregkh/linux@f3a3e2dac5ec printk: add print_hex_dump_devel()
gregkh/linux@2adbfca7452e crypto: caam - guard HMAC key hex dumps in hash_digest_key
gregkh/linux@6a74af77eba5 net: stmmac: avoid shadowing global buf_sz
gregkh/linux@8a2c91de61ff net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
gregkh/linux@e1c50b273298 net: stmmac: Prevent NULL deref when RX memory exhausted
gregkh/linux@247ed8a969f9 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
gregkh/linux@409fb34c1860 ALSA: hda: cs35l56: Propagate ASP TX source control errors
gregkh/linux@fe337552143f ALSA: misc: Use guard() for spin locks
gregkh/linux@3915715273cd ALSA: core: Serialize deferred fasync state checks
gregkh/linux@dbacde3d4755 ALSA: seq: Notify client and port info changes
gregkh/linux@7e78a5bcbd65 ALSA: seq: Fix UMP group 16 filtering
gregkh/linux@0841fc6a36c3 net: ipv4: stop checking crypto_ahash_alignmask
gregkh/linux@9d3968c48367 net: ipv6: stop checking crypto_ahash_alignmask
gregkh/linux@0555d4f52623 xfrm: ah: account for ESN high bits in async callbacks
gregkh/linux@b4a53add2fa8 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
gregkh/linux@6823f730bf19 Bluetooth: hci_conn: fix potential UAF in create_big_sync
gregkh/linux@5bbe69946620 spi: synquacer: switch to use modern name
gregkh/linux@904ff4e79961 spi: syncuacer: fix controller deregistration
gregkh/linux@79a38ff2bd3d spi: sun4i: switch to use modern name
gregkh/linux@1cdba535877d spi: sun4i: fix controller deregistration
gregkh/linux@3b6cededf65a spi: spi-ti-qspi: Convert to platform remove callback returning void
gregkh/linux@25ba53c43f30 spi: spi-ti-qspi: switch to use modern name
gregkh/linux@db96551920e2 spi: ti-qspi: fix controller deregistration
gregkh/linux@ae6ee9f16538 spi: zynq-qspi: switch to use modern name
gregkh/linux@dc2044ef3647 spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
gregkh/linux@7fd0c4fd2185 spi: zynq-qspi: fix controller deregistration
gregkh/linux@9da85b209f26 spi: sun6i: switch to use modern name
gregkh/linux@df771f250402 spi: sun6i: fix controller deregistration
gregkh/linux@4541a6cbec27 spi: tegra114: fix controller deregistration
gregkh/linux@664b60985a77 spi: tegra20-sflash: fix controller deregistration
gregkh/linux@c9577d966503 spi: uniphier: switch to use modern name
gregkh/linux@3e272e6be1a2 spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
gregkh/linux@fa7aaaed583a spi: uniphier: fix controller deregistration
gregkh/linux@420d6f5e3fb4 mm/hugetlb_cma: round up per_node before logging it
gregkh/linux@091499f90e09 spi: microchip-core-qspi: Use helper function devm_clk_get_enabled()
gregkh/linux@f4b177f96955 spi: microchip-core-qspi: fix controller deregistration
gregkh/linux@594973a2e549 fbcon: Avoid OOB font access if console rotation fails
gregkh/linux@c0428a22daf6 rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
gregkh/linux@cf1fd517f892 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
gregkh/linux@172dcb67dd35 bonding: fix use-after-free due to enslave fail after slave array update
gregkh/linux@cfa4267b5075 mm/damon/core: disallow time-quota setting zero esz
gregkh/linux@7c504ffab3ef rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
gregkh/linux@0dd8917f35da mm/damon/core: implement damon_kdamond_pid()
gregkh/linux@2b26b1ec4c1d mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
gregkh/linux@8e7317598d72 usb: typec: tcpm: reset internal port states on soft reset AMS
gregkh/linux@b32f4cd81ef5 mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
gregkh/linux@0000a7780e0e ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
gregkh/linux@b7cd63d13fae mtd: spi-nor: sst: Factor out common write operation to sst_nor_write_data()
gregkh/linux@3666c037fbde mtd: spi-nor: sst: Fix write enable before AAI sequence
gregkh/linux@c2287250ba69 pwm: imx-tpm: Count the number of enabled channels in probe
gregkh/linux@79bc0eaeef2c batman-adv: stop tp_meter sessions during mesh teardown
gregkh/linux@6b57d6e4c302 batman-adv: tp_meter: fix tp_num leak on kmalloc failure
gregkh/linux@f5ee467b5676 btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
gregkh/linux@033c80d80fd1 tracing/probes: Limit size of event probe to 3K
gregkh/linux@09a69a3d8f97 usb: dwc3: Move GUID programming after PHY initialization
gregkh/linux@83ce43a21bb7 ceph: only d_add() negative dentries when they are unhashed
gregkh/linux@944d76f749dd KVM: arm64: Wake-up from WFI when iqrchip is in userspace
gregkh/linux@a998a7e250bf vsock: fix buffer size clamping order
gregkh/linux@65c484726e74 vsock/virtio: fix accept queue count leak on transport mismatch
gregkh/linux@9b2c795bb2c6 vsock/virtio: fix length and offset in tap skb for split packets
gregkh/linux@1936310f68c5 drm/amdgpu/vcn3: Avoid overflow on msg bound check
gregkh/linux@5bb5faff4837 drm/amdgpu/vcn4: Avoid overflow on msg bound check
gregkh/linux@f7c14993dc2f mtd: spi-nor: sst: Fix SST write failure
gregkh/linux@d7e42dc47beb Bluetooth: MGMT: Fix memory leak in set_ssp_complete
gregkh/linux@b94588f5a697 crypto: nx - fix context leak in nx842_crypto_free_ctx
gregkh/linux@2074dfffad76 Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
gregkh/linux@4c3ed344a970 smb: client: use kzalloc to zero-initialize security descriptor buffer
gregkh/linux@eac8889a3a1c Linux 6.6.140