UPDATE: 7.1.8

[fepitre-bot]

Update to 7.1.8

Details

Changes since previous version:
gregkh/linux@61649a2d61cb x86/bugs: Make Safe-RET robust against interrupt injection
gregkh/linux@c7ba9d6de43e Linux 7.1.7
gregkh/linux@2dc2fffc704a net: mpls: initialize rtm_tos in mpls_getroute()
gregkh/linux@4349e4dd25b2 mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
gregkh/linux@2e048fda7bc7 lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
gregkh/linux@ebefca49e4c6 mm/slab: prevent unbounded recursion in free path with new kmalloc type
gregkh/linux@bd3fb6b74a49 ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
gregkh/linux@2aa2cde2cc79 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
gregkh/linux@f78f08b38a7f KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
gregkh/linux@4087bf79d2a8 dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold
gregkh/linux@85997b1c6a2e pinctrl: qcom: Unconditionally mark gpio as wakeup enable
gregkh/linux@dffcf5d44213 pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
gregkh/linux@d4ba6aa65fcd dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
gregkh/linux@c93a9f652b73 dmaengine: idxd: fix double free of wq, engine, and group structs
gregkh/linux@6e26a41c4c1a dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
gregkh/linux@0acbc621341a iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
gregkh/linux@96c25ed04aa7 gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
gregkh/linux@1dcffb3ecf54 selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
gregkh/linux@321c437d5c9c selftests/seccomp: Fix pointer type mismatch build error
gregkh/linux@4180b67aeb8f ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
gregkh/linux@99417b0dd4db ata: sata_mv: accept 1 or 2 resources in platform probe
gregkh/linux@35ede850a936 ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
gregkh/linux@5815ae160add phy: qcom: m31-eusb2: Fix return value of init call
gregkh/linux@4f385927d295 ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
gregkh/linux@0cd45057cd4b ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
gregkh/linux@de8ccbd6bf4e of: reserved_mem: prevent OOB when too many dynamic regions are defined
gregkh/linux@ec7959ecbfb0 btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
gregkh/linux@75859a7cd77c btrfs: zoned: fix deadlock between metadata writeback and transaction commit
gregkh/linux@920fe5b8317c btrfs: zoned: reset meta_write_pointer on zone reset
gregkh/linux@b0c33c0628c5 btrfs: warn about extent buffer that can not be released
gregkh/linux@076349e4c8d1 btrfs: skip global block reserve accounting for rescue mounts
gregkh/linux@20f6badf1c2a btrfs: raid56: fix an incorrect csum skip during scrub
gregkh/linux@0e9dbc6d1f0d btrfs: zoned: skip fully truncated ordered extents at zone finish
gregkh/linux@57e7b8bf7b02 ntfs: harden runlist realloc size calculations
gregkh/linux@ed0d2e33fab5 ntfs: drop stale page-cache when shrinking a non-resident attr
gregkh/linux@e8c5c80a20c7 rtla/timerlat_top: Fix on-threshold actions firing on signal
gregkh/linux@efea649f214f phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
gregkh/linux@a6b6d16a5e1c phy: zynqmp: fix runtime PM leak on probe allocation failure
gregkh/linux@ef5e2c6555d2 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
gregkh/linux@5b361672720c selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests
gregkh/linux@8501ca88419a netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
gregkh/linux@068f84c542b3 drm/mediatek: Check CRTC state before freeing
gregkh/linux@ccfb70d92a52 mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
gregkh/linux@35dbc4cc58ce Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
gregkh/linux@c34ac583c2fa mshv: Fix duplicate GSI detection for GSI 0
gregkh/linux@668120335b89 mshv: Fix sleeping under spinlock in mshv_portid_alloc
gregkh/linux@292e80a159aa KVM: arm64: vgic: Fix race between LPI release and re-registration
gregkh/linux@72aea30c76d3 KVM: arm64: vgic: Mitigate potential LPI registration failure
gregkh/linux@67baa93486bc KVM: arm64: Fix hyp_trace clock disabling
gregkh/linux@c9a590838b73 KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing
gregkh/linux@4c51944735f1 KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()
gregkh/linux@c71729aab77d KVM: arm64: Add missing hyp_enter when trapping sysreg
gregkh/linux@92e2c891a06b KVM: arm64: Reject guest_memfd memslots when the VM has MTE
gregkh/linux@b16272fe8916 KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
gregkh/linux@8dba33c1e779 keys: fix out-of-bounds read in keyring_get_key_chunk()
gregkh/linux@7e5397a3fed0 keys: make keyring key-chunk byte order agree with keyring_diff_objects()
gregkh/linux@24053cfe4d50 assoc_array: trim the final shortcut word using the current chunk end
gregkh/linux@eec19d7c90cb ipvs: adjust double hashing when fwd method changes
gregkh/linux@7d4789b58761 netfilter: nf_tables: make nft_object rhltable per table
gregkh/linux@06a76334243c netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
gregkh/linux@5558a85add07 ipvs: fix the checksum validations
gregkh/linux@79c1254f3dbd ipvs: fix places with wrong packet offsets
gregkh/linux@92600ca75fda ipvs: do not mangle ICMP replies for non-first fragments
gregkh/linux@da286d421b9a ipvs: clear the nfct flag under lock
gregkh/linux@630295d5bba1 netfilter: nft_payload: fix mask build for partial field offload
gregkh/linux@5c595f2ef60a ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
gregkh/linux@3712e66064a2 ASoC: SDCA: Always free firmware in FDL path
gregkh/linux@fe5c53a95297 ASoC: SDCA: Make UMP message size check more robust
gregkh/linux@6a4d9d37c1c0 ASoC: SDCA: Ensure that Control Range is large enough for header
gregkh/linux@8398bc477d3c rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
gregkh/linux@bb2b072c619c nexthop: take nh->lock for f6i_list walks in replace check and notify
gregkh/linux@44f53e4331a3 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
gregkh/linux@6c88d205c732 af_unix: fix listen() succeeding on sockets in the wrong state
gregkh/linux@b0d8ecdac394 selftests/net/af_unix: test listen() rejects wrong socket states
gregkh/linux@a0528ab6af62 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
gregkh/linux@5e94d74e4f3b xsk: drain continuation descs after overflow in xsk_build_skb()
gregkh/linux@be1b85613ca7 xsk: provide sufficient space in pool->tx_descs
gregkh/linux@e7ce2bad0c33 xsk: reclaim invalid Tx descriptors in ZC batch path
gregkh/linux@3bb9cbcd944b net/sched: sch_cake: skip clearing unused tins during rate adjustment
gregkh/linux@a7c855969b1a pinctrl-amd: Don't clear S4 wake bits at probe
gregkh/linux@1f07a897d43c scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
gregkh/linux@b0aa3e8e2ab4 scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
gregkh/linux@b9c44a140620 scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
gregkh/linux@b3e97ba24110 smb: client: fix buffer leaks in SMB1 read and write
gregkh/linux@fce6cd6f9845 erofs: clean up erofs_ishare_fill_inode()
gregkh/linux@f6145794f17a erofs: remove fscache backend entirely
gregkh/linux@3879657c4ffd erofs: ensure valid f_path for page cache sharing
gregkh/linux@fbfa371a2fb3 gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
gregkh/linux@9703abd39ef0 ACPI: CPPC: Skip writes to unsupported performance controls
gregkh/linux@234b5cb81e6f wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
gregkh/linux@c0c99275cce5 ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
gregkh/linux@8e89cc882f0a spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
gregkh/linux@a7f47f5246cd hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
gregkh/linux@e9374bbeb8b7 hwmon: (ina2xx) Fix various overflow issues
gregkh/linux@a0668ac20fea hwmon: (ltc4282) Fix reading the minimum alarm voltage
gregkh/linux@1fb41650bc3e hwmon: (sht3x) Fix unaligned accesses
gregkh/linux@f0b791a00651 hwmon: (lm90) Only report alarms if driver is ready
gregkh/linux@6a2dbce5da2d hwmon: (nzxt-smart2) DMA-align output buffer
gregkh/linux@828f6670d110 net: do not send ICMP/NDISC Redirects when peer allocation fails
gregkh/linux@4ad2972ef0e1 hwmon: (nct6775-core) Prevent access to unsupported weight registers
gregkh/linux@fec7c738e0f7 net: bridge: mrp: fix Option TLV length in MRP_Test frames
gregkh/linux@693ebff3e777 ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
gregkh/linux@201e05aa531e forcedeth: fix UAF of txrx_stats in nv_remove
gregkh/linux@c8ee73e540f3 hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
gregkh/linux@8a9492c467d6 hwmon: (adt7470) Fix cache updated before hardware write on I2C error
gregkh/linux@5ea299c3aa42 hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
gregkh/linux@c6540a03838b hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
gregkh/linux@c48557dc66c1 hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
gregkh/linux@fe3c8c93d02d hwmon: (adt7470) Use cached PWM frequency value
gregkh/linux@76963b04b2d1 hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
gregkh/linux@3a1c578d8539 hwmon: (adt7470) Fix PWM auto temp state array and bounds check
gregkh/linux@de691dc3227b rtase: fix double free of multi-frag skb on DMA map failure
gregkh/linux@f7bf8803e39c ethtool: Embed FEC hist ranges as buffer in struct
gregkh/linux@be2471a5af6d powerpc/boot: Fix simpleboot CPU node lookup check
gregkh/linux@fe85d44d2c08 powerpc/boot: Fix treeboot-currituck CPU node lookup check
gregkh/linux@c7116f38131d powerpc/boot: Fix treeboot-akebono CPU node lookup check
gregkh/linux@313cb9ffc410 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
gregkh/linux@b322532a4b77 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
gregkh/linux@47fb04c3826e wifi: mac80211: validate individual TWT params before driver setup
gregkh/linux@614b7f4bfcf6 netfs: clear PG_private_2 on copy-to-cache append failure
gregkh/linux@e65e0c057664 netfs: handle single writeback rolling buffer allocation failure
gregkh/linux@935e7b74bb23 netfs: release readahead folios on iterator preparation failure
gregkh/linux@3f6d7f8a5416 netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
gregkh/linux@7eb46318d539 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
gregkh/linux@95599c050359 hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
gregkh/linux@41bb8748124d idpf: bound interrupt-vector register fill to the allocated array
gregkh/linux@372f458eef99 idpf: adjust TxQ ring count minimum
gregkh/linux@b7f2c666fae8 idpf: Fix mailbox IRQ name leak on request failure
gregkh/linux@4d0644bd7821 ice: suppress DPLL errors during reset recovery
gregkh/linux@69a4a7b162b3 Bluetooth: ISO: clear iso_data always when detaching conn from hcon
gregkh/linux@09f447accc25 Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
gregkh/linux@b7dbf53fb3ca Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
gregkh/linux@202670e6602e Bluetooth: ISO: lock sk in iso_sock_getname
gregkh/linux@9bee7e476534 Bluetooth: ISO: lock sk in iso_connect_ind
gregkh/linux@c46c7a22c496 Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
gregkh/linux@171e71a6d661 Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
gregkh/linux@1308d72903d7 Bluetooth: ISO: hold sk properly in iso_conn_ready
gregkh/linux@e30e5ca63c8f Bluetooth: ISO: fix leaking sk after socket release
gregkh/linux@3c3d5f85db80 Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
gregkh/linux@cdce8af9291d Bluetooth: ISO: ensure no dangling hcon references in iso_conn
gregkh/linux@8208b4939afb Bluetooth: ISO: fix refcounting of iso_conn
gregkh/linux@876a3e94c70d Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
gregkh/linux@6ec9c3dc5230 Bluetooth: btintel: Validate length before parsing diagnostics TLV
gregkh/linux@fa812cfa81aa Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
gregkh/linux@9a77f296aff4 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
gregkh/linux@2d91e6244b69 Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
gregkh/linux@c53c70ec289e Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
gregkh/linux@e6792adef614 Bluetooth: hci_sync: hold conn in hci_past_sync() callback
gregkh/linux@236e5387cb09 Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
gregkh/linux@3f2ce63fe551 Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync
gregkh/linux@f0bc7e69ba1b x86/boot: Add volatile, clobbers and zero-length test in memcmp()
gregkh/linux@4dc5361dd284 net: phylink: put link_gpio if phylink_create fails
gregkh/linux@f15bcf9a99b1 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
gregkh/linux@9265806bd1f9 scsi: ufs: core: Cancel RTC work in active-active suspend
gregkh/linux@80aae06187d8 scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
gregkh/linux@deff324a327b scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
gregkh/linux@bb0894e1eef6 scsi: target: Clear cmd_cnt when initial counter enrollment fails
gregkh/linux@b21a2571f530 octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle
gregkh/linux@d3c6b0f48f12 octeontx2-af: Block VFs from clobbering special CGX PKIND state
gregkh/linux@df817b19dac7 scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
gregkh/linux@a29db0c7f695 scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
gregkh/linux@f2e5bb9fb710 net: sxgbe: free TX rings on RX allocation failure
gregkh/linux@64442a301711 net: sxgbe: check descriptor ring allocation failures
gregkh/linux@ffa229d67de5 can: isotp: check register_netdevice_notifier() error in module init
gregkh/linux@fdffacb12279 drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
gregkh/linux@b641bfb518a3 drm/xe/pt: check no-DMA huge-pte cases before DMA segment test
gregkh/linux@ac61f5b01dfe fprobe: Fix module reference count leak on error in register_fprobe()
gregkh/linux@d9d771a6e503 tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
gregkh/linux@60234845142f tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
gregkh/linux@25f228e6ac57 riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
gregkh/linux@e9b98da3355e accel/qaic: use sizeof(*trans_hdr) for transaction length check
gregkh/linux@1bb0ef8069ef riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
gregkh/linux@e0d8d33bac3b ring-buffer: Fix reader page read offset for remote buffers
gregkh/linux@5cbcd7e4a18a ipv6: release fib6_null_entry on subtree failure
gregkh/linux@9474b1eead40 riscv: vdso: Only try to install vDSO when present
gregkh/linux@fdefb3409f1c net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
gregkh/linux@f3fc89593ef7 net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
gregkh/linux@0f30be7f2922 net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
gregkh/linux@11b83d56d5f5 net: stmmac: Fix E2E delay mechanism
gregkh/linux@690ecb7bdfab net: mana: Create separate EQs for each vPort
gregkh/linux@bc8ccdc869d5 net: mana: Return error code from mana_create_rxq()
gregkh/linux@8486038decc6 ptp: netc: fix potential interrupt storm caused by incorrect unbind order
gregkh/linux@7416702c30ac net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
gregkh/linux@aeddda24726c octeontx2-pf: Set correct sequence for carrier off and tx queue stop
gregkh/linux@3ab00c9fd420 sched/deadline: Use revised wakeup rule only for running dl_server
gregkh/linux@bd2fc7a71dd2 spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs
gregkh/linux@6f1ef8170d3d qede: sync udp_tunnel ports outside qede_lock in the recovery path
gregkh/linux@54382aa779da drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
gregkh/linux@a52601f2e2b4 ksmbd: return success for deferred final close
gregkh/linux@cffbdc86393b ksmbd: fix use-after-free in __close_file_table_ids()
gregkh/linux@d53536329982 ksmbd: use memcmp() to compare ClientGUIDs
gregkh/linux@4a869be56e9f iomap: add a separate bio_set for iomap_split_ioend
gregkh/linux@4529a41a675b mshv: Fix race in mshv_irqfd_deassign
gregkh/linux@363a6500ff31 mshv: Fix level-triggered check on uninitialized data
gregkh/linux@3fb8a6e89abe mshv: Fix missing error code on VP allocation failure
gregkh/linux@eba2bf5daa79 mshv: Order pt_vp_array publish against irqfd assertion path
gregkh/linux@bfc58bfd2415 mshv: Publish VP to pt_vp_array before installing the file descriptor
gregkh/linux@6f9fe8087bf1 ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
gregkh/linux@ca9e49e1c893 iommufd/viommu: Release the igroup lock on the vdevice_size error path
gregkh/linux@0827a1ce6572 iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
gregkh/linux@41e615bc0e95 iommufd: Reject DMABUF pages from the access pin path
gregkh/linux@8eb077025279 iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
gregkh/linux@4e74a3692364 iommu/iommufd: Fix IOPF group ownership UAF
gregkh/linux@3edc387ba188 kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos
gregkh/linux@51b4c3743ab2 ACPI: CPPC: Check all controls for fast switching
gregkh/linux@fceb6b7f3dde mm: mglru: fix stale batch updates after memcg reparenting
gregkh/linux@2fa11c60c9c0 mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
gregkh/linux@f49b37761f24 pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
gregkh/linux@9d00a5ac7cd3 pinctrl: devicetree: don't free uninitialized dev_name on error path
gregkh/linux@6fedc49478be btrfs: raid56: fix scrub read assembly submitting no reads
gregkh/linux@e52da169b8c0 erofs: cap LZMA stream pool size
gregkh/linux@8612c37c7e06 pinctrl: bm1880: add missing select GENERIC_PINCONF
gregkh/linux@8ddfd1c1302d fortify: Disable -Wstringop-overread in tests
gregkh/linux@afe9f6f9b6be lib: test_hmm: use device devt for coherent device range selection
gregkh/linux@c6e484fecc4d btrfs: zoned: fix missing chunk metadata reservation
gregkh/linux@bcd83664c1c5 ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset
gregkh/linux@42f30fa5481a mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
gregkh/linux@c64932457120 mm/util: don't read __page_2 for order-1 folios in snapshot_page()
gregkh/linux@45f6333ef56c selftest: fix headers in fclog.c
gregkh/linux@e20086c3be6e fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
gregkh/linux@f7e22bcbec1a fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
gregkh/linux@5c7fc39bf19a mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
gregkh/linux@ac1bb7fd4508 mm/hugetlb: fix list corruption in allocate_file_region_entries()
gregkh/linux@43d3c86b1e80 userfaultfd: wait on source PMD during UFFDIO_MOVE
gregkh/linux@e2036b052a19 mm/vmstat: fold stranded per-cpu node stats when a node comes online
gregkh/linux@ed56a6b58222 KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
gregkh/linux@cad531c857f4 tracing/probes: Reject $arg0 in meta argument expansion
gregkh/linux@c56baa99c5f4 tracing/fprobe: Roll back on enable_trace_fprobe() failure
gregkh/linux@2451c2f95c78 KVM: VMX: add memory clobber to asm for VMX instructions
gregkh/linux@89f9e8398e79 KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
gregkh/linux@591952b63a9f KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
gregkh/linux@e3f732e086e4 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
gregkh/linux@239d8c02c839 KVM: s390: pci: Fix missing error codes and memory unaccounting
gregkh/linux@6a3339023e08 KVM: s390: pci: Fix resource leak on IRQ registration failure
gregkh/linux@d1a103dc9016 KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
gregkh/linux@fbfe683f8b1a KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
gregkh/linux@48c073f88c93 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
gregkh/linux@bfa28cf99eb4 sctp: validate Adaptation Indication parameter length
gregkh/linux@e18946575480 audit: fix potential integer overflow in audit_log_n_string()
gregkh/linux@5b8f46864f06 audit: fix potential use-after-free in audit_del_rule()
gregkh/linux@0fdd312c1396 Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
gregkh/linux@1023e4524625 Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
gregkh/linux@d9de4bd6bdf4 Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
gregkh/linux@35464ff81816 Bluetooth: mgmt: fix pending command UAF in EIR updates
gregkh/linux@8fe627192fa5 Bluetooth: SCO: give the socket its own sco_conn reference
gregkh/linux@51be7280980f Bluetooth: mgmt: fix UAF in pair command cancellation
gregkh/linux@b16ebdbebd2d Bluetooth: hci_sync: Fix advertising data UAFs
gregkh/linux@854194494a6f Bluetooth: HIDP: reject frames without a transaction header
gregkh/linux@9c841f59e10b Bluetooth: HIDP: validate numbered report payloads
gregkh/linux@8f0a7004755b bpf: lwt: Fix dst reference leak on reroute failure
gregkh/linux@616a3b534e32 afs: Fix afs_fs_fetch_data() to set call->async
gregkh/linux@cb20530c81eb afs: Fix afs_fs_fetch_data() to subtract transferred from len
gregkh/linux@daaa726b14fc afs: Fix UAF when sending a message
gregkh/linux@630c8d6a93cb ALSA: 6fire: Fix UAF at error handling during probe
gregkh/linux@61ddb594dba5 ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
gregkh/linux@1863097b1713 ALSA: lx6464es: fix period byte count for 16-bit streams
gregkh/linux@db09bc4ab19c ALSA: pcm: wake linked drain waiters on unlink
gregkh/linux@42c6543ff27e ALSA: seq: Fix division by zero in initialize_timer()
gregkh/linux@0c561fab5099 ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
gregkh/linux@c57001f55f97 ALSA: ump: fix double free of out_cvts on rawmidi error
gregkh/linux@637f7b361f10 ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
gregkh/linux@7e65b396192f ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
gregkh/linux@97d20ff1ab70 ASoC: tas2562: fix DVC coefficient write order
gregkh/linux@a4c7ae006ff5 ASoC: tas2562: fix broken entries in the volume lookup table
gregkh/linux@410f7290dc15 ata: libata-eh: Increase STANDBY IMMEDIATE timeout
gregkh/linux@1d8e0ff6eab8 ata: libata-sata: fix ata_scsi_lpm_supported() iteration
gregkh/linux@5f19cc10afaa ata: libata-scsi: terminate deferred commands on time out
gregkh/linux@3164ce8ca109 ata: libata-scsi: schedule deferred atapi command
gregkh/linux@ae388c0e1bf7 ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
gregkh/linux@98dbfbb38e29 ALSA: usb-audio: fix stack info leak in RME Digiface status
gregkh/linux@2b7a0f330dd9 ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
gregkh/linux@bd65b7191683 ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
gregkh/linux@53f0aa37eb94 ALSA: usb-audio: Clamp frame size in implicit-feedback mode
gregkh/linux@5ccf1b76c239 dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
gregkh/linux@378768dbce47 e1000: fix memory leak in e1000_probe()
gregkh/linux@a28d8903bfe7 fou: Fix use-after-free in fou_create()
gregkh/linux@df07003b5a6c igbvf: Fix leak in TX DMA error cleanup
gregkh/linux@9a2b637aef4e igc: remove napi_synchronize() in igc_down()
gregkh/linux@e7acfc990c29 ipvs: do not propagate one-packet flag to synced conns
gregkh/linux@7e02cb30e8a1 ksmbd: reject repeated SMB2 NEGOTIATE requests
gregkh/linux@b12378f6d1bb mshv: fix hv_input_get_system_property struct
gregkh/linux@f0541a775d04 net/smc: fix socket use-after-free during link group termination
gregkh/linux@77dbb248a5cc netfilter: ipset: do not update comments from kernel-side hash adds
gregkh/linux@eddd0159a876 of/address: Fix NULL bus dereference in of_pci_range_parser_one()
gregkh/linux@f448d2e9e938 PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug
gregkh/linux@ac2f787980fd tipc: avoid use-after-free in poll trace queue dumps
gregkh/linux@882af7b84f97 x86/CPU/AMD: Carve out a Zen5 models range
gregkh/linux@09fc36eec784 wifi: mac80211: fix tid_tx use-after-free on BA session stop
gregkh/linux@5a21ab03829c wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
gregkh/linux@3b522487a3a9 binfmt_misc: restore write access when removing an entry
gregkh/linux@f0edbaf487e4 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
gregkh/linux@9a2d87db3898 binfmt_misc: reject a flag character as the field delimiter
gregkh/linux@098e92fe0f1b binfmt_misc: don't let an 'F' entry pin its own instance
gregkh/linux@87a4eb9bbb34 binfmt_misc: don't leak the user namespace when the mount fails
gregkh/linux@ce5b96f9656d io_uring/net: initialize mshot_len for send
gregkh/linux@fcef9325afee io_uring: preserve task restrictions across exec
gregkh/linux@d640efe94d86 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
gregkh/linux@faf439b5fa7b mm/page_reporting: use system_freezable_wq to fix UAF during suspend
gregkh/linux@2097e1ddf3a6 mm: memcg: initialize *locked in memcg1_oom_prepare() stub
gregkh/linux@4c57056ca6aa net: bridge: stop fast-leave after deleting a port group
gregkh/linux@a341c091ca0b net: ipv6: clear suppressed fib6 rule result
gregkh/linux@b006a5404470 net: pktgen: fix proc entry use-after-free
gregkh/linux@11ad86830a78 riscv/mm: use physical alignment for vmemmap_start_pfn
gregkh/linux@95f05c1c0450 powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
gregkh/linux@804b681002ea um: vector: fix use-after-free in vector_mmsg_rx()
gregkh/linux@06c275a6c0a9 uprobes: Fix NULL pointer dereference in hprobe_expire()
gregkh/linux@f9c1fff857e9 veth: convert frag_list skbs before running XDP
gregkh/linux@c9dceac9e1c7 vxlan: re-fetch eth header after route_shortcircuit()
gregkh/linux@e50da7442910 vxlan: unclone skb head before modifying eth header in route_shortcircuit()
gregkh/linux@05f2987f73da vxlan: use neigh_ha_snapshot() in route_shortcircuit()
gregkh/linux@7076a34b6e33 vxlan: use pskb_network_may_pull() for transmit path header pulls
gregkh/linux@4f3f96e771a2 vxlan: use pskb_network_may_pull() in route_shortcircuit()
gregkh/linux@127033b79383 ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
gregkh/linux@000765dcdc3e tracing: Check return value of _register_event() in trace_module_add_events()
gregkh/linux@83c756f3f7a5 tracing/filters: Fix false positive match in regex_match_full()
gregkh/linux@3ba021079ef2 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
gregkh/linux@89fe0bddd429 spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
gregkh/linux@d7bd560e06ae selftests/mm: fix potential wild pointer access of getline due to missing init
gregkh/linux@e1d8f92f9603 selftests/clone3: fix wild pointer access of getline due to missing init
gregkh/linux@73e4cf572507 scsi: libsas: terminate deferred commands on time out
gregkh/linux@d6e6da6bc3b5 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
gregkh/linux@cad7ab03b989 scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
gregkh/linux@35c279113498 sctp: reject stale cookies with mismatched verification tags
gregkh/linux@6201cd1d70f1 sctp: prevent peer transport count overflow
gregkh/linux@8583336d9e52 hwmon: (npcm750-pwm-fan): stop fan timer on device detach
gregkh/linux@705e87e35e54 hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
gregkh/linux@8bf719659406 i2c: amd-mp2: Unregister callback on adapter add failure
gregkh/linux@a5012358afb6 gpiolib: tolerate gpio-hogs lacking a hogging state
gregkh/linux@a97d774fb738 gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
gregkh/linux@c0a4ec89fc26 gpio: pch: use raw_spinlock_t for the register lock
gregkh/linux@3513f3931c57 cifs: add fscache_resize_cookie() to cifs_setsize()
gregkh/linux@304b5281191b cpufreq: cppc: Sanitize lockless policy limit snapshots
gregkh/linux@8e787961a5dc cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
gregkh/linux@b6814d55ccd4 cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
gregkh/linux@8a1b4b8a451e power: supply: bq25890: fix the -10 C NTC lookup entry
gregkh/linux@57694663d658 power: supply: macsmc: Support macOS 27 SMC firmware
gregkh/linux@ee2ea0c452ed power: supply: max17040: handle missing status supplier
gregkh/linux@e355752a94d9 s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
gregkh/linux@93a0a846ec59 s390/qeth: Check CAP_NET_ADMIN for private ioctls
gregkh/linux@96b8e09b0953 s390/dasd: Fix potential NULL pointer dereference
gregkh/linux@87f3389cd392 s390/dasd: Fix undersized format-check buffer
gregkh/linux@1223477ca88e s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
gregkh/linux@82b62eda68ab s390/zcrypt: Close speculative mem read possibility
gregkh/linux@3b2abee2a678 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
gregkh/linux@ebfbb9ac7adb s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
gregkh/linux@3859f630b674 s390/zcrypt: Validate length for CCA AES cipher key requests
gregkh/linux@8fa3e9435a13 s390/zcrypt: Validate length for CCA ECC private key requests
gregkh/linux@7e7b9c0dca77 phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
gregkh/linux@68c49df14c95 phy: zynqmp: use read-modify-write for SERDES scrambler bypass
gregkh/linux@fa7da1efed83 phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
gregkh/linux@431a295d93f7 net: openvswitch: fix potential UAF on meter attach failure
gregkh/linux@378e341b29f9 net: openvswitch: fix skb leak on flow key update failure during recirculation
gregkh/linux@393f3c72600a net: openvswitch: fix skb leak on flow key update failure during ct
gregkh/linux@2ee7feff7bfa ice: wait for reset completion in ice_resume()
gregkh/linux@5be4386042bb ice: fix VF interrupts cleanup
gregkh/linux@85dc667f4aeb ice: fix memory leak in ice_lbtest_prepare_rings()
gregkh/linux@f7f0b514ac66 i2c: spacemit: request IRQ after controller initialization
gregkh/linux@100f7fdc1398 i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
gregkh/linux@aa1944b52d64 i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
gregkh/linux@83d48e4bf8a1 i2c: iproc: reset bus after timeout if START_BUSY is stuck
gregkh/linux@ec8e15e3e5c7 i2c: imx: mark I2C adapter when hardware is powered down
gregkh/linux@614ca6594e30 i2c: imx: Fix slave registration race and error handling
gregkh/linux@dab4762ee7f3 i2c: imx: Cancel hrtimer before clearing slave pointer
gregkh/linux@2ded503449ce can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
gregkh/linux@df3ac2a672a5 can: ems_usb: validate CPC message lengths
gregkh/linux@19c6c8c6cd5d can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
gregkh/linux@4976c9cf4186 can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
gregkh/linux@35c62ac98d06 can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
gregkh/linux@d5b3613c7d69 can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
gregkh/linux@6fbf77ca59c9 can: j1939: use netdevice_tracker for j1939{priv,session,ecu} tracking
gregkh/linux@195e70e83a09 can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
gregkh/linux@21f0465fd86d can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
gregkh/linux@0e36a43dcdd4 can: rcar_canfd: change the initializing flow for clocks and resets
gregkh/linux@808ed899dcf8 can: softing: fw_parse(): validate firmware record spans
gregkh/linux@0149fdb50a30 can: peak_usb: add bounds check for USB channel index
gregkh/linux@dfb17bf04a76 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
gregkh/linux@d9c115948c3d can: peak_usb: validate uCAN receive record lengths
gregkh/linux@731ed47772a5 can: ctucanfd: add missing MODULE_DEVICE_TABLE()
gregkh/linux@8e4eadb4b770 can: ctucanfd: use self-test mode for PRESUME_ACK
gregkh/linux@02170ecf8e2d can: ctucanfd: unmap BAR0 using base address
gregkh/linux@5bdcb17d788b can: ctucanfd: handle bus error interrupts
gregkh/linux@e49fa5a495af can: ctucanfd: mark error-active controller status valid
gregkh/linux@f3d2397f5309 drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
gregkh/linux@1e33ca7f44be drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
gregkh/linux@a75c8f365e20 drm/vc4: Zero the tile state data array before each BIN job
gregkh/linux@f32aeba8e9ef drm/bridge: display-connector: Fix I2C adapter resource leak
gregkh/linux@7f4674d986c1 drm/panthor: reject firmware sections with oversized data
gregkh/linux@ca41d9f3a215 drm/panthor: validate firmware interface structure sizes
gregkh/linux@2faeaaf28f92 drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
gregkh/linux@4296fd8fe37a drm/mediatek: ovl_adaptor: balance component registrations
gregkh/linux@a0062a4653e4 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
gregkh/linux@3529c9b1e4e7 drm/amdgpu: restore UMD profile pstate after runtime resume
gregkh/linux@30e7e004bef7 drm/amdgpu: cap GTT size to physical RAM on APUs
gregkh/linux@219eed1a041e drm/amd/pm: fix torn gpu metrics reads
gregkh/linux@b628f2c6feb3 drm/amd/pm: fix pptable use-after-free
gregkh/linux@dfc5d288c7c9 drm/amd/pm: hide pp_table sysfs on APUs
gregkh/linux@221d2766fefa drm/amd/pm: use milliwatts for GPU power sensors
gregkh/linux@062cfd6c678f drm/amd/display: check if dml21_add_phantom_plane() is successful
gregkh/linux@1f93537881fd drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
gregkh/linux@3fc61f526ffa drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
gregkh/linux@1c0b90e44768 drm/amd/display: Silence link_dpms I2C retimer failures
gregkh/linux@f556bc844cc4 drm/amd/display: use proper context for logging
gregkh/linux@4070909ac042 drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
gregkh/linux@7c35bf94150d drm/amdkfd: fix QID bit leak in pqm_create_queue()
gregkh/linux@7c54bd225d83 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
gregkh/linux@46c6041c7b02 drm/amdkfd: Handle invalid event type in CRIU event restore
gregkh/linux@bed80be08c0b drm/amdkfd: hold event_mutex while checkpointing CRIU events
gregkh/linux@3b2bb16a5b62 drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
gregkh/linux@6b1eb0b63cc1 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
gregkh/linux@2c10e2271a08 drm/vmwgfx: clamp dirty-page range with min, not max
gregkh/linux@bacbdc0be793 drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
gregkh/linux@4df39eb99bb4 drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
gregkh/linux@c77cf8edae2b drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
gregkh/linux@9759da60e38d drm/vmwgfx: bound DMA command body size against suffix pointer
gregkh/linux@0ee0532f1d40 drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
gregkh/linux@9109b7935b9c drm/vmwgfx: enforce cursor size limits for MOB cursors
gregkh/linux@5c725901908e drm/vmwgfx: use check_add_overflow for shader size+offset bound
gregkh/linux@5e4a2d15637a drm/vmwgfx: validate external BO copy bounds for both stride paths
gregkh/linux@16449f284fa4 drm/xe/rtp: Maintain OA whitelists separately
gregkh/linux@cc6b3f0c82b2 drm/xe/rtp: Keep track of non-OA nonpriv slots
gregkh/linux@339bc3ab303e drm/xe/rtp: Generalize whitelist_apply_to_hwe
gregkh/linux@ddcc9e4a8ebe drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
gregkh/linux@e8d1f040eb15 drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
gregkh/linux@43114690b12f drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
gregkh/linux@3be72ad315db drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
gregkh/linux@2c55034e53c5 drm/xe/rtp: Ensure locking/ref counting for OA whitelists
gregkh/linux@30df04e2d569 usb: typec: ucsi: split connector lock classes
gregkh/linux@bc7a0f721123 usb: typec: ucsi: Fix race condition and ordering in port unregistration
gregkh/linux@f571c2616e58 drm/xe: Drop unused param from xe_device_create()
gregkh/linux@d4c139fe4548 drm/xe: Move xe->info.force_execlist initialization
gregkh/linux@805dcf380590 drm/xe: Move xe->info.devid|revid initialization
gregkh/linux@15dfb66b557a drm/xe: Separate early xe_device initialization
gregkh/linux@3e891bfe08b4 drm/xe: Set TTM device beneficial_order to 9 (2M)
gregkh/linux@1366bf0496c2 drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
gregkh/linux@5d363d00bc97 drm/xe: Wait on external BO kernel fences in exec IOCTL
gregkh/linux@c1a029cb1aeb media: chips-media: wave5: Support CBP profile
gregkh/linux@be5c6ca1924a drm/amd/display: check GRPH_FLIP status before sending event
gregkh/linux@971962e96618 drm/amd/display: Exit idle optimizations before programming
gregkh/linux@bed97cd6f0ea usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
gregkh/linux@25c76bea853d Linux 7.1.8