This is the start of the stable review cycle for the 5.15.167 release. There are 212 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 13 Sep 2024 13:05:05 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.167-rc2.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Linux 5.15.167-rc2 Felix Fietkau <nbd@xxxxxxxx> udp: fix receiving fraglist GSO packets Shakeel Butt <shakeel.butt@xxxxxxxxx> memcg: protect concurrent access to mem_cgroup_idr Filipe Manana <fdmanana@xxxxxxxx> btrfs: fix race between direct IO write and fsync when using same fd Daniel Borkmann <daniel@xxxxxxxxxxxxx> net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket Thomas Gleixner <tglx@xxxxxxxxxxxxx> x86/mm: Fix PTI for i386 some more Willem de Bruijn <willemb@xxxxxxxxxx> net: drop bad gso csum_start and offset in virtio_net_hdr Yan Zhai <yan@xxxxxxxxxxxxxx> gso: fix dodgy bit handling for GSO_UDP_L4 Yuri Benditovich <yuri.benditovich@xxxxxxxxxx> net: change maximum number of UDP segments to 128 Willem de Bruijn <willemb@xxxxxxxxxx> net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx> gpio: rockchip: fix OF node leak in probe() Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> drm/i915/fence: Mark debug_fence_free() with __maybe_unused Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused Matteo Martelli <matteomartelli3@xxxxxxxxx> ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode Maurizio Lombardi <mlombard@xxxxxxxxxx> nvmet-tcp: fix kernel crash if commands allocation fails Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx> arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry James Morse <james.morse@xxxxxxx> arm64: acpi: Move get_cpu_for_acpi_id() to a header Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx> ACPI: processor: Fix memory leaks in error paths of processor_add() Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx> ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() Nicholas Piggin <npiggin@xxxxxxxxx> workqueue: Improve scalability of workqueue watchdog touch Nicholas Piggin <npiggin@xxxxxxxxx> workqueue: wq_watchdog_touch is always called with valid CPU Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx> nilfs2: protect references to superblock parameters exposed in sysfs Qing Wang <wangqing@xxxxxxxx> nilfs2: replace snprintf in show functions with sysfs_emit Dan Carpenter <dan.carpenter@xxxxxxxxxx> ksmbd: Unlock on in ksmbd_tcp_set_interfaces() Namjae Jeon <linkinjeon@xxxxxxxxxx> ksmbd: unset the binding mark of a reused connection Peter Zijlstra <peterz@xxxxxxxxxxxxx> perf/aux: Fix AUX buffer serialization Sven Schnelle <svens@xxxxxxxxxxxxx> uprobes: Use kzalloc to allocate xol area Daniel Lezcano <daniel.lezcano@xxxxxxxxxx> clocksource/drivers/timer-of: Remove percpu irq related code Jacky Bai <ping.bai@xxxxxxx> clocksource/drivers/imx-tpm: Fix next event not taking effect sometime Jacky Bai <ping.bai@xxxxxxx> clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX David Fernandez Gonzalez <david.fernandez.gonzalez@xxxxxxxxxx> VMCI: Fix use-after-free when removing resource in vmci_resource_remove() Naman Jain <namjain@xxxxxxxxxxxxxxxxxxx> Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic Saurabh Sengar <ssengar@xxxxxxxxxxxxxxxxxxx> uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind Geert Uytterhoeven <geert+renesas@xxxxxxxxx> nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc Carlos Llamas <cmllamas@xxxxxxxxxx> binder: fix UAF caused by offsets overwrite Faisal Hassan <quic_faisalh@xxxxxxxxxxx> usb: dwc3: core: update LC timer as per USB Spec V3.2 Dumitru Ceclan <mitrutzceclan@xxxxxxxxx> iio: adc: ad7124: fix chip ID mismatch Dumitru Ceclan <mitrutzceclan@xxxxxxxxx> iio: adc: ad7124: fix config comparison Matteo Martelli <matteomartelli3@xxxxxxxxx> iio: fix scale application in iio_convert_raw_to_processed_unlocked David Lechner <dlechner@xxxxxxxxxxxx> iio: buffer-dmaengine: fix releasing dma channel on error Aleksandr Mishin <amishin@xxxxxxxxxx> staging: iio: frequency: ad9834: Validate frequency parameter value Ronnie Sahlberg <lsahlber@xxxxxxxxxx> cifs: Check the lease context if we actually got a lease Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations Michael Ellerman <mpe@xxxxxxxxxxxxxx> ata: pata_macio: Use WARN instead of BUG Jiaxun Yang <jiaxun.yang@xxxxxxxxxxx> MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed Kent Overstreet <kent.overstreet@xxxxxxxxx> lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() Stefan Wiehler <stefan.wiehler@xxxxxxxxx> of/irq: Prevent device address out-of-bounds read in interrupt map walk Phillip Lougher <phillip@xxxxxxxxxxxxxxx> Squashfs: sanity check symbolic link size Oliver Neukum <oneukum@xxxxxxxx> usbnet: ipheth: race between ipheth_close and error handling Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx> Input: uinput - reject requests with unreasonable number of slots Olivier Sobrie <olivier@xxxxxxxxx> HID: amd_sfh: free driver_data after destroying hid device Camila Alvarez <cam.alvarez.i@xxxxxxxxx> HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup Heiko Carstens <hca@xxxxxxxxxxxxx> s390/vmlinux.lds.S: Move ro_after_init section behind rodata section David Sterba <dsterba@xxxxxxxx> btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() Zenghui Yu <yuzenghui@xxxxxxxxxx> kselftests: dmabuf-heaps: Ensure the driver name is null-terminated Jarkko Nikula <jarkko.nikula@xxxxxxxxxxxxxxx> i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Vladimir Oltean <vladimir.oltean@xxxxxxx> net: dpaa: avoid on-stack arrays of NR_CPUS elements Dan Williams <dan.j.williams@xxxxxxxxx> PCI: Add missing bridge lock to pci_bus_lock() yang.zhang <yang.zhang@xxxxxxxxxxxx> riscv: set trap vector earlier Filipe Manana <fdmanana@xxxxxxxx> btrfs: replace BUG_ON() with error handling at update_ref_for_cow() Josef Bacik <josef@xxxxxxxxxxxxxx> btrfs: clean up our handling of refs == 0 in snapshot delete Josef Bacik <josef@xxxxxxxxxxxxxx> btrfs: replace BUG_ON with ASSERT in walk_down_proc() Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx> fs/ntfs3: Check more cases when directory is corrupted Zqiang <qiang.zhang1211@xxxxxxxxx> smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() Yicong Yang <yangyicong@xxxxxxxxxxxxx> dma-mapping: benchmark: Don't starve others when doing the test Luis Henriques (SUSE) <luis.henriques@xxxxxxxxx> ext4: fix possible tid_t sequence overflows Yifan Zha <Yifan.Zha@xxxxxxx> drm/amdgpu: Set no_hw_access when VF request full GPU fails Andreas Ziegler <ziegler.andreas@xxxxxxxxxxx> libbpf: Add NULL checks to bpf_object__{prev_map,next_map} Guenter Roeck <linux@xxxxxxxxxxxx> hwmon: (w83627ehf) Fix underflows seen when writing limit attributes Guenter Roeck <linux@xxxxxxxxxxxx> hwmon: (nct6775-core) Fix underflows seen when writing limit attributes Guenter Roeck <linux@xxxxxxxxxxxx> hwmon: (lm95234) Fix underflows seen when writing limit attributes Guenter Roeck <linux@xxxxxxxxxxxx> hwmon: (adc128d818) Fix underflows seen when writing limit attributes Krishna Kumar <krishnak@xxxxxxxxxxxxx> pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv Zijun Hu <quic_zijuhu@xxxxxxxxxxx> devres: Initialize an uninitialized struct member Johannes Berg <johannes.berg@xxxxxxxxx> um: line: always fill *error_out in setup_one_line() Waiman Long <longman@xxxxxxxxxx> cgroup: Protect css->cgroup write under css_set_lock Jacob Pan <jacob.jun.pan@xxxxxxxxxxxxxxx> iommu/vt-d: Handle volatile descriptor status read Benjamin Marzinski <bmarzins@xxxxxxxxxx> dm init: Handle minors larger than 255 Amadeusz Sławiński <amadeuszx.slawinski@xxxxxxxxxxxxxxx> ASoC: topology: Properly initialize soc_enum values Pawel Dembicki <paweldembicki@xxxxxxxxx> net: dsa: vsc73xx: fix possible subblocks range of CAPT block Jonas Gorski <jonas.gorski@xxxxxxxx> net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> fou: Fix null-ptr-deref in GRO. Eric Dumazet <edumazet@xxxxxxxxxx> gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers Eric Dumazet <edumazet@xxxxxxxxxx> gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers Guillaume Nault <gnault@xxxxxxxxxx> bareudp: Fix device stats updates. Oliver Neukum <oneukum@xxxxxxxx> usbnet: modern method to get random MAC Jakub Kicinski <kuba@xxxxxxxxxx> net: usb: don't write directly to netdev->dev_addr Larysa Zaremba <larysa.zaremba@xxxxxxxxx> ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset Dan Carpenter <dan.carpenter@xxxxxxxxxx> igc: Unlock on error in igc_io_resume() Cong Wang <cong.wang@xxxxxxxxxxxxx> tcp_bpf: fix return value of tcp_bpf_sendmsg() Aleksandr Mishin <amishin@xxxxxxxxxx> platform/x86: dell-smbios: Fix error path in dell_smbios_init() Daiwei Li <daiweili@xxxxxxxxxx> igb: Fix not clearing TimeSync interrupts for 82580 Simon Horman <horms@xxxxxxxxxx> can: m_can: Release irq on error in m_can_open Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> can: bcm: Remove proc entry when dev is unregistered. Marek Olšák <marek.olsak@xxxxxxx> drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6 Jules Irenge <jbi.octave@xxxxxxxxx> pcmcia: Use resource_size function on resource object Chen Ni <nichen@xxxxxxxxxxx> media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse Kishon Vijay Abraham I <kishon@xxxxxx> PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) Hans Verkuil <hverkuil-cisco@xxxxxxxxx> media: vivid: don't set HDMI TX controls if there are no HDMI outputs Alex Hung <alex.hung@xxxxxxx> drm/amd/display: Check HDCP returned status Shantanu Goel <sgoel01@xxxxxxxxx> usb: uas: set host status byte on data completion error Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx> wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> leds: spi-byte: Call of_node_put() on error path Hans Verkuil <hverkuil-cisco@xxxxxxxxx> media: vivid: fix wrong sizeimage value for mplane Jan Kara <jack@xxxxxxx> udf: Avoid excessive partition lengths Yunjian Wang <wangyunjian@xxxxxxxxxx> netfilter: nf_conncount: fix wrong variable type Jernej Skrabec <jernej.skrabec@xxxxxxxxx> iommu: sun50i: clear bypass register Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> af_unix: Remove put_pid()/put_cred() in copy_peercred(). Pali Rohár <pali@xxxxxxxxxx> irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 Konstantin Andreev <andreev@xxxxxxxxx> smack: unix sockets: fix accept()ed socket label Takashi Iwai <tiwai@xxxxxxx> ALSA: hda: Add input value sanity checks to HDMI channel map controls Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: send ACK on an active subflow Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pr_debug: add missing \n at the end Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: skip connecting to already established sf Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: do not remove already closed subflows Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: ADD_ADDR 0 is not a new address Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: close subflow when receiving TCP+FIN Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: avoid duplicated SUB_CLOSED events Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: avoid possible UaF when selecting endp Paolo Abeni <pabeni@xxxxxxxxxx> mptcp: constify a bunch of of helpers Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: fullmesh: select the right ID later Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: only decrement add_addr_accepted for MPJ req Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx> mptcp: pm: re-using ID of unused flushed subflows Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx> nilfs2: fix state management in error path of log writing function Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx> nilfs2: fix missing cleanup on rollforward recovery error Toke Høiland-Jørgensen <toke@xxxxxxxxxx> sched: sch_cake: fix bulk flow accounting logic for host fairness Eric Dumazet <edumazet@xxxxxxxxxx> ila: call nf_unregister_net_hooks() sooner Zheng Yejian <zhengyejian@xxxxxxxxxxxxxxx> tracing: Avoid possible softlockup in tracing_iter_reset() Simon Arlott <simon@xxxxxxxxxxx> can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open Satya Priya Kakitapalli <quic_skakitap@xxxxxxxxxxx> clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled Satya Priya Kakitapalli <quic_skakitap@xxxxxxxxxxx> clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API Satya Priya Kakitapalli <quic_skakitap@xxxxxxxxxxx> clk: qcom: clk-alpha-pll: Fix the pll post div mask Jann Horn <jannh@xxxxxxxxxx> fuse: use unsigned type for getxattr/listxattr size truncation Joanne Koong <joannelkoong@xxxxxxxxx> fuse: update stats for pages in dropped aux writeback list Seunghwan Baek <sh8267.baek@xxxxxxxxxxx> mmc: cqhci: Fix checking of CQHCI_HALT state Liao Chen <liaochen4@xxxxxxxxxx> mmc: sdhci-of-aspeed: fix module autoloading Sam Protsenko <semen.protsenko@xxxxxxxxxx> mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx> Bluetooth: MGMT: Ignore keys being loaded with invalid type Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx> Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" Georg Gottleuber <ggo@xxxxxxxxxxxxxxxxxxx> nvme-pci: Add sleep quirk for Samsung 990 Evo Roland Xu <mu001999@xxxxxxxxxxx> rtmutex: Drop rt_mutex::wait_lock before scheduling Ma Ke <make24@xxxxxxxxxxx> irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() Zheng Qixing <zhengqixing@xxxxxxxxxx> ata: libata: Fix memory leak for error path in ata_host_alloc() Maximilien Perreault <maximilienperreault@xxxxxxxxx> ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx Terry Cheong <htcheong@xxxxxxxxxxxx> ALSA: hda/realtek: add patch for internal mic in Lenovo V145 Christoffer Sandberg <cs@xxxxxxxxx> ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices Ravi Bangoria <ravi.bangoria@xxxxxxx> KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing Maxim Levitsky <mlevitsk@xxxxxxxxxx> KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE robelin <robelin@xxxxxxxxxx> ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx> sch/netem: fix use after free in netem_dequeue Richard Fitzgerald <rf@xxxxxxxxxxxxxxxxxxxxx> i2c: Use IS_REACHABLE() for substituting empty ACPI functions Jan Kara <jack@xxxxxxx> ext4: handle redirtying in ext4_bio_write_page() Jan Kara <jack@xxxxxxx> udf: Limit file size to 4TB Eric Biggers <ebiggers@xxxxxxxxxx> ext4: reject casefold inode flag without casefold feature Nikita Kiryushin <kiryushin@xxxxxxxx> rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow Breno Leitao <leitao@xxxxxxxxxx> virtio_net: Fix napi_skb_cache_put warning Bob Zhou <bob.zhou@xxxxxxx> drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr Ricardo Ribalda <ribalda@xxxxxxxxxxxx> media: uvcvideo: Enforce alignment of frame and interval Alex Hung <alex.hung@xxxxxxx> drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Christoph Hellwig <hch@xxxxxx> block: remove the blk_flush_integrity call in blk_integrity_unregister Johannes Berg <johannes.berg@xxxxxxxxx> wifi: cfg80211: make hash table duplicates more survivable Marek Vasut <marex@xxxxxxx> drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ Haoran Liu <liuhaoran14@xxxxxxx> drm/meson: plane: Add error handling Casey Schaufler <casey@xxxxxxxxxxxxxxxx> smack: tcp: ipv4, fix incorrect labeling Amir Goldstein <amir73il@xxxxxxxxx> fsnotify: clear PARENT_WATCHED flags lazily Abhishek Pandit-Subedi <abhishekpandit@xxxxxxxxxxxx> usb: typec: ucsi: Fix null pointer dereference in trace Simon Holesch <simon@xxxxxxxxxx> usbip: Don't submit special requests twice Frederic Weisbecker <frederic@xxxxxxxxxx> rcu/nocb: Remove buggy bypass lock contention mitigation Shannon Nelson <shannon.nelson@xxxxxxx> ionic: fix potential irq name truncation Michael Margolin <mrgolin@xxxxxxxxxx> RDMA/efa: Properly handle unexpected AQ completions Richard Maina <quic_rmaina@xxxxxxxxxxx> hwspinlock: Introduce hwspin_lock_bust() Aleksandr Mishin <amishin@xxxxxxxxxx> PCI: al: Check IORESOURCE_BUS existence during probe Jagadeesh Kona <quic_jkona@xxxxxxxxxxx> cpufreq: scmi: Avoid overflow of target_freq in fast switch Shahar S Matityahu <shahar.s.matityahu@xxxxxxxxx> wifi: iwlwifi: remove fw_running op Tao Zhou <tao.zhou1@xxxxxxx> drm/amdgpu: update type of buf size to u32 for eeprom functions Jesse Zhang <jesse.zhang@xxxxxxx> drm/amd/pm: check negtive return for table entries Jesse Zhang <jesse.zhang@xxxxxxx> drm/amdgpu: the warning dereferencing obj for nbio_v7_4 Jesse Zhang <jesse.zhang@xxxxxxx> drm/amd/pm: check specific index for aldebaran Jesse Zhang <jesse.zhang@xxxxxxx> drm/amdgpu: fix the waring dereferencing hive Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs Leesoo Ahn <lsahn@xxxxxxxxxx> apparmor: fix possible NULL pointer dereference Michael Chen <michael.chen@xxxxxxx> drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device Tim Huang <Tim.Huang@xxxxxxx> drm/amdgpu: fix mc_data out-of-bounds read warning Tim Huang <Tim.Huang@xxxxxxx> drm/amdgpu: fix ucode out-of-bounds read warning Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu: Fix out-of-bounds write warning Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu/pm: Fix uninitialized variable agc_btc_response Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu/pm: Fix uninitialized variable warning for smu10 Asad Kamal <asad.kamal@xxxxxxx> drm/amd/amdgpu: Check tbo resource pointer Hersen Wu <hersenxs.wu@xxxxxxx> drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create Alex Hung <alex.hung@xxxxxxx> drm/amd/display: Check msg_id before processing transcation Alex Hung <alex.hung@xxxxxxx> drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] Hersen Wu <hersenxs.wu@xxxxxxx> drm/amd/display: Add array index check for hdcp ddc access Hersen Wu <hersenxs.wu@xxxxxxx> drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 Alex Hung <alex.hung@xxxxxxx> drm/amd/display: Check gpio_id before used as array index Zhigang Luo <Zhigang.Luo@xxxxxxx> drm/amdgpu: avoid reading vf2pf info size from FB Tim Huang <Tim.Huang@xxxxxxx> drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr Tim Huang <Tim.Huang@xxxxxxx> drm/amdgpu: fix uninitialized scalar variable warning Jesse Zhang <jesse.zhang@xxxxxxx> drm/amd/pm: fix the Out-of-bounds read warning Jesse Zhang <jesse.zhang@xxxxxxx> drm/amd/pm: fix warning using uninitialized value of max_vid_step Tim Huang <Tim.Huang@xxxxxxx> drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc Tim Huang <Tim.Huang@xxxxxxx> drm/amdgpu: fix overflowed array index read warning Alvin Lee <alvin.lee2@xxxxxxx> drm/amd/display: Assign linear_pitch_alignment even for VM Ma Jun <Jun.Ma2@xxxxxxx> drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr ZHANG Yuntian <yt@xxxxxxxxx> net: usb: qmi_wwan: add MeiG Smart SRM825L Rik van Riel <riel@xxxxxxxxxxx> dma-debug: avoid deadlock between dma debug vs printk and netconsole Richard Fitzgerald <rf@xxxxxxxxxxxxxxxxxxxxx> i2c: Fix conditional for substituting empty ACPI functions Takashi Iwai <tiwai@xxxxxxx> ALSA: hda/conexant: Mute speakers at suspend / shutdown Takashi Iwai <tiwai@xxxxxxx> ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown Philip Mueller <philm@xxxxxxxxxxx> drm: panel-orientation-quirks: Add quirk for OrangePi Neo ------------- Diffstat: Documentation/locking/hwspinlock.rst | 11 ++ Makefile | 4 +- arch/arm64/include/asm/acpi.h | 12 ++ arch/arm64/kernel/acpi_numa.c | 11 -- arch/mips/kernel/cevt-r4k.c | 15 +- arch/riscv/kernel/head.S | 3 + arch/s390/kernel/vmlinux.lds.S | 9 ++ arch/um/drivers/line.c | 2 + arch/x86/kvm/svm/svm.c | 15 ++ arch/x86/mm/pti.c | 45 ++++-- block/blk-integrity.c | 2 - drivers/acpi/acpi_processor.c | 15 +- drivers/android/binder.c | 1 + drivers/ata/libata-core.c | 4 +- drivers/ata/pata_macio.c | 7 +- drivers/base/devres.c | 1 + drivers/clk/qcom/clk-alpha-pll.c | 9 +- drivers/clocksource/timer-imx-tpm.c | 16 +- drivers/clocksource/timer-of.c | 17 +- drivers/clocksource/timer-of.h | 1 - drivers/cpufreq/scmi-cpufreq.c | 4 +- drivers/gpio/gpio-rockchip.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 8 +- drivers/gpu/drm/amd/amdgpu/df_v1_7.c | 2 + drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 - drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +- .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + .../gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 + drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 17 +- drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 +- .../drm/amd/display/modules/hdcp/hdcp1_execution.c | 15 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 +++- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 13 +- .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 29 +++- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 15 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 90 ++++++++--- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 20 ++- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 31 +++- .../drm/amd/pm/powerplay/smumgr/vega10_smumgr.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/i915/i915_sw_fence.c | 8 +- drivers/gpu/drm/meson/meson_plane.c | 17 +- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +- drivers/hid/hid-cougar.c | 2 +- drivers/hv/vmbus_drv.c | 1 + drivers/hwmon/adc128d818.c | 4 +- drivers/hwmon/lm95234.c | 9 +- drivers/hwmon/nct6775.c | 2 +- drivers/hwmon/w83627ehf.c | 4 +- drivers/hwspinlock/hwspinlock_core.c | 28 ++++ drivers/hwspinlock/hwspinlock_internal.h | 3 + drivers/i3c/master/mipi-i3c-hci/dma.c | 5 +- drivers/iio/adc/ad7124.c | 27 ++-- drivers/iio/buffer/industrialio-buffer-dmaengine.c | 4 +- drivers/iio/inkern.c | 8 +- drivers/infiniband/hw/efa/efa_com.c | 30 ++-- drivers/input/misc/uinput.c | 14 ++ drivers/iommu/intel/dmar.c | 2 +- drivers/iommu/sun50i-iommu.c | 1 + drivers/irqchip/irq-armada-370-xp.c | 4 + drivers/irqchip/irq-gic-v2m.c | 6 +- drivers/leds/leds-spi-byte.c | 6 +- drivers/md/dm-init.c | 4 +- drivers/media/platform/qcom/camss/camss.c | 5 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 17 +- drivers/media/test-drivers/vivid/vivid-vid-out.c | 16 +- drivers/media/usb/uvc/uvc_driver.c | 18 ++- drivers/misc/vmw_vmci/vmci_resource.c | 3 +- drivers/mmc/host/cqhci-core.c | 2 +- drivers/mmc/host/dw_mmc.c | 4 +- drivers/mmc/host/sdhci-of-aspeed.c | 1 + drivers/net/bareudp.c | 22 +-- drivers/net/can/m_can/m_can.c | 5 +- drivers/net/can/spi/mcp251x.c | 2 +- drivers/net/dsa/vitesse-vsc73xx-core.c | 10 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 20 ++- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_lib.c | 12 +- drivers/net/ethernet/intel/igb/igb_main.c | 10 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- drivers/net/geneve.c | 8 +- drivers/net/usb/ch9200.c | 4 +- drivers/net/usb/cx82310_eth.c | 5 +- drivers/net/usb/ipheth.c | 2 +- drivers/net/usb/kaweth.c | 3 +- drivers/net/usb/mcs7830.c | 4 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/sierra_net.c | 6 +- drivers/net/usb/sr9700.c | 4 +- drivers/net/usb/sr9800.c | 5 +- drivers/net/usb/usbnet.c | 15 +- drivers/net/virtio_net.c | 8 +- .../broadcom/brcm80211/brcmsmac/mac80211_if.c | 1 + drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 3 +- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 - drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 - drivers/net/wireless/marvell/mwifiex/main.h | 3 + drivers/nvme/host/pci.c | 11 ++ drivers/nvme/target/tcp.c | 4 +- drivers/nvmem/core.c | 6 +- drivers/of/irq.c | 15 +- drivers/pci/controller/dwc/pci-keystone.c | 44 +++++- drivers/pci/controller/dwc/pcie-al.c | 16 +- drivers/pci/hotplug/pnv_php.c | 3 +- drivers/pci/pci.c | 35 +++-- drivers/pcmcia/yenta_socket.c | 6 +- drivers/platform/x86/dell/dell-smbios-base.c | 5 +- drivers/staging/iio/frequency/ad9834.c | 2 +- drivers/uio/uio_hv_generic.c | 11 +- drivers/usb/dwc3/core.c | 15 ++ drivers/usb/dwc3/core.h | 2 + drivers/usb/storage/uas.c | 1 + drivers/usb/typec/ucsi/ucsi.h | 2 +- drivers/usb/usbip/stub_rx.c | 77 +++++---- fs/btrfs/ctree.c | 12 +- fs/btrfs/ctree.h | 1 - fs/btrfs/extent-tree.c | 32 +++- fs/btrfs/file.c | 25 ++- fs/btrfs/inode.c | 2 +- fs/btrfs/transaction.h | 6 + fs/cifs/smb2ops.c | 24 ++- fs/ext4/fast_commit.c | 8 +- fs/ext4/inode.c | 5 +- fs/ext4/page-io.c | 14 +- fs/fuse/file.c | 8 +- fs/fuse/xattr.c | 4 +- fs/ksmbd/smb2pdu.c | 4 + fs/ksmbd/transport_tcp.c | 4 +- fs/nfs/super.c | 2 + fs/nilfs2/recovery.c | 35 ++++- fs/nilfs2/segment.c | 10 +- fs/nilfs2/sysfs.c | 117 ++++++++------ fs/notify/fsnotify.c | 31 ++-- fs/notify/fsnotify.h | 2 +- fs/notify/mark.c | 32 +++- fs/ntfs3/dir.c | 52 +++--- fs/squashfs/inode.c | 7 +- fs/udf/super.c | 24 ++- include/linux/fsnotify_backend.h | 8 +- include/linux/hwspinlock.h | 6 + include/linux/i2c.h | 2 +- include/linux/udp.h | 2 +- include/linux/virtio_net.h | 35 +++-- include/net/bluetooth/hci_core.h | 5 - kernel/cgroup/cgroup.c | 2 +- kernel/dma/debug.c | 5 +- kernel/dma/map_benchmark.c | 16 ++ kernel/events/core.c | 18 ++- kernel/events/internal.h | 1 + kernel/events/ring_buffer.c | 2 + kernel/events/uprobes.c | 3 +- kernel/locking/rtmutex.c | 9 +- kernel/rcu/tasks.h | 2 +- kernel/rcu/tree.h | 1 - kernel/rcu/tree_nocb.h | 32 +--- kernel/smp.c | 1 + kernel/trace/trace.c | 2 + kernel/workqueue.c | 14 +- lib/generic-radix-tree.c | 2 + mm/memcontrol.c | 23 ++- net/8021q/vlan_core.c | 7 +- net/bluetooth/mgmt.c | 60 +++---- net/bluetooth/smp.c | 7 - net/bridge/br_fdb.c | 6 +- net/can/bcm.c | 4 + net/ethernet/eth.c | 7 +- net/ipv4/af_inet.c | 19 +-- net/ipv4/fou.c | 54 ++++--- net/ipv4/gre_offload.c | 12 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_offload.c | 3 + net/ipv4/udp_offload.c | 22 ++- net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 + net/ipv6/ila/ila_xlat.c | 13 +- net/ipv6/ip6_offload.c | 14 +- net/ipv6/udp_offload.c | 2 - net/mptcp/options.c | 44 +++--- net/mptcp/pm.c | 36 +++-- net/mptcp/pm_netlink.c | 174 +++++++++++++-------- net/mptcp/protocol.c | 61 +++++--- net/mptcp/protocol.h | 28 ++-- net/mptcp/sockopt.c | 4 +- net/mptcp/subflow.c | 56 ++++--- net/netfilter/nf_conncount.c | 8 +- net/sched/sch_cake.c | 11 +- net/sched/sch_netem.c | 9 +- net/sunrpc/xprtsock.c | 7 + net/unix/af_unix.c | 9 +- net/wireless/scan.c | 46 ++++-- security/apparmor/apparmorfs.c | 4 + security/smack/smack_lsm.c | 14 +- sound/hda/hdmi_chmap.c | 18 +++ sound/pci/hda/hda_generic.c | 63 ++++++++ sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/patch_conexant.c | 13 ++ sound/pci/hda/patch_realtek.c | 10 ++ sound/soc/soc-dapm.c | 1 + sound/soc/soc-topology.c | 2 + sound/soc/sunxi/sun4i-i2s.c | 143 ++++++++--------- tools/lib/bpf/libbpf.c | 4 +- tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 4 +- tools/testing/selftests/net/udpgso.c | 2 +- 221 files changed, 1930 insertions(+), 988 deletions(-)
