- Update to 5.10.258.
- 6pack: propagage new tty types
- ACPI: property: Constify stubs for CONFIG_ACPI=n case
- ACPI: video: force native backlight on HP OMEN 16 (8A44)
- af_unix: read UNIX_DIAG_VFS data under unix_state_lock
- alarmtimer: Check RTC features instead of ops
- ALSA: 6fire: Fix input volume change detection
- ALSA: 6fire: fix use-after-free on disconnect
- ALSA: aoa: i2sbus: fix OF node lifetime handling
- ALSA: asihpi: avoid write overflow check warning
- ALSA: asihpi: Fix potential OOB array access at reading cache
- ALSA: caiaq: Don't abort when no input device is available
- ALSA: caiaq: Fix control_put() result and cache rollback
- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
- ALSA: caiaq: fix usb_dev refcount leak on probe failure
- ALSA: caiaq: Handle probe errors properly
- ALSA: caiaq: take a reference on the USB device in create_card()
- ALSA: compress: Drop unused functions
- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
- ALSA: core: Validate compress device numbers without dynamic minors
- ALSA: ctxfi: Add fallback to default RSR for S/PDIF
- ALSA: ctxfi: Limit PTP to a single page
- ALSA: firewire-tascam: Do not drop unread control events
- ALSA: fireworks: bound device-supplied status before string array lookup
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')
- ALSA: hda/realtek: Whitespace fix
- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
- ALSA: ua101: Reject too-short USB descriptors
- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
- ALSA: usb-audio: Avoid false E-MU sample-rate notifications
- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
- ALSA: usb-audio: Fix UAC3 cluster descriptor size check
- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
- ASoC: codecs: ab8500: Fix casting of private data
- ASoC: fsl_easrc: Change the type for iec958 channel status controls
- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
- ASoC: fsl_easrc: fix comment typo
- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
- ASoC: sti: Return errors from regmap_field_alloc()
- ASoC: sti: use managed regmap_field allocations
- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
- audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
- audit: fix incorrect inheritable capability in CAPSET records
- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
- bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
- bcache: fix cached_dev.sb_bio use-after-free and crash
- bcache: fix uninitialized closure object
- blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
- blk-mq: use quiesced elevator switch when reinitializing queues
- Bluetooth: bnep: Fix UAF read of dev->name
- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
- bpf: fix end-of-list detection in cgroup_storage_get_next_key()
- bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
- bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
- bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
- brcmfmac: support chipsets with different core enumeration space
- btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
- btrfs: merge PAGE_CLEAR_DIRTY and PAGE_SET_WRITEBACK to PAGE_START_WRITEBACK
- btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
- btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
- can: mcp251x: add error handling for power enable in open and resume
- can: raw: fix ro->uniq use-after-free in raw_rcv()
- cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
- ceph: fix a buffer leak in __ceph_setxattr()
- cgroup/rdma: fix integer overflow in rdmacg_try_charge()
- checkpatch: add support for Assisted-by tag
- cifs: Fix connections leak when tlink setup failed
- clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
- clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
- clk: imx8mq: Correct the CSI PHY sels
- clk: qcom: dispcc-sc7180: Add missing MDSS resets
- clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
- clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
- clk: qoriq: avoid format string warning
- clk: xgene: Fix mapping leak in xgene_pllclk_init()
- crypto: af_alg - Cap AEAD AD length to 0x80000000
- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
- crypto: atmel-ecc - Release client on allocation failure
- crypto: atmel-tdes - fix DMA sync direction
- crypto: authencesn - reject short ahash digests during instance creation
- crypto: ccp - copy IV using skcipher ivsize
- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
- crypto: ccree - fix a memory leak in cc_mac_digest()
- crypto: hisilicon - Fix dma_unmap_single() direction
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests
- crypto: sa2ul - Fix AEAD fallback algorithm names
- dev_printk: add new dev_err_probe() helpers
- devres: fix missing node debug info in devm_krealloc()
- dissector: do not set invalid PPP protocol
- dm cache: fix concurrent write failure in passthrough mode
- dm cache: fix dirty mapping checking in passthrough mode switching
- dm cache: fix null-deref with concurrent writes in passthrough mode
- dm cache: fix write path cache coherency in passthrough mode
- dm cache metadata: fix memory leak on metadata abort retry
- dm cache policy smq: fix missing locks in invalidating cache blocks
- dm cache: support shrinking the origin device
- dm: don't report warning when doing deferred remove
- dm: fix a buffer overflow in ioctl processing
- dm log: fix out-of-bounds write due to region_count overflow
- dm mirror: fix integer overflow in create_dirty_log()
- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
- dm-verity-fec: correctly reject too-small FEC devices
- dm-verity-fec: correctly reject too-small hash devices
- Documentation: fix a hugetlbfs reservation statement
- drbd: Balance RCU calls in drbd_adm_dump_devices()
- driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
- driver core: device.h: remove extern from function prototypes
- driver core: Don't let a device probe until it's ready
- driver core: Move dev_err_probe() to where it belogs
- drivers: base: Free devm resources when unregistering a device
- drm/amd/display: Add null checker before passing variables
- drm/amd/display: Allow DCE link encoder without AUX registers
- drm/amd/display: Do not add '-mhard-float' to calcs, dsc, and dcn30 FP files for clang
- drm/amd/display: Fix integer overflow in bios_get_image()
- drm/amd/display: Fix memory leak
- drm/amd/display: Read EDID from VBIOS embedded panel info
- drm/amdgpu: fix zero-size GDS range init on RDNA4
- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
- drm/amdgpu/pm: add missing revision check for CI
- drm/amdgpu/pm: align Hawaii mclk workaround with radeon
- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
- drm/amd/pm/ci: Fill DW8 fields from SMC
- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
- drm/bridge: megachips: remove bridge when irq request fails
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
- drm/komeda: fix integer overflow in AFBC framebuffer size check
- drm/msm/a6xx: Fix HLSQ register dumping
- drm/msm/a6xx: Use barriers while updating HFI Q headers
- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
- drm/panel: simple: Correct G190EAN01 prepare timing
- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()
- drm/radeon: add missing revision check for CI
- drm/sun4i: Fix resource leaks
- drm/vc4: Fix a memory leak in hang state error path
- drm/vc4: Fix memory leak of BO array in hang state
- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
- dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
- e1000: check return value of e1000_read_eeprom
- e1000e: Unroll PTP in probe error handling
- efi/capsule-loader: fix incorrect sizeof in phys array reallocation
- ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
- ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
- ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
- fanotify: fix false positive on permission events
- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
- fbdev: offb: fix PCI device reference leak on probe failure
- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
- firmware: dmi: Correct an indexing error in dmi.h
- firmware: google: framebuffer: Do not mark framebuffer as busy
- flow_dissector: Add number of vlan tags dissector
- flow_dissector: Add PPPoE dissectors
- flow_dissector: Do not count vlan tags inside tunnel payload
- flow_dissector: do not dissect PPPoE PFC frames
- fs/adfs: validate nzones in adfs_validate_bblk()
- fs/ocfs2: fix comments mentioning i_mutex
- fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
- fuse: quiet down complaints in fuse_conn_limit_write
- fuse: reject oversized dirents in page cache
- gfs2: Validate i_depth for exhash directories
- gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
- gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
- HID: alps: fix NULL pointer dereference in alps_raw_event()
- HID: asus: do not abort probe when not necessary
- HID: asus: make asus_resume adhere to linux kernel coding standards
- HID: core: clamp report_size in s32ton() to avoid undefined shift
- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
- HID: quirks: really enable the intended work around for appledisplay
- HID: roccat: fix use-after-free in roccat_report_event
- HID: usbhid: fix deadlock in hid_post_reset()
- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple
- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
- hwmon: (pmbus/adm1266) reject implausible blackbox record_count
- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
- i2c: s3c24xx: check the size of the SMBUS message before using it
- i3c: fix uninitialized variable use in i2c setup
- i40e: don't advertise IFF_SUPP_NOFCS
- IB/core: Fix zero dmac race in neighbor resolution
- IB/mad: Don't call to function that might sleep while in atomic context
- ibmasm: fix heap over-read in ibmasm_send_i2o_message()
- ibmasm: fix OOB reads in command_file_write due to missing size checks
- ibmveth: Disable GSO for packets with small MSS
- ice: fix locking in ice_dcb_rebuild()
- iio: adc: ad7768-1: fix one-shot mode data acquisition
- ima: check return value of crypto_shash_final() in boot aggregate
- inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
- iommu/vt-d: Disable DMAR for Intel Q35 IGFX
- io_uring/poll: fix backport of io_poll_add() changes
- io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored
- io-wq: check that the predecessor is hashed in io_wq_remove_pending()
- ip6_gre: Use cached t->net in ip6erspan_changelink().
- ipmi: Add limits to event and receive message requests
- ipmi: Check event message buffer response for bad data
- ipmi:si: Return state to normal if message allocation fails
- ipmi:ssif: Clean up kthread on errors
- ipmi:ssif: Fix a shutdown race
- ipmi:ssif: NULL thread on error
- ipmi:ssif: Remove unnecessary indention
- ipv4: add new arguments to udp_tunnel_dst_lookup()
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5
- ipv4: remove "proto" argument from udp_tunnel_dst_lookup()
- ipv4: rename and move ip_route_output_tunnel()
- ipv6: add NULL checks for idev in SRv6 paths
- ipv6: fix possible UAF in icmpv6_rcv()
- ipv6: rename and move ip6_dst_lookup_tunnel()
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
- ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
- ipvs: fix MTU check for GSO packets in tunnel mode
- irqchip/ath79-cpu: Remove unused function
- irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter
- isofs: validate block number from NFS file handle in isofs_export_iget
- isofs: validate Rock Ridge CE continuation extent against volume size
- ixgbevf: fix use-after-free in VEPA multicast source pruning
- ktest: Avoid undef warning when WARNINGS_FILE is unset
- ktest: Honor empty per-test option overrides
- ktest: Run POST_KTEST hooks on failure and cancellation
- kunit: config: Enable KUNIT_DEBUGFS by default
- kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
- KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
- KVM: x86: Use scratch field in MMIO fragment to hold small write values
- l2tp: Drop large packets with UDP encap
- libceph: Fix potential null-ptr-deref in decode_choose_args()
- libceph: Fix potential out-of-bounds access in crush_decode()
- libceph: Fix potential out-of-bounds access in osdmap_decode()
- libceph: handle rbtree insertion error in decode_choose_args()
- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
- lib/ts_kmp: fix integer overflow in pattern length calculation
- Linux 5.10.258
- locking: Fix rwlock support in <linux/spinlock_up.h>
- mailbox: add sanity check for channel array
- mailbox: mailbox-test: don't free the reused channel
- mailbox: mailbox-test: free channels on probe error
- mailbox: mailbox-test: initialize struct earlier
- mailbox: mailbox-test: make data_ready a per-instance variable
- mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()
- md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
- md/raid5: fix soft lockup in retry_aligned_read()
- md/raid5: validate payload size before accessing journal metadata
- media: as102: fix to not free memory after the device is registered in as102_usb_probe()
- media: dib8000: avoid division by 0 in dib8000_set_dds()
- media: em28xx: fix use-after-free in em28xx_v4l2_open()
- media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()
- media: rc: streamzap: Error handling in probe
- media: rc: xbox_remote: heed DMA restrictions
- media: uvcvideo: Allow extra entities
- media: uvcvideo: Enable VB2_DMABUF for metadata stream
- media: vidtv: fix nfeeds state corruption on start_streaming failure
- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
- media: vidtv: fix pass-by-value structs causing MSAN warnings
- memory: tegra124-emc: Fix dll_change check
- memory: tegra30-emc: Fix dll_change check
- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
- MIPS: Always record SEGBITS in cpu_data.vmbits
- mips: mm: Allocate tlb_vpn array atomically
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
- MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
- MIPS: mm: Suppress TLB uniquification on EHINV hardware
- misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
- mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
- mmc: block: use single block write in retry
- mm/kasan: fix double free for kasan pXds
- mtd: docg3: fix use-after-free in docg3_release()
- mtd: physmap_of_gemini: Fix disabled pinctrl state check
- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
- net: ag71xx: check error for platform_get_irq
- net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
- net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
- net: bcmgenet: keep RBUF EEE/PM disabled
- net: caif: clear client service pointer on teardown
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
- net: ethernet: cortina: Carry over frag counter
- net: ethernet: cortina: Drop half-assembled SKB
- net: ethernet: cortina: Make RX SKB per-port
- net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
- net: lapbether: Close the LAPB device before its underlying Ethernet device closes
- net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
- net: lapbether: remove trailing whitespaces
- net: lapbether: replace comparison to NULL with "lapbeth_get_x25_dev"
- net: phy: dp83869: fix setting CLK_O_SEL field.
- net: qrtr: ns: Fix use-after-free in driver remove()
- net: rds: fix MR cleanup on copy error
- net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
- net: sched: act_csum: validate nested VLAN headers
- net: sched: choke: remove unused variables in struct choke_sched_data
- net: sched: gred/red: remove unused variables in struct red_stats
- net: sched: sch_netem: Refactor code in 4-state loss generator
- net: strparser: fix skb_head leak in strp_abort_strp()
- net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null
- net: taprio offload: enforce qdisc to netdev queue mapping
- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
- net: tls: prevent chain-after-chain in plain text SG
- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
- net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
- netdevsim: zero initialize struct iphdr in dummy sk_buff
- netfilter: arp_tables: fix IEEE1394 ARP payload parsing
- netfilter: conntrack: add missing netlink policy validations
- netfilter: conntrack: remove sprintf usage
- netfilter: ip6t_eui64: reject invalid MAC header for all packets
- netfilter: ip6t_hbh: reject oversized option lists
- netfilter: ipset: stop hash:* range iteration at end
- netfilter: nf_conntrack_sip: don't use simple_strtoul
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
- netfilter: nft_ct: fix missing expect put in obj eval
- netfilter: nft_fwd_netdev: check ttl/hl before forwarding
- netfilter: nft_osf: restrict it to ipv4
- netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
- netfilter: reject zero shift in nft_bitwise
- netfilter: skip recording stale or retransmitted INIT
- netfilter: xtables: restrict several matches to inet family
- netfilter: xt_multiport: validate range encoding in checkentry
- netfilter: xt_policy: fix strict mode inbound policy matching
- net/rds: handle zerocopy send cleanup before the message is queued
- net/rds: Optimize rds_ib_laddr_check
- net/rds: reset op_nents when zerocopy page pin fails
- net/rds: Restrict use of RDS/IB to the initial network namespace
- net/rds: zero per-item info buffer before handing it to visitors
- net/sched: act_ct: fix ref leak when switching zones
- net/sched: act_ct: Only release RCU read lock after ct_ft
- net/sched: netem: fix probability gaps in 4-state loss model
- net/sched: netem: fix queue limit check to include reordered packets
- net/sched: netem: validate slot configuration
- net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
- net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys
- net/sched: sch_choke: annotate data-races in choke_dump_stats()
- net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
- net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
- net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
- net/sched: sch_pie: annotate data-races in pie_dump_stats()
- net/sched: sch_pie: annotate more data-races in pie_dump_stats()
- net/sched: sch_red: annotate data-races in red_dump_stats()
- net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
- net/sched: taprio: continue with other TXQs if one dequeue() failed
- net/sched: taprio: Fix init procedure
- net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
- net/sched: taprio: refactor one skb dequeue from TXQ to separate function
- net/sched: taprio: rename close_time to end_time
- net/sched: taprio: replace safety precautions with comments
- net/sched: taprio: stop going through private ops for dequeue and peek
- net/smc: avoid early lgr access in smc_clc_wait_msg
- nexthop: Emit a notification when a nexthop group is modified
- nexthop: fix IPv6 route referencing IPv4 nexthop
- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
- nfc: llcp: add missing return after LLCP_CLOSED checks
- NFC: trf7970a: Ignore antenna noise when checking for RF field
- nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
- nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
- nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
- nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
- nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
- ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
- ocfs2: fix listxattr handling when the buffer is full
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
- ocfs2: fix possible deadlock between unlink and dio_end_io_write
- ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
- ocfs2: handle invalid dinode in ocfs2_group_extend
- ocfs2: split transactions in dio completion to avoid credit exhaustion
- ocfs2: validate bg_bits during freefrag scan
- ocfs2: validate group add input before caching
- ocfs2: validate inline data i_size during inode read
- ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
- ocfs2/dlm: validate qr_numregions in dlm_match_regions()
- openvswitch: cap upcall PID array size and pre-size vport replies
- padata: Fix pd UAF once and for all
- padata: Remove comment for reorder_work
- PCI: Enable AtomicOps only if Root Port supports them
- PCI: hv: Set default NUMA node to 0 for devices without affinity info
- PCI: tegra194: Disable direct speed change for Endpoint mode
- PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
- PCI/AER: Clear only error bits in PCIe Device Status
- PCI/AER: Stop ruling out unbound devices as error source
- PCMCIA: Fix garbled log messages for KERN_CONT
- perf branch: Avoid incrementing NULL
- perf expr: Return -EINVAL for syntax error in expr__find_ids()
- perf util: Kill die() prototype, dead for a long time
- phonet/pep: disable BH around forwarded sk_receive_skb()
- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
- pinctrl: abx500: Fix type of 'argument' variable
- pinctrl: pinctrl-pic32: Fix resource leak
- platform/surface: surfacepro3_button: Drop wakeup source on remove
- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
- pmdomain: ti: omap_prm: Fix a reference leak on device node
- power: supply: max17042: avoid overflow when determining health
- ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
- pppoe: drop PFC frames
- pstore/ram: fix resource leak when ioremap() fails
- quota: Fix race of dquot_scan_active() with quota deactivation
- RDMA/core: Prefer NLA_NUL_STRING
- RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
- RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
- RDMA/rxe: Reject unknown opcodes before ICRC processing
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
- RDMA/siw: Reject MPA FPDU length underflow before signed receive math
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
- regulator: act8945a: fix OF node reference imbalance
- regulator: max77650: fix OF node reference imbalance
- Revert "ALSA: usb: Increase volume range that triggers a warning"
- Revert "scsi: ufs: core: Improve SCSI abort handling"
- Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
- Revert "x86/vdso: Fix output operand size of RDPID"
- ring-buffer: Fix reporting of missed events in iterator
- rtc: abx80x: Disable alarm feature if no interrupt attached
- rtc: allow rtc_read_alarm without read_alarm callback
- rtc: introduce features bitfield
- rxrpc: Fix anonymous key handling
- rxrpc: Fix call removal to use RCU safe deletion
- rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
- rxrpc: Fix recvmsg() unconditional requeue
- rxrpc: fix reference count leak in rxrpc_server_keyring()
- rxrpc: only handle RESPONSE during service challenge
- rxrpc: proc: size address buffers for %pISpc output
- rxrpc: reject undecryptable rxkad response tickets
- scripts/dtc: Remove unused dts_version in dtc-lexer.l
- scsi: isci: Fix use-after-free in device removal path
- scsi: qla2xxx: Fix crash when I/O abort times out
- scsi: qla2xxx: Fix warning message due to adisc being flushed
- scsi: sg: Resolve soft lockup issue when opening /dev/sgX
- scsi: sr: Add memory allocation failure handling for get_capabilities()
- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
- scsi: target: core: Fix integer overflow in UNMAP bounds check
- scsi: ufs: core: Improve SCSI abort handling
- sctp: discard stale INIT after handshake completion
- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
- selftest: memcg: skip memcg_sock test if address family not supported
- selftests: lib.mk: Also install "config" and "settings"
- selftests/mqueue: Fix incorrectly named file
- slip: bound decode() reads against the compressed packet length
- slip: reject VJ receive packets on instances with no rstate array
- smb: client: reject userspace cifs.spnego descriptions
- soc: qcom: aoss: compare against normalized cooling state
- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
- sound: ua101: fix division by zero at probe
- spi: fsl-qspi: Use reinit_completion() for repeated operations
- spi: imx: fix runtime pm leak on probe deferral
- spi: mpc52xx: fix use-after-free on unbind
- spi: mtk-nor: fix controller deregistration
- spi: orion: fix clock imbalance on registration failure
- spi: sprd: fix error pointer deref after DMA setup failure
- spi: ti-qspi: fix use-after-free after DMA setup failure
- spi: topcliff-pch: fix use-after-free on unbind
- spi: zynqmp-gqspi: fix controller deregistration
- staging: media: atomisp: Disallow all private IOCTLs
- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
- staging: sm750fb: fix division by zero in ps_to_hz()
- string: add mem_is_zero() helper to check if memory area is all zeros
- sysfs: don't remove existing directory on update failure
- taprio: Handle short intervals and large packets
- taskstats: set version in TGID exit notifications
- tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
- thermal/drivers/spear: Fix error condition for reading st,thermal-flags
- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
- thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
- tipc: fix double-free in tipc_buf_append()
- tpm: avoid -Wunused-but-set-variable
- tpm: tpm_tis: add error logging for data transfer
- tracing: Avoid NULL return from hist_field_name() on truncation
- tracing: branch: Fix inverted check on stat tracer registration
- tracing: Do not call map->ops->elt_free() if elt_alloc() fails
- tracing: Rebuild full_name on each hist_field_name() call
- tracing/probe: reject non-closed empty immediate strings
- tty: hvc: remove HVC_IUCV_MAGIC
- tty: hvc_iucv: fix off-by-one in number of supported devices
- udf: reject descriptors with oversized CRC length
- um: drivers: call kernel_strrchr() explicitly in cow_user.c
- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
- USB: omap_udc: DMA: Don't enable burst 4 mode
- USB: serial: option: add Telit Cinterion FN990A MBIM composition
- USB: serial: option: add Telit Cinterion LE910Cx compositions
- usb: storage: Expand range of matched versions for VL817 quirks entry
- usb: ulpi: fix memory leak on ulpi_register() error paths
- usb: usblp: fix heap leak in IEEE 1284 device ID via short response
- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
- usbip: validate number_of_packets in usbip_pack_ret_submit()
- userfaultfd: allow registration of ranges below mmap_min_addr
- vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
- vrf: Fix a potential NPD when removing a port from a VRF
- vsock: fix buffer size clamping order
- vsock/virtio: fix accept queue count leak on transport mismatch
- vsock/vmci: fix UAF when peer resets connection during handshake
- wifi: ath11k: clear shared SRNG pointer state on restart
- wifi: ath5k: do not access array OOB
- wifi: b43: enforce bounds check on firmware key index in b43_rx()
- wifi: b43legacy: enforce bounds check on firmware key index in RX path
- wifi: brcmfmac: Fix error pointer dereference
- wifi: brcmfmac: validate bsscfg indices in IF events
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
- wifi: rsi: fix kthread lifetime race between self-exit and external-stop
- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
- wifi: wl1251: validate packet IDs before indexing tx_frames
- x86/uprobes: Fix XOL allocation failure for 32-bit tasks
- xfrm: clear trailing padding in build_polexpire()
- xfrm: provide message size for XFRM_MSG_MAPPING
- xfrm_user: fix info leak in build_mapping()
- xsk: tighten UMEM headroom validation to account for tailroom and min frame