This whole week I had the feeling that people were starting to go on
summer vacation, but running the numbers shows that I must have been
wrong - it all looks pretty normal.

And by "pretty normal" I obviously mean the "new normal" with a fair
number of fixes all over. It's not a small rc4.

The stats look pretty normal too, with most of it being small one- and
few-liners. There's a couple of bigger fixes (can/bcm stands out for
syzbot and sashiko fixes, and the selftests get some extra tests too
that show up in the diffs), but nothing that looks odd. There's some
larger amd gpu noise, but the size of that is largely some code
movement and extra comments - and nothing like the occasional big
header drops...

Go forth and test,

             Linus

---

Abdun Nihaal (2):
      wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
      scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

Abhishek Ojha (1):
      regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

Agustin Luzardo (1):
      ALSA: usb-audio: Add quirk for Redragon H510-PRO Wireless headset

Akhil R (1):
      arm64: tegra: Remove fallback compatible for GPCDMA

Aleksandrova Alyona (1):
      RDMA/irdma: Prevent overflows in memory contiguity checks

Alessandro Rinaldi (1):
      drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05

Alex Deucher (1):
      drm/amdgpu: always emit the job vm fence

Alexander Hölzl (1):
      can: vxcan: Kconfig: fix description stating no local echo provided

Alexander Usyskin (1):
      drm/xe/nvm: fix writable override for CRI

Amit Machhiwal (1):
      powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors

Andi Shyti (1):
      CREDITS: Add Wolfram Sang

Andre Carvalho (1):
      selftests: netconsole: only restore MAC when it changed on resume

Andrea Righi (4):
      sched_ext: Reset dsq_vtime and slice when a task leaves SCX
      sched_ext: Preserve rq tracking across local DSQ dispatch
      sched_ext: Enable tick for finite slices on nohz_full
      selftests/sched_ext: Verify nohz_full tick behavior

Andreas Ziegler (1):
      rtla: Fix missing unistd include

Andrey Albershteyn (1):
      xfs: fix null pointer dereference in tracepoint

Andriy Korud (1):
      drm/amd/display: dce100: skip non-DP stream encoders for DP MST

Andy Shevchenko (2):
      smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols
      smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2

AngeloGioacchino Del Regno (1):
      pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check

Antony Antony (1):
      xfrm: reject optional IPTFS templates in outbound policies

Ao Sun (1):
      mmc: block: fix RPMB device unregister ordering

Arnd Bergmann (5):
      scsi: bfa: Reduce kernel stack usage in
bfa_fcs_lport_fdmi_build_portattr_block()
      soc/tegra: pmc: fix #ifdef block in header
      mtd: rawnand: ndfc: add CONFIG_OF dependency
      RDMa/mlx5: Avoid frame overflow warning
      wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack

Arvind Yadav (2):
      drm/xe/guc: Keep scheduler timeline name alive
      drm/xe/guc: Hold device ref until queue teardown completes

Asim Viladi Oglu Manizada (1):
      net: openvswitch: reject oversized nested action attrs

Atish Patra (2):
      KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
      KVM: selftests: Verify SNP VMs are rejected from migration and mirroring

Aurelien Jarno (1):
      arch/riscv: vdso: remove CFI landing pad from rt_sigreturn

Baojun Xu (1):
      ASoC: amd: acp: amd-acp70-acpi-match: Add tas2783 support

Bartosz Golaszewski (1):
      bug: fix warning suppressions with kunit built as module

Bastian Blank (1):
      rtla: Also link in ctype.c

Binbin Wu (1):
      KVM: TDX: Reject concurrent change to CPUID entry count

Boris Burkov (1):
      btrfs: fallback to transaction csum tree on a commit root csum miss

Bradley Morgan (1):
      KVM: arm64: account pKVM reclaim against the VM mm

Breno Leitao (2):
      soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms
      sched_ext: Avoid flooding the log with deprecation warnings

Bryam Vargas (4):
      wifi: mac80211_hwsim: clamp virtio RX length before skb_put
      net/iucv: take a reference on the socket found in afiucv_hs_rcv()
      scsi: target: Bound PR-OUT TransportID parsing to the received buffer
      scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Catalin Iacob (1):
      scsi: core: Remove export for scsi_device_from_queue()

Cen Zhang (7):
      xfrm: cache the offload ifindex for netlink dumps
      xfrm: clear mode callbacks after failed mode setup
      wifi: cfg80211: cancel sched scan results work on unregister
      wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
      wifi: cfg80211: use wiphy work for socket owner autodisconnect
      xfs: tie zoned sysfs lifetime to zone info
      Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

Charles Keepax (1):
      ASoC: cs42l43: Correct report for forced microphone jack

Chen Bowen (1):
      ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series

Chen YanJun (1):
      xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

Chenguang Zhao (1):
      RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

Christian Hewitt (1):
      ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop

Christoph Hellwig (2):
      block: handle huge zero folios in bio_free_folios
      block: fix aligning of bounced dio read bios

Christophe JAILLET (2):
      drm/tegra: Fix a strange error handling path
      wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

Christophe Leroy (CS GROUP) (1):
      powerpc: Remove dead non-preemption code

Chuck Lever (1):
      NFSD: Prevent post-shutdown use-after-free in NFSD_CMD_UNLOCK_FILESYSTEM

Claudio Imbrenda (3):
      KVM: s390: vsie: Avoid potential deadlock with real spaces
      KVM: s390: Fix dat_crste_walk_range() early return
      KVM: s390: Improve kvm_s390_vm_stop_migration()

Corentin Labbe (1):
      wifi: ralink: RT2X00: init EEPROM properly

Daan De Meyer (1):
      loop: remove manually added partitions on detach

Damien Laine (1):
      ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with
codec SSID 17aa:38a7

Daniel Paziyski (1):
      KVM: x86: Fix null pointer deref due to dummy array in
trace_kvm_inj_exception()

Daniel Schaefer (1):
      ALSA: hda/realtek: add quirk for Framework F111:0010

Daniele Ceraolo Spurio (1):
      drm/xe/wopcm: fix WOPCM size for LNL+

Danila Chernetsov (1):
      RDMA/hns: Fix potential integer overflow in mhop hem cleanup

Darrick J. Wong (15):
      xfs: resample the data fork mapping after cycling ILOCK
      xfs: don't replace the wrong part of the cow fork
      xfs: make cow repair somewhat flaky when debugging knob enabled
      xfs: move cow_replace_mapping to xfs_bmap_util.c
      xfs: don't wrap around quota ids in dqiterate
      xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
      xfs: use the rt version of the cow staging checker
      xfs: write the rg superblock when fixing it
      xfs: grab rtrmap btree when checking rgsuper
      xfs: set xfarray killable sort correctly
      xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
      xfs: handle non-inode owners for rtrmap record checking
      xfs: fully check the parent handle when it points to the rootdir
      xfs: clamp timestamp nanoseconds correctly
      xfs: don't zap bmbt forks if they are MAXLEVELS tall

David Jeffery (1):
      scsi: core: wake eh reliably when using scsi_schedule_eh

Dawei Feng (2):
      wifi: libertas: fix memory leak in helper_firmware_cb()
      wifi: mac80211: fix memory leak in ieee80211_register_hw()

Deepanshu Kartikey (1):
      mtd: mtdpart: validate partition bounds in mtd_add_partition()

Dmytro Laktyushkin (2):
      drm/amd/display: fix dcn42 det allocation order
      drm/amd/display: fix dcn42b det allocation order

Doehyun Baek (1):
      Docs/admin-guide/cgroup-v2: fix memory.stat doc details

Doruk Tan Ozturk (2):
      accel/amdxdna: reject user command submission without a command BO
      accel/amdxdna: reject command submission on devices without a submit op

Eckhart Mohr (1):
      ALSA: hda/realtek: Add quirk for TongFang X6xx45xU

Emre Cecanpunar (1):
      drm/i915/selftests: Fix GT PM sort comparators

Eric Biggers (4):
      lib/crypto: md5: Remove support for md5_mod_init_arch()
      lib/crypto: docs: Fix some sentence fragments
      lib/crypto: docs: Improve introduction sentence
      crypto: aes - Fix conditions for selecting MAC dependencies

Eric Dumazet (1):
      tcp: fix TIME_WAIT socket reference leak on PSP policy failure

Ethan Nelson-Moore (2):
      x86/cpu: Remove Makefile rule for removed UMC CPU support
      powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()

Fan Wu (1):
      can: esd_usb: kill anchored URBs before freeing netdevs

Fangzhi Zuo (1):
      drm/amd/display: Fix 8K Mode Not Parsed by EDID

Farhad Alemi (1):
      cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

Federico Lombardo (1):
      ALSA: hda/realtek: Enable mute LED quirk for HP Laptop 15-dw0xxx

Filipe Manana (3):
      btrfs: validate properties before setting them
      btrfs: fix transaction abort logic in btrfs_fileattr_set()
      btrfs: fix root leak if its reloc root is unexpected in
merge_reloc_roots()

Florian Westphal (2):
      ipvs: reload ip header after head reallocation
      netfilter: xt_physdev: masks are not c-strings

Fredric Cover (1):
      smb: client: use kvzalloc() for megabyte buffer in simple fallocate

Fuad Tabba (13):
      KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
      KVM: arm64: Sync SPSR_EL1 when injecting an exception into a pVM
      KVM: arm64: nv: Fix PSTATE construction on illegal exception return
      KVM: arm64: Add Fuad Tabba as a reviewer
      KVM: arm64: Set ESR_ELx.IL for injected undefined exceptions at EL2
      KVM: arm64: Unconditionally set IL for injected undefined exceptions
      KVM: arm64: Unconditionally set IL for injected abort exceptions
      KVM: arm64: Set IL for injected FPAC exceptions during ERET emulation
      KVM: arm64: Set IL for emulated SError injection
      KVM: arm64: Set IL for nested SError injection
      KVM: arm64: Set IL in fake ESR for pKVM memory sharing exit
      KVM: arm64: Fix sign-extension of MMIO loads
      KVM: arm64: selftests: Add MMIO sign-extending load test

Gao Xiang (4):
      erofs: use more informative s_id for file-backed mounts
      erofs: relax sanity check for tail pclusters due to ztailpacking
      erofs: get rid of erofs_is_ishare_inode() helper
      erofs: hide "cache_strategy=" for plain filesystems

Gary Yang (1):
      MAINTAINERS: Update maintainer and git tree for CIX SoC

Gautam Menghani (1):
      powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM

Geert Uytterhoeven (1):
      firmware: arm_scmi: Grammar s/may needed/may be needed/

Gil Portnoy (5):
      ksmbd: zero the smb2_read alignment tail to avoid an infoleak
      ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
      ksmbd: fix stack buffer overflow in multichannel session-key copy
      ksmbd: remove stale channels from all sessions on teardown
      ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp

Guangshuo Li (2):
      mmc: vub300: fix use-after-free on probe failure
      drm/amdkfd: free MQD managers on DQM init failures

Guoniu Zhou (2):
      dt-bindings: power: imx93: Add MIPI PHY power domain
      pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI

Guopeng Zhang (3):
      Docs/admin-guide/cgroup-v2: drop stale misc interface file count
      Docs/admin-guide/cgroup-v1: document rdma.peak, rdma.events and
rdma.events.local
      Docs/admin-guide/cgroup-v2: note blkcg_debug_stats gates io.latency stats

HE WEI (ギカク) (1):
      wifi: cfg80211: bound element ID read when checking non-inheritance

Haofeng Li (1):
      wifi: cfg80211: validate EHT MLE before MLD ID read

Haoxiang Li (3):
      KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
      scsi: elx: efct: Fix I/O leak on unsupported additional CDB
      scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

Harshit Mogalapalli (2):
      mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
      mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()

Himal Prasad Ghimiray (1):
      drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

Honglei Huang (3):
      drm/gpusvm: free the whole IOVA reservation on unmap
      drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap
      drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

Huiwen He (6):
      smb/client: refresh allocation size after duplicate extents
      smb/client: handle overlapping allocated ranges in fallocate
      smb/client: reduce fallocate zero buffer allocation
      smb/client: emulate small EOF-extending mode 0 fallocate ranges
      smb/client: refresh allocation after EOF-extending fallocate
      smb/client: flush dirty data before punching a hole

Hyunwoo Kim (1):
      KVM: arm64: vgic: Check the interrupt is still ours before migrating it

Ibrahim Hashimov (1):
      ksmbd: fix integer overflow in set_file_allocation_info()

Ihor Solodrai (1):
      bpf: Fix tracing of kfuncs with implicit args

Ivan Vecera (1):
      dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

Jackie Liu (2):
      block: free copied pages when blk_rq_map_kern() fails
      block: show operation in error injection rules

Jacob Moroni (2):
      RDMA/irdma: Prevent rereg_mr for non-mem regions
      RDMA/irdma: Prevent user-triggered null deref on QP create

Jaeyeong Lee (1):
      io_uring/kbuf: free the replaced iovec after a successful grow

Jamal Hadi Salim (1):
      net/sched: act_tunnel_key: Defer dst_release to RCU callback

James Raphael Tiovalen (1):
      macsec: fix promiscuity refcount leak in macsec_dev_open()

Jason Macnak (1):
      drm/virtio: Don't detach GEM from a non-created context

Jens Wiklander (1):
      MAINTAINERS: .mailmap: update Jens Wiklander's email address

Jesse Zhang (1):
      drm/amdgpu/userq: fix indefinite fence wait during GPU reset

Jhonraushan (1):
      accel/ivpu: Reject firmware log with size smaller than header

Jinliang Zheng (1):
      xfs: use xfs_csn_t for xlog_cil_push_now() push_seq parameter

Johannes Thumshirn (1):
      btrfs: decentralize transaction aborts in create_reloc_root()

Joseph Qi (1):
      block: try slab allocation in bio_alloc_bioset() before mempool

Julian Anastasov (1):
      ipvs: fix more places with wrong ipv6 transport offsets

Junrui Luo (1):
      powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

Kailang Yang (1):
      ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255

Karol Wachowski (1):
      accel/ivpu: Fix wrong register read in LNL failure diagnostics

Krzysztof Kozlowski (1):
      ARC: configs: Drop redundant I2C_DESIGNWARE_PLATFORM

Kshamendra Kumar Mishra (1):
      ALSA: hda/realtek: Add mic mute LED quirk for HP Laptop 15-fd0xxx

Kuba Piecuch (2):
      sched_ext: Check remote rq eligibility under task's rq lock
      sched_ext: Skip ops.set_weight() for disabled tasks

Kumar Kartikeya Dwivedi (1):
      selftests/bpf: Cover tracing implicit kfunc args

Lad Prabhakar (1):
      mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion

Laxman Acharya Padhya (1):
      Bluetooth: btrtl: validate firmware patch bounds

Lee Jones (1):
      can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Leo Li (3):
      drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
      drm/amd/display: check GRPH_FLIP status before sending event
      Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"

Liang Luo (1):
      sched_ext: Documentation: Fix ops table header reference

Lianqin Hu (1):
      ALSA: usb-audio: Add delay quirk for iBasso DC-Elite

Linmao Li (1):
      drm/panthor: Check debugfs GEM lock initialization

Linus Torvalds (1):
      Linux 7.2-rc4

Lizhi Hou (1):
      accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

Longlong Xia (1):
      ALSA: firewire: Drop redundant mod_devicetable.h includes

Louis-Alexis Eyraud (1):
      dt-bindings: mmc: mtk-sd: Document extra clocks for MT8189

Luke Wang (8):
      mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq
check for tuning save/restore
      mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
      mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow
default state restore
      mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios
timing on resume
      mmc: sdhci-esdhc-imx: disable irq during suspend to fix
unhandled interrupt
      mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
      mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
      mmc: sdhci-esdhc-imx: fix resume error handling

Maciej Strozek (1):
      ASoC: sof_sdw: Add a quirk for 0x17aa383c laptop using sidecar
amps with cs42l43

Malaya Kumar Rout (2):
      selftests/alsa: Fix memory leak in find_controls error path
      selftests/alsa: Fix format specifier and function mismatch in mixer-test

Maoyi Xie (4):
      wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
      wifi: mac80211: defer link RX stats percpu free to RCU
      memstick: ms_block: reject a card that reports too many blocks
      wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

Marc Zyngier (3):
      KVM: arm64: vgic: Handle race between interrupt affinity change
and LPI disabling
      KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
      KVM: arm64: Fix propagation of TLBI level in
kvm_pgtable_stage2_relax_perms()

Marek Vasut (1):
      arm64: dts: renesas: ironhide: Describe inline ECC carveouts

Mario Limonciello (5):
      drm/amd/display: Fix backlight max_brightness to match exported range
      drm/amdgpu: Fix VFCT bus number matching with soft filter
      drm/amdgpu: Release VFCT ACPI table reference
      drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
      drm/amd: Create a device link between APU display and XHCI devices

Mark Harris (1):
      riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()

Matt Bobrowski (1):
      bpf: Fix UAF in sock clone early bailouts

Matthew Brost (2):
      drm/ttm: Account for NULL and handle pages in ttm_pool_backup
      drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves

Matthew Rosato (1):
      KVM: s390: pci: Fix handling of AIF enable without AISB

Matthew Schwartz (2):
      ALSA: hda/realtek: Fix headphone output on ASUS ROG Ally X
      ALSA: hda/realtek: Fix headset mic on ASUS ROG Ally X

Matthew Stewart (1):
      drm/amd/display: Fix DCN42B null registers & register masks

Matthieu Buffet (2):
      landlock: Fix TCP Fast Open connection bypass
      selftests/landlock: Add test for TCP fast open

Mattia Meleleo (2):
      bpf, sockmap: Account for receive queue in FIONREAD without a
verdict program
      selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program

Michael Bommarito (4):
      scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
      scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
      IB/mad: Drop unmatched RMPP responses before reassembly
      partitions: aix: bound the lvd scan to one sector

Michal Luczaj (4):
      selftests/bpf: Ensure UDP sockets are bound
      bpf, sockmap: Reject unhashed UDP sockets on sockmap update
      selftests/bpf: Adapt sockmap update error handling
      selftests/bpf: Fail unbound UDP on sockmap update

Mickaël Salaün (2):
      landlock: Fix kernel-doc for the nested quiet layer flag
      landlock: Update formatting

Mike Waychison (1):
      block: fix race in blk_time_get_ns() returning 0

Mikhail Gavrilov (1):
      Bluetooth: mgmt: Translate HCI reason in Device Disconnected event

Mikko Perttunen (1):
      gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Miquel Raynal (1):
      Revert "mtd: maps: remove uclinux map driver"

Mostafa Saleh (3):
      KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim()
      KVM: arm64: Ensure FFA ranges are page aligned
      firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

Nikolay Ivchenko (1):
      mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path

Nikunj A Dadhania (1):
      KVM: SVM: Bump asid_generation on CPU online to avoid ASID
collision after hotplug

Nitin Gote (1):
      drm/xe: Hold a dma-buf reference for imported BOs

Norbert Szetei (1):
      ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

Oliver Hartkopp (14):
      can: raw: add locking for raw flags bitfield
      can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
      can: bcm: add locking when updating filter and timer values
      can: bcm: fix CAN frame rx/tx statistics
      can: bcm: add missing rcu list annotations and operations
      can: bcm: extend bcm_tx_lock usage for data and timer updates
      can: bcm: validate frame length in bcm_rx_setup() for RTR replies
      can: bcm: add missing device refcount for CAN filter removal
      can: bcm: fix stale rx/tx ops after device removal
      can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
      can: bcm: track a single source interface for ANYDEV timeout/throttle ops
      can: isotp: use unconditional synchronize_rcu() in isotp_release()
      can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
      can: isotp: serialize TX state transitions under so->rx_lock

Oliver Upton (8):
      KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
      KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
      KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
      KVM: arm64: nv: Re-translate VNCR before injecting abort
      KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
      KVM: arm64: nv: Mark VM as bugged for unexpected VNCR abort
      KVM: arm64: Ensure level is always initialized when relaxing perms
      KVM: arm64: Only update XN attr when requested during S2 relaxation

Ondrej Mosnacek (1):
      selinux: fix incorrect execmem checks on overlayfs

Or Gerlitz (1):
      RDMA/cma: Fix hardware address comparison length in netevent callback

Osama Abdelkader (1):
      drm/panthor: return error on truncated firmware

Pablo Neira Ayuso (1):
      netfilter: flowtable: use correct direction to set up tunnel route

Pagadala Yesu Anjaneyulu (1):
      wifi: mac80211: ibss: wait for in-flight TX on disconnect

Pauli Virtanen (4):
      Bluetooth: hci_sync: extend conn_hash lookup critical sections
      Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
      Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
      Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups

Peddolla Harshavardhan Reddy (1):
      wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

Pei Xiao (1):
      i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED

Peng Fan (2):
      pmdomain: imx: Fix i.MX8MP power notifier
      pmdomain: imx: Fix i.MX8MP VC8000E power up sequence

Pengpeng Hou (18):
      mtd: nand: ecc-mtk: handle ECC clock enable failures
      mtd: rawnand: ingenic: handle ECC clock enable failures
      mtd: mtdswap: remove debugfs stats file on teardown
      mtd: nand: mtk-ecc: stop on ECC idle timeouts
      mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
      mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
      mtd: mchp23k256: use SPI match data for chip caps
      mtd: rawnand: fsl_ifc: return errors for failed page reads
      mtd: onenand: samsung: report DMA completion timeouts
      ALSA: usb-audio: caiaq: validate EP1 reply lengths
      wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
      wifi: libertas: reject short monitor TX frames
      wifi: rsi: bound background scan probe request copy
      wifi: libipw: fix key index receive bound checks
      wifi: rsi: validate beacon length before fixed buffer copy
      arc: validate DT CPU map strings before parsing them
      drm/i915/gt: use correct selftest config symbol
      drm/amd/display: wire DCN42B mcache programming callback

Petr Wozniak (2):
      xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
      xfrm: fix stale skb->prev after async crypto steals a GSO segment

Pushpendra Singh (1):
      firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context

Qianyu Luo (1):
      xfrm: nat_keepalive: avoid double free on send error

Qihang (1):
      ksmbd: pin conn during async oplock break notification

Qu Wenruo (3):
      btrfs: lzo: add error message for invalid headers
      btrfs: print-tree: print header owner as signed
      block: do not warn when doing greedy allocation in folio_alloc_greedy()

Rafael Beims (2):
      wifi: mwifiex: fix roaming to different channel in host_mlme mode
      wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Rafael J. Wysocki (2):
      cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
      cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq

Ravi Hothi (3):
      ASoC: dt-bindings: qcom: Add Eliza LPASS macro codecs
      ASoC: dt-bindings: qcom,sm8250: Add Eliza sound card
      ASoC: qcom: sc8280xp: Add support for Eliza

Richard Fitzgerald (3):
      ALSA: hda/cirrus_scodec: Make Kconfig visible if KUNIT
      ALSA: hda: MAINTAINERS: Fix missing cirrus* file reference
      ALSA: hda: cs35l56: Fail if wmfw file is missing

Robby Cai (1):
      reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ

Robert Mader (1):
      udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()

Rohit Sinha (1):
      ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)

Roman Li (1):
      drm/amdgpu/discovery: Fix device family for DCN42

Roman Vivchar (1):
      i2c: mediatek: fix WRRD for SoCs without auto_restart option

Rong Zhang (1):
      ALSA: usb-audio: Fix imbalance per-channel volume of sticky mixers

Rosen Penev (6):
      mtd: rawnand: ndfc: fix gcc uninitialized var
      ata: sata_dwc_460ex: enable SATA interrupts only after IRQ
handler is registered
      ata: sata_dwc_460ex: use platform_get_irq()
      ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all
pending interrupts
      ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
      powerpc/85xx: Add fsl,ifc to common device ids

Rui Qi (1):
      riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE

Runyu Xiao (3):
      wifi: rt2x00: avoid full teardown before work setup in probe
      mmc: vub300: defer reset until cmd_mutex is unlocked
      wifi: brcmfmac: initialize SDIO data work before cleanup

Ruoyu Wang (6):
      mtd: spinand: initialize ret in regular page reads
      RDMA/erdma: initialize ret for empty receive WR lists
      RDMA/mana_ib: initialize err for empty send WR lists
      RDMA/siw: publish QP after initialization
      Bluetooth: hci_qca: Clear memdump state on invalid dump size
      bnxt_en: Handle partially initialized auxiliary devices

Ryosuke Yasuoka (1):
      drm/virtio: fix deadlock in display_info_cb by removing hotplug
from dequeue worker

Satyanarayana K V P (1):
      drm/xe/pf: Disable display in admin only PF mode

Sean Christopherson (4):
      KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
      KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into
"normal" checks
      KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when
EPT is disabled
      KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to
invalid guest state

Sebastian Ene (3):
      KVM: arm64: Validate the offset to the mem access descriptor
      KVM: arm64: Zero out the stack initialized data in the FFA handler
      firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset
calculation

Sergey Shtylyov (1):
      mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method

Seth Forshee (1):
      firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits

Shahar Tzarfati (1):
      wifi: mac80211: recalculate rx_nss on IBSS peer capability update

Shin'ichiro Kawasaki (1):
      block: serialize elevator changes for the same queue using a writer lock

Shoichiro Miyamoto (1):
      smb: client: reject overlapping data areas in SMB2 responses

Shrikanth Hegde (1):
      powerpc/vtime: Initialize starttime at boot for native accounting

Shuhao Fu (1):
      can: j1939: fix lockless local-destination check

Srikanth Boyapally (1):
      spi: cadence-quadspi: Fix indirect write timeout when DMA read
mode is enabled

Steve Dunnagan (1):
      firmware: arm_scmi: Use 64-bit division for clock rate rounding

Steven Rostedt (3):
      scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()
      selftests/ftrace: Fix reading enabled_functions in
add_remove_fprobe_module test
      selftests/tracing: Have trigger-hist-poll.tc use sched_process_exit

Stéphane Grosjean (1):
      can: peak: Modification of references to email accounts being deleted

Sumanth Korikkar (1):
      s390/perf_cpum_cf: Add missing array_index_nospec() to
__hw_perf_event_init()

Sumit Gupta (2):
      arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
      arm64: tegra: Fix CPU1 node unit-address on Tegra264

Sun Jian (2):
      bpf: Reject negative const offsets for buffer pointers
      selftests/bpf: Cover negative buffer pointer offsets

Syed Saba Kareem (1):
      ASoC: amd: acp: Fix linker error with SDCA quirks

Takashi Iwai (1):
      ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC

Tanmay Kathpalia (1):
      dt-bindings: reset: altr: add COMBOPHY_RESET for Agilex5

Tao Cui (1):
      blk-cgroup: fix leaks and online flag on radix_tree_insert failure

Tejun Heo (6):
      sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
      sched_ext: Pin parent scx_sched across a child sub-scheduler's lifetime
      sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
      sched_ext: Record an error on errno-only sub-enable failure
      sched_ext: Fix premature ops->priv publication in
scx_alloc_and_add_sched()
      tools/sched_ext: scx - Fix cmask_subset(), cmask_equal() and
cmask_weight()

Thomas Huth (2):
      selftests/landlock: Fix screwed up pointers in the scoped_signal_test
      selftests/landlock: Skip scoped_signal subtest with MSG_OOB if
not available

Thomas Weißschuh (1):
      riscv: vdso: Do not use LTO for the vDSO

Thorsten Blum (3):
      x86/boot: Reject too long acpi_rsdp= values
      x86/boot: Validate console=uart8250 baud rate to fix early boot hang
      powerpc/pseries: fix memory leak on krealloc failure in papr_init

Tianze Shao (1):
      ASoC: rt712-sdca: reset codec at io_init to fix silent headphone

Timur Kristóf (10):
      drm/amd/display: Fix preferred link rate for NUTMEG
      drm/amd/display: Add dp_skip_rbr flag for NUTMEG
      drm/amdgpu: Print vmid, pasid and more task info in devcoredump
      drm/amdgpu: Reserve space for IB contents in devcoredumps
      drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
      drm/amd/display: Set native cursor mode for disabled CRTCs
      drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
      drm/amd/pm/si: Fix AC/DC switch notification
      drm/amd/pm/smu7: Fix AC/DC switch notification
      drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities

Uday Khare (1):
      ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup

Unnathi Chalicheemala (1):
      firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

Uwe Kleine-König (The Capable Hub) (1):
      ARM: Don't let ARMv5 platforms select USE_OF

Vasily Gorbik (1):
      s390/checksum: Fix csum_partial() without vector facility

Vidya Srinivas (1):
      drm/i915/display: Fix NV12 ceiling division for bigjoiner case

Vijendar Mukunda (3):
      ASoC: amd: ps: disable MSI on resume in ACP PCI driver
      ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
      ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check

Vincent Jardin (2):
      i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
      i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)

Vinod Govindapillai (1):
      drm/i915/wm: clear the plane ddb_y entries on plane disable

Vivian Wang (2):
      riscv: mm: Make mark_new_valid_map() stuff depend on 64BIT && MMU
      mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap

Wang YuWei (1):
      spi: dw-dma: Wait for controller idle before completing Tx

Weiming Shi (8):
      KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
      btrfs: tree-checker: validate INODE_REF's namelen
      xfs: drop ASSERT(0) on unrecognized log item type
      xfs: splice unsorted log items back to the transaction after the loop
      xfs: fail recovery on a committed log item with no regions
      ipv4: fib: free fib_alias with kfree_rcu() on insert error path
      sctp: validate STALE_COOKIE cause length before reading staleness
      mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

WenTao Liang (2):
      scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
      drm/amd/display: set new_stream to NULL after release

Woraphat Khiaodaeng (1):
      io_uring/bpf-ops: reject re-registration of an already-bound ops

Wyatt Feng (1):
      netfilter: xt_nat: reject unsupported target families

Xiang Mei (5):
      btrfs: reject free space cache with more entries than pages
      wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
      wifi: mac80211: fix fils_discovery double free on alloc failure
      wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
      Bluetooth: qca: fix NVM tag length underflow in TLV parser

Xiang Mei (Microsoft) (5):
      xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
      xfrm6: clear dst.dev on error to avoid double netdev_put in
xfrm6_fill_dst()
      xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
      netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
      ksmbd: validate compound request size before reading StructureSize2

Xin Long (1):
      sctp: fix auth_hmacs array size in struct sctp_cookie

Xu Rao (3):
      mtd: virt-concat: free duplicate generated name
      ALSA: hda: Fix cached processing coefficient verbs
      scsi: sg: Report request-table problems when any status is set

Xuanqiang Luo (2):
      i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
      llc: fix SAP refcount leak when creating incoming sockets

Xue Lei (1):
      mtd: fix double free and WARN_ON in add_mtd_device() error paths

Yi Xie (1):
      io_uring/fs: check unused sqe fields for unlinkat

Yixun Lan (2):
      reset: spacemit: k3: fix USB2 ahb reset
      MAINTAINERS: Update SpacemiT SoC git tree repository

Yizhou Zhao (2):
      netfilter: ecache: fix inverted time_after() check
      netfilter: nf_conncount: fix zone comparison in tuple dedup

Yongqiang Sun (1):
      drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

Yousef Alhouseen (1):
      wifi: mac80211_hwsim: avoid treating MCS as legacy rate index

Yunhui Cui (1):
      riscv: io: avoid null-pointer arithmetic in PIO helpers

Zhang Heng (1):
      ALSA: hda: conexant: Remove mic bias threshold override

Zhao Dongdong (1):
      reset: sunxi: fix memory region leak on ioremap failure

Zhao Li (14):
      wifi: nl80211: free RNR data on MBSSID mismatch
      wifi: mac80211: validate extension-frame layout before RX
      wifi: cfg80211: derive S1G beacon TSF from S1G fields
      wifi: ieee80211: validate MLE common info length
      wifi: nl80211: validate nested MBSSID IE blobs
      wifi: nl80211: constrain MBSSID TX link ID range
      wifi: cfg80211: validate PMSR measurement type data
      wifi: cfg80211: validate PMSR FTM preamble range
      wifi: cfg80211: reject unsupported PMSR FTM location requests
      wifi: cfg80211: reject empty PMSR peer lists
      wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
      wifi: mac80211: validate deauth frame length before reason access
      wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
      wifi: cfg80211: validate assoc response length before status and IE access

Zhengyang Chen (1):
      selftests: netfilter: add bridge tunnel flowtable regression

Zhiling Zou (1):
      wifi: mac80211: free ack status frame on TX header build failure

Zhiping Zhang (1):
      net/mlx5: free mlx5_st_idx_data on final dealloc

Zhu Lingshan (1):
      drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

Zongyao Bai (1):
      drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

leixiang (1):
      KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails

yanglinlin (1):
      drm/amd/display: fix __udivdi3 link error