https://source.android.com/docs/security/bulletin/2025-10-01
* tag 'ASB-2025-10-06_12-5.10' of https://android.googlesource.com/kernel/common:
BACKPORT: mm/userfaultfd: fix uninitialized output field for -EAGAIN race
BACKPORT: FROMGIT: selinux: enable per-file labeling for functionfs
UPSTREAM: vsock: Do not allow binding to VMADDR_PORT_ANY
BACKPORT: FROMGIT: f2fs: add reserved nodes for privileged users
FROMGIT: f2fs: fix condition in __allow_reserved_blocks()
Revert "e1000e: fix heap overflow in e1000_set_eeprom"
Revert "wifi: cw1200: cap SSID length in cw1200_do_join()"
Revert "wifi: libertas: cap SSID len in lbs_associate()"
Linux 5.10.243
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
cifs: fix integer overflow in match_server()
clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
spi: spi-fsl-lpspi: Fix transmissions when using CONT
pcmcia: Add error handling for add_interval() in do_validate_mem()
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
net: phy: microchip: force IRQ polling mode for lan88xx
net: phy: microchip: remove the use of .ack_interrupt()
net: phy: microchip: implement generic .handle_interrupt() callback
randstruct: gcc-plugin: Fix attribute addition
randstruct: gcc-plugin: Remove bogus void member
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
vmxnet3: update MTU after device quiesce
net: dsa: microchip: linearize skb for tail-tagging switches
net: dsa: microchip: update tag_ksz masks for KSZ9477 family
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
gpio: pca953x: fix IRQ storm on system wake up
iio: light: opt3001: fix deadlock due to concurrent flag access
iio: chemical: pms7003: use aligned_s64 for timestamp
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
cpufreq/sched: Explicitly synchronize limits_changed flag handling
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
mm/khugepaged: fix ->anon_vma race
e1000e: fix heap overflow in e1000_set_eeprom
batman-adv: fix OOB read/write in network-coding decode
scsi: lpfc: Fix buffer free/clear order in deferred receive path
drm/amdgpu: drop hw access in non-DC audio fini
wifi: mwifiex: Initialize the chan_stats array to zero
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
ppp: fix memory leak in pad_compress_skb
net: atm: fix memory leak in atm_register_sysfs when device_register fail
ax25: properly unshare skbs in ax25_kiss_rcv()
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
net: thunder_bgx: decrement cleanup index before use
net: thunder_bgx: add a missing of_node_put
wifi: libertas: cap SSID len in lbs_associate()
wifi: cw1200: cap SSID length in cw1200_do_join()
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
i40e: Fix potential invalid access when MAC list is empty
icmp: fix icmp_ndo_send address translation for reply direction
mISDN: Fix memory leak in dsp_hwec_enable()
xirc2ps_cs: fix register access when enabling FullDuplex
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
wifi: cfg80211: fix use-after-free in cmp_bss()
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
tee: fix NULL pointer dereference in tee_shm_put
drm/amd/display: Don't warn when missing DCE encoder caps
ANDROID: GKI: fix up crc issue caused by new .h inclusion
Linux 5.10.242
xfs: do not propagate ENODATA disk errors into xattr code
ASoC: Intel: sof_da7219_mx98360a: fail to initialize soundcard
ASoC: Intel: sof_da7219_max98373: shrink platform_id below 20 characters
ASoC: Intel: glk_rt5682_max98357a: shrink platform_id below 20 characters
ASoC: Intel: sof_rt5682: shrink platform_id names below 20 characters
ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20 characters
Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
HID: mcp2221: Handle reads greater than 60 bytes
HID: mcp2221: Don't set bus speed on every transfer
drm/nouveau/disp: Always accept linear modifier
net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
Revert "drm/amdgpu: fix incorrect vm flags to map bo"
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
HID: wacom: Add a new Art Pen 2
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
KVM: x86: use array_index_nospec with indices that come from guest
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
sctp: initialize more fields in sctp_v6_from_sk()
net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
net/mlx5e: Set local Xoff after FW update
net/mlx5e: Update and set Xon/Xoff upon port speed set
net/mlx5e: Update and set Xon/Xoff upon MTU set
net: dlink: fix multicast stats being counted incorrectly
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
powerpc/kvm: Fix ifdef to remove build warning
net: ipv4: fix regression in local-broadcast routes
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
NFS: Fix a race when updating an existing write
nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
scsi: core: sysfs: Correct sysfs attributes access rights
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
pinctrl: STMFX: add missing HAS_IOMEM dependency
Revert "i3c: add missing include to internal header"
Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports"
Revert "media: venus: vdec: Clamp param smaller than 1fps and bigger than 240."
Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
Linux 5.10.241
alloc_fdtable(): change calling conventions.
netfilter: nf_reject: don't leak dst refcount for loopback packets
netfilter: nft_reject_inet: allow to use reject from inet ingress
netfilter: nft_reject: unify reject init and dump into nft_reject
s390/hypfs: Enable limited access during lockdown
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
iommu/amd: Avoid stack buffer overflow from kernel cmdline
scsi: qla4xxx: Prevent a potential error pointer dereference
RDMA/bnxt_re: Fix to initialize the PBL array
cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
mm/page_alloc: detect allocation forbidden by cpuset and bail out early
iio: light: as73211: Ensure buffer holes are zeroed
tracing: Limit access to parser->buffer when trace_get_user failed
tracing: Remove unneeded goto out logic
iio: imu: inv_icm42600: change invalid data error to -EBUSY
usb: xhci: Fix slot_id resource race conflict
compiler: remove __ADDRESSABLE_ASM{_STR,}() again
net: usbnet: Fix the wrong netif_carrier_on() call
selftests: mptcp: pm: check flush doesn't reset limits
gpio: rcar: Use raw_spinlock to protect register access
usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
usb: dwc3: Remove DWC3 locking during gadget suspend/resume
dm rq: don't queue request to blk-mq during DM suspend
dm: rearrange core declarations for extended use from dm-zone.c
uio_hv_generic: Fix another memory leak in error handling paths
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
f2fs: fix to avoid out-of-boundary access in dnode page
media: qcom: camss: cleanup media device allocated resource on error path
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
drm/amd/display: Don't overclock DCE 6 by 15%
media: venus: protect against spurious interrupts during probe
media: venus: Add support for SSR trigger using fault injection
media: venus: hfi: explicitly release IRQ during teardown
media: venus: don't de-reference NULL pointers at IRQ time
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
media: v4l2-ctrls: always copy the controls on completion
wifi: ath11k: fix dest ring-buffer corruption when ring is full
asm-generic: Add memory barrier dma_mb()
locking/barriers, kcsan: Support generic instrumentation
pwm: mediatek: Fix duty and period setting
pwm: mediatek: Handle hardware enable and clock enable separately
pwm: mediatek: Implement .apply() callback
platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
platform/chrome: cros_ec: remove unneeded label and if-condition
platform/chrome: cros_ec: Use per-device lockdep key
platform/chrome: cros_ec: Make cros_ec_unregister() return void
ext4: fix hole length calculation overflow in non-extent inodes
minmax: add umin(a, b) and umax(a, b)
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
btrfs: populate otime when logging an inode item
usb: musb: omap2430: fix device leak at unbind
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
iio: adc: ad_sigma_delta: change to buffer predisable
scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
net/sched: ets: use old 'nbands' while purging unused classes
net_sched: sch_ets: implement lockless ets_dump()
net/sched: sch_ets: properly init all active DRR list handles
NFS: Fix the setting of capabilities when automounting a new filesystem
NFS: Create an nfs4_server_set_init_caps() function
NFSv4: Fix nfs4_bitmap_copy_adjust()
NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache validity
scsi: pm80xx: Fix memory leak during rmmod
scsi: lpfc: Fix link down processing to address NULL pointer dereference
RDMA/rxe: Return CQE error if invalid lkey was supplied
drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
dma-buf: insert memory barrier before updating num_fences
selftests/memfd: add test for mapping write-sealed memfd read-only
mm: reinstate ability to map write-sealed memfd mappings read-only
mm: update memfd seal write check to include F_SEAL_WRITE
mm: drop the assumption that VM_SHARED always implies writable
dpaa2-eth: Fix device reference count leak in MAC endpoint handling
dpaa2-eth: retry the probe when the MAC is not yet discovered on the bus
dpaa2-mac: export MAC counters even when in TYPE_FIXED
dpaa2-mac: split up initializing the MAC object from connecting to it
ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
btrfs: fix deadlock when cloning inline extents and using qgroups
block: don't call rq_qos_ops->done_bio if the bio isn't tracked
ptp: Fix possible memory leak in ptp_clock_register()
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
cdc-acm: fix race between initial clearing halt and open
USB: cdc-acm: do not log successful probe on later errors
hv_netvsc: Fix panic during namespace deletion with VF
block: Make REQ_OP_ZONE_FINISH a write operation
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
usb: typec: fusb302: cache PD RX state
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
x86/fpu: Delay instruction pointer fixup until after warning
mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
drm/sched: Remove optimization that causes hang when killing dependent jobs
ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
tracing: Add down_write(trace_event_sem) when adding trace event
smb: client: fix use-after-free in crypt_message when using async crypto
usb: hub: Don't try to recover devices lost during warm reset.
usb: hub: avoid warm port reset during USB3 disconnect
x86/mce/amd: Add default names for MCA banks and blocks
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
f2fs: fix to do sanity check on ino and xnid
kbuild: userprogs: use correct linker when mixing clang and GNU ld
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
usb: renesas-xhci: Fix External ROM access timeouts
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
most: core: Drop device reference after usage in get_channel()
iio: proximity: isl29501: fix buffered read on big-endian systems
iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
ftrace: Also allocate and copy hash for reading of filter files
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
use uniform permission checks for all mount propagation changes
move_mount: allow to add a mount into an existing group
fs/buffer: fix use-after-free when call bh_read() helper
selftests: mptcp: connect: also cover alt modes
drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
squashfs: fix memory leak in squashfs_fill_super
mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
memstick: Fix deadlock by moving removing flag earlier
sch_htb: make htb_deactivate() idempotent
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
sch_qfq: make qfq_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_drr: make drr_qlen_notify() idempotent
sch_htb: make htb_qlen_notify() idempotent
net, hsr: reject HSR frame if skb can't hold tag
drm/amd: Restore cached power limit during resume
media: venus: Add a check for packet size after reading from shared memory
media: ov2659: Fix memory leaks in ov2659_probe()
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
media: usbtv: Lock resolution while streaming
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
media: hi556: correct the test pattern configuration
media: gspca: Add bounds checking to firmware parser
soc/tegra: pmc: Ensure power-domains are in a known state
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
PCI: endpoint: Fix configfs group removal on driver teardown
PCI: endpoint: Fix configfs group list head handling
mtd: rawnand: fsmc: Add missing check after DMA map
hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
pwm: imx-tpm: Reset counter if CMOD is 0
wifi: ath11k: fix source ring-buffer corruption
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
zynq_fpga: use sgtable-based scatterlist wrappers
ata: libata-scsi: Fix ata_to_sense_error() status handling
ext4: fix reserved gdt blocks handling in fsmap
ext4: fix fsmap end of range reporting with bigalloc
ext4: check fast symlink for ea_inode correctly
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
vt: defkeymap: Map keycodes above 127 to K_HOLE
vt: keyboard: Don't process Unicode characters in K_OFF mode
bus: mhi: host: Fix endianness of BHI vector table
usb: dwc3: meson-g12a: fix device leaks at unbind
usb: gadget: udc: renesas_usb3: fix device leak at unbind
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
m68k: Fix lost column on framebuffer debug console
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
serial: 8250: fix panic due to PSLVERR
media: uvcvideo: Do not mark valid metadata as invalid
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
parisc: Makefile: fix a typo in palo.conf
btrfs: fix log tree replay failure due to file with 0 links and extents
thunderbolt: Fix copy+paste error in match_service_id()
comedi: fix race between polling and detaching
usb: typec: ucsi: Update power_supply on power role change
misc: rtsx: usb: Ensure mmc child device is active when card is present
usb: core: config: Prevent OOB read in SS endpoint companion parsing
drm/amdgpu: fix incorrect vm flags to map bo
ASoC: fsl_sai: replace regmap_write with regmap_update_bits
ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
scsi: lpfc: Remove redundant assignment to avoid memory leak
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
pNFS: Fix uninited ptr deref in block/scsi layout
pNFS: Handle RPC size limit for layoutcommits
pNFS: Fix disk addr range check in block/scsi layout
pNFS: Fix stripe mapping in block/scsi layout
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
net: phy: smsc: add proper reset flags for LAN8710A
ipmi: Fix strcpy source and destination the same
kconfig: lxdialog: fix 'space' to (de)select options
kconfig: gconf: fix potential memory leak in renderer_edited()
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
kconfig: nconf: Ensure null termination where strncpy is used
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
i2c: Force DLL0945 touchpad i2c freq to 100khz
dm-mpath: don't print the "loaded" message if registering fails
i3c: don't fail if GETHDRCAP is unsupported
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
i3c: add missing include to internal header
md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
media: uvcvideo: Fix bandwidth issue for Alcor camera
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
media: usb: hdpvr: disable zero-length read messages
media: tc358743: Increase FIFO trigger level to 374
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
media: tc358743: Check I2C succeeded during probe
pinctrl: stm32: Manage irq affinity settings
scsi: mpt3sas: Correctly handle ATA device errors
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
RDMA/core: reduce stack using in nldev_stat_get_doit()
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
leds: leds-lp50xx: Handle reg to get correct multi_index
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
jfs: upper bound check of tree index in dbAllocAG
jfs: Regular file corruption check
jfs: truncate good inode pages when hard link is 0
scsi: bfa: Double-free fix
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
watchdog: dw_wdt: Fix default timeout
fs/orangefs: use snprintf() instead of sprintf()
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
cifs: Fix calling CIFSFindFirst() for root path without msearch
vhost: fail early when __vhost_add_used() fails
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
uapi: in6: restore visibility of most IPv6 socket options
drm/ttm: Should to return the evict error
net: ncsi: Fix buffer overflow in fetching version id
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
gve: Return error for unknown admin queue command
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
wifi: iwlegacy: Check rate_idx range after addition
netmem: fix skb_frag_address_safe with unreadable skbs
wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
drm/amd/display: Fix 'failed to blank crtc!'
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
drm/amd/display: Separate set_gsl from set_gsl_source_select
net: fec: allow disable coalescing
(powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
s390/stp: Remove udelay from stp_sync_clock()
wifi: iwlwifi: mvm: fix scan request validation
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
net: ipv4: fix incorrect MTU in broadcast routes
wifi: cfg80211: Fix interface type validation
rcu: Protect ->defer_qs_iw_pending from data race
net: ag71xx: Add missing check after DMA map
et131x: Add missing check after DMA map
be2net: Use correct byte order and format string for TCP seq and ack_seq
s390/time: Use monotonic clock in get_cycles()
wifi: cfg80211: reject HTC bit for management frames
ktest.pl: Prevent recursion of default variable options
xen/netfront: Fix TX response spurious interrupts
ASoC: codecs: rt5640: Retry DEVICE_ID verification
iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
platform/chrome: cros_ec_typec: Defer probe on missing EC parent
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
usb: core: usb_submit_urb: downgrade type check
usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
x86/bugs: Avoid warning when overriding return thunk
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
reset: brcmstb: Enable reset drivers for ARCH_BCM2835
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
ACPI: processor: fix acpi_object initialization
PM: sleep: console: Fix the black screen issue
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
selftests: tracing: Use mutex_unlock for testing glob filter
ARM: tegra: Use I/O memcpy to write to IRAM
gpio: tps65912: check the return value of regmap_update_bits()
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
ARM: rockchip: fix kernel hang during smp initialization
cpufreq: Exit governor when failed to start old governor
gpio: wcd934x: check the return value of regmap_update_bits()
usb: xhci: Avoid showing errors during surprise removal
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
usb: xhci: Avoid showing warnings for dying controller
usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
usb: xhci: print xhci->xhc_state when queue_command failed
securityfs: don't pin dentries twice, once is enough...
ata: libata-sata: Disallow changing LPM state if not supported
better lockdep annotations for simple_recursive_removal()
hfs: fix not erasing deleted b-tree node issue
drbd: add missing kref_get in handle_write_conflicts
udf: Verify partition map count
arm64: Handle KCOV __init vs inline mismatches
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
hfs: fix slab-out-of-bounds in hfs_bnode_read()
cpuidle: governors: menu: Avoid using invalid recent intervals data
intel_idle: Allow loading ACPI tables for any family
sctp: linearize cloned gso packets in sctp_rcv
netfilter: ctnetlink: fix refcount leak on table dump
udp: also consider secpath when evaluating ipsec use for checksumming
ACPI: processor: perflib: Move problematic pr->performance check
ACPI: processor: perflib: Fix initial _PPC limit application
Documentation: ACPI: Fix parent device references
fs: Prevent file descriptor table allocations exceeding INT_MAX
sunvdc: Balance device refcount in vdc_port_mpgroup_check
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
net: dpaa: fix device leak when querying time stamp info
net: gianfar: fix device leak when querying time stamp info
netlink: avoid infinite retry looping in netlink_unicast()
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
io_uring: don't use int for ABI
usb: gadget : fix use-after-free in composite_dev_cleanup()
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
USB: serial: option: add Foxconn T99W709
vsock: Do not allow binding to VMADDR_PORT_ANY
net/packet: fix a race in packet_set_ring() and packet_notifier()
perf/core: Prevent VMA split of buffer mappings
perf/core: Exit early on perf_mmap() fail
perf/core: Don't leak AUX buffer refcount on allocation failure
pptp: fix pptp_xmit() error path
smb: client: let recv_done() cleanup before notifying the callers.
ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
benet: fix BUG when creating VFs
net: drop UFO packets in udp_rcv_segment()
ipv6: reject malicious packets in ipv6_gso_segment()
pptp: ensure minimal skb length in pptp_xmit()
phy: mscc: Fix parsing of unicast frames
netpoll: prevent hanging NAPI when netcons gets enabled
NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
XArray: Add calls to might_alloc()
mm: extract might_alloc() debug check
NFSv4.2: another fix for listxattr
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
pNFS/flexfiles: don't attempt pnfs on fatal DS errors
pNFS/flexfiles: Avoid spurious layout returns in ff_layout_choose_ds_for_read
PCI: pnv_php: Fix surprise plug detection and recovery
powerpc/eeh: Make EEH driver device hotplug safe
powerpc/eeh: Rely on dev->link_active_reporting
powerpc/eeh: Export eeh_unfreeze_pe()
PCI: pnv_php: Work around switches with broken presence detection
PCI: pnv_php: Clean up allocated IRQs on unplug
kconfig: qconf: fix ConfigList::updateListAllforAll()
scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
f2fs: fix to avoid out-of-boundary access in devs.path
f2fs: fix to avoid panic in f2fs_evict_inode
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
f2fs: doc: fix wrong quota mount option description
rtc: rv3028: fix incorrect maximum clock rate handling
rtc: pcf8563: fix incorrect maximum clock rate handling
rtc: pcf85063: fix incorrect maximum clock rate handling
rtc: hym8563: fix incorrect maximum clock rate handling
rtc: ds1307: fix incorrect maximum clock rate handling
module: Restore the moduleparam prefix length check
apparmor: ensure WB_HISTORY_SIZE value is a power of 2
bpf: Check flow_dissector ctx accesses are aligned
vhost-scsi: Fix log flooding with target does not exist errors
mtd: rawnand: atmel: set pmecc data setup time
mtd: rawnand: atmel: Fix dma_mapping_error() address
jfs: fix metapage reference count leak in dbAllocCtl
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
crypto: qat - fix seq_file position update in adf_ring_next()
sh: Do not use hyphen in exported variable name
dmaengine: nbpfaxi: Add missing check after DMA map
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
fs/orangefs: Allow 2 more characters in do_c_string()
soundwire: stream: restore params when prepare ports fail
crypto: img-hash - Fix dma_unmap_sg() nents value
hwrng: mtk - handle devm_pm_runtime_enable errors
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
scsi: isci: Fix dma_unmap_sg() nents value
scsi: mvsas: Fix dma_unmap_sg() nents value
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
clk: sunxi-ng: v3s: Fix de clock definition
perf tests bp_account: Fix leaked file descriptor
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
crypto: inside-secure - Fix `dma_unmap_sg()` nents value
pinctrl: sunxi: Fix memory leak on krealloc failure
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
mtd: fix possible integer overflow in erase_xfer()
crypto: marvell/cesa - Fix engine load inaccuracy
PCI: rockchip-host: Fix "Unexpected Completion" log message
vrf: Drop existing dst reference in vrf_ip6_input_dst
selftests: rtnetlink.sh: remove esp4_offload after test
netfilter: xt_nfacct: don't assume acct name is null-terminated
can: kvaser_usb: Assign netdev.dev_port based on device channel index
can: kvaser_pciefd: Store device channel index
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
mwl8k: Add missing check after DMA map
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
xen/gntdev: remove struct gntdev_copy_batch from stack
net_sched: act_ctinfo: use atomic64_t for three counters
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
netfilter: nf_tables: adjust lockdep assertions handling
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
m68k: Don't unregister boot console needlessly
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
wifi: ath11k: clear initialized flag for deinit-ed srng lists
iwlwifi: Add missing check for alloc_ordered_workqueue
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
wifi: rtl818x: Kill URBs before clearing tx status queue
caif: reduce stack size, again
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
selftests/tracing: Fix false failure of subsystem event test
staging: nvec: Fix incorrect null termination of battery manufacturer
samples: mei: Fix building on musl libc
cpufreq: Init policy->rwsem before it may be possibly used
cpufreq: Initialize cpufreq-based frequency-invariance later
arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
usb: early: xhci-dbc: Fix early_ioremap leak
Revert "vmci: Prevent the dispatching of uninitialized payloads"
pps: fix poll support
vmci: Prevent the dispatching of uninitialized payloads
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
ARM: dts: vfxxx: Correctly use two tuples for timer address
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
hfsplus: remove mutex_lock check in hfsplus_free_extents
fs_context: fix parameter name in infofc() macro
ASoC: Intel: fix SND_SOC_SOF dependencies
ethernet: intel: fix building with large NR_CPUS
usb: phy: mxs: disconnect line when USB charger is attached
usb: chipidea: add USB PHY event
ALSA: hda: Add missing NVIDIA HDA codec IDs
comedi: comedi_test: Fix possible deletion of uninitialized timers
x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
nilfs2: reject invalid file types when reading inodes
gve: Fix stuck TX queue for DQ queue format
e1000e: ignore uninitialized checksum word on tgp
e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
i2c: qup: jump out of the loop in case of timeout
net: hns3: fixed vf get max channels bug
net: hns3: refine the struct hane3_tc_info
net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
net: appletalk: Fix use-after-free in AARP proxy probe
net: appletalk: fix kerneldoc warnings
i40e: report VF tx_dropped with tx_errors instead of tx_discards
i40e: Add rx_missed_errors for buffer exhaustion
RDMA/core: Rate limit GID cache warning messages
regulator: core: fix NULL dereference on unbind due to stale coupling data
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
virtio-net: ensure the received length does not exceed allocated size
mm/vmalloc: leave lazy MMU mode on PTE mapping error
ASoC: fsl_sai: Force a software reset when starting in consumer mode
usb: dwc3: qcom: Don't leave BCR asserted
usb: musb: fix gadget state on disconnect
usb: musb: Add and use inline functions musb_{get,set}_state
usb: hub: Fix flushing of delayed work used for post resume purposes
usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
usb: hub: fix detection of high tier USB3 devices behind suspended hubs
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
Bluetooth: SMP: If an unallowed command is received consider it a failure
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
usb: net: sierra: check for no status endpoint
hwmon: (corsair-cpro) Validate the size of the received input buffer
rpl: Fix use-after-free in rpl_do_srh_inline().
net/sched: sch_qfq: Fix race condition on qfq_aggregate
net: emaclite: Fix missing pointer increment in aligned_read()
comedi: Fix initialization of data for instructions that write to subdevice
comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
comedi: Fix some signed shift left operations
comedi: das6402: Fix bit shift out of bounds
comedi: das16m1: Fix bit shift out of bounds
comedi: aio_iiro_16: Fix bit shift out of bounds
comedi: pcl812: Fix bit shift out of bounds
iio: adc: stm32-adc: Fix race in installing chained IRQ handler
iio: adc: max1363: Reorder mode_list[] entries
iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
soc: aspeed: lpc-snoop: Cleanup resources in stack-order
mmc: sdhci_am654: Workaround for Errata i2312
mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
mmc: bcm2835: Fix dma_unmap_sg() nents value
memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
isofs: Verify inode mode when loading from disk
dmaengine: nbpfaxi: Fix memory corruption in probe()
af_packet: fix soft lockup issue caused by tpacket_snd()
af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
HID: core: do not bypass hid_hw_raw_request
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: ensure the allocated report buffer can contain the reserved report ID
pch_uart: Fix dma_sync_sg_for_device() nents value
Input: xpad - set correct controller type for Acer NGR200
thunderbolt: Fix bit masking in tb_dp_port_set_hops()
i2c: stm32: fix the device used for the DMA map
usb: gadget: configfs: Fix OOB read on empty string write
USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
USB: serial: option: add Foxconn T99W640
USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
Conflicts:
drivers/mmc/host/sdhci-msm.c
drivers/soc/qcom/mdt_loader.c
Change-Id: Ibd0c3241478d126b2744db7a07361717b132d9b3
3283efc9f2