# changelog

author: Mark Nicholson <mark.j.nicholson@oracle.com> [7.1.8-0.el9uek]
changelog:
  - uek-next: Updating to upstream v7.1.8 (Mark Nicholson)
  - Linux 7.1.8 (Greg Kroah-Hartman)
  - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path (Andrei Kuchynski)
  - drm/amd/display: Exit idle optimizations before programming (Leo Li)
  - drm/amd/display: check GRPH_FLIP status before sending event (Leo Li)
  - media: chips-media: wave5: Support CBP profile (Jackson Lee)
  - drm/xe: Wait on external BO kernel fences in exec IOCTL (Matthew Brost)
  - drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] (Thomas Hellström)
  - drm/xe: Set TTM device beneficial_order to 9 (2M) (Matthew Brost)
  - drm/xe: Separate early xe_device initialization (Michal Wajdeczko)
  - drm/xe: Move xe->info.devid|revid initialization (Michal Wajdeczko)
  - drm/xe: Move xe->info.force_execlist initialization (Michal Wajdeczko)
  - drm/xe: Drop unused param from xe_device_create() (Michal Wajdeczko)
  - usb: typec: ucsi: Fix race condition and ordering in port unregistration (Andrei Kuchynski)
  - usb: typec: ucsi: split connector lock classes (Sergey Senozhatsky)
  - drm/xe/rtp: Ensure locking/ref counting for OA whitelists (Ashutosh Dixit)
  - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release (Ashutosh Dixit)
  - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt (Ashutosh Dixit)
  - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs (Ashutosh Dixit)
  - drm/xe/rtp: Save OA nonpriv registers to register save/restore lists (Ashutosh Dixit)
  - drm/xe/rtp: Generalize whitelist_apply_to_hwe (Ashutosh Dixit)
  - drm/xe/rtp: Keep track of non-OA nonpriv slots (Ashutosh Dixit)
  - drm/xe/rtp: Maintain OA whitelists separately (Ashutosh Dixit)
  - drm/vmwgfx: validate external BO copy bounds for both stride paths (Zack Rusin)
  - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Zack Rusin)
  - drm/vmwgfx: enforce cursor size limits for MOB cursors (Zack Rusin)
  - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (Zack Rusin)
  - drm/vmwgfx: bound DMA command body size against suffix pointer (Zack Rusin)
  - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (Zack Rusin)
  - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin)
  - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down (Zack Rusin)
  - drm/vmwgfx: clamp dirty-page range with min, not max (Zack Rusin)
  - drm/vmwgfx: reject DX_BIND_QUERY without a DX context (Zack Rusin)
  - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (Zack Rusin)
  - drm/amdkfd: hold event_mutex while checkpointing CRIU events (William Palacek)
  - drm/amdkfd: Handle invalid event type in CRIU event restore (David Francis)
  - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (William Palacek)
  - drm/amdkfd: fix QID bit leak in pqm_create_queue() (Vladimir Marioukhine)
  - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (Gang Ba)
  - drm/amd/display: use proper context for logging (Jiri Slaby (SUSE))
  - drm/amd/display: Silence link_dpms I2C retimer failures (Alan Swanson)
  - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (Ray Wu)
  - drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (George Zhang)
  - drm/amd/display: check if dml21_add_phantom_plane() is successful (Alex Deucher)
  - drm/amd/pm: use milliwatts for GPU power sensors (Yang Wang)
  - drm/amd/pm: hide pp_table sysfs on APUs (Yang Wang)
  - drm/amd/pm: fix pptable use-after-free (Yang Wang)
  - drm/amd/pm: fix torn gpu metrics reads (Yang Wang)
  - drm/amdgpu: cap GTT size to physical RAM on APUs (Harkirat Gill)
  - drm/amdgpu: restore UMD profile pstate after runtime resume (Candice Li)
  - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (Pierre-Eric Pelloux-Prayer)
  - drm/mediatek: ovl_adaptor: balance component registrations (Myeonghun Pak)
  - drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2 (Guangshuo Li)
  - drm/panthor: validate firmware interface structure sizes (Osama Abdelkader)
  - drm/panthor: reject firmware sections with oversized data (Osama Abdelkader)
  - drm/bridge: display-connector: Fix I2C adapter resource leak (Laurent Pinchart)
  - drm/vc4: Zero the tile state data array before each BIN job (Maíra Canal)
  - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (Jose Maria Casanova Crespo)
  - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (Alexander Kaplan)
  - can: ctucanfd: mark error-active controller status valid (Avi Weiss)
  - can: ctucanfd: handle bus error interrupts (Avi Weiss)
  - can: ctucanfd: unmap BAR0 using base address (Avi Weiss)
  - can: ctucanfd: use self-test mode for PRESUME_ACK (Avi Weiss)
  - can: ctucanfd: add missing MODULE_DEVICE_TABLE() (Pengpeng Hou)
  - can: peak_usb: validate uCAN receive record lengths (Pengpeng Hou)
  - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (Maoyi Xie)
  - can: peak_usb: add bounds check for USB channel index (James Gao)
  - can: softing: fw_parse(): validate firmware record spans (Pengpeng Hou)
  - can: rcar_canfd: change the initializing flow for clocks and resets (Tu Nguyen)
  - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (Pengpeng Hou)
  - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (Abdun Nihaal)
  - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (Tetsuo Handa)
  - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (Oleksij Rempel)
  - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering (Oliver Hartkopp)
  - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (Marc Kleine-Budde)
  - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (Guangshuo Li)
  - can: ems_usb: validate CPC message lengths (Pengpeng Hou)
  - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (Lucas Martins Alves)
  - i2c: imx: Cancel hrtimer before clearing slave pointer (Liem)
  - i2c: imx: Fix slave registration race and error handling (Liem)
  - i2c: imx: mark I2C adapter when hardware is powered down (Carlos Song)
  - i2c: iproc: reset bus after timeout if START_BUSY is stuck (Jonas Gorski)
  - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (H. Nikolaus Schaller)
  - i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers (Wenmeng Liu)
  - i2c: spacemit: request IRQ after controller initialization (Linmao Li)
  - ice: fix memory leak in ice_lbtest_prepare_rings() (Dawei Feng)
  - ice: fix VF interrupts cleanup (Dawid Osuchowski)
  - ice: wait for reset completion in ice_resume() (Aaron Ma)
  - net: openvswitch: fix skb leak on flow key update failure during ct (Ilya Maximets)
  - net: openvswitch: fix skb leak on flow key update failure during recirculation (Ilya Maximets)
  - net: openvswitch: fix potential UAF on meter attach failure (Ilya Maximets)
  - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (Nava kishore Manne)
  - phy: zynqmp: use read-modify-write for SERDES scrambler bypass (Nava kishore Manne)
  - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (Nava kishore Manne)
  - s390/zcrypt: Validate length for CCA ECC private key requests (Holger Dengler)
  - s390/zcrypt: Validate length for CCA AES cipher key requests (Holger Dengler)
  - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() (Harald Freudenberger)
  - s390/zcrypt: Fix buffer over-read in cca_cipher2protkey (Harald Freudenberger)
  - s390/zcrypt: Close speculative mem read possibility (Harald Freudenberger)
  - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (Harald Freudenberger)
  - s390/dasd: Fix undersized format-check buffer (Stefan Haberland)
  - s390/dasd: Fix potential NULL pointer dereference (Jan Höppner)
  - s390/qeth: Check CAP_NET_ADMIN for private ioctls (Aswin Karuvally)
  - s390/pci: Fix s390_pci_mmio_write syscall error return without MIO (Niklas Schnelle)
  - power: supply: max17040: handle missing status supplier (Jianing Li)
  - power: supply: macsmc: Support macOS 27 SMC firmware (Sasha Finkelstein)
  - power: supply: bq25890: fix the -10 C NTC lookup entry (Xu Rao)
  - cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized (Zhongqiu Han)
  - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() (Abdun Nihaal)
  - cpufreq: cppc: Sanitize lockless policy limit snapshots (Christian Loehle)
  - cifs: add fscache_resize_cookie() to cifs_setsize() (Frank Sorenson)
  - gpio: pch: use raw_spinlock_t for the register lock (Junjie Cao)
  - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (bui duc phuc)
  - gpiolib: tolerate gpio-hogs lacking a hogging state (Daniel Golle)
  - i2c: amd-mp2: Unregister callback on adapter add failure (Myeonghun Pak)
  - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (Vincent Jardin)
  - hwmon: (npcm750-pwm-fan): stop fan timer on device detach (Hongyan Xu)
  - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada)
  - sctp: reject stale cookies with mismatched verification tags (Yuxiang Yang)
  - scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc (Shawn Guo)
  - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (Ibrahim Hashimov)
  - scsi: libsas: terminate deferred commands on time out (Damien Le Moal)
  - selftests/clone3: fix wild pointer access of getline due to missing init (Chris Gellermann)
  - selftests/mm: fix potential wild pointer access of getline due to missing init (Chris Gellermann)
  - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (Vijaya Krishna Nivarthi)
  - spi: spi-qpic-snand: write the feature value before executing SET_FEATURE (Stanislaw Pal)
  - tracing/filters: Fix false positive match in regex_match_full() (Masami Hiramatsu (Google))
  - tracing: Check return value of __register_event() in trace_module_add_events() (Masami Hiramatsu (Google))
  - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (Ming Lei)
  - vxlan: use pskb_network_may_pull() in route_shortcircuit() (Eric Dumazet)
  - vxlan: use pskb_network_may_pull() for transmit path header pulls (Eric Dumazet)
  - vxlan: use neigh_ha_snapshot() in route_shortcircuit() (Eric Dumazet)
  - vxlan: unclone skb head before modifying eth header in route_shortcircuit() (Eric Dumazet)
  - vxlan: re-fetch eth header after route_shortcircuit() (Eric Dumazet)
  - veth: convert frag_list skbs before running XDP (Matt Fleming)
  - uprobes: Fix NULL pointer dereference in hprobe_expire() (Breno Leitao)
  - um: vector: fix use-after-free in vector_mmsg_rx() (Michael Bommarito)
  - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() (Thorsten Blum)
  - riscv/mm: use physical alignment for vmemmap_start_pfn (Jiakai Xu)
  - net: pktgen: fix proc entry use-after-free (Chengfeng Ye)
  - net: ipv6: clear suppressed fib6 rule result (Zhiling Zou)
  - net: bridge: stop fast-leave after deleting a port group (Zhiling Zou)
  - mm: memcg: initialize *locked in memcg1_oom_prepare() stub (Breno Leitao)
  - mm/page_reporting: use system_freezable_wq to fix UAF during suspend (Link Lin)
  - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (Kiryl Shutsemau (Meta))
  - io_uring: preserve task restrictions across exec (Kyumin Lee)
  - io_uring/net: initialize mshot_len for send (Jens Axboe)
  - binfmt_misc: don't leak the user namespace when the mount fails (Christian Brauner)
  - binfmt_misc: don't let an 'F' entry pin its own instance (Christian Brauner)
  - binfmt_misc: reject a flag character as the field delimiter (Christian Brauner)
  - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (Christian Brauner)
  - binfmt_misc: restore write access when removing an entry (Christian Brauner)
  - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (Zhao Li)
  - wifi: mac80211: fix tid_tx use-after-free on BA session stop (Zhao Li)
  - x86/CPU/AMD: Carve out a Zen5 models range (Pratik Vishwakarma)
  - tipc: avoid use-after-free in poll trace queue dumps (Zihan Xi)
  - PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug (Soeren Moch)
  - of/address: Fix NULL bus dereference in of_pci_range_parser_one() (Carlo Caione)
  - netfilter: ipset: do not update comments from kernel-side hash adds (David Lee)
  - net/smc: fix socket use-after-free during link group termination (Xuanqiang Luo)
  - mshv: fix hv_input_get_system_property struct (Wei Liu)
  - ksmbd: reject repeated SMB2 NEGOTIATE requests (Namjae Jeon)
  - ipvs: do not propagate one-packet flag to synced conns (Zhiling Zou)
  - igc: remove napi_synchronize() in igc_down() (David Carlier)
  - igbvf: Fix leak in TX DMA error cleanup (Matt Vollrath)
  - fou: Fix use-after-free in fou_create() (Xuanqiang Luo)
  - e1000: fix memory leak in e1000_probe() (Dawei Feng)
  - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (Md Sadre Alam)
  - ALSA: usb-audio: Clamp frame size in implicit-feedback mode (Sonali Pradhan)
  - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (Sonali Pradhan)
  - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (Baul Lee)
  - ALSA: usb-audio: fix stack info leak in RME Digiface status (Baul Lee)
  - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (Baul Lee)
  - ata: libata-scsi: schedule deferred atapi command (Damien Le Moal)
  - ata: libata-scsi: terminate deferred commands on time out (Damien Le Moal)
  - ata: libata-sata: fix ata_scsi_lpm_supported() iteration (Niklas Cassel)
  - ata: libata-eh: Increase STANDBY IMMEDIATE timeout (Matt Vollrath)
  - ASoC: tas2562: fix broken entries in the volume lookup table (Haidar Lee)
  - ASoC: tas2562: fix DVC coefficient write order (Haidar Lee)
  - ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return (Shengjiu Wang)
  - ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return (Shengjiu Wang)
  - ALSA: ump: fix double free of out_cvts on rawmidi error (Baul Lee)
  - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (Norbert Szetei)
  - ALSA: seq: Fix division by zero in initialize_timer() (Norbert Szetei)
  - ALSA: pcm: wake linked drain waiters on unlink (Norbert Szetei)
  - ALSA: lx6464es: fix period byte count for 16-bit streams (Xu Rao)
  - ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Eckhart Mohr)
  - ALSA: 6fire: Fix UAF at error handling during probe (Takashi Iwai)
  - afs: Fix UAF when sending a message (David Howells)
  - afs: Fix afs_fs_fetch_data() to subtract transferred from len (David Howells)
  - afs: Fix afs_fs_fetch_data() to set call->async (David Howells)
  - bpf: lwt: Fix dst reference leak on reroute failure (Xuanqiang Luo)
  - Bluetooth: HIDP: validate numbered report payloads (Sangho Lee)
  - Bluetooth: HIDP: reject frames without a transaction header (Sangho Lee)
  - Bluetooth: hci_sync: Fix advertising data UAFs (Chengfeng Ye)
  - Bluetooth: mgmt: fix UAF in pair command cancellation (Zihan Xi)
  - Bluetooth: SCO: give the socket its own sco_conn reference (Aldo Ariel Panzardo)
  - Bluetooth: mgmt: fix pending command UAF in EIR updates (Zihan Xi)
  - Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() (Greg Kroah-Hartman)
  - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (Greg Kroah-Hartman)
  - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (Greg Kroah-Hartman)
  - audit: fix potential use-after-free in audit_del_rule() (Luxiao Xu)
  - audit: fix potential integer overflow in audit_log_n_string() (Zhan Xusheng)
  - sctp: validate Adaptation Indication parameter length (Charles Vosburgh)
  - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (Hidayath Khan)
  - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (Farhan Ali)
  - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (Farhan Ali)
  - KVM: s390: pci: Fix resource leak on IRQ registration failure (Farhan Ali)
  - KVM: s390: pci: Fix missing error codes and memory unaccounting (Farhan Ali)
  - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (Farhan Ali)
  - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (Farhan Ali)
  - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Sean Christopherson)
  - KVM: VMX: add memory clobber to asm for VMX instructions (Paolo Bonzini)
  - tracing/fprobe: Roll back on enable_trace_fprobe() failure (Raushan Patel)
  - tracing/probes: Reject $arg0 in meta argument expansion (Raushan Patel)
  - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (Weiming Shi)
  - mm/vmstat: fold stranded per-cpu node stats when a node comes online (Gregory Price)
  - userfaultfd: wait on source PMD during UFFDIO_MOVE (Usama Arif)
  - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Xiangfeng Cai)
  - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() (Zi Yan)
  - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes (Kiryl Shutsemau (Meta))
  - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes (Kiryl Shutsemau (Meta))
  - selftest: fix headers in fclog.c (Jori Koolstra)
  - mm/util: don't read __page_2 for order-1 folios in snapshot_page() (Aboorva Devarajan)
  - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (Kefeng Wang)
  - ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset (Joseph Qi)
  - btrfs: zoned: fix missing chunk metadata reservation (Guanghui Yang)
  - lib: test_hmm: use device devt for coherent device range selection (Stanislav Kinsburskii)
  - fortify: Disable -Wstringop-overread in tests (Nathan Chancellor)
  - pinctrl: bm1880: add missing select GENERIC_PINCONF (Benjamin Boortz)
  - erofs: cap LZMA stream pool size (Michael Bommarito)
  - btrfs: raid56: fix scrub read assembly submitting no reads (Mykola Lysenko)
  - pinctrl: devicetree: don't free uninitialized dev_name on error path (Karl Mehltretter)
  - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO (Benjamin Boortz)
  - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (Kiryl Shutsemau (Meta))
  - mm: mglru: fix stale batch updates after memcg reparenting (Qi Zheng)
  - ACPI: CPPC: Check all controls for fast switching (Christian Loehle)
  - kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos (Nicolas Schier)
  - iommu/iommufd: Fix IOPF group ownership UAF (Peiyang He)
  - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Peiyang He)
  - iommufd: Reject DMABUF pages from the access pin path (Peiyang He)
  - iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Nicolin Chen)
  - iommufd/viommu: Release the igroup lock on the vdevice_size error path (Nicolin Chen)
  - ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path (Masami Hiramatsu (Google))
  - mshv: Publish VP to pt_vp_array before installing the file descriptor (Stanislav Kinsburskii)
  - mshv: Order pt_vp_array publish against irqfd assertion path (Stanislav Kinsburskii)
  - mshv: Fix missing error code on VP allocation failure (Stanislav Kinsburskii)
  - mshv: Fix level-triggered check on uninitialized data (Stanislav Kinsburskii)
  - mshv: Fix race in mshv_irqfd_deassign (Stanislav Kinsburskii)
  - iomap: add a separate bio_set for iomap_split_ioend (Christoph Hellwig)
  - ksmbd: use memcmp() to compare ClientGUIDs (Namjae Jeon)
  - ksmbd: fix use-after-free in __close_file_table_ids() (Namjae Jeon)
  - ksmbd: return success for deferred final close (Namjae Jeon)
  - drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status (Jerome Tollet)
  - qede: sync udp_tunnel ports outside qede_lock in the recovery path (Denis V. Lunev)
  - spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs (Haibo Chen)
  - sched/deadline: Use revised wakeup rule only for running dl_server (Gabriele Monaco)
  - octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)
  - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets (Jiawen Wu)
  - ptp: netc: fix potential interrupt storm caused by incorrect unbind order (Wei Fang)
  - net: mana: Return error code from mana_create_rxq() (Aditya Garg)
  - net: mana: Create separate EQs for each vPort (Long Li)
  - net: stmmac: Fix E2E delay mechanism (Nazim Amirul)
  - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling (Daniel Golle)
  - net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling (Daniel Golle)
  - net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend (Daniel Golle)
  - riscv: vdso: Only try to install vDSO when present (Thomas Weißschuh)
  - ipv6: release fib6_null_entry on subtree failure (Shuangpeng Bai)
  - ring-buffer: Fix reader page read offset for remote buffers (Vincent Donnefort)
  - riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove (Karl Mehltretter)
  - accel/qaic: use sizeof(*trans_hdr) for transaction length check (Muhammad Bilal)
  - riscv: drop __init from vec_check_unaligned_access_speed_all_cpus (Anirudh Srinivasan)
  - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (Masami Hiramatsu (Google))
  - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() (Masami Hiramatsu (Google))
  - fprobe: Fix module reference count leak on error in register_fprobe() (Masami Hiramatsu (Google))
  - drm/xe/pt: check no-DMA huge-pte cases before DMA segment test (Himal Prasad Ghimiray)
  - drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder (Alexander Kaplan)
  - can: isotp: check register_netdevice_notifier() error in module init (Minhong He)
  - net: sxgbe: check descriptor ring allocation failures (Chenguang Zhao)
  - net: sxgbe: free TX rings on RX allocation failure (Chenguang Zhao)
  - scsi: ufs: core: Initialize hba->rpmbs list in ufshcd (Ao Sun)
  - scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil)
  - octeontx2-af: Block VFs from clobbering special CGX PKIND state (Hariprasad Kelam)
  - octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle (Ratheesh Kannoth)
  - scsi: target: Clear cmd_cnt when initial counter enrollment fails (Leon Romanovsky)
  - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req (Benjamin Block)
  - scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" (Bart Van Assche)
  - scsi: ufs: core: Cancel RTC work in active-active suspend (Guangshuo Li)
  - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE (TanZheng)
  - net: phylink: put link_gpio if phylink_create fails (Christian Marangi)
  - x86/boot: Add volatile, clobbers and zero-length test in memcmp() (Mauricio Faria de Oliveira)
  - Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (Pauli Virtanen)
  - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync (Pauli Virtanen)
  - Bluetooth: hci_sync: hold conn in hci_past_sync() callback (Pauli Virtanen)
  - Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (Pauli Virtanen)
  - Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (Pauli Virtanen)
  - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (Pauli Virtanen)
  - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (Pauli Virtanen)
  - Bluetooth: btintel: Validate length before parsing diagnostics TLV (Zijun Hu)
  - Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (Pauli Virtanen)
  - Bluetooth: ISO: fix refcounting of iso_conn (Pauli Virtanen)
  - Bluetooth: ISO: ensure no dangling hcon references in iso_conn (Pauli Virtanen)
  - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (Pauli Virtanen)
  - Bluetooth: ISO: fix leaking sk after socket release (Pauli Virtanen)
  - Bluetooth: ISO: hold sk properly in iso_conn_ready (Pauli Virtanen)
  - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (Pauli Virtanen)
  - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (Pauli Virtanen)
  - Bluetooth: ISO: lock sk in iso_connect_ind (Pauli Virtanen)
  - Bluetooth: ISO: lock sk in iso_sock_getname (Pauli Virtanen)
  - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (Pauli Virtanen)
  - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (Jiale Yao)
  - Bluetooth: ISO: clear iso_data always when detaching conn from hcon (Pauli Virtanen)
  - ice: suppress DPLL errors during reset recovery (Przemyslaw Korba)
  - idpf: Fix mailbox IRQ name leak on request failure (Yuho Choi)
  - idpf: adjust TxQ ring count minimum (Joshua Hay)
  - idpf: bound interrupt-vector register fill to the allocated array (Michael Bommarito)
  - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (Guenter Roeck)
  - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (Chenguang Zhao)
  - netfs: Fix folio_queue ENOMEM in writeback by adding a mempool (David Howells)
  - netfs: release readahead folios on iterator preparation failure (Yichong Chen)
  - netfs: handle single writeback rolling buffer allocation failure (Yichong Chen)
  - netfs: clear PG_private_2 on copy-to-cache append failure (Yichong Chen)
  - wifi: mac80211: validate individual TWT params before driver setup (Zhao Li)
  - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() (Eric Dumazet)
  - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (Cen Zhang (Microsoft))
  - powerpc/boot: Fix treeboot-akebono CPU node lookup check (Thorsten Blum)
  - powerpc/boot: Fix treeboot-currituck CPU node lookup check (Thorsten Blum)
  - powerpc/boot: Fix simpleboot CPU node lookup check (Thorsten Blum)
  - ethtool: Embed FEC hist ranges as buffer in struct (Eric Joyner)
  - rtase: fix double free of multi-frag skb on DMA map failure (Yun Lu)
  - hwmon: (adt7470) Fix PWM auto temp state array and bounds check (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Use cached PWM frequency value (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Fix cache updated before hardware write on I2C error (Luiz Angelo Daros de Luca)
  - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (Luiz Angelo Daros de Luca)
  - forcedeth: fix UAF of txrx_stats in nv_remove (Chenguang Zhao)
  - ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() (Surendra Singh Chouhan)
  - net: bridge: mrp: fix Option TLV length in MRP_Test frames (David Corvaglia)
  - hwmon: (nct6775-core) Prevent access to unsupported weight registers (Guenter Roeck)
  - net: do not send ICMP/NDISC Redirects when peer allocation fails (Eric Dumazet)
  - hwmon: (nzxt-smart2) DMA-align output buffer (Guenter Roeck)
  - hwmon: (lm90) Only report alarms if driver is ready (Guenter Roeck)
  - hwmon: (sht3x) Fix unaligned accesses (Guenter Roeck)
  - hwmon: (ltc4282) Fix reading the minimum alarm voltage (Guenter Roeck)
  - hwmon: (ina2xx) Fix various overflow issues (Guenter Roeck)
  - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (Guenter Roeck)
  - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (Srikanth Boyapally)
  - ASoC: tas2781: Use correct calibration data for SINEGAIN2 register (wangdicheng)
  - wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() (Baochen Qiang)
  - ACPI: CPPC: Skip writes to unsupported performance controls (Christian Loehle)
  - gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper (Alex Tran)
  - erofs: ensure valid f_path for page cache sharing (Gao Xiang)
  - erofs: remove fscache backend entirely (Gao Xiang)
  - erofs: clean up erofs_ishare_fill_inode() (Gao Xiang)
  - smb: client: fix buffer leaks in SMB1 read and write (Dawei Feng)
  - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (Xingui Yang)
  - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (HyeongJun An)
  - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (HyeongJun An)
  - pinctrl-amd: Don't clear S4 wake bits at probe (Mario Limonciello)
  - net/sched: sch_cake: skip clearing unused tins during rate adjustment (Jonas Köppeler)
  - xsk: reclaim invalid Tx descriptors in ZC batch path (Maciej Fijalkowski)
  - xsk: provide sufficient space in pool->tx_descs (Maciej Fijalkowski)
  - xsk: drain continuation descs after overflow in xsk_build_skb() (Jason Xing)
  - xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx (Jason Xing)
  - selftests/net/af_unix: test listen() rejects wrong socket states (John Ericson)
  - af_unix: fix listen() succeeding on sockets in the wrong state (John Ericson)
  - nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush (Xiang Mei (Microsoft))
  - nexthop: take nh->lock for f6i_list walks in replace check and notify (Xiang Mei (Microsoft))
  - ASoC: SDCA: Ensure that Control Range is large enough for header (Charles Keepax)
  - ASoC: SDCA: Make UMP message size check more robust (Charles Keepax)
  - ASoC: SDCA: Always free firmware in FDL path (Charles Keepax)
  - ASoC: SDCA: Correct pointer passed to devm_acpi_table_put (Charles Keepax)
  - netfilter: nft_payload: fix mask build for partial field offload (Xiang Mei (Microsoft))
  - ipvs: clear the nfct flag under lock (Julian Anastasov)
  - ipvs: do not mangle ICMP replies for non-first fragments (Julian Anastasov)
  - ipvs: fix places with wrong packet offsets (Julian Anastasov)
  - ipvs: fix the checksum validations (Julian Anastasov)
  - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (Pablo Neira Ayuso)
  - netfilter: nf_tables: make nft_object rhltable per table (Pablo Neira Ayuso)
  - ipvs: adjust double hashing when fwd method changes (Julian Anastasov)
  - assoc_array: trim the final shortcut word using the current chunk end (Michael Bommarito)
  - keys: make keyring key-chunk byte order agree with keyring_diff_objects() (Michael Bommarito)
  - keys: fix out-of-bounds read in keyring_get_key_chunk() (Michael Bommarito)
  - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type (Fabrice Derepas)
  - KVM: arm64: Reject guest_memfd memslots when the VM has MTE (Alexandru Elisei)
  - KVM: arm64: Add missing hyp_enter when trapping sysreg (Vincent Donnefort)
  - KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load() (Vincent Donnefort)
  - KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing (Vincent Donnefort)
  - KVM: arm64: Fix hyp_trace clock disabling (Vincent Donnefort)
  - KVM: arm64: vgic: Mitigate potential LPI registration failure (Carlos López)
  - KVM: arm64: vgic: Fix race between LPI release and re-registration (Carlos López)
  - mshv: Fix sleeping under spinlock in mshv_portid_alloc (Stanislav Kinsburskii)
  - mshv: Fix duplicate GSI detection for GSI 0 (Stanislav Kinsburskii)
  - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation (Sebastian Andrzej Siewior)
  - mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() (Yi Xie)
  - drm/mediatek: Check CRTC state before freeing (Ruoyu Wang)
  - netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() (Pablo Neira Ayuso)
  - selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests (Lorenzo Bianconi)
  - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (Xiang Mei)
  - phy: zynqmp: fix runtime PM leak on probe allocation failure (Radhey Shyam Pandey)
  - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() (Radhey Shyam Pandey)
  - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar)
  - ntfs: drop stale page-cache when shrinking a non-resident attr (Namjae Jeon)
  - ntfs: harden runlist realloc size calculations (Namjae Jeon)
  - btrfs: zoned: skip fully truncated ordered extents at zone finish (Johannes Thumshirn)
  - btrfs: raid56: fix an incorrect csum skip during scrub (Qu Wenruo)
  - btrfs: skip global block reserve accounting for rescue mounts (Dongjiang Zhu)
  - btrfs: warn about extent buffer that can not be released (Qu Wenruo)
  - btrfs: zoned: reset meta_write_pointer on zone reset (Johannes Thumshirn)
  - btrfs: zoned: fix deadlock between metadata writeback and transaction commit (Johannes Thumshirn)
  - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (Qu Wenruo)
  - of: reserved_mem: prevent OOB when too many dynamic regions are defined (Sang-Heon Jeon)
  - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (Uday Khare)
  - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (Uday Khare)
  - phy: qcom: m31-eusb2: Fix return value of init call (Krishna Kurapati)
  - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() (Radhey Shyam Pandey)
  - ata: sata_mv: accept 1 or 2 resources in platform probe (Rosen Penev)
  - ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points (Namjae Jeon)
  - selftests/seccomp: Fix pointer type mismatch build error (Kuan-Ying Lee)
  - selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE (Haofeng Li)
  - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (Abdun Nihaal)
  - iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Nicolin Chen)
  - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (Yuho Choi)
  - dmaengine: idxd: fix double free of wq, engine, and group structs (Yuho Choi)
  - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (Hongling Zeng)
  - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (Konrad Dybcio)
  - pinctrl: qcom: Unconditionally mark gpio as wakeup enable (Sneh Mankad)
  - dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold (David Carlier)
  - KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context (D Scott Phillips)
  - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (Michael Bommarito)
  - ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) (Michael Diesen)
  - mm/slab: prevent unbounded recursion in free path with new kmalloc type (Harry Yoo (Oracle))
  - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() (Harry Yoo (Oracle))
  - mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT (Harry Yoo (Oracle))
  - net: mpls: initialize rtm_tos in mpls_getroute() (Yehyeong Lee)
  - uek-next: Updating to upstream v7.1.7 (Mark Nicholson)
  - Linux 7.1.7 (Greg Kroah-Hartman)
  - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))


author: LUCI Bot <rhythm.m.mahajan@oracle.com> [7.1.9-0.el9uek]
changelog:
  - uek-next: Updating to upstream v7.1.9 (LUCI Bot)
  - Linux 7.1.9 (Greg Kroah-Hartman)
  - thunderbolt: Fix bandwidth group reservation indexing (Xu Rao)
  - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (Bryam Vargas)
  - sctp: clear new_transport when removing a peer (Qing Ming)
  - sctp: fix use-after-free of cached ASCONF chunk (Yuxiang Yang)
  - sctp: keep chunk->transport in step with the list it is queued on (Baul Lee)
  - scsi: scsi_debug: Negate wrapped memcmp() result (Xu Rao)
  - bpf, sockmap: Fix sk_redir use-after-free in send verdict (Chengfeng Ye)
  - fsverity: Fix silent truncation in bpf_get_fsverity_digest() (Eric Biggers)
  - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (Eric Biggers)
  - mm/filemap: __filemap_add_folio() restore index before retrying (Hugh Dickins)
  - ima: Instantiate file_truncate and path_truncate hooks (Mimi Zohar)
  - sched_ext: Take cgroup_lock() first in scx_cgroup_lock() (Tejun Heo)
  - sched/psi: Create the psimon kthread outside of cgroup_mutex (Tejun Heo)
  - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (Tejun Heo)
  - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (Zhan Xusheng)
  - fs,fsverity: remove check for fsverity being enabled in setattr_prepare() (Andrey Albershteyn)
  - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (Zhiling Zou)
  - ipv6: fix Route Information option length validation (Yuejie Shi)
  - mm/ptdump: always stabilise against page table freeing using init_mm (Lorenzo Stoakes (ARM))
  - mm/page_table_check: skip special zero mappings (Zhiling Zou)
  - ring-buffer: Use current_context for safe per-CPU buffer swap (Tengda Wu)
  - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (Vincent Donnefort)
  - ptp: ocp: Fix board ID over-read (Ahmad Byagowi)
  - Revert "thermal: hwmon: Register a hwmon device for each thermal zone" (Rafael J. Wysocki)
  - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (Rafael J. Wysocki)
  - ring-buffer: Prevent resizing of persistent ring buffer (Vincent Donnefort)
  - eventfs: Use children field for rcu head and add memory barriers (Steven Rostedt)
  - eventfs: Fix use-after-free in eventfs_remove_rec() (Shuangpeng Bai)
  - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson)
  - KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (Paolo Bonzini)
  - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Frank Sorenson)
  - smb: client: Fix use-after-free in cifs_try_adding_channels() (Shuangpeng Bai)
  - tipc: read le->link under the node lock in tipc_node_link_down() (Jun Yang)
  - tls: don't leave a full plaintext sk_msg ring unpushed (chanyoung)
  - tls: rx: restore msg_iter before TLS 1.3 optimistic retry (Jérémy Jean)
  - vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang)
  - veth: fix skb length accounting after XDP frag adjustment (Sun Jian)
  - vsock/virtio: avoid refilling the RX queue after teardown (Weiming Shi)
  - vsock/virtio: read virtqueues under worker locks (Weiming Shi)
  - vxlan: do not arm the ageing timer on a device that is down (Baul Lee)
  - xdp: reject clones that overrun skb_shared_info tailroom (Zhiling Zou)
  - x86/mce: Set up the polling timer before CMCI discovery (Breno Leitao)
  - x86/CPU: Add a tlbi= cmdline switch (Rik van Riel)
  - arm64: remove redundant concurrent ptdump UAF mitigation (Lorenzo Stoakes (ARM))
  - dibs: initialise dibs->lock in dibs_dev_alloc() (Hidayath Khan)
  - Revert "drm/amdgpu: fix aperture mapping leak" (Asad Kamal)
  - binfmt_misc: don't warn when the mount is completed from another user namespace (Christian Brauner)
  - ovl: don't warn when the mount is completed from another user namespace (Christian Brauner)
  - net/sched: act_gact, act_police: range check the fallback control action (Hyunjung Ko)
  - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (Hyunjung Ko)
  - net: atlantic: free RX pages of consumed but not refilled buffers (Yangyu Chen)
  - net: atlantic: free stranded TX buffers on ring deinit (Yangyu Chen)
  - netfilter: nf_conntrack: defer invalid log until after unlock (Zihan Xi)
  - netfilter: bridge: release template ct on non-IP path (Zhiling Zou)
  - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den)
  - net: devmem: prevent net-iov / page mixing (Pavel Begunkov)
  - net/x25: fix use-after-free of the socket by its timers (Baul Lee)
  - net/dibs: Correct freeing of dmb_clientid_arr (Alexandra Winter)
  - ipv6: prevent in6_dev_get() from resurrecting inet6_dev (Kyle Zeng)
  - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (Daming Li)
  - net: phy: mediatek: fix TX blink masks using the RX bits (Ahmed Naseef)
  - mm/huge_memory: fix huge_zero_pfn race (Lorenzo Stoakes (ARM))
  - mm/huge_memory: initialise workingset state before folio split (Matt Fleming)
  - tracing: Fix NULL pointer dereference in module event cache removal (Hui Su)
  - ring-buffer: Prevent subbuf order change when resizing is disabled (Vincent Donnefort)
  - fbdev: bitblit: bound-check glyph index in bit_cursor() (Rik van Riel)
  - tracing: Fix race between update_event_fields and, event_define_fields (Michael Wu)
  - perf/core: Fix group leader use-after-free after sibling detach (Aditya Chillara)
  - drm/v3d: Serialize the scheduler timeout handlers (Maíra Canal)
  - ALSA: us144mkii: re-anchor capture URBs on resubmission (Baul Lee)
  - ALSA: hda/tas2781: fix ACPI reference handling (Xu Rao)
  - ALSA: FCP: fix OOB write in fcp_meter_ctl_get() (Baul Lee)
  - ALSA: usx2y: bound the hwdep mmap fault offset (Baul Lee)
  - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (Takashi Iwai)
  - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} (SJ Park)
  - samples/damon/mtier: error out for zero quota goal target values (SJ Park)
  - mm/damon/ops-common: putback folios on invalid migrate nid (liyouhong)
  - mm/damon/lru_sort: error out for >10000 active_mem_bp (SJ Park)
  - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() (Hui Su)
  - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (Eddie Lin)
  - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (Junrui Luo)
  - misc: fastrpc: Remove buffer from list prior to unmap operation (Ekansh Gupta)
  - misc: fastrpc: fix channel ctx ref leak when session alloc fails (Anandu Krishnan E)
  - misc: fastrpc: Fix initial memory allocation for Audio PD memory pool (Ekansh Gupta)
  - staging: rtl8723bs: validate monitor transmit frame lengths (Mariano Baragiola)
  - staging: rtl8723bs: fix missing shared-key auth challenge length check (Panagiotis Petrakopoulos)
  - staging: rtl8723bs: fix OOB read in WMM_param_handler() (Muhammad Bilal)
  - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (Muhammad Bilal)
  - serial: amba-pl011: synchronize DMA teardown (Fan Wu)
  - serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ (Fan Wu)
  - serial: amba-pl011: fix indefinite RS485 post-send delay (Fan Wu)
  - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (Ryan Wilbur)
  - serial: 8250_dma: Clear stale RX state on shutdown (Cunhao Lu)
  - serial: sc16is7xx: enable THRI before filling TX FIFO (Luca Fresi)
  - serial: qcom-geni: fix TX DMA buffer flush (Jan Sebastian Götte)
  - rust_binder: do not query current thread for all ioctls (Alice Ryhl)
  - nvmem: layouts: Add fixed-layout driver (Mathieu Dubois-Briand)
  - nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI (Aelin Reidel)
  - mei: pull kvfree out of spinlock (Alexander Usyskin)
  - ipv4: fix use-after-free in fib_nhc_update_mtu() (Chengfeng Ye)
  - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (Zihan Xi)
  - selftests/bpf: Adapt sockmap update error handling (Michal Luczaj)
  - selftests/bpf: Ensure UDP sockets are bound (Michal Luczaj)
  - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (Nils Helmig)
  - Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan (Alexej Sidorenko)
  - selftests/xsk: account reclaimed invalid Tx descriptors (Maciej Fijalkowski)
  - selftests/xsk: fix too-many-frags multi-buffer Tx test (Maciej Fijalkowski)
  - futex: Prevent robust futex exit race some more (Keno Fischer)
  - Revert "drm/amd/display: Fix backlight max_brightness to match exported range" (Alex Deucher)
  - net: bridge: mrp: fix uninitialised bytes on the wire (Baul Lee)
  - netfilter: ebt_nflog: pin the NFLOG backend (Chengfeng Ye)
  - igc: fix netdev not re-attached after resume if interface is down (Philipp David)
  - mac802154: fix netdev use-after-free in beacon worker (Zihan Xi)
  - inet: frags: publish queues before arming timer (Zhiling Zou)
  - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Qihang Tang)
  - net: octeontx2-pf: Fix UB in shift operation (Sergey V. Frolov)
  - net/sched: reject overly deep qdisc hierarchies (Zijie Huang)
  - net: openvswitch: reallocate update replies for mismatched IDs (Zhiling Zou)
  - net: fix skb length accounting after generic XDP frag adjustment (Sun Jian)
  - packet: synchronize pressure clearing with ring reconfiguration (Zihan Xi)
  - net/packet: reset the MAC header on the packet-socket transmit path (Doruk Tan Ozturk)
  - packet: use consistent hard_header_len in TX_RING send path (Qihang Tang)
  - packet: use consistent hard_header_len in non-ring send paths (Qihang Tang)
  - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Kyle Zeng)
  - ipvs: separate destination availability state (Yizhou Zhao)
  - ipvs: properly update the overload flag on dest edit (Julian Anastasov)
  - ipvs: add totalconns for dest (Julian Anastasov)
  - ipvs: stop estimator after disabled calc phase (Zhiling Zou)
  - ima: fix out-of-bounds read in xattr_verify() (Lincoln Wallace)
  - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (Lorenzo Stoakes (ARM))
  - Input: evdev - fix information leak in evdev_pass_values() (Dmitry Torokhov)
  - mm: fix incorrect flush address in direct page table reclaim (Andy Lutomirski)
  - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (Joshua Rogers)
  - vt: add permission check for KDSKBMETA ioctl (Joshua Rogers)
  - usbnet: cap max_mtu for drivers without bind callback (Laurent Vivier)
  - net: usb: ipheth: fix carrier_work UAF on disconnect (Doruk Tan Ozturk)
  - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (Yi Cong)
  - usb: gadget: f_ncm: Use unsigned int for ndp_index (Sonali Pradhan)
  - usb: cdnsp: fix incorrect endian conversions for APB timeout register (Pawel Laszczak)
  - thunderbolt: icm: Preserve USB4 proxy data-valid bit (Xu Rao)
  - usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask (Lachlan Hodges)
  - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (Aleksandr Nogikh)
  - usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg (Jiangshan Yi)
  - usb: quirks: Add ShanWan gamepad to quirk list (Ishaan Dandekar)
  - usb: core: Add quirk for 255-bytes initial config read (Nikhil Solanke)
  - ALSA: usb-audio: fix OOB write on Type II inbound URBs (Baul Lee)
  - Input: evdev - sanitize event type index when fetching event masks (Dmitry Torokhov)
  - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)
  - ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra (Takashi Iwai)
  - hwmon: (corsair-psu) serialize debugfs access against hwmon (Ali Ahmet Memis)
  - hwmon: Support guard() and scoped_guard for subsystem locks (Guenter Roeck)
  - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (Guenter Roeck)
  - hwmon: (ltc4282) Clamp negative current limits (Guenter Roeck)
  - hwmon: (ltc4282) Avoid overflow in maximum power calculation (Guenter Roeck)
  - hwmon: (ads7828) Fix external VREF regulator handling (Qingshuang Fu)
  - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (Wilken Gottwalt)
  - rqspinlock: Reset tail when preserving queue on deadlock (Kumar Kartikeya Dwivedi)
  - watchdog: at91sam9_wdt: prevent timer rearm during teardown (Hongyan Xu)
  - tls: don't abort the connection on signal-interrupted sends (Maximilian Immanuel Brandtner)
  - sctp: clear control chunk transport if it is being removed (Xin Long)
  - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (Eric Dumazet)
  - s390/ism: Fix UAF of sba and ieq during ism_dev_exit() (Alexandra Winter)
  - bnge: Fix resource leak in bnge_init_nic() error path (Bhargava Marreddy)
  - ata: pata_sl82c105: fix bridge revision use-after-free (Hongyan Xu)
  - net: thunderbolt: Tear down DMA paths before stopping the rings (Fan XinRan)
  - net: qrtr: ns: Raise lookup limit to 128 (Łukasz Patron)
  - net/smc: fix TOCTOU race between smc_listen_out() and listener close (Sidraya Jayagond)
  - net: remove WARN_ON_ONCE() from sk_mc_loop() (Eric Dumazet)
  - net: prestera: validate firmware header length (Pengpeng Hou)
  - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (Henry Martin)
  - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (Eric Dumazet)
  - tcp: fix TFO max_qlen accounting across reuseport migration (Jiayuan Chen)
  - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie (Luxiao Xu)
  - sctp: fix addip_serial increment on ASCONF_ACK allocation failure (Qing Luo)
  - bnxt_en: Fix PTP PPS setting bug (Keegan Freyhof)
  - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (Michael Chan)
  - bnxt_en: Refresh VNIC default ring on queue restart if needed (Shravya KN)
  - bnxt_en: Determine and store default RX ring in vnic structure (Shravya KN)
  - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() (Shravya KN)
  - net/mlx5e: fix BQL reset on SQ re-activation (Bobby Eshleman)
  - bnge: use int for bnge_fix_rings_count() return value (Alok Tiwari)
  - net: stmmac: resume PHY before hardware setup when opening the interface (Stefan Agner)
  - selftests/ftrace: refactor eprobes test to fix argument checks (Martin Kaiser)
  - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (Guenter Roeck)
  - hwmon: (nzxt-smart2) Check return value of init_device() in probe (Qingshuang Fu)
  - drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs (Marcin Bernatowicz)
  - drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() (Michał Winiarski)
  - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (Jamal Hadi Salim)
  - net/openvswitch: check Ethernet header length in key_extract() (Cen Zhang (Microsoft))
  - vhost-scsi: reject feature changes after endpoint (Jia Jia)
  - vhost-scsi: Validate T10 PI scatterlist counts (Linfeng Sun)
  - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (Toke Høiland-Jørgensen)
  - udp: fix potential use-after-free in tunnel segmentation (Xuanqiang Luo)
  - bnge: Fix NULL pointer dereference in aux device release (Alok Tiwari)
  - xsk: validate metadata when processing requests (Stanislav Fomichev)
  - xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h (Stanislav Fomichev)
  - xsk: validate launch-time metadata size (Stanislav Fomichev)
  - xsk: clear metadata pointer when no timestamp is requested (Stanislav Fomichev)
  - xsk: pass TX metadata pointer by reference (Stanislav Fomichev)
  - xsk: require at least 16 bytes of TX metadata (Stanislav Fomichev)
  - bnxt: fix memory leak in bnxt_queue_mem_alloc error cases (Will Chen)
  - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() (Nathan Gao)
  - hwmon: (pmbus) Fix type confusion in notification logic (Guenter Roeck)
  - hwmon: (pmbus/core) Avoid race condition during probe (Guenter Roeck)
  - vdpa/mlx5: Fix buffer length in create_direct_keys() (Christian Borntraeger)
  - vhost/vdpa: reject overflowing PA map page counts on 32-bit (Yousef Alhouseen)
  - vhost_iotlb: bound map allocation in add_range (Linfeng Sun )
  - ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED (Rong Zhang)
  - ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN (Rong Zhang)
  - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() (Jose Fernandez (Anthropic))
  - counter: microchip-tcb-capture: Fix DT channel validation (Babanpreet Singh)
  - bpf: Fix netns reference imbalance in conntrack kfuncs (Chengfeng Ye)
  - accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() (Lizhi Hou)
  - net/mlx5: fw_tracer, return NULL on create error (Michael Guralnik)
  - devlink: fix net namespace reference leak in reload (Or Har-Toov)
  - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete (Jiawen Liu)
  - net/sched: cls_route: fix fastmap use-after-free on filter (Jamal Hadi Salim)
  - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (Mahanta Jambigi)
  - bpf: Propagate untrusted pointer state in commuted arithmetic (Yiyang Chen)
  - bpf: Preserve pointer state for commuted arithmetic (Yiyang Chen)
  - accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() (Lizhi Hou)
  - btrfs: initialize inode mapping flags for cached inodes (Qu Wenruo)
  - btrfs: fix memory leak in btrfs_do_encoded_write() (Dmitry Antipov)
  - btrfs: lzo: reject inline extents without valid headers (David Lee)
  - btrfs: lzo: add error message for invalid headers (Qu Wenruo)
  - watchdog: bd96801_wdt: Fix timeout for enabled WDG (Matti Vaittinen)
  - ipvs: return the csum validation for forward hook (Julian Anastasov)
  - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp (Julian Anastasov)
  - netfilter: ipset: switch ext_size to atomic64_t (Jozsef Kadlecsik)
  - pds_core: cancel pending PCI reset work on AER recovery (Nikhil P. Rao)
  - pds_core: keep the health thread stopped during reset (Nikhil P. Rao)
  - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (Shay Drory)
  - enic: fix tx_hang_reset use-after-free on device removal (Satish Kharat)
  - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (Xiang Mei (Microsoft))
  - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" (Fan Ye)
  - net: hns3: fix speed configuration residue after driver reload (Jijie Shao)
  - drm/bridge: ps8640: propagate AUX transfer register errors (Pengpeng Hou)
  - ovpn: fix incorrect use of rcu_access_pointer() (Qingfang Deng)
  - ovpn: ensure TCP vars are initialized first (Antonio Quartulli)
  - ovpn: disable IPv4 redirects on MP interfaces (Antonio Quartulli)
  - ovpn: hash floated peer by transport identity only (Antonio Quartulli)
  - ovpn: zero-initialize sockaddr before learning a floated endpoint (Antonio Quartulli)
  - ovpn: ensure socket is owned by ovpn before deref sk_user_data (Antonio Quartulli)
  - ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET (Antonio Quartulli)
  - ovpn: skip rehash for peers already removed from by_id (Antonio Quartulli)
  - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt (Rosen Penev)
  - ovpn: add missing rtnl_link_ops->get_size callback (Ralf Lici)
  - pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function (Hans Ulli Kroll)
  - pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function (Hans Ulli Kroll)
  - selftests/sched_ext: Handle sleeping task affinity changes in numa test (Kuba Piecuch)
  - ARM: npcm: Fix OF node refcount leaks in SMP setup (Yuho Choi)
  - xfs: handle NULL b_addr in xfs_buf_free (Yun Zhou)
  - soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read (Karthikeyan KS)
  - arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer (Daniel Drake)
  - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails (Anna Schumaker)
  - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (Anna Schumaker)
  - sched_ext: Don't enable non-ext tasks in the sub-sched task loops (Tejun Heo)
  - sched_ext: Skip sub-disable teardown for never-linked sub-schedulers (Tejun Heo)
  - sched_ext: Reject setting disallow from init_task outside the enable path (Tejun Heo)
  - arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle (Dmitry Baryshkov)
  - arm64: dts: qcom: sm8650: Fix IPA IMEM slice (Alexander Koskovich)
  - arm64: dts: qcom: monaco: Add default GIC address cells (Krzysztof Kozlowski)
  - arm64: dts: qcom: purwa: Fix GPU IOMMU property (Akhil P Oommen)
  - arm64: dts: qcom: glymur: fix QUP serial engine IRQs (Bjorn Andersson)
  - arm64: dts: qcom: glymur: fix PCIe SMMU interrupts (Bjorn Andersson)
  - drm/amd/display: Check for tg ops in dce110_set_avmute (Ray Wu)
  - drm/amd/display: Add AV mute wait frames to dce110_set_avmute (Ray Wu)
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Mark Tomlinson)
  - selftests/bpf: Add tests for sleepable tracepoint programs (Mykyta Yatsenko)
  - selftests/bpf: Fail unbound UDP on sockmap update (Michal Luczaj)
  - mount: honour SB_NOUSER in the new mount API (Al Viro)


author: LUCI Bot <rhythm.m.mahajan@oracle.com> [7.1.10-1.el9uek]
changelog:
  - uek-next: Updating to upstream v7.1.10 (LUCI Bot)   
  - Linux 7.1.10 (Greg Kroah-Hartman)   
  - ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (Ajrat Makhmutov)   
  - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms (Gao Xiang)   
  - spi: virtio: mark device ready before registering the controller (Jasper Wise)   
  - drm/log: Fix infinite loop when scale is too large for display (Shixiong Ou)   
  - drm/log: Fix out-of-bounds read on empty message length (Shixiong Ou)   
  - drm/log: Fix division by zero when scale module parameter is 0 (Shixiong Ou)   
  - drm/xe: Fix a bug in pc_adjust_freq_bounds() (Vinay Belgaumkar)   
  - drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI (Nareshkumar Gollakoti)   
  - drm/xe/oa: Check managed mutex initialization errors (Linmao Li)   
  - drm/xe/oa: Fix sync entry leak on OA config emit failure (Linmao Li)   
  - drm/xe/pxp: add termination on resume (Daniele Ceraolo Spurio)   
  - firewire: ohci: fix NULL pointer dereference in ar_context_release (Aleksandr Nogikh)   
  - l2tp: fix tunnel and session refcount leak on seq_file release (Eric Dumazet)   
  - net/sched: cls_bpf: reject dev-bound programs bound to a different device (Jamal Hadi Salim)   
  - accel/amdxdna: Skip unmapped range in aie2_populate_range() (Lizhi Hou)   
  - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (Siddharth Vadapalli)   
  - regmap: sdw-mbq: don't call an unset readable_reg callback (Andrey Golovko)   
  - m68k: Define NR_CPUS to 1 (Uwe Kleine-König)   
  - pid: reject allocations through dead ancestor pid namespaces (Jérémy Jean)   
  - net/sched: cls_u32: skip hash tables in u32_bind_class() (Zhang Changzhong)   
  - net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain (Jamal Hadi Salim)   
  - af_packet: Don't send zero-byte data in tpacket_snd(). (Eric Dumazet)   
  - regmap: sdw-mbq: Fix swap of timeout and retry times (Charles Keepax)   
  - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (Rosen Penev)   
  - net/tls: Fail tls_sw_splice_read() after a failed async decrypt (Chuck Lever)   
  - net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling (Jiawen Wu)   
  - net: tap: fix wrong transport_header when sending VLAN-tagged frame (Wei Fang)   
  - net: packet: fix wrong transport_header when sending VLAN-tagged frame (Wei Fang)   
  - net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path (Oleksij Rempel)   
  - tcp: fix icsk_ack.ato bitfield overflow (Jiayuan Chen)   
  - veth: fix queue index used to wake the peer txq in veth_poll (Jonas Köppeler)   
  - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Eric Dumazet)   
  - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Eric Dumazet)   
  - eth: bnxt: avoid deadlock when canceling IRQ affinity notifier (Jakub Kicinski)   
  - eth: bnxt: decrease indent in bnxt_request_irq() (Jakub Kicinski)   
  - eth: bnxt: keep the aRFS rmap updated when TPH is enabled (Jakub Kicinski)   
  - eth: bnxt: cancel IRQ notifier before freeing affinity mask (Jakub Kicinski)   
  - netfilter: ipset: let destroy callbacks adjust ext mem size (Florian Westphal)   
  - netfilter: ipset: fix list type element drift bug (Florian Westphal)   
  - netfilter: flowtable: publish GC-visible tuple last (Jérémy Jean)   
  - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (Alexey Velichayshiy)   
  - ipvs: revalidate ihl to prevent out-of-bounds access (Julian Anastasov)   
  - netfilter: ipset: fix refcount race between list:set GC and swap (Xiang Mei (Microsoft))   
  - tick: Include ktime.h and jiffies.h in linux/tick.h (Karl Mehltretter)   
  - ASoC: tas2781: fix clang build error for goto bypassing cleanup variable (Shenghao Ding)   
  - gpio: ml-ioh: share the register lock across channels (Junjie Cao)   
  - rseq: Prevent hard lockup on granted time slice extension (Niels Pressel)   
  - ovpn: defer key slot crypto freeing to workqueue (Ralf Lici)   
  - ovpn: run deferred work on a module-owned workqueue (Ralf Lici)   
  - riscv: lib: Fix ZBB strnlen reading past count boundary (Michael Neuling)   
  - ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5 (Takashi Iwai)   
  - sctp: validate cookie AUTH state before use (Jérémy Jean)   
  - perf: Reject exited events as group leaders (Kyle Zeng)   
  - scsi: core: pair EH runtime PM get and put (Hongjie Fang)   
  - riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions (Pu Lehui)   
  - ovpn: finish crypto callback cleanup before peer release (Ralf Lici)   
  - ovpn: fix NULL dereference when killing missing key (Ralf Lici)   
  - af_unix: Unlink scc_entry in unix_del_edge(). (Kuniyuki Iwashima)   
  - regulator: fp9931: Fix VPOS/VNEG voltage selector table (Robby Cai)   
  - gpiolib: Check gc->get_direction() before calling gpiod_get_direction() (Christophe Leroy (CS GROUP))   
  - rhashtable: fix false-positive lockdep splat on rhltable destruction (Florian Westphal)   
  - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (Vladislav Dronov)   
  - crypto: ccm - Set rfc4309 maxauthsize from child (Herbert Xu)   
  - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 (Jon Hunter)   
  - clk: spacemit: k3: set hdma clock as critical (Yixun Lan)   
  - clk: spacemit: k3: fix USB2 bus clock (Yixun Lan)   
  - optee: ffa: Add NULL check in optee_ffa_lend_protmem (Mostafa Saleh)   
  - clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK (Krzysztof Kozlowski)   
  - ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup (Peter Ujfalusi)   
  - net: expect instance lock in netdev_queue_get_dma_dev() (Jakub Kicinski)   
  - net: rename netdev_ops_assert_locked() (Jakub Kicinski)   
  - drm/amdkfd: Add bounds check for CRAT subtype length (William Palacek)   
  - drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable (AngeloGioacchino Del Regno)   
  - drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_dsi.c (Abhishek Rajput)   
  - ASoC: tas2562: Validate values for volume writes (Mark Brown)   
  - ceph: fix hanging __ceph_get_caps() with stale mds_wanted (Max Kellermann)   
  - ceph: avoid fs reclaim while using current->journal_info (Max Kellermann)   
  - xfs: check v5 superblock features early (Christoph Hellwig)   
  - xfs: check xfarray iteration errors when committing unlinked inode lists (Darrick J. Wong)   
  - xfs: don't ignore runtime errors in xrep_iunlink_reload_next (Darrick J. Wong)   
  - xfs: don't swallow dquot recovery verification errors (Long Li)   
  - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lin Jiapeng)   
  - xfs: avoid UAF on sc->tempip in xrep_tempfile_create (Darrick J. Wong)   
  - xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers (Darrick J. Wong)   
  - xfs: fix another iunlink infinite loop bug in online fsck (Darrick J. Wong)   
  - xfs: fix allocated inodes that show up in the unlinked list (Darrick J. Wong)   
  - xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair (Darrick J. Wong)   
  - xfs: don't zap the attr fork on repair when there are queued pptr updates (Darrick J. Wong)   
  - xfs: fix ilock leak on error in xfs_dq_get_next_id (Long Li)   
  - xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev (Darrick J. Wong)   
  - xfs: nlink scrub must take IOLOCK before determining ILOCK state (Darrick J. Wong)   
  - xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers (Darrick J. Wong)   
  - xfs: set the prev pointer when reinserting an inode on the unlinked list (Darrick J. Wong)   
  - xfs: don't double-lock when deleting a self-referential directory (Darrick J. Wong)   
  - xfs: only check mergeability of bnobt records (Darrick J. Wong)   
  - xfs: zero i_nlink before repair puts inode on unlinked list (Darrick J. Wong)   
  - xfs: fix transaction block reservation in xrep_rtbitmap (Darrick J. Wong)   
  - xfs: check cowextsize in xrep_inode_cowextsize (Darrick J. Wong)   
  - xfs: clear zapped attr fork state when bmap repair finds no attr fork (Qiang Ma)   
  - xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems (Darrick J. Wong)   
  - xfs: bounds-check buffer log item's dirty bitmap (Ibrahim Hashimov)   
  - xfs: fix off-by-one in rtrefcount btree root level validation (Xiang Mei)   
  - xfs: propagate errors from xfs_rtginode_load (Guanghui Yang)   
  - drm/amdgpu: disallow multiple FENCE chunks in one submit (Junrui Luo)   
  - drm/amdgpu: Fix UVD decode image min size calculation (David Rosca)   
  - drm/amdgpu: Fix UVD dpb min size calculation for H264 (David Rosca)   
  - drm/amdgpu: Fix UVD min buffer sizes (David Rosca)   
  - drm/amdgpu: Implement insert_end for VCE 3 (David Rosca)   
  - drm/amdgpu: Reject UVD message with dimensions above 4096 (David Rosca)   
  - drm/amdgpu: validate GEM_CREATE domain combinations (Candice Li)   
  - drm/amdgpu: check ASPM on the dGPU host link (Yang Wang)   
  - drm/amdgpu: fix missing check in vm_flush() (Alex Deucher)   
  - drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (Yang Wang)   
  - drm/amdgpu: Prefer default discovery offset (Lijo Lazar)   
  - drm/amdgpu: Reject UVD message with invalid number of h265 refs (David Rosca)   
  - drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (Nathan Lucas)   
  - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (Nathan Lucas)   
  - drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (Samuel Pitoiset)   
  - s390/zcrypt: Pad trailing CCA or EP11 message with zeros (Harald Freudenberger)   
  - s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing (Harald Freudenberger)   
  - s390/zcrypt: Improve EP11 CPRB length and overflow checks (Harald Freudenberger)   
  - s390/zcrypt: Improve CCA CPRB length and overflow checks (Harald Freudenberger)   
  - s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code (Harald Freudenberger)   
  - s390/vfio_ccw: Implement a crw lock (Eric Farman)   
  - s390/vfio_ccw: Calculate idal length based on idaw type (Eric Farman)   
  - s390/vfio_ccw: Selectively expand io_mutex (Eric Farman)   
  - s390/vfio_ccw: Move cp cleanup out of not operational (Eric Farman)   
  - s390/vfio_ccw: Fix out of bounds check on CCW array (Eric Farman)   
  - s390/vfio_ccw: Ensure first IDAW remains constant (Eric Farman)   
  - s390/vfio_ccw: Ensure index for read/write regions are within range (Eric Farman)   
  - s390/vfio_ccw: Cancel existing workqueues (Eric Farman)   
  - s390/vfio_ccw: Limit the number of channel program segments (Eric Farman)   
  - s390/vfio_ccw: Free all memory if cp_init() fails (Eric Farman)   
  - drm/radeon: fix autosuspend cleanup during teardown (Guangshuo Li)   
  - drm/xe/guc_ads: use uncached mapping for UM queue BO (Jia Yao)   
  - drm/xe/guc_ads: allocate UM queues in VRAM on dGFX (Jia Yao)   
  - drm/xe/guc_ads: allocate UM queues in a separate BO (Jia Yao)   
  - drm/xe: Fix xe_device_probe() failure (Raag Jadav)   
  - drm/xe: Order ring writes before ring tail updates (Matthew Brost)   
  - riscv: hwprobe: Register unaligned probes before usermode (Rui Qi)   
  - pmdomain: mediatek: Fix mt8183 hang on boot (Dmitry Osipenko)   
  - mmc: loongson2: Fix sg iteration in data reorder functions (Binbin Zhou)   
  - drm/connector/hdmi: Fix out of bounds memory read (John Harrison)   
  - mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (Pei Xiao)   
  - pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE (AngeloGioacchino Del Regno)   
  - mmc: sdhci: make tuning_err a signed int (Haibo Chen)   
  - pmdomain: mediatek: fix remaining %pOF after of_node_put() (Guangshuo Li)   
  - mmc: sdhci: unmap the bounce buffer before device release (Myeonghun Pak)   
  - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (Zhan Xusheng)   
  - libceph: tolerate addrvecs with multiple entries of the same type (Kefu Chai)   
  - libceph: fix OOB read in decode_watchers() via missing bounds check (Pavitra Jha)   
  - ceph: fix MDS random selection readiness predicate (Yiming Zhu)   
  - libceph: Avoid using invalid osd indices from primary_temp (Raphael Zimmer)   
  - Input: sur40 - fix V4L error path cleanup (Dmitry Torokhov)   
  - Input: sur40 - fix input device registration ordering (Dmitry Torokhov)   
  - openrisc: signal: do not restore privileged SR bits on sigreturn (Ali Ahmet Memis)   
  - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() (Josh Poimboeuf)   
  - ftrace: Protect direct_functions in update_ftrace_direct_mod (Leon Hwang)   
  - ftrace: Protect direct_functions in update_ftrace_direct_del (Leon Hwang)   
  - ftrace: Protect direct_functions in ftrace_find_rec_direct (Leon Hwang)   
  - pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() (Karl Mehltretter)   
  - libceph: fix multiple unsafe decodes in decode_locker() (Pavitra Jha)   
  - pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 (Praveen Talari)   
  - pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza (Abel Vesa)   
  - gpio: ml-ioh: use raw_spinlock_t for the register lock (Junjie Cao)   
  - gve: fix zero-length skb frag with header-split (Jordan Rhee)   
  - selftests/ftrace: Convert ELF entry point to file offset in uprobe test (Rui Qi)   
  - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (Cengiz Can)   
  - gve: fix NULL dereference due to missing ptp adjfine (Jordan Rhee)   
  - crypto: qce - fix error path in devm_qce_register_algs (Thorsten Blum)   
  - crypto: starfive - use scatterlist length before DMA mapping (Thorsten Blum)   
  - Input: hynitron_cstxxx - validate touch count and finger IDs (Jianing Li)   
  - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (Dmitry Torokhov)   
  - Input: synaptics-rmi4 - block s_input when F54 queue is busy (Dmitry Torokhov)   
  - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (Bryam Vargas)   
  - Input: synaptics-rmi4 - zero report size on F54 work error (Dmitry Torokhov)   
  - powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (George Wilson)   
  - powerpc/pseries: lparcfg - fix kbuf[] underflow (George Wilson)   
  - Input: byd - synchronize timer deletion before freeing private data (Linmao Li)   
  - Input: iforce - validate input packet lengths (Pengpeng Hou)   
  - Input: atkbd - skip deactivate for HONOR ZQC-P (Donglin Lyu)   
  - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (Zhefu Zhang)   
  - Input: psxpad-spi - set driver data before use (Linmao Li)   
  - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (Richard Davies)   
  - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (Dmitry Torokhov)   
  - powerpc/pseries: pci - logic bug (George Wilson)   
  - Input: cs40l50-vibra - validate custom data from user space (HyeongJun An)   
  - Input: xpad - add support for ZENAIM LEVERLESS (Kyohei Kadota)   
  - ASoC: SOF: topology: Use acpi mach from the machine driver (Bard Liao)   
  - drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush (Alex Deucher)   
  - drm/amdgpu/gmc12.1: implement tlb inv semaphore (Alex Deucher)   
  - drm/amdgpu: fix aperture iounmap skipped on device removal (Asad Kamal)   
  - drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode (Jesse Zhang)   
  - drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode (Jesse Zhang)   
  - drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode (Jesse Zhang)   
  - drm/amdgpu: Use virtual alloc during coredump (Lijo Lazar)   
  - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (Wang Jiang)   
  - drm/amd: Disable DP audio spread spectrum for Cyan Skillfish (Travis K. Bangs)   
  - drm/amdgpu/userq: serialize queue map against GPU reset (Jesse Zhang)   
  - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (Qiang Yu)   
  - drm/amdgpu: reject oversized IBs with per-ring packet limits (Candice Li)   
  - drm/panthor: skip zero-sized firmware sections (Osama Abdelkader)   
  - fbdev: core: Fix pointer desynchronization in fb_io_read() (Mingyu Wang)   
  - fbdev: clear fb_info->mode before deleting a videomode (Melbin K Mathew)   
  - fbdev: bound mode sysfs output to the sysfs buffer (Melbin K Mathew)   
  - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (Dawid Wróbel)   
  - ASoC: cs35l41: sort the register default table (Peter Ujfalusi)   
  - ASoC: cs35l45: sort the register default table (Peter Ujfalusi)   
  - ASoC: cs4265: sort the register default table (Peter Ujfalusi)   
  - ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout (Peter Ujfalusi)   
  - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (Peter Ujfalusi)   
  - drm/shmem_helper: Check VMA boundaries for PMD mappings (Christian A. Ehrhardt)   
  - ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (Dawid Wróbel)   
  - microblaze: restore the page alignment of swapper_pg_dir (Ramin Moussavi)   
  - s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Hidayath Khan)   
  - mptcp: fastopen: only mark MPTFO subflows with SYN data (Wyatt Feng)   
  - mptcp: pm: fix data race in add_addr timer callback (Qing Luo)   
  - mptcp: options: reset DSS fields in case of unexpected size (Matthieu Baerts (NGI0))   
  - mptcp: avoid combining some incoming suboptions (Matthieu Baerts (NGI0))   
  - selftests: mptcp: join: mark tests with data corruption as failed (Gang Yan)   
  - mptcp: reclaim forward-allocated memory on RX path errors (Paolo Abeni)   
  - selinux: reject a permission value exceeding the class permission count (Bryam Vargas)   
  - selinux: reject an unclaimed class value in security_get_classes() (Bryam Vargas)   
  - selinux: do not cancel a policy conversion that never started (Bryam Vargas)   
  - selinux: reject a class permission count below its inherited common (Bryam Vargas)   
  - selinux: require every boolean value to be defined (Bryam Vargas)   
  - block: stop the timeout timer when releasing a never added disk (Chao Shi)


author: Mark Nicholson <mark.j.nicholson@oracle.com> [7.1.8-0.el9uek]
changelog:
  - uek-next: Updating to upstream v7.1.8 (Mark Nicholson)   
  - Linux 7.1.8 (Greg Kroah-Hartman)   
  - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path (Andrei Kuchynski)   
  - drm/amd/display: Exit idle optimizations before programming (Leo Li)   
  - drm/amd/display: check GRPH_FLIP status before sending event (Leo Li)   
  - media: chips-media: wave5: Support CBP profile (Jackson Lee)   
  - drm/xe: Wait on external BO kernel fences in exec IOCTL (Matthew Brost)   
  - drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] (Thomas Hellström)   
  - drm/xe: Set TTM device beneficial_order to 9 (2M) (Matthew Brost)   
  - drm/xe: Separate early xe_device initialization (Michal Wajdeczko)   
  - drm/xe: Move xe->info.devid|revid initialization (Michal Wajdeczko)   
  - drm/xe: Move xe->info.force_execlist initialization (Michal Wajdeczko)   
  - drm/xe: Drop unused param from xe_device_create() (Michal Wajdeczko)   
  - usb: typec: ucsi: Fix race condition and ordering in port unregistration (Andrei Kuchynski)   
  - usb: typec: ucsi: split connector lock classes (Sergey Senozhatsky)   
  - drm/xe/rtp: Ensure locking/ref counting for OA whitelists (Ashutosh Dixit)   
  - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release (Ashutosh Dixit)   
  - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt (Ashutosh Dixit)   
  - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs (Ashutosh Dixit)   
  - drm/xe/rtp: Save OA nonpriv registers to register save/restore lists (Ashutosh Dixit)   
  - drm/xe/rtp: Generalize whitelist_apply_to_hwe (Ashutosh Dixit)   
  - drm/xe/rtp: Keep track of non-OA nonpriv slots (Ashutosh Dixit)   
  - drm/xe/rtp: Maintain OA whitelists separately (Ashutosh Dixit)   
  - drm/vmwgfx: validate external BO copy bounds for both stride paths (Zack Rusin)   
  - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Zack Rusin)   
  - drm/vmwgfx: enforce cursor size limits for MOB cursors (Zack Rusin)   
  - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (Zack Rusin)   
  - drm/vmwgfx: bound DMA command body size against suffix pointer (Zack Rusin)   
  - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (Zack Rusin)   
  - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin)   
  - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down (Zack Rusin)   
  - drm/vmwgfx: clamp dirty-page range with min, not max (Zack Rusin)   
  - drm/vmwgfx: reject DX_BIND_QUERY without a DX context (Zack Rusin)   
  - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (Zack Rusin)   
  - drm/amdkfd: hold event_mutex while checkpointing CRIU events (William Palacek)   
  - drm/amdkfd: Handle invalid event type in CRIU event restore (David Francis)   
  - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (William Palacek)   
  - drm/amdkfd: fix QID bit leak in pqm_create_queue() (Vladimir Marioukhine)   
  - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (Gang Ba)   
  - drm/amd/display: use proper context for logging (Jiri Slaby (SUSE))   
  - drm/amd/display: Silence link_dpms I2C retimer failures (Alan Swanson)   
  - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (Ray Wu)   
  - drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (George Zhang)   
  - drm/amd/display: check if dml21_add_phantom_plane() is successful (Alex Deucher)   
  - drm/amd/pm: use milliwatts for GPU power sensors (Yang Wang)   
  - drm/amd/pm: hide pp_table sysfs on APUs (Yang Wang)   
  - drm/amd/pm: fix pptable use-after-free (Yang Wang)   
  - drm/amd/pm: fix torn gpu metrics reads (Yang Wang)   
  - drm/amdgpu: cap GTT size to physical RAM on APUs (Harkirat Gill)   
  - drm/amdgpu: restore UMD profile pstate after runtime resume (Candice Li)   
  - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (Pierre-Eric Pelloux-Prayer)   
  - drm/mediatek: ovl_adaptor: balance component registrations (Myeonghun Pak)   
  - drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2 (Guangshuo Li)   
  - drm/panthor: validate firmware interface structure sizes (Osama Abdelkader)   
  - drm/panthor: reject firmware sections with oversized data (Osama Abdelkader)   
  - drm/bridge: display-connector: Fix I2C adapter resource leak (Laurent Pinchart)   
  - drm/vc4: Zero the tile state data array before each BIN job (Maíra Canal)   
  - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (Jose Maria Casanova Crespo)   
  - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (Alexander Kaplan)   
  - can: ctucanfd: mark error-active controller status valid (Avi Weiss)   
  - can: ctucanfd: handle bus error interrupts (Avi Weiss)   
  - can: ctucanfd: unmap BAR0 using base address (Avi Weiss)   
  - can: ctucanfd: use self-test mode for PRESUME_ACK (Avi Weiss)   
  - can: ctucanfd: add missing MODULE_DEVICE_TABLE() (Pengpeng Hou)   
  - can: peak_usb: validate uCAN receive record lengths (Pengpeng Hou)   
  - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (Maoyi Xie)   
  - can: peak_usb: add bounds check for USB channel index (James Gao)   
  - can: softing: fw_parse(): validate firmware record spans (Pengpeng Hou)   
  - can: rcar_canfd: change the initializing flow for clocks and resets (Tu Nguyen)   
  - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (Pengpeng Hou)   
  - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (Abdun Nihaal)   
  - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (Tetsuo Handa)   
  - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (Oleksij Rempel)   
  - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering (Oliver Hartkopp)   
  - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (Marc Kleine-Budde)   
  - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (Guangshuo Li)   
  - can: ems_usb: validate CPC message lengths (Pengpeng Hou)   
  - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (Lucas Martins Alves)   
  - i2c: imx: Cancel hrtimer before clearing slave pointer (Liem)   
  - i2c: imx: Fix slave registration race and error handling (Liem)   
  - i2c: imx: mark I2C adapter when hardware is powered down (Carlos Song)   
  - i2c: iproc: reset bus after timeout if START_BUSY is stuck (Jonas Gorski)   
  - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (H. Nikolaus Schaller)   
  - i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers (Wenmeng Liu)   
  - i2c: spacemit: request IRQ after controller initialization (Linmao Li)   
  - ice: fix memory leak in ice_lbtest_prepare_rings() (Dawei Feng)   
  - ice: fix VF interrupts cleanup (Dawid Osuchowski)   
  - ice: wait for reset completion in ice_resume() (Aaron Ma)   
  - net: openvswitch: fix skb leak on flow key update failure during ct (Ilya Maximets)   
  - net: openvswitch: fix skb leak on flow key update failure during recirculation (Ilya Maximets)   
  - net: openvswitch: fix potential UAF on meter attach failure (Ilya Maximets)   
  - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (Nava kishore Manne)   
  - phy: zynqmp: use read-modify-write for SERDES scrambler bypass (Nava kishore Manne)   
  - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (Nava kishore Manne)   
  - s390/zcrypt: Validate length for CCA ECC private key requests (Holger Dengler)   
  - s390/zcrypt: Validate length for CCA AES cipher key requests (Holger Dengler)   
  - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() (Harald Freudenberger)   
  - s390/zcrypt: Fix buffer over-read in cca_cipher2protkey (Harald Freudenberger)   
  - s390/zcrypt: Close speculative mem read possibility (Harald Freudenberger)   
  - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (Harald Freudenberger)   
  - s390/dasd: Fix undersized format-check buffer (Stefan Haberland)   
  - s390/dasd: Fix potential NULL pointer dereference (Jan Höppner)   
  - s390/qeth: Check CAP_NET_ADMIN for private ioctls (Aswin Karuvally)   
  - s390/pci: Fix s390_pci_mmio_write syscall error return without MIO (Niklas Schnelle)   
  - power: supply: max17040: handle missing status supplier (Jianing Li)   
  - power: supply: macsmc: Support macOS 27 SMC firmware (Sasha Finkelstein)   
  - power: supply: bq25890: fix the -10 C NTC lookup entry (Xu Rao)   
  - cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized (Zhongqiu Han)   
  - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() (Abdun Nihaal)   
  - cpufreq: cppc: Sanitize lockless policy limit snapshots (Christian Loehle)   
  - cifs: add fscache_resize_cookie() to cifs_setsize() (Frank Sorenson)   
  - gpio: pch: use raw_spinlock_t for the register lock (Junjie Cao)   
  - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (bui duc phuc)   
  - gpiolib: tolerate gpio-hogs lacking a hogging state (Daniel Golle)   
  - i2c: amd-mp2: Unregister callback on adapter add failure (Myeonghun Pak)   
  - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (Vincent Jardin)   
  - hwmon: (npcm750-pwm-fan): stop fan timer on device detach (Hongyan Xu)   
  - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada)   
  - sctp: reject stale cookies with mismatched verification tags (Yuxiang Yang)   
  - scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc (Shawn Guo)   
  - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (Ibrahim Hashimov)   
  - scsi: libsas: terminate deferred commands on time out (Damien Le Moal)   
  - selftests/clone3: fix wild pointer access of getline due to missing init (Chris Gellermann)   
  - selftests/mm: fix potential wild pointer access of getline due to missing init (Chris Gellermann)   
  - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (Vijaya Krishna Nivarthi)   
  - spi: spi-qpic-snand: write the feature value before executing SET_FEATURE (Stanislaw Pal)   
  - tracing/filters: Fix false positive match in regex_match_full() (Masami Hiramatsu (Google))   
  - tracing: Check return value of __register_event() in trace_module_add_events() (Masami Hiramatsu (Google))   
  - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (Ming Lei)   
  - vxlan: use pskb_network_may_pull() in route_shortcircuit() (Eric Dumazet)   
  - vxlan: use pskb_network_may_pull() for transmit path header pulls (Eric Dumazet)   
  - vxlan: use neigh_ha_snapshot() in route_shortcircuit() (Eric Dumazet)   
  - vxlan: unclone skb head before modifying eth header in route_shortcircuit() (Eric Dumazet)   
  - vxlan: re-fetch eth header after route_shortcircuit() (Eric Dumazet)   
  - veth: convert frag_list skbs before running XDP (Matt Fleming)   
  - uprobes: Fix NULL pointer dereference in hprobe_expire() (Breno Leitao)   
  - um: vector: fix use-after-free in vector_mmsg_rx() (Michael Bommarito)   
  - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() (Thorsten Blum)   
  - riscv/mm: use physical alignment for vmemmap_start_pfn (Jiakai Xu)   
  - net: pktgen: fix proc entry use-after-free (Chengfeng Ye)   
  - net: ipv6: clear suppressed fib6 rule result (Zhiling Zou)   
  - net: bridge: stop fast-leave after deleting a port group (Zhiling Zou)   
  - mm: memcg: initialize *locked in memcg1_oom_prepare() stub (Breno Leitao)   
  - mm/page_reporting: use system_freezable_wq to fix UAF during suspend (Link Lin)   
  - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (Kiryl Shutsemau (Meta))   
  - io_uring: preserve task restrictions across exec (Kyumin Lee)   
  - io_uring/net: initialize mshot_len for send (Jens Axboe)   
  - binfmt_misc: don't leak the user namespace when the mount fails (Christian Brauner)   
  - binfmt_misc: don't let an 'F' entry pin its own instance (Christian Brauner)   
  - binfmt_misc: reject a flag character as the field delimiter (Christian Brauner)   
  - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (Christian Brauner)   
  - binfmt_misc: restore write access when removing an entry (Christian Brauner)   
  - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (Zhao Li)   
  - wifi: mac80211: fix tid_tx use-after-free on BA session stop (Zhao Li)   
  - x86/CPU/AMD: Carve out a Zen5 models range (Pratik Vishwakarma)   
  - tipc: avoid use-after-free in poll trace queue dumps (Zihan Xi)   
  - PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug (Soeren Moch)   
  - of/address: Fix NULL bus dereference in of_pci_range_parser_one() (Carlo Caione)   
  - netfilter: ipset: do not update comments from kernel-side hash adds (David Lee)   
  - net/smc: fix socket use-after-free during link group termination (Xuanqiang Luo)   
  - mshv: fix hv_input_get_system_property struct (Wei Liu)   
  - ksmbd: reject repeated SMB2 NEGOTIATE requests (Namjae Jeon)   
  - ipvs: do not propagate one-packet flag to synced conns (Zhiling Zou)   
  - igc: remove napi_synchronize() in igc_down() (David Carlier)   
  - igbvf: Fix leak in TX DMA error cleanup (Matt Vollrath)   
  - fou: Fix use-after-free in fou_create() (Xuanqiang Luo)   
  - e1000: fix memory leak in e1000_probe() (Dawei Feng)   
  - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (Md Sadre Alam)   
  - ALSA: usb-audio: Clamp frame size in implicit-feedback mode (Sonali Pradhan)   
  - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (Sonali Pradhan)   
  - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (Baul Lee)   
  - ALSA: usb-audio: fix stack info leak in RME Digiface status (Baul Lee)   
  - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (Baul Lee)   
  - ata: libata-scsi: schedule deferred atapi command (Damien Le Moal)   
  - ata: libata-scsi: terminate deferred commands on time out (Damien Le Moal)   
  - ata: libata-sata: fix ata_scsi_lpm_supported() iteration (Niklas Cassel)   
  - ata: libata-eh: Increase STANDBY IMMEDIATE timeout (Matt Vollrath)   
  - ASoC: tas2562: fix broken entries in the volume lookup table (Haidar Lee)   
  - ASoC: tas2562: fix DVC coefficient write order (Haidar Lee)   
  - ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return (Shengjiu Wang)   
  - ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return (Shengjiu Wang)   
  - ALSA: ump: fix double free of out_cvts on rawmidi error (Baul Lee)   
  - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (Norbert Szetei)   
  - ALSA: seq: Fix division by zero in initialize_timer() (Norbert Szetei)   
  - ALSA: pcm: wake linked drain waiters on unlink (Norbert Szetei)   
  - ALSA: lx6464es: fix period byte count for 16-bit streams (Xu Rao)   
  - ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Eckhart Mohr)   
  - ALSA: 6fire: Fix UAF at error handling during probe (Takashi Iwai)   
  - afs: Fix UAF when sending a message (David Howells)   
  - afs: Fix afs_fs_fetch_data() to subtract transferred from len (David Howells)   
  - afs: Fix afs_fs_fetch_data() to set call->async (David Howells)   
  - bpf: lwt: Fix dst reference leak on reroute failure (Xuanqiang Luo)   
  - Bluetooth: HIDP: validate numbered report payloads (Sangho Lee)   
  - Bluetooth: HIDP: reject frames without a transaction header (Sangho Lee)   
  - Bluetooth: hci_sync: Fix advertising data UAFs (Chengfeng Ye)   
  - Bluetooth: mgmt: fix UAF in pair command cancellation (Zihan Xi)   
  - Bluetooth: SCO: give the socket its own sco_conn reference (Aldo Ariel Panzardo)   
  - Bluetooth: mgmt: fix pending command UAF in EIR updates (Zihan Xi)   
  - Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() (Greg Kroah-Hartman)   
  - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (Greg Kroah-Hartman)   
  - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (Greg Kroah-Hartman)   
  - audit: fix potential use-after-free in audit_del_rule() (Luxiao Xu)   
  - audit: fix potential integer overflow in audit_log_n_string() (Zhan Xusheng)   
  - sctp: validate Adaptation Indication parameter length (Charles Vosburgh)   
  - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (Hidayath Khan)   
  - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (Farhan Ali)   
  - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (Farhan Ali)   
  - KVM: s390: pci: Fix resource leak on IRQ registration failure (Farhan Ali)   
  - KVM: s390: pci: Fix missing error codes and memory unaccounting (Farhan Ali)   
  - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (Farhan Ali)   
  - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (Farhan Ali)   
  - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Sean Christopherson)   
  - KVM: VMX: add memory clobber to asm for VMX instructions (Paolo Bonzini)   
  - tracing/fprobe: Roll back on enable_trace_fprobe() failure (Raushan Patel)   
  - tracing/probes: Reject $arg0 in meta argument expansion (Raushan Patel)   
  - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (Weiming Shi)   
  - mm/vmstat: fold stranded per-cpu node stats when a node comes online (Gregory Price)   
  - userfaultfd: wait on source PMD during UFFDIO_MOVE (Usama Arif)   
  - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Xiangfeng Cai)   
  - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() (Zi Yan)   
  - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes (Kiryl Shutsemau (Meta))   
  - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes (Kiryl Shutsemau (Meta))   
  - selftest: fix headers in fclog.c (Jori Koolstra)   
  - mm/util: don't read __page_2 for order-1 folios in snapshot_page() (Aboorva Devarajan)   
  - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (Kefeng Wang)   
  - ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset (Joseph Qi)   
  - btrfs: zoned: fix missing chunk metadata reservation (Guanghui Yang)   
  - lib: test_hmm: use device devt for coherent device range selection (Stanislav Kinsburskii)   
  - fortify: Disable -Wstringop-overread in tests (Nathan Chancellor)   
  - pinctrl: bm1880: add missing select GENERIC_PINCONF (Benjamin Boortz)   
  - erofs: cap LZMA stream pool size (Michael Bommarito)   
  - btrfs: raid56: fix scrub read assembly submitting no reads (Mykola Lysenko)   
  - pinctrl: devicetree: don't free uninitialized dev_name on error path (Karl Mehltretter)   
  - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO (Benjamin Boortz)   
  - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (Kiryl Shutsemau (Meta))   
  - mm: mglru: fix stale batch updates after memcg reparenting (Qi Zheng)   
  - ACPI: CPPC: Check all controls for fast switching (Christian Loehle)   
  - kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos (Nicolas Schier)   
  - iommu/iommufd: Fix IOPF group ownership UAF (Peiyang He)   
  - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Peiyang He)   
  - iommufd: Reject DMABUF pages from the access pin path (Peiyang He)   
  - iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Nicolin Chen)   
  - iommufd/viommu: Release the igroup lock on the vdevice_size error path (Nicolin Chen)   
  - ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path (Masami Hiramatsu (Google))   
  - mshv: Publish VP to pt_vp_array before installing the file descriptor (Stanislav Kinsburskii)   
  - mshv: Order pt_vp_array publish against irqfd assertion path (Stanislav Kinsburskii)   
  - mshv: Fix missing error code on VP allocation failure (Stanislav Kinsburskii)   
  - mshv: Fix level-triggered check on uninitialized data (Stanislav Kinsburskii)   
  - mshv: Fix race in mshv_irqfd_deassign (Stanislav Kinsburskii)   
  - iomap: add a separate bio_set for iomap_split_ioend (Christoph Hellwig)   
  - ksmbd: use memcmp() to compare ClientGUIDs (Namjae Jeon)   
  - ksmbd: fix use-after-free in __close_file_table_ids() (Namjae Jeon)   
  - ksmbd: return success for deferred final close (Namjae Jeon)   
  - drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status (Jerome Tollet)   
  - qede: sync udp_tunnel ports outside qede_lock in the recovery path (Denis V. Lunev)   
  - spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs (Haibo Chen)   
  - sched/deadline: Use revised wakeup rule only for running dl_server (Gabriele Monaco)   
  - octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)   
  - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets (Jiawen Wu)   
  - ptp: netc: fix potential interrupt storm caused by incorrect unbind order (Wei Fang)   
  - net: mana: Return error code from mana_create_rxq() (Aditya Garg)   
  - net: mana: Create separate EQs for each vPort (Long Li)   
  - net: stmmac: Fix E2E delay mechanism (Nazim Amirul)   
  - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling (Daniel Golle)   
  - net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling (Daniel Golle)   
  - net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend (Daniel Golle)   
  - riscv: vdso: Only try to install vDSO when present (Thomas Weißschuh)   
  - ipv6: release fib6_null_entry on subtree failure (Shuangpeng Bai)   
  - ring-buffer: Fix reader page read offset for remote buffers (Vincent Donnefort)   
  - riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove (Karl Mehltretter)   
  - accel/qaic: use sizeof(*trans_hdr) for transaction length check (Muhammad Bilal)   
  - riscv: drop __init from vec_check_unaligned_access_speed_all_cpus (Anirudh Srinivasan)   
  - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (Masami Hiramatsu (Google))   
  - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() (Masami Hiramatsu (Google))   
  - fprobe: Fix module reference count leak on error in register_fprobe() (Masami Hiramatsu (Google))   
  - drm/xe/pt: check no-DMA huge-pte cases before DMA segment test (Himal Prasad Ghimiray)   
  - drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder (Alexander Kaplan)   
  - can: isotp: check register_netdevice_notifier() error in module init (Minhong He)   
  - net: sxgbe: check descriptor ring allocation failures (Chenguang Zhao)   
  - net: sxgbe: free TX rings on RX allocation failure (Chenguang Zhao)   
  - scsi: ufs: core: Initialize hba->rpmbs list in ufshcd (Ao Sun)   
  - scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil)   
  - octeontx2-af: Block VFs from clobbering special CGX PKIND state (Hariprasad Kelam)   
  - octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle (Ratheesh Kannoth)   
  - scsi: target: Clear cmd_cnt when initial counter enrollment fails (Leon Romanovsky)   
  - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req (Benjamin Block)   
  - scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" (Bart Van Assche)   
  - scsi: ufs: core: Cancel RTC work in active-active suspend (Guangshuo Li)   
  - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE (TanZheng)   
  - net: phylink: put link_gpio if phylink_create fails (Christian Marangi)   
  - x86/boot: Add volatile, clobbers and zero-length test in memcmp() (Mauricio Faria de Oliveira)   
  - Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (Pauli Virtanen)   
  - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync (Pauli Virtanen)   
  - Bluetooth: hci_sync: hold conn in hci_past_sync() callback (Pauli Virtanen)   
  - Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (Pauli Virtanen)   
  - Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (Pauli Virtanen)   
  - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (Pauli Virtanen)   
  - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (Pauli Virtanen)   
  - Bluetooth: btintel: Validate length before parsing diagnostics TLV (Zijun Hu)   
  - Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (Pauli Virtanen)   
  - Bluetooth: ISO: fix refcounting of iso_conn (Pauli Virtanen)   
  - Bluetooth: ISO: ensure no dangling hcon references in iso_conn (Pauli Virtanen)   
  - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (Pauli Virtanen)   
  - Bluetooth: ISO: fix leaking sk after socket release (Pauli Virtanen)   
  - Bluetooth: ISO: hold sk properly in iso_conn_ready (Pauli Virtanen)   
  - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (Pauli Virtanen)   
  - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (Pauli Virtanen)   
  - Bluetooth: ISO: lock sk in iso_connect_ind (Pauli Virtanen)   
  - Bluetooth: ISO: lock sk in iso_sock_getname (Pauli Virtanen)   
  - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (Pauli Virtanen)   
  - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (Jiale Yao)   
  - Bluetooth: ISO: clear iso_data always when detaching conn from hcon (Pauli Virtanen)   
  - ice: suppress DPLL errors during reset recovery (Przemyslaw Korba)   
  - idpf: Fix mailbox IRQ name leak on request failure (Yuho Choi)   
  - idpf: adjust TxQ ring count minimum (Joshua Hay)   
  - idpf: bound interrupt-vector register fill to the allocated array (Michael Bommarito)   
  - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (Guenter Roeck)   
  - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (Chenguang Zhao)   
  - netfs: Fix folio_queue ENOMEM in writeback by adding a mempool (David Howells)   
  - netfs: release readahead folios on iterator preparation failure (Yichong Chen)   
  - netfs: handle single writeback rolling buffer allocation failure (Yichong Chen)   
  - netfs: clear PG_private_2 on copy-to-cache append failure (Yichong Chen)   
  - wifi: mac80211: validate individual TWT params before driver setup (Zhao Li)   
  - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() (Eric Dumazet)   
  - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (Cen Zhang (Microsoft))   
  - powerpc/boot: Fix treeboot-akebono CPU node lookup check (Thorsten Blum)   
  - powerpc/boot: Fix treeboot-currituck CPU node lookup check (Thorsten Blum)   
  - powerpc/boot: Fix simpleboot CPU node lookup check (Thorsten Blum)   
  - ethtool: Embed FEC hist ranges as buffer in struct (Eric Joyner)   
  - rtase: fix double free of multi-frag skb on DMA map failure (Yun Lu)   
  - hwmon: (adt7470) Fix PWM auto temp state array and bounds check (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Use cached PWM frequency value (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Fix cache updated before hardware write on I2C error (Luiz Angelo Daros de Luca)   
  - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (Luiz Angelo Daros de Luca)   
  - forcedeth: fix UAF of txrx_stats in nv_remove (Chenguang Zhao)   
  - ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() (Surendra Singh Chouhan)   
  - net: bridge: mrp: fix Option TLV length in MRP_Test frames (David Corvaglia)   
  - hwmon: (nct6775-core) Prevent access to unsupported weight registers (Guenter Roeck)   
  - net: do not send ICMP/NDISC Redirects when peer allocation fails (Eric Dumazet)   
  - hwmon: (nzxt-smart2) DMA-align output buffer (Guenter Roeck)   
  - hwmon: (lm90) Only report alarms if driver is ready (Guenter Roeck)   
  - hwmon: (sht3x) Fix unaligned accesses (Guenter Roeck)   
  - hwmon: (ltc4282) Fix reading the minimum alarm voltage (Guenter Roeck)   
  - hwmon: (ina2xx) Fix various overflow issues (Guenter Roeck)   
  - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (Guenter Roeck)   
  - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (Srikanth Boyapally)   
  - ASoC: tas2781: Use correct calibration data for SINEGAIN2 register (wangdicheng)   
  - wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() (Baochen Qiang)   
  - ACPI: CPPC: Skip writes to unsupported performance controls (Christian Loehle)   
  - gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper (Alex Tran)   
  - erofs: ensure valid f_path for page cache sharing (Gao Xiang)   
  - erofs: remove fscache backend entirely (Gao Xiang)   
  - erofs: clean up erofs_ishare_fill_inode() (Gao Xiang)   
  - smb: client: fix buffer leaks in SMB1 read and write (Dawei Feng)   
  - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (Xingui Yang)   
  - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (HyeongJun An)   
  - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (HyeongJun An)   
  - pinctrl-amd: Don't clear S4 wake bits at probe (Mario Limonciello)   
  - net/sched: sch_cake: skip clearing unused tins during rate adjustment (Jonas Köppeler)   
  - xsk: reclaim invalid Tx descriptors in ZC batch path (Maciej Fijalkowski)   
  - xsk: provide sufficient space in pool->tx_descs (Maciej Fijalkowski)   
  - xsk: drain continuation descs after overflow in xsk_build_skb() (Jason Xing)   
  - xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx (Jason Xing)   
  - selftests/net/af_unix: test listen() rejects wrong socket states (John Ericson)   
  - af_unix: fix listen() succeeding on sockets in the wrong state (John Ericson)   
  - nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush (Xiang Mei (Microsoft))   
  - nexthop: take nh->lock for f6i_list walks in replace check and notify (Xiang Mei (Microsoft))   
  - ASoC: SDCA: Ensure that Control Range is large enough for header (Charles Keepax)   
  - ASoC: SDCA: Make UMP message size check more robust (Charles Keepax)   
  - ASoC: SDCA: Always free firmware in FDL path (Charles Keepax)   
  - ASoC: SDCA: Correct pointer passed to devm_acpi_table_put (Charles Keepax)   
  - netfilter: nft_payload: fix mask build for partial field offload (Xiang Mei (Microsoft))   
  - ipvs: clear the nfct flag under lock (Julian Anastasov)   
  - ipvs: do not mangle ICMP replies for non-first fragments (Julian Anastasov)   
  - ipvs: fix places with wrong packet offsets (Julian Anastasov)   
  - ipvs: fix the checksum validations (Julian Anastasov)   
  - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (Pablo Neira Ayuso)   
  - netfilter: nf_tables: make nft_object rhltable per table (Pablo Neira Ayuso)   
  - ipvs: adjust double hashing when fwd method changes (Julian Anastasov)   
  - assoc_array: trim the final shortcut word using the current chunk end (Michael Bommarito)   
  - keys: make keyring key-chunk byte order agree with keyring_diff_objects() (Michael Bommarito)   
  - keys: fix out-of-bounds read in keyring_get_key_chunk() (Michael Bommarito)   
  - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type (Fabrice Derepas)   
  - KVM: arm64: Reject guest_memfd memslots when the VM has MTE (Alexandru Elisei)   
  - KVM: arm64: Add missing hyp_enter when trapping sysreg (Vincent Donnefort)   
  - KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load() (Vincent Donnefort)   
  - KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing (Vincent Donnefort)   
  - KVM: arm64: Fix hyp_trace clock disabling (Vincent Donnefort)   
  - KVM: arm64: vgic: Mitigate potential LPI registration failure (Carlos López)   
  - KVM: arm64: vgic: Fix race between LPI release and re-registration (Carlos López)   
  - mshv: Fix sleeping under spinlock in mshv_portid_alloc (Stanislav Kinsburskii)   
  - mshv: Fix duplicate GSI detection for GSI 0 (Stanislav Kinsburskii)   
  - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation (Sebastian Andrzej Siewior)   
  - mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() (Yi Xie)   
  - drm/mediatek: Check CRTC state before freeing (Ruoyu Wang)   
  - netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() (Pablo Neira Ayuso)   
  - selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests (Lorenzo Bianconi)   
  - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (Xiang Mei)   
  - phy: zynqmp: fix runtime PM leak on probe allocation failure (Radhey Shyam Pandey)   
  - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() (Radhey Shyam Pandey)   
  - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar)   
  - ntfs: drop stale page-cache when shrinking a non-resident attr (Namjae Jeon)   
  - ntfs: harden runlist realloc size calculations (Namjae Jeon)   
  - btrfs: zoned: skip fully truncated ordered extents at zone finish (Johannes Thumshirn)   
  - btrfs: raid56: fix an incorrect csum skip during scrub (Qu Wenruo)   
  - btrfs: skip global block reserve accounting for rescue mounts (Dongjiang Zhu)   
  - btrfs: warn about extent buffer that can not be released (Qu Wenruo)   
  - btrfs: zoned: reset meta_write_pointer on zone reset (Johannes Thumshirn)   
  - btrfs: zoned: fix deadlock between metadata writeback and transaction commit (Johannes Thumshirn)   
  - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (Qu Wenruo)   
  - of: reserved_mem: prevent OOB when too many dynamic regions are defined (Sang-Heon Jeon)   
  - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (Uday Khare)   
  - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (Uday Khare)   
  - phy: qcom: m31-eusb2: Fix return value of init call (Krishna Kurapati)   
  - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() (Radhey Shyam Pandey)   
  - ata: sata_mv: accept 1 or 2 resources in platform probe (Rosen Penev)   
  - ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points (Namjae Jeon)   
  - selftests/seccomp: Fix pointer type mismatch build error (Kuan-Ying Lee)   
  - selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE (Haofeng Li)   
  - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (Abdun Nihaal)   
  - iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Nicolin Chen)   
  - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (Yuho Choi)   
  - dmaengine: idxd: fix double free of wq, engine, and group structs (Yuho Choi)   
  - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (Hongling Zeng)   
  - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (Konrad Dybcio)   
  - pinctrl: qcom: Unconditionally mark gpio as wakeup enable (Sneh Mankad)   
  - dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold (David Carlier)   
  - KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context (D Scott Phillips)   
  - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (Michael Bommarito)   
  - ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) (Michael Diesen)   
  - mm/slab: prevent unbounded recursion in free path with new kmalloc type (Harry Yoo (Oracle))   
  - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() (Harry Yoo (Oracle))   
  - mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT (Harry Yoo (Oracle))   
  - net: mpls: initialize rtm_tos in mpls_getroute() (Yehyeong Lee)   
  - uek-next: Updating to upstream v7.1.7 (Mark Nicholson)   
  - Linux 7.1.7 (Greg Kroah-Hartman)   
  - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))


author: LUCI Bot <rhythm.m.mahajan@oracle.com> [7.1.9-0.el9uek]
changelog:
  - uek-next: Updating to upstream v7.1.9 (LUCI Bot)   
  - Linux 7.1.9 (Greg Kroah-Hartman)   
  - thunderbolt: Fix bandwidth group reservation indexing (Xu Rao)   
  - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (Bryam Vargas)   
  - sctp: clear new_transport when removing a peer (Qing Ming)   
  - sctp: fix use-after-free of cached ASCONF chunk (Yuxiang Yang)   
  - sctp: keep chunk->transport in step with the list it is queued on (Baul Lee)   
  - scsi: scsi_debug: Negate wrapped memcmp() result (Xu Rao)   
  - bpf, sockmap: Fix sk_redir use-after-free in send verdict (Chengfeng Ye)   
  - fsverity: Fix silent truncation in bpf_get_fsverity_digest() (Eric Biggers)   
  - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (Eric Biggers)   
  - mm/filemap: __filemap_add_folio() restore index before retrying (Hugh Dickins)   
  - ima: Instantiate file_truncate and path_truncate hooks (Mimi Zohar)   
  - sched_ext: Take cgroup_lock() first in scx_cgroup_lock() (Tejun Heo)   
  - sched/psi: Create the psimon kthread outside of cgroup_mutex (Tejun Heo)   
  - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (Tejun Heo)   
  - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (Zhan Xusheng)   
  - fs,fsverity: remove check for fsverity being enabled in setattr_prepare() (Andrey Albershteyn)   
  - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (Zhiling Zou)   
  - ipv6: fix Route Information option length validation (Yuejie Shi)   
  - mm/ptdump: always stabilise against page table freeing using init_mm (Lorenzo Stoakes (ARM))   
  - mm/page_table_check: skip special zero mappings (Zhiling Zou)   
  - ring-buffer: Use current_context for safe per-CPU buffer swap (Tengda Wu)   
  - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (Vincent Donnefort)   
  - ptp: ocp: Fix board ID over-read (Ahmad Byagowi)   
  - Revert "thermal: hwmon: Register a hwmon device for each thermal zone" (Rafael J. Wysocki)   
  - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (Rafael J. Wysocki)   
  - ring-buffer: Prevent resizing of persistent ring buffer (Vincent Donnefort)   
  - eventfs: Use children field for rcu head and add memory barriers (Steven Rostedt)   
  - eventfs: Fix use-after-free in eventfs_remove_rec() (Shuangpeng Bai)   
  - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson)   
  - KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (Paolo Bonzini)   
  - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Frank Sorenson)   
  - smb: client: Fix use-after-free in cifs_try_adding_channels() (Shuangpeng Bai)   
  - tipc: read le->link under the node lock in tipc_node_link_down() (Jun Yang)   
  - tls: don't leave a full plaintext sk_msg ring unpushed (chanyoung)   
  - tls: rx: restore msg_iter before TLS 1.3 optimistic retry (Jérémy Jean)   
  - vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang)   
  - veth: fix skb length accounting after XDP frag adjustment (Sun Jian)   
  - vsock/virtio: avoid refilling the RX queue after teardown (Weiming Shi)   
  - vsock/virtio: read virtqueues under worker locks (Weiming Shi)   
  - vxlan: do not arm the ageing timer on a device that is down (Baul Lee)   
  - xdp: reject clones that overrun skb_shared_info tailroom (Zhiling Zou)   
  - x86/mce: Set up the polling timer before CMCI discovery (Breno Leitao)   
  - x86/CPU: Add a tlbi= cmdline switch (Rik van Riel)   
  - arm64: remove redundant concurrent ptdump UAF mitigation (Lorenzo Stoakes (ARM))   
  - dibs: initialise dibs->lock in dibs_dev_alloc() (Hidayath Khan)   
  - Revert "drm/amdgpu: fix aperture mapping leak" (Asad Kamal)   
  - binfmt_misc: don't warn when the mount is completed from another user namespace (Christian Brauner)   
  - ovl: don't warn when the mount is completed from another user namespace (Christian Brauner)   
  - net/sched: act_gact, act_police: range check the fallback control action (Hyunjung Ko)   
  - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (Hyunjung Ko)   
  - net: atlantic: free RX pages of consumed but not refilled buffers (Yangyu Chen)   
  - net: atlantic: free stranded TX buffers on ring deinit (Yangyu Chen)   
  - netfilter: nf_conntrack: defer invalid log until after unlock (Zihan Xi)   
  - netfilter: bridge: release template ct on non-IP path (Zhiling Zou)   
  - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den)   
  - net: devmem: prevent net-iov / page mixing (Pavel Begunkov)   
  - net/x25: fix use-after-free of the socket by its timers (Baul Lee)   
  - net/dibs: Correct freeing of dmb_clientid_arr (Alexandra Winter)   
  - ipv6: prevent in6_dev_get() from resurrecting inet6_dev (Kyle Zeng)   
  - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (Daming Li)   
  - net: phy: mediatek: fix TX blink masks using the RX bits (Ahmed Naseef)   
  - mm/huge_memory: fix huge_zero_pfn race (Lorenzo Stoakes (ARM))   
  - mm/huge_memory: initialise workingset state before folio split (Matt Fleming)   
  - tracing: Fix NULL pointer dereference in module event cache removal (Hui Su)   
  - ring-buffer: Prevent subbuf order change when resizing is disabled (Vincent Donnefort)   
  - fbdev: bitblit: bound-check glyph index in bit_cursor() (Rik van Riel)   
  - tracing: Fix race between update_event_fields and, event_define_fields (Michael Wu)   
  - perf/core: Fix group leader use-after-free after sibling detach (Aditya Chillara)   
  - drm/v3d: Serialize the scheduler timeout handlers (Maíra Canal)   
  - ALSA: us144mkii: re-anchor capture URBs on resubmission (Baul Lee)   
  - ALSA: hda/tas2781: fix ACPI reference handling (Xu Rao)   
  - ALSA: FCP: fix OOB write in fcp_meter_ctl_get() (Baul Lee)   
  - ALSA: usx2y: bound the hwdep mmap fault offset (Baul Lee)   
  - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (Takashi Iwai)   
  - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} (SJ Park)   
  - samples/damon/mtier: error out for zero quota goal target values (SJ Park)   
  - mm/damon/ops-common: putback folios on invalid migrate nid (liyouhong)   
  - mm/damon/lru_sort: error out for >10000 active_mem_bp (SJ Park)   
  - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() (Hui Su)   
  - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (Eddie Lin)   
  - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (Junrui Luo)   
  - misc: fastrpc: Remove buffer from list prior to unmap operation (Ekansh Gupta)   
  - misc: fastrpc: fix channel ctx ref leak when session alloc fails (Anandu Krishnan E)   
  - misc: fastrpc: Fix initial memory allocation for Audio PD memory pool (Ekansh Gupta)   
  - staging: rtl8723bs: validate monitor transmit frame lengths (Mariano Baragiola)   
  - staging: rtl8723bs: fix missing shared-key auth challenge length check (Panagiotis Petrakopoulos)   
  - staging: rtl8723bs: fix OOB read in WMM_param_handler() (Muhammad Bilal)   
  - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (Muhammad Bilal)   
  - serial: amba-pl011: synchronize DMA teardown (Fan Wu)   
  - serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ (Fan Wu)   
  - serial: amba-pl011: fix indefinite RS485 post-send delay (Fan Wu)   
  - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (Ryan Wilbur)   
  - serial: 8250_dma: Clear stale RX state on shutdown (Cunhao Lu)   
  - serial: sc16is7xx: enable THRI before filling TX FIFO (Luca Fresi)   
  - serial: qcom-geni: fix TX DMA buffer flush (Jan Sebastian Götte)   
  - rust_binder: do not query current thread for all ioctls (Alice Ryhl)   
  - nvmem: layouts: Add fixed-layout driver (Mathieu Dubois-Briand)   
  - nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI (Aelin Reidel)   
  - mei: pull kvfree out of spinlock (Alexander Usyskin)   
  - ipv4: fix use-after-free in fib_nhc_update_mtu() (Chengfeng Ye)   
  - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (Zihan Xi)   
  - selftests/bpf: Adapt sockmap update error handling (Michal Luczaj)   
  - selftests/bpf: Ensure UDP sockets are bound (Michal Luczaj)   
  - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (Nils Helmig)   
  - Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan (Alexej Sidorenko)   
  - selftests/xsk: account reclaimed invalid Tx descriptors (Maciej Fijalkowski)   
  - selftests/xsk: fix too-many-frags multi-buffer Tx test (Maciej Fijalkowski)   
  - futex: Prevent robust futex exit race some more (Keno Fischer)   
  - Revert "drm/amd/display: Fix backlight max_brightness to match exported range" (Alex Deucher)   
  - net: bridge: mrp: fix uninitialised bytes on the wire (Baul Lee)   
  - netfilter: ebt_nflog: pin the NFLOG backend (Chengfeng Ye)   
  - igc: fix netdev not re-attached after resume if interface is down (Philipp David)   
  - mac802154: fix netdev use-after-free in beacon worker (Zihan Xi)   
  - inet: frags: publish queues before arming timer (Zhiling Zou)   
  - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Qihang Tang)   
  - net: octeontx2-pf: Fix UB in shift operation (Sergey V. Frolov)   
  - net/sched: reject overly deep qdisc hierarchies (Zijie Huang)   
  - net: openvswitch: reallocate update replies for mismatched IDs (Zhiling Zou)   
  - net: fix skb length accounting after generic XDP frag adjustment (Sun Jian)   
  - packet: synchronize pressure clearing with ring reconfiguration (Zihan Xi)   
  - net/packet: reset the MAC header on the packet-socket transmit path (Doruk Tan Ozturk)   
  - packet: use consistent hard_header_len in TX_RING send path (Qihang Tang)   
  - packet: use consistent hard_header_len in non-ring send paths (Qihang Tang)   
  - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Kyle Zeng)   
  - ipvs: separate destination availability state (Yizhou Zhao)   
  - ipvs: properly update the overload flag on dest edit (Julian Anastasov)   
  - ipvs: add totalconns for dest (Julian Anastasov)   
  - ipvs: stop estimator after disabled calc phase (Zhiling Zou)   
  - ima: fix out-of-bounds read in xattr_verify() (Lincoln Wallace)   
  - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (Lorenzo Stoakes (ARM))   
  - Input: evdev - fix information leak in evdev_pass_values() (Dmitry Torokhov)   
  - mm: fix incorrect flush address in direct page table reclaim (Andy Lutomirski)   
  - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (Joshua Rogers)   
  - vt: add permission check for KDSKBMETA ioctl (Joshua Rogers)   
  - usbnet: cap max_mtu for drivers without bind callback (Laurent Vivier)   
  - net: usb: ipheth: fix carrier_work UAF on disconnect (Doruk Tan Ozturk)   
  - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (Yi Cong)   
  - usb: gadget: f_ncm: Use unsigned int for ndp_index (Sonali Pradhan)   
  - usb: cdnsp: fix incorrect endian conversions for APB timeout register (Pawel Laszczak)   
  - thunderbolt: icm: Preserve USB4 proxy data-valid bit (Xu Rao)   
  - usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask (Lachlan Hodges)   
  - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (Aleksandr Nogikh)   
  - usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg (Jiangshan Yi)   
  - usb: quirks: Add ShanWan gamepad to quirk list (Ishaan Dandekar)   
  - usb: core: Add quirk for 255-bytes initial config read (Nikhil Solanke)   
  - ALSA: usb-audio: fix OOB write on Type II inbound URBs (Baul Lee)   
  - Input: evdev - sanitize event type index when fetching event masks (Dmitry Torokhov)   
  - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)   
  - ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra (Takashi Iwai)   
  - hwmon: (corsair-psu) serialize debugfs access against hwmon (Ali Ahmet Memis)   
  - hwmon: Support guard() and scoped_guard for subsystem locks (Guenter Roeck)   
  - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (Guenter Roeck)   
  - hwmon: (ltc4282) Clamp negative current limits (Guenter Roeck)   
  - hwmon: (ltc4282) Avoid overflow in maximum power calculation (Guenter Roeck)   
  - hwmon: (ads7828) Fix external VREF regulator handling (Qingshuang Fu)   
  - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (Wilken Gottwalt)   
  - rqspinlock: Reset tail when preserving queue on deadlock (Kumar Kartikeya Dwivedi)   
  - watchdog: at91sam9_wdt: prevent timer rearm during teardown (Hongyan Xu)   
  - tls: don't abort the connection on signal-interrupted sends (Maximilian Immanuel Brandtner)   
  - sctp: clear control chunk transport if it is being removed (Xin Long)   
  - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (Eric Dumazet)   
  - s390/ism: Fix UAF of sba and ieq during ism_dev_exit() (Alexandra Winter)   
  - bnge: Fix resource leak in bnge_init_nic() error path (Bhargava Marreddy)   
  - ata: pata_sl82c105: fix bridge revision use-after-free (Hongyan Xu)   
  - net: thunderbolt: Tear down DMA paths before stopping the rings (Fan XinRan)   
  - net: qrtr: ns: Raise lookup limit to 128 (Łukasz Patron)   
  - net/smc: fix TOCTOU race between smc_listen_out() and listener close (Sidraya Jayagond)   
  - net: remove WARN_ON_ONCE() from sk_mc_loop() (Eric Dumazet)   
  - net: prestera: validate firmware header length (Pengpeng Hou)   
  - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (Henry Martin)   
  - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (Eric Dumazet)   
  - tcp: fix TFO max_qlen accounting across reuseport migration (Jiayuan Chen)   
  - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie (Luxiao Xu)   
  - sctp: fix addip_serial increment on ASCONF_ACK allocation failure (Qing Luo)   
  - bnxt_en: Fix PTP PPS setting bug (Keegan Freyhof)   
  - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (Michael Chan)   
  - bnxt_en: Refresh VNIC default ring on queue restart if needed (Shravya KN)   
  - bnxt_en: Determine and store default RX ring in vnic structure (Shravya KN)   
  - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() (Shravya KN)   
  - net/mlx5e: fix BQL reset on SQ re-activation (Bobby Eshleman)   
  - bnge: use int for bnge_fix_rings_count() return value (Alok Tiwari)   
  - net: stmmac: resume PHY before hardware setup when opening the interface (Stefan Agner)   
  - selftests/ftrace: refactor eprobes test to fix argument checks (Martin Kaiser)   
  - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (Guenter Roeck)   
  - hwmon: (nzxt-smart2) Check return value of init_device() in probe (Qingshuang Fu)   
  - drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs (Marcin Bernatowicz)   
  - drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() (Michał Winiarski)   
  - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (Jamal Hadi Salim)   
  - net/openvswitch: check Ethernet header length in key_extract() (Cen Zhang (Microsoft))   
  - vhost-scsi: reject feature changes after endpoint (Jia Jia)   
  - vhost-scsi: Validate T10 PI scatterlist counts (Linfeng Sun)   
  - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (Toke Høiland-Jørgensen)   
  - udp: fix potential use-after-free in tunnel segmentation (Xuanqiang Luo)   
  - bnge: Fix NULL pointer dereference in aux device release (Alok Tiwari)   
  - xsk: validate metadata when processing requests (Stanislav Fomichev)   
  - xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h (Stanislav Fomichev)   
  - xsk: validate launch-time metadata size (Stanislav Fomichev)   
  - xsk: clear metadata pointer when no timestamp is requested (Stanislav Fomichev)   
  - xsk: pass TX metadata pointer by reference (Stanislav Fomichev)   
  - xsk: require at least 16 bytes of TX metadata (Stanislav Fomichev)   
  - bnxt: fix memory leak in bnxt_queue_mem_alloc error cases (Will Chen)   
  - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() (Nathan Gao)   
  - hwmon: (pmbus) Fix type confusion in notification logic (Guenter Roeck)   
  - hwmon: (pmbus/core) Avoid race condition during probe (Guenter Roeck)   
  - vdpa/mlx5: Fix buffer length in create_direct_keys() (Christian Borntraeger)   
  - vhost/vdpa: reject overflowing PA map page counts on 32-bit (Yousef Alhouseen)   
  - vhost_iotlb: bound map allocation in add_range (Linfeng Sun )   
  - ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED (Rong Zhang)   
  - ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN (Rong Zhang)   
  - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() (Jose Fernandez (Anthropic))   
  - counter: microchip-tcb-capture: Fix DT channel validation (Babanpreet Singh)   
  - bpf: Fix netns reference imbalance in conntrack kfuncs (Chengfeng Ye)   
  - accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() (Lizhi Hou)   
  - net/mlx5: fw_tracer, return NULL on create error (Michael Guralnik)   
  - devlink: fix net namespace reference leak in reload (Or Har-Toov)   
  - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete (Jiawen Liu)   
  - net/sched: cls_route: fix fastmap use-after-free on filter (Jamal Hadi Salim)   
  - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (Mahanta Jambigi)   
  - bpf: Propagate untrusted pointer state in commuted arithmetic (Yiyang Chen)   
  - bpf: Preserve pointer state for commuted arithmetic (Yiyang Chen)   
  - accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() (Lizhi Hou)   
  - btrfs: initialize inode mapping flags for cached inodes (Qu Wenruo)   
  - btrfs: fix memory leak in btrfs_do_encoded_write() (Dmitry Antipov)   
  - btrfs: lzo: reject inline extents without valid headers (David Lee)   
  - btrfs: lzo: add error message for invalid headers (Qu Wenruo)   
  - watchdog: bd96801_wdt: Fix timeout for enabled WDG (Matti Vaittinen)   
  - ipvs: return the csum validation for forward hook (Julian Anastasov)   
  - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp (Julian Anastasov)   
  - netfilter: ipset: switch ext_size to atomic64_t (Jozsef Kadlecsik)   
  - pds_core: cancel pending PCI reset work on AER recovery (Nikhil P. Rao)   
  - pds_core: keep the health thread stopped during reset (Nikhil P. Rao)   
  - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (Shay Drory)   
  - enic: fix tx_hang_reset use-after-free on device removal (Satish Kharat)   
  - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (Xiang Mei (Microsoft))   
  - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" (Fan Ye)   
  - net: hns3: fix speed configuration residue after driver reload (Jijie Shao)   
  - drm/bridge: ps8640: propagate AUX transfer register errors (Pengpeng Hou)   
  - ovpn: fix incorrect use of rcu_access_pointer() (Qingfang Deng)   
  - ovpn: ensure TCP vars are initialized first (Antonio Quartulli)   
  - ovpn: disable IPv4 redirects on MP interfaces (Antonio Quartulli)   
  - ovpn: hash floated peer by transport identity only (Antonio Quartulli)   
  - ovpn: zero-initialize sockaddr before learning a floated endpoint (Antonio Quartulli)   
  - ovpn: ensure socket is owned by ovpn before deref sk_user_data (Antonio Quartulli)   
  - ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET (Antonio Quartulli)   
  - ovpn: skip rehash for peers already removed from by_id (Antonio Quartulli)   
  - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt (Rosen Penev)   
  - ovpn: add missing rtnl_link_ops->get_size callback (Ralf Lici)   
  - pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function (Hans Ulli Kroll)   
  - pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function (Hans Ulli Kroll)   
  - selftests/sched_ext: Handle sleeping task affinity changes in numa test (Kuba Piecuch)   
  - ARM: npcm: Fix OF node refcount leaks in SMP setup (Yuho Choi)   
  - xfs: handle NULL b_addr in xfs_buf_free (Yun Zhou)   
  - soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read (Karthikeyan KS)   
  - arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer (Daniel Drake)   
  - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails (Anna Schumaker)   
  - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (Anna Schumaker)   
  - sched_ext: Don't enable non-ext tasks in the sub-sched task loops (Tejun Heo)   
  - sched_ext: Skip sub-disable teardown for never-linked sub-schedulers (Tejun Heo)   
  - sched_ext: Reject setting disallow from init_task outside the enable path (Tejun Heo)   
  - arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle (Dmitry Baryshkov)   
  - arm64: dts: qcom: sm8650: Fix IPA IMEM slice (Alexander Koskovich)   
  - arm64: dts: qcom: monaco: Add default GIC address cells (Krzysztof Kozlowski)   
  - arm64: dts: qcom: purwa: Fix GPU IOMMU property (Akhil P Oommen)   
  - arm64: dts: qcom: glymur: fix QUP serial engine IRQs (Bjorn Andersson)   
  - arm64: dts: qcom: glymur: fix PCIe SMMU interrupts (Bjorn Andersson)   
  - drm/amd/display: Check for tg ops in dce110_set_avmute (Ray Wu)   
  - drm/amd/display: Add AV mute wait frames to dce110_set_avmute (Ray Wu)   
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Mark Tomlinson)   
  - selftests/bpf: Add tests for sleepable tracepoint programs (Mykyta Yatsenko)   
  - selftests/bpf: Fail unbound UDP on sockmap update (Michal Luczaj)   
  - mount: honour SB_NOUSER in the new mount API (Al Viro)


author: Karolina Stolarek <karolina.stolarek@oracle.com> - 580.65.06-1
changelog:
  - Update install step to use install instead of make modules_install
  - Use fixed kernel version instead of the current kernel


author: Karolina Stolarek <karolina.stolarek@oracle.com> - 580.76.05-1
changelog:
  - Update to 580.76.05
  - Add gcc params to return thunks; do not generate unwind tables (to be confirmed)
    in order to fix objtool warnings


