DFSG, Licensing & New Packages Team

linux (7.2.7-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.7
     - [arm64] iommu/arm-smmu-v3: Disable implementations during devm teardown
     - wifi: mt76: mt7921: validate CLC firmware records
     - wifi: mt76: mt7921: skip unknown CLC firmware records
     - leds: st1202: Validate pattern input before stopping the sequence
     - ppp_async: drop the errored frame instead of resetting its headroom
     - RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed
     - EDAC/igen6: Fix interleave boundary condition
     - EDAC/igen6: Fix channel selection hash
     - EDAC/igen6: Fix channel address decode for non-hash mode
     - EDAC/igen6: Fix Raptor Lake-P logged error address
     - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
     - drm/virtio: Fix a NULL vs ERR_PTR() bug in
       virtio_gpu_user_framebuffer_create()
     - drm/virtio: use the DMA API for resource backing on Xen
     - accel/qaic: Address potential out-of-bounds read in resp_worker()
     - nvme-rdma: fix -EIO cleanup order in queue_rq
     - nvme: add context annotations for nvme_subsystem::lock
     - nvme: set ns->head in nvme_alloc_ns_head
     - nvme: fix racy access to FDP placement id array
     - nvmet-rdma: fix queue leak when connect backlog is exceeded
     - sched_ext: Fix nonexistent field in sched-ext.rst example
     - bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
     - bpf: Fix BPF_F_CPU validation for sparse CPU IDs
     - bpf: Fix percpu map update indexing with sparse CPU IDs
     - sched_ext: Fix spurious aborts in scx_bpf_dsq_move() on ownership change
       races
     - drm/gud: validate GUD_ROTATION_0 is present in supported rotations
     - printk: Don't WARN on kthread_run failure.
     - [amd64] accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
     - [amd64] accel/amdxdna: reject a command chain that carries no commands
     - [amd64] accel/amdxdna: put the chained BO when its mapping fails
     - cgroup/cpuset: Preserve boot-isolated CPUs on partition release
     - accel: ethosu: Don't read the U65 rounding mode as a storage mode
     - ufs: do not treat unreadable directory blocks as empty
     - drm/cirrus-qemu: Validate BAR0 size during probe
     - ntfs: return DT_UNKNOWN on inode lookup failure in readdir
     - ntfs: propagate reparse index insertion failure
     - ntfs: return -ERANGE for undersized xattr buffer
     - ntfs: preserve error code in ntfs_resident_attr_record_add()
     - ntfs: return real error from ntfs_non_resident_attr_record_add()
     - ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
     - ntfs: only count successfully cleared runs when freeing clusters
     - ntfs: skip free cluster decrement when rollback fails
     - ntfs: do not mark the volume clean in sync_fs when errors were recorded
     - ntfs: treat any nonzero dio zero-range return as an error
     - ntfs: bound $AttrDef table walk to the loaded table size
     - ntfs: reject invalid sectors_per_cluster in the boot sector
     - bpf: check_cond_jmp_op(): properly infer if register is null
     - ntfs: leave HasEA flag untouched on setxattr failure
     - bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
     - net: icmp: avoid invalid transport header access in icmp_send tracepoint
     - tcp: use GFP_ATOMIC in tcp_send_active_reset()
     - net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
     - net: iptunnel: fix stale transport header during tunnel decapsulation
     - net/sched: act_api: budget all shared attributes in notify skbs
     - net/sched: act_api: size the RTM_GETACTION reply from the actions
     - net/sched: act_api: fix skb sizing and action leak on reoffload delete
     - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
     - scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
     - scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
     - scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
     - scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
     - smb/client: validate new EOF for insert range
     - smb/client: validate new EOF for zero range
     - smb/client: mark file sparse before emulating insert range
     - smb/client: fix data corruption in emulated insert range
     - smb/client: fix integer truncation in collapse range
     - smb/client: fix stale page cache in insert/collapse range
     - smb/client: invalidate fscache for fallocate range operations
     - smb: client: transport: Fix debug printing in __release_mid()
     - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
     - raw: annotate disconnect-side IPv4 match writers
     - net: amd-xgbe: discard rx packets with bad FCS
     - vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
     - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
     - perf symbol: Do not use debug file as the binary type
     - OPP: of: Fix potential multiplication overflow when calculating freq
     - perf powerpc-vpadtl: Fix raw_size of DTL samples
     - netfs: Fix unbuffered/DIO write partial transfer error return
     - netfs: Fix error vs transferred passed to ->ki_complete()
     - netfs: Fix i_size update for partial transfer
     - netfs: Fix subreq ref leak
     - netfs: break unbuffered write when netfs_alloc_subrequest() fails
     - netfs: Fix readahead synchronisation issues by loading all folios upfront
     - netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs
     - netfs: Fix read progress reporting
     - cachefiles: Fix potential UAF/KASAN warning
     - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
     - dma-buf: fix some kernel-doc warnings
     - octeontx2-af: fix CN20K default MCAM rule removal on port cleanup
     - [amd64] drm/i915/dp_mst: Remove duplicate intel_pfit_compute_config() call
     - [amd64] drm/i915/cdclk: Fix dg2_power_well_count() return type
     - ovl: return EINVAL instead of EIO in case of mismatched user_ns
     - smb/server: cancel async requests when closing connection
     - ksmbd: safely drain sessions during logoff
     - ksmbd: propagate DACL parsing errors
     - ksmbd: rate limit unmapped SID errors
     - ksmbd: fix listener task lifetime on netdev events
     - [s390x] time: Use jiffies instead of jiffies_64
     - [s390x] ipl: Fix NULL deref in kdump without re-IPL parm block
     - [s390x] ipl: Fix NULL deref in dump_reipl without re-IPL parm block
     - [s390x] diag324: Preserve -EBUSY return code
     - [s390x] pai: Reduce excessive debug feature size
     - sched_ext: Fix timer pinning and return value in scx_central
     - sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration
     - Bluetooth: btintel_pcie: Clear automask on spurious interrupts
     - workqueue: reject watchdog thresholds that overflow jiffies
     - Bluetooth: btintel: validate version TLV value lengths
     - Bluetooth: btintel: bound firmware ID by TLV length
     - Bluetooth: hci_core: Fix race condition during device registration
     - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
     - Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
     - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
     - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
     - platform/x86: asus-laptop: Fix ACPI event handling (Closes: #1146124)
     - ASoC: ab8500: Reset the audio block before configuring it
     - ASoC: ab8500: Repair the DAPM capture graph
     - ASoC: ab8500: Correct digital interface format setup
     - ASoC: ab8500: Validate and program TDM slots correctly
     - ASoC: codecs: ab8500: Use guard() for mutex locks
     - ASoC: ab8500: Remove the nonfunctional sidetone apply control
     - ASoC: ab8500: Skip missing DMIC GPIOs on AB8505
     - drm/pagemap: Prevent double migration of device pages
     - drm/pagemap: Reset migration page count on eviction retry
     - net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
     - net: ethernet: oa_tc6: Export standard defined registers
     - net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers
     - net: ethernet: oa_tc6: Protect skb pointer used by two different kernel
       instances
     - net: ethernet: oa_tc6: Improve the error recovery
     - net: ethernet: oa_tc6: Disable tx queues on fatal error
     - net: ethernet: oa_tc6: Fix for the wrong data type
     - net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
     - igmp: convert struct ip_sf_list to RCU
     - ppp: ppp_async: simplify tty disc_data access
     - ppp: ppp_synctty: simplify tty disc_data access
     - klp-build: Fix wrong index in funcs cleanup error path
     - objtool/klp: Fix checksums for constant pool references
     - ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
     - ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
     - ipv6: mcast: fix delay calculation in igmp6_join_group()
     - ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
     - ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show()
     - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
     - tipc: fix NULL deref in tipc_named_node_up() on empty publication list
     - tipc: Dont send random pad bytes in RESET/ACTIVATE messages
     - ipv6: sr: restore network header before routing and forwarding
     - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
     - staging: fbtft: make dirty_lock IRQ-safe
     - net: bonding: annotate lockless writes with WRITE_ONCE()
     - ALSA: hda: restore MFG widget enumeration after core split
     - [s390x] boot: Fix physical memory search range
     - [s390x] boot: Avoid IPL parameter append past command line
     - ASoC: fsl_micfil: balance mclk enable/disable
     - [amd64] ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
     - [amd64] ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
     - block: save page offset gaps in cloned bio
     - ASoC: cs35l56: Request IRQ in cs35l56_common_probe()
     - ASoC: cs35l56: Fix probe deadlock waiting for SoundWire enumeration
     - drm/xe/oa: Remove sysfs entry on idr_alloc failure in
       xe_oa_add_config_ioctl()
     - ALSA: dummy: Report a change when one capture switch channel moves
     - [amd64] accel/amdxdna: refuse to flush an imported BO
     - btrfs: detach failed sprout device from transaction update list
     - btrfs: restore active device pointers after failed sprout
     - bonding: alb: fix uninitialized transport header access in
       alb_determine_nd()
     - perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
     - scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in
       _base_assign_reply_queues()
     - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
     - sched/core: Skip rq->avg_idle update without a valid idle_stamp
     - [amd64] x86/itmt: Don't make ITMT enablement depend on debugfs
     - perf/core: Skip empty AUX records with only format flags
     - locking/lockdep: Invalidate stale class_cache entries for zapped classes
     - octeontx2-af: Fix limiting SRIOV VF count logic
     - ksmbd: fix sparc build with atomic work state
     - ALSA: ump: do not touch legacy_rmidi before it exists
     - printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY
     - [amd64] platform/x86: x86-android-tablets: hold device reference for
       secondary fwnode teardown
     - ASoC: ux500: Fix MSP stream lifecycle handling
     - ASoC: ux500: Propagate MSP setup errors
     - ASoC: ux500: Correct MSP frame and bit clock setup
     - ASoC: ux500: Validate MSP DAI configuration
     - mfd: db8500-prcmu: Fold dbx500 header into db8500
     - ASoC: ux500: Deassert the MSP reset during probe
     - ASoC: ux500: Request the MSP MMIO resource
     - ASoC: ux500: Remove obsolete PRCMU QoS calls
     - ASoC: ux500: Allow repeated MSP prepare calls
     - ASoC: ux500: Program the MSP FIFO watermarks
     - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
     - bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
     - btrfs: scrub: report the failing sector's address, not the stripe base
     - btrfs: fix transaction use-after-free in raid stripe insertion
     - btrfs: fix the possible bioc_list memory leak during error
     - btrfs: return proper negative error code for update_raid_extent_item()
     - btrfs: zoned: finish active block group cleanup if call_zone_finish()
       fails
     - btrfs: send: fix lost error return value in will_overwrite_ref()
     - btrfs: do not force reloc root creation during qgroup_account_snapshot()
     - btrfs: zstd: fix lost wakeup when waiting for a workspace
     - drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit
       compile
     - ipvs: fix reversed sequence option serialization
     - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
     - tracing/probes: Fix use-after-free on field name/type of events with
       multiple probes
     - bpf: reject BPF_PSEUDO_FUNC reference to the main program
     - bonding: do not clear curr_active_slave prematurely when releasing all
       slaves
     - net: Remove conflicting altnames for dying netns in
       __dev_change_net_namespace().
     - net: macb: unify device pointer naming convention
     - net: macb: exclude software FCS from TX byte statistics
     - net/rds: use wq_has_sleeper() in release_in_xmit()
     - net/rds: use clear_bit_unlock() in release_refill()
     - net/rds: clear cp_flags bits individually in rds_conn_path_reset()
     - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
     - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
     - net/rds: acquire the fastpath locks in rds_conn_shutdown()
     - net/rds: don't let rds_conn_shutdown() consume a concurrent drop
     - [powerpc*] Don't drop _TIF_RESTOREALL on syscall restart
     - [powerpc*] Do not restore KUAP in arch_exit_to_user_mode_prepare()
     - net: airoha: enable RX_DONE interrupt for RX queue 31
     - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after
       reset
     - net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
     - [arm64] trans_pgd: clone only the linear map that exists at runtime
     - erofs: disable LZ4 rolling decompression for now
     - selftests/alsa: Fix the step check for INTEGER controls
     - ALSA: caiaq: Fix potential double-free at error path
     - drm/rockchip: dw_dp: Select DRM_BRIDGE_CONNECTOR
     - drm/rockchip: rk3066_hdmi: Add missing Kconfig selects
     - bpf: Reject key-less BTF for hash maps
     - bpf: Fix NULL-ptr-deref when showing a void BTF type
     - bpf: Fix NULL-ptr-deref in btf_var_show()
     - bpf: Mark signal tracepoint siginfo arguments as scalar
     - bpf: Reject tail calls directly from callback frames
     - bpf: Reject resilient lock operations in rbtree callbacks
     - bpf: Mark sched_process_wait argument as nullable
     - bpf: Mark syscall helpers as sleepable
     - ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
     - nvme: remove stale namespaces by NSID range during scan
     - nvme: print namespace IDs as unsigned 32bit value
     - nvmet: print namespace IDs as unsigned 32bit value
     - nvme-tcp: defer TLS inline send to io_work
     - [amd64] ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
     - [amd64] ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology
     - [amd64] ASoC: Intel: avs: Fix unbalanced module reference count
     - [amd64] ASoC: Intel: avs: Refactor and fix init_config access
     - net: bcmasp: clear txcb->last before writing each descriptor
     - net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
     - mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
     - bpf: zero extend the result of an arena 32-bit cmpxchg
     - bpf: don't rewrite bpf_fastcall patterns entered by a jump
     - bpf: Track verifier instruction stats for each subprogram
     - bpf: Check ancestor frames for rbtree callbacks
     - bpf: Mark bpf_btf_find_by_name_kind() as sleepable
     - bpf: Mark faultable stack helpers as sleepable
     - bpf: Reject legacy packet loads from callbacks
     - bpf: Don't infer non-NULL from a pointer with an unbounded offset
     - bpf: Don't resurrect a scalar id dropped by collect_linked_regs()
     - bpf: Don't predict JMP32 pointer vs zero comparisons
     - bpf: Mark the zero register precise for a register-form NULL check
     - thermal: sysfs: switch to use scnprintf() to suppress truncation warning
     - bpf: Require MEM_PERCPU for percpu kptr stores
     - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
     - bpf: Reject untrusted allocated-object pointers
     - tracing: Fix to avoid creating trace instances with duplicate names
     - bpf: Preserve special fields in recycled rhtab elements
     - bpf: Cancel special fields when recycling rhtab elements
     - bpf: Mark NULL kptr stores precise
     - bpf: Preserve inner map identity in callback frames
     - ring-buffer: Remove ring_buffer_per_cpu::mapped
     - tracing: Fix subbuf resize races with trace_pipe_raw readers
     - ring-buffer: Cap static ring buffer nr_pages
     - tracing: Fix comment in tracing_buffers_splice_read()
     - nexthop: Initialize extack in remove_nh_grp_entry()
     - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
     - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
     - eth: nfp: bound the ntuple rule dump by the caller's buffer size
     - eth: nfp: drop the replaced rule from the list when reprogramming fails
     - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer
       size
     - net: bridge: mcast: properly convert mglist to rcu
     - octeontx2-af: mcs: Clear stale X2P calibration state before calibration
     - ionic: use netif_txq_maybe_stop() in ionic_tx()
     - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent
       partial_data heap overflow
     - dibs: Unregister dibs_class after error
     - [s390x] ism: folio_put() after error
     - vxlan: reject dynamic fdb entries that reference a nexthop id
     - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
     - net: reject oversized tx_queue_len at netlink parse time
     - pds_core: fix cmd_regs access racing BAR unmap on reset
     - pds_core: don't release PCI regions for VFs on reset
     - bpf: mark a NULL call argument precise
     - bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
     - [powerpc*] kexec_file: Use inclusive range checks in add_usable_mem()
     - [powerpc*] kexec_file: Use inclusive range checks for excluded memory
     - net: mctp: i3c: serialize probe with bus removal
     - [powerpc*] entry: Fix irq_soft_mask corruption on replayed interrupt exit
     - net/sched: defer qdisc freeing after failed creation
     - net/mlx5e: Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD
     - net/mlx5e: Fix setting RS FEC after remapping
     - net/mlx5e: Fix reporting support for all RS FEC variants
     - net/mlx5: LAG, use local tracker to update active ports
     - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
     - net/mlx5e: Fix use-after-free race in sample_restore_put()
     - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
     - net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
     - net/mlx5e: Keep HW timestamp stats monotonic across reconfiguration
     - net/sched: fq_pie: clamp quantum in change path
     - net/sched: sfq: clamp quantum in change path
     - net/sched: hhf: clamp quantum in change and init paths
     - net/sched: dualpi2: clamp psched_mtu at all call sites
     - net/sched: pie: clamp psched_mtu in pie_drop_early
     - net/sched: drr: clamp quantum in change class
     - net/sched: ets: clamp quantum in parse and fallback paths
     - net: macb: fix NULL pointer dereference on unbind with fixed-link
     - bpf: Reject non-scalar bpf_loop iteration counts
     - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
     - erofs: delimit inode_share cache key components
     - [riscv64] iommu/riscv: Add command queue lock
     - [riscv64] iommu/riscv: Serialize command queue publishing
     - [riscv64] iommu/riscv: Avoid waiting on failed command enqueue
     - [amd64] iommu/amd: Do not reallocate GA log buffers on resume
     - [amd64] iommu/amd: Fix premature break in init_iommu_one() again
     - [amd64] iommu/amd: Fix ineffective error check in nested domain allocation
     - hwmon: (ltc4282) Make sure clk_init_data is fully initialized
     - Documentation/hwmon: Document hwmon_notify_event()
     - hwmon: Fix potential UAF in pec_store
     - hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show()
     - hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()
     - hwmon: (ina2xx) Replace masks with enum in alert functions
     - hwmon: (ina2xx) Decouple in0 and curr1 alarms
     - Documentation: hwmon: replace full-width colon by a standard ASCII colon
     - hwmon: (yogafan) fix non-kernel-doc comment
     - hwmon: (sht4x) Add missing locks
     - hwmon: (sht4x) Fix return value from heater_enable_store()
     - ASoC: bcm: bcm63xx: Publish the OF module aliases
     - [amd64] ASoC: Intel: SST: Publish the PCI module aliases
     - btrfs: fix unnecessary transaction commit fallback from
       btrfs_log_all_parents()
     - netfilter: nfnetlink_log: cope with concurrent instance destruction
     - netfilter: ip6_tables: set F_PROTO when proto value is nonzero
     - regulator: pf1550: fix which regulator is notified
     - ASoC: mt6351: Publish the OF module alias
     - irqchip/gic-v5: Preserve ICC_CR0_EL1 state
     - virtio_ring: fix stale descriptor flags after a failed packed add
     - virtio: fix use-after-free in unregister_virtio_device()
     - virtio_console: do not free control-out buffers on remove
     - vhost/vdpa: reject VRING_NUM larger than device max
     - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
     - vhost-vdpa: protect config_ctx from being freed under the config callback
     - vdpa_sim_blk: reject out-of-range sector starts
     - vdpa_sim_net: check TX pull result before RX copy
     - virtio-pci: return IRQ_HANDLED after non-zero ISR
     - vduse: validate virtqueue alignment
     - vhost: invalidate vring access on IOTLB transitions
     - virtio_input: reset device if input_register_device() fails
     - virtio_input: stop callbacks before unregistering input device
     - af_unix: Update last skb marker in manage_oob().
     - af_unix: Return immediately when manage_oob() returns NULL for 0-length
       buffer.
     - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
     - net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
     - net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
     - vduse: return compat ioctl results directly
     - net: macb: zero the link settings taprio reads back
     - net: macb: reject an unknown link speed in the taprio setup
     - net: ethernet: cortina: Fix budget accounting
     - net: ethernet: cortina: Finish RX updates before NAPI completion
     - net: ethernet: cortina: Count dropped frames as NAPI work
     - net: ethernet: cortina: Count RX drops once per frame
     - net: ethernet: cortina: Count RX descriptors for freeq refill
     - drm/adp: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
     - drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
     - [s390x] debug: Fix NULL pointer dereference in debug_set_level()
     - ALSA: hda: Report a change when only the channel status bytes move
     - platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not
       working
     - idpf: account for VLAN header when parsing RSC packet header
     - ice: add missing xa_destroy for sched_node_ids
     - eth: ice: don't dereference pointers from TP_printk()
     - Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen
       platform
     - Bluetooth: btusb: Fix UAF of btusb_data by rx_work
     - Bluetooth: btintel_pcie: validate packet_len before skb_put_data
     - Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
     - Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
     - Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
     - Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset
     - Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset
     - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe()
     - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
     - net: macb: destroy the phylink instance on the probe error path
     - net: macb: put the "mdio" child node reference on success
     - nstree: check listing permission before taking a namespace reference
     - drm/xe: Guard page-fault worker with runtime PM check
     - mptcp: remove unneeded READ_ONCE() annotation
     - watchdog: fix hrtimer start when pretimeout is zero
     - watchdog: msc313e: Avoid division by zero
     - watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
     - watchdog: msc313e: Enable clock before accessing hardware registers
     - watchdog: msc313e: Fix spurious reset on suspend
     - watchdog: msc313e: Fix undefined behavior
     - watchdog: msc313e: Sync timeout value if WDT was running at boot
     - net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value
     - net: ks8851: Fix receiver error in 100BASE-TX mode following software
       power-down
     - hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
     - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
     - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
     - hwmon: (corsair-cpro) Remove debugfs entries when probe fails
     - hwmon: (nct6694) do not expose enable on DTIN temperature channels
     - octeontx2-pf: reset HTB scheduler topology before freeing queues
     - vxlan: initialize _md in vxlan_xmit_one()
     - ppp_synctty: ensure a writeable skb header
     - net: phylink: initialise link_state before a forced major config
     - net: stmmac: initialize ptp_lock at probe time
     - net/mlx5e: Move representor vnic reporter to eswitch devlink port
     - [powerpc*] entry: Fix double accounting of user time on interrupt entry
     - [amd64] drm/i915/dp: Gate UHBR SST SDP splitting on sink capability
     - perf/core: Allow list_del during perf_event_overflow()
     - [amd64] perf/x86/intel: Correct pt_regs->flags update for PEBS path
     - [amd64] perf/x86/intel: Prevent drain_pebs() reentry
     - sched/eevdf: Fix augmented max_slice
     - sched/eevdf: Fix rb augmented with multi fields
     - sched: Account cgroup CPU time to the execution context
     - sched/core: Call wq_worker_tick() for the execution context
     - net/sched: cls_route: free emptied bucket on filter move
     - net/sched: cls_route: Reject handle aliasing
     - net/sched: cls_route: Fix in-place replace
     - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
     - net: sun4i-emac: fix missing of_node_put() for phy_node
     - net: hinic: fix mailbox segment buffer overflow
     - net: dsa: mt7530: add EN7528 support
     - net: dsa: mt7530: populate lpi_interfaces to fix EEE support
     - net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
     - net: phy: mediatek-ge: disable EEE on the MT7530 PHY
     - net: net_failover: Fix the deadlock in net_failover_slave_name_change()
     - octeontx2-af: fix PF/CGX debugfs PCI bus lookup
     - net: phy: dp83867: handle the active-high LED polarity mode
     - net: mana: restore the XDP program pointer when pre-allocation fails
     - net/rds: fix tcp stream corruption with large pages
     - net: stmmac: fix TX descriptor availability check for TSO traffic
     - net: hsr: enable promiscuous mode on interlink port with fwd offload
     - openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
     - block: Fix start and length check added to iov_iter_extract_bvecs()
     - sunvdc: unmap LDC cookies when the descriptor send fails
     - ublk: clear force_abort in ublk_queue_reset_io_flags()
     - erofs: add missing buf->off in erofs_bread()
     - tracing: Fix ring_buffer_read_page_size() kernel-doc
     - scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms
     - scripts/mksysmap: fix escape of '$' in the __pi_ pattern
     - tracing/remotes: Account for ring buffer page header in size calculation
     - tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
     - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
     - configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
     - configfs: unhash the dentry before dropping the item in rmdir
     - [powerpc*] ps3: Fix repository.c build failure
     - [powerpc*] eeh: Fix recursive locking on devices without EEH sensitive
       driver
     - [powerpc*] pci-ioda: Fix the stale irq chip reference
     - [amd64] x86/amd_node: Avoid divide by zero on virtualized systems
     - [amd64] x86/MCE/AMD: Fix inverted interrupt enablement during storm
       handling
     - [amd64] x86/amd_node: Fix potential NULL pointer dereference
     - [amd64] crypto: x86/aria - add missing vzeroupper in AVX2 code
     - [amd64] crypto: x86/aria - add missing vzeroupper in AVX-512 code
     - [amd64] x86/amd_node: Fix PCI device reference counting in amd_smn_init()
     - [amd64] x86/mm: Fix user-space data loss with MADV_FREE and THP
     - [amd64] x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
     - [amd64] x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
     - [amd64] x86/alternatives: Exclude text poking against change_page_attr()
     - mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
     - ipv6: fix fib6 walker UAF on seq stop
     - ipmr: account multicast table and route memory
     - reboot: fix cad_pid use-after-free race
     - ftrace: Use rcu_assign_pointer() for tmp_ops filter hash
     - ftrace: fork: Initialize function graph state before copy_exec_state()
     - tracing: Fix memory corruption from the histogram stacktrace modifier
     - tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()
     - tracing: Set the trace clock before registering the histogram trigger
     - tracing: Fix memory corruption from a "STACKTRACE" histogram key
     - tracing: Take trace_array reference when opening a tracer options file
     - tracing: Don't dereference trace_event_file in deferred trigger free
     - rust: num: seal Integer
     - rust: pin-init: use irrefutable pattern for `stack_pin_init`
     - rust: allow `clippy::as_underscore` in the generated bindings
     - rust: allow `unknown_lints` in generated bindings for Rust < 1.88
     - drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
     - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
     - ALSA: us122l: Prevent write upgrades for read mappings
     - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
     - ALSA: usbusx2y: validate URB actual_length in interrupt callback
     - Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
     - [riscv64] hwprobe: initialize pair->value in hwprobe_one_pair()
     - dm/amdgpu: fix malformed link_settings debugfs output
     - drm/amdgpu: skip gfx switch_power_profile during GPU reset
     - drm/amdgpu: skip the VMID 0 flush for VRAM
     - watchdog: sunxi_wdt: preserve boot-enabled watchdog
     - virtio_mmio: disable IRQ wake before free_irq
     - ufs: create the root dentry after loading cylinder metadata
     - ufs: validate cylinder group metadata before caching it
     - tunnels: Drop stale dst when building an ICMP error for PMTUD
       (Closes: #1108860)
     - tick/broadcast: Plug clockevents replacement race
     - tools/bootconfig: Fix integer overflow and truncation in size checks
     - tracing/user_events: Don't destroy fields when event removal fails
     - tracing: Free histogram the var ref when its initialization fails
     - tracing: Free histogram var refs regardless of how often they are
       referenced
     - tracing: Free histogram the field rejected for a bad modifier
     - tracing: Let histogram values keep the percent and graph modifiers
     - tracing: Keep the entry count when the histogram stats allocation fails
     - tracing: Take the reference before publishing the named histogram trigger
     - tracing: Undo the registration when enabling the histogram trigger fails
     - accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
     - accel/ivpu: Validate firmware log buffer metadata
     - accel/ivpu: Limit firmware log name prints to field size
     - accel: ethosu: Fix ethosu_job_open() return value
     - accel: ethosu: Drop IRQF_SHARED flag
     - accel: ethosu: Ensure cmd stream ends with a stop op
     - accel: ethosu: Ensure SRAM size is 0 on mapping failure
     - accel: ethosu: Ensure SRAM region size matches job
     - ata: pata_legacy: remove documentation for removed module parameters
     - ASoC: amd: acp-da7219-max98357a: don't bind on Raven/Picasso boards
     - ASoC: sprd: validate compress buffer sizes against fixed allocations
     - ASoC: sti: initialize IRQ lock before requesting IRQ
     - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
     - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
     - bootconfig: Fix integer overflow in initrd size check
     - cpufreq: zero-initialize policy cpumask before sysfs publication
     - cpufreq: initialize policy rwsem before sysfs publication
     - exec: do_close_on_exec() before taking exec_update_lock
     - exit: hold a reference to thread_pid across proc_flush_pid
     - fs: don't return -EINVAL for successful nested thaw
     - function_graph: Use the saved entry's size when reprinting it
     - genetlink: pin family module during policy dump
     - hrtimer: Use hard expiry when updating timers on the same base
     - drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7
     - drm/bridge: tc358768: Enforce input bus flags via atomic_check
     - drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
     - drm/drm_exec: fix up contended obj when num_objects is 0
     - [amd64] drm/i915: Fix memory leak in query_perf_config_list()
     - drm/rockchip: analogix_dp: fix unchecked bound endpoint name length
     - drm/sched: Create a fake device for KUnit tests
     - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
     - drm/amd/display: Exit IPS before connector detection on resume
     - drm/amd/display: Rebuild InfoFrames on output color space changes
     - io_uring/rw: end write accounting from ->ki_complete
     - io_uring/net: let io_recv_buf_select return the length of the buffer
       region
     - io_uring/net: don't overconsume buffers when using MSG_TRUNC
     - ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
     - ring-buffer: Check resize_disabled before publishing the new subbuf order
     - net/sched: act_api: release all action references on NEWACTION failure
     - net: bridge: use option bits for CFM/MRP frame handlers
     - net: dsa: tag_brcm: legacy FCS: request needed tailroom
     - net: hso: fix TIOCMIWAIT race
     - net: macb: initialize PTP state before registering clock
     - net: mana: Reserve extra CQ slot for the fence completion CQE
     - net: mpls: clear inner_protocol when the last label is popped
     - net: openvswitch: fix use-after-free of the flow table mask array
     - net: phy: dp83td510: handle the active-high LED polarity mode
     - netfs: Fix uninitialized return value in netfs_unbuffered_write()
     - netfilter: cttimeout: prevent UAF during module unload
     - netfilter: nf_log: unregister loggers before per-net teardown
     - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
     - vdpa: ifcvf: Put device on unsupported feature error
     - vdpa: solidrun: Free IRQs after request failure
     - scripts/sorttable: Mark long_size as __maybe_unused
     - fs: autofs: fix memory leak in autofs_fill_super()
     - erofs: add sysfs feature entry for xattr prefixes
     - erofs: preserve LZMA decoders on resize failure
     - fbdev: vfb: defer cleanup until the last reference
     - idpf: disable DIM work before freeing q_vectors
     - inet: frags: invalidate queues before flushing them
     - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
     - ieee802154: cc2520: fix FIFOP work use-after-free
     - ieee802154: hwsim: serialize pib updates to fix double-free
     - ipv4: fib: bound automatic table ID allocation
     - ipv6: flowlabel: cap duplicate leases per socket
     - ipvs: reject invalid states in connection template sync records
     - mac802154: fix use-after-free of sdata via queued RX frames
     - [powerpc*] KVM: PPC: Book3S HV: Set irqfd->producer only on success
     - landlock: Fix use-after-free of the source's parent directory
     - [s390x] iommu/s390: Fix NULL dereference in iova_to_phys() with
       ZPCI_TABLE_TYPE_RFX
     - [s390x] qeth: allow bridgeport queries despite OS_MISMATCH
     - [s390x] crypto: Fix skcipher_walk return code handling in aes_s390
     - [s390x] crypto: Fix use of mutex in atomic context
     - [s390x] crypto: Fix missing scrub of temp buffers with AES ctr and gcm
       algorithm
     - [s390x] crypto: Fix missing cra_flags in paes_s390
     - [s390x] crypto: Fix handling of EBUSY in PHMAC when req is pushed to
       crypto engine
     - [s390x] crypto: Fix missing scrub of temp buffers with PAES algorithm
     - [s390x] crypto: Fix wrong return code to engine in asynch callbacks
     - [s390x] crypto: Map EBUSY to EIO when key conversion fails repeatedly
     - [riscv64] perf: RISC-V: store available counter mask as bitmap
     - [riscv64] perf: RISC-V: use BIT_ULL for u64 overflow masks
     - afs: Fix missing kunmap in afs_dir_search_bucket()
     - afs: Fix double-unmap of directory block
     - afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
     - afs: Clear stale peer app data after address list changes
     - hwmon: (applesmc) fix key backlight workqueue leak on register failure
     - hwmon: (chipcap2) fix channels in humidity alarm notifications
     - hwmon: (gpio-fan) Fix use-after-free in alarm work
     - hwmon: (mcp9982) Propagate one-shot polling errors
     - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
     - media: hevc: add bounded tile-count helpers
     - media: ipu-bridge: do not use the CVS device lookup for IVSC
     - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
     - media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
     - media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
     - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
     - media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
     - media: verisilicon: rockchip: reject AV1 frames exceeding the tile
       capacity
     - media: v4l2-ctrls: validate HEVC tile counts
     - media: v4l2-ctrls: validate AV1 tile counts
     - bnxt_en: Only restore LRO if the device supports TPA
     - bnxt_en: Don't free the live ring's TPA state on queue restart failure
     - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
     - bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
     - bnxt_en: Propagate TPA buffer allocation failures in
       bnxt_queue_mem_alloc()
     - bnxt_en: Bound SW TPA IDs to prevent crashes
     - bnxt_en: Prevent queue stop with deferred completions
     - mptcp: do not reschedule the RTX timer for fallback sockets
     - mptcp: options: handle MPC data + csum reqd + no csum
     - mptcp: subflow: no need to copy thmac during ulp_clone
     - mptcp: syncookies: remember the request backup flag
     - mptcp: options: fix uninit-value in mptcp_write_data_fin
     - mptcp: prevent race between disconnect() and rtx
     - mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
     - mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
     - mptcp: pm: userspace: fix address ID overflow
     - smb: client: reject short READ responses in CIFSSMBRead()
     - smb: client: reject userspace cifs.idmap descriptions
     - smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
     - smb: client: pin DFS superblock in iterator callback
     - smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
     - smb: client: fix WSL reparse point uid/gid override
     - smb: client: fix uid/gid override in getattr with posix extensions
     - smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
     - smb: client: fail DACL rewrite when the new DACL exceeds 64K
     - smb: client: fix cifsFileInfo reference leak in deferred close
     - smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
     - smb: client: fix file type corruption in posix_reparse_to_fattr()
     - smb: client: fix file type corruption in wsl_to_fattr()
     - smb: client: avoid leaking refcount in cifs_queue_oplock_break()
     - smb: client: avoid leaking refcount when cifs_sb_tlink() fails
     - smb: client: fix heap overflow in DACL owner/group rewrite
     - smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
     - xfs: use the rtgroup extent count to find rtrefcount gaps
     - xfs: truncate quota file correctly when repairing quota file
     - xfs: strengthen the "is cow staging" helpers in scrub
     - xfs: snapshot scrub stats when rendering them
     - xfs: snapshot old AGFL before rewriting it
     - xfs: signal inode btree xref error if get_rec returns an error
     - xfs: reset parent pointer args before each dir tree unlink repair
     - xfs: report nonexistent parents as a filesystem corruption
     - xfs: report healthy filesystem events in scrub stats
     - xfs: release alleged child inode on metapath unlink error
     - xfs: preserve owner on in-memory btree creation
     - xfs: make the rtsummary repair fix the file size too
     - xfs: log the tempip after we convert it to extents format
     - xfs: lock the healthmon when inserting unmount event
     - xfs: initialise error in xfs_defer_finish_one()
     - xfs: initialise args->total for parent pointer updates
     - xfs: fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems
     - xfs: fix unit conversions in per_binval computation
     - xfs: fix under-reservation of blocks when repairing sf directories
     - xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
     - xfs: fix short ifork reaping computation in xreap_bmapi_binval
     - xfs: fix rtrmap cross-referencing elision logic
     - xfs: fix rtrefcount btree block counting in scrub
     - xfs: fix replaying dirent removals into the temporary directory
     - xfs: fix reclaimed page accounting in xfs_buf_free
     - xfs: fix parent rec lookup initialization in xrep_metapath_unlink
     - xfs: fix name string recording in slowpath pptr tracepoints
     - xfs: fix media verification ioctl for internal rt volumes
     - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
     - xfs: fix bnobt repair space reservation disposal failure
     - xfs: fix backwards skipping logic in xrep_quota_block
     - xfs: fix backwards mergeability logic in refcount scrubber
     - xfs: don't stash removename operations with unknown ftype
     - xfs: don't spin forever on zero-length dirents when salvaging them
     - xfs: don't modify file attributes or poke fsnotify for dry runs
     - xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
     - xfs: don't leak dqacct if rhashtable insertion fails
     - xfs: destroy seen inode bitmap when we fail to add a dirpath
     - xfs: cross-reference the rtgroup superblock extent, not block
     - xfs: count escaped corruption errors in scrub stats
     - xfs: compute dquot checksum after resetting dd_lsn in repair
     - xfs: check healthmon outbuffer space correctly
     - xfs: bump lost_prev_errors if we lose even the healthmon lost event
     - xfs: bail out on bitmap errors in xrep_agfl_fill
     - xfs: always set xfs_healthmon::first_event when inserting at front of list
     - xfs: advance the findparent inode scan cursor while holding ILOCK
     - xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent
     - xfs: actually check internal-rtdev fields in the superblock
     - ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()
     - wifi: ath9k_htc: don't store usb_device_id
     - media: as102: do not rely on id table address comparison
     - usb: serial: spcp8x5: don't store usb_device_id
     - net: usb: pegasus: don't rely on id table pointer arithmetic
     - usb: xusbatm: don't rely on id table pointer arithmetic
     - usb: usbtmc: don't store usb_device_id
     - hwmon: (asus_rog_ryujin) Add per-device configuration
     - hwmon: (asus_rog_ryujin) Validate HID report lengths
     - hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
     - media: remove conditional return with no effect
     - media: qcom: iris: fix runtime PM reference leaks
     - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
     - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
     - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
     - scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
     - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
     - f2fs: accurately adjust free_sections during free_segment_range
     - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
     - f2fs: fix to reset all pinned status during fggc
     - [amd64] drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+
     - [amd64] accel/amdxdna: Disable device buffer exporting
     - i2c: designware: Global register definitions
     - drm/xe/i2c: Fix the interrupt handling
     - [amd64] platform/x86: hp-wmi: Introduce board-specific feature data
     - [amd64] platform/x86: hp-wmi: Fix board_params typo for 8DD6 board
     - [amd64] x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()
     - [amd64] x86/mm/pat: Acquire init_mm read lock on attribute changes to
       avoid UAF
     - EDAC/altera: Use parent device for devres in altr_portb_setup()
     - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
     - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
     - scsi: qla2xxx: Skip vport under deletion in report ID acquisition
     - scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
     - scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
     - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
     - scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
     - scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
     - drm/amd/display: Propagate HDMI RGB quantization selectability
     - drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
     - [s390x] pai: Use PAI PMU index as parameter replacing event
     - [s390x] pai: Move locking to event init and delete
     - [s390x] pai: Support CPU hotplug for PMU PAI
     - [amd64] x86/mm/pat: Allocate split page tables as kernel page tables
     - misc: amd-sbi: Add null check for devm_kasprintf()
     - [amd64] x86/mm: Fix and document DEBUG_PAGEALLOC
     - mptcp: move the stale logic out of retrans scheduler
     - mptcp: avoid unneeded actions on subflow reset
     - mptcp: close race between scheduler and state change
     - mptcp: fix bad accounting in __mptcp_subflow_push_pending()

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Linux kernel
Source: https://www.kernel.org/pub/linux/kernel/
Files-Excluded: Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt
 arch/powerpc/platforms/8xx/micropatch.c
 drivers/media/usb/dvb-usb/af9005-script.h
 drivers/video/fbdev/nvidia
 drivers/video/fbdev/riva
 tools/testing/selftests/tc-testing/action-ebpf
Comment:
 The 'perf' tool is dynamically linked with the Python interpreter,
 which is itself dynamically linked with OpenSSL, which is not
 GPL-compatible.  However, since perf itself does not link with or use
 OpenSSL, we believe that this indirect linking does not require
 additional permissions beyond the GPL.

Files: *
Copyright: 1991-2012 Linus Torvalds and many others
License: GPL-2

Files: debian/*
Copyright: 1996-2006 Manoj Srivastava
           2005-2012 Debian kernel team
           2006-2009 Bastian Blank <waldi@debian.org>
License: GPL-2

Files: debian/installer/kernel-wedge/*
Copyright: 2001-2002 Herbert Xu <herbert@debian.org>
           2001-2005 Joey Hess <joeyh@debian.org>
           2011-2012, 2014, 2016, 2018-2019 Ben Hutchings <ben@decadent.org.uk>
License: GPL-2+
 This program is free software; you can redistribute it
 and/or modify it under the terms of the GNU General Public
 License as published by the Free Software Foundation;
 either version 2 of the License, or (at your option) any
 later version.
 .
 This program is distributed in the hope that it will be
 useful, but WITHOUT ANY WARRANTY; without even the implied
 warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
 PURPOSE.  See the GNU General Public License for more
 details.
 .
 A copy of the GNU General Public License is available as
 `/usr/share/common-licenses/GPL-2' on Debian systems or on the World Wide
 Web at <URL:https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>.

Files:
 arch/arm/boot/dts/allwinner/axp*.dts*
 arch/arm/boot/dts/allwinner/sun*.dts*
 arch/arm/boot/dts/amlogic/meson*.dts*
 arch/arm/boot/dts/arm/mps2*.dts*
 arch/arm/boot/dts/axis/artpec6.dtsi
 arch/arm/boot/dts/cnxt/cx92755*.dts*
 arch/arm/boot/dts/cros-ec-sbs.dtsi
 arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_vining_fpga.dts
 arch/arm/boot/dts/marvell/armada-370-d*.dts*
 arch/arm/boot/dts/marvell/armada-370-mirabox.dts
 arch/arm/boot/dts/marvell/armada-370-netgear*.dts*
 arch/arm/boot/dts/marvell/armada-370-rd.dts
 arch/arm/boot/dts/marvell/armada-370-synology-ds213j.dts
 arch/arm/boot/dts/marvell/armada-370.dtsi
 arch/arm/boot/dts/marvell/armada-375*.dts*
 arch/arm/boot/dts/marvell/armada-38*.dts*
 arch/arm/boot/dts/marvell/armada-39*.dts*
 arch/arm/boot/dts/marvell/armada-xp*.dts*
 arch/arm/boot/dts/marvell/kirkwood-linkstation*.dts*
 arch/arm/boot/dts/marvell/mvebu-linkstation-*.dts*
 arch/arm/boot/dts/marvell/orion5x-kuroboxpro.dts
 arch/arm/boot/dts/marvell/orion5x-linkstation*.dts*
 arch/arm/boot/dts/marvell/orion5x-ls*.dts*
 arch/arm/boot/dts/microchip/at91sam9260ek.dts
 arch/arm/boot/dts/microchip/at91sam9xe.dtsi
 arch/arm/boot/dts/microchip/sama5d2.dtsi
 arch/arm/boot/dts/microchip/sama5d4.dtsi
 arch/arm/boot/dts/nvidia/tegra124-apalis*.dts*
 arch/arm/boot/dts/nxp/imx/imx7*.dts*
 arch/arm/boot/dts/nxp/ls/ls*.dts*
 arch/arm/boot/dts/nxp/vf/vf610-colibri*.dts*
 arch/arm/boot/dts/nxp/vf/vf610m*.dts*
 arch/arm/boot/dts/qcom/qcom-mdm9615*.dts*
 arch/arm/boot/dts/rockchip/rk*.dts
 arch/arm/boot/dts/socionext/uniphier-*.dts*
 arch/arm/boot/dts/st/stm*.dts*
 arch/arm/boot/dts/synaptics/berlin2*.dts*
 arch/arm64/boot/dts/allwinner/*.dts*
 arch/arm64/boot/dts/amlogic/*.dts*
 arch/arm64/boot/dts/cavium/thunder-*.dts*
 arch/arm64/boot/dts/freescale/fsl-*.dts*
 arch/arm64/boot/dts/marvell/armada-*.dts*
 arch/arm64/boot/dts/rockchip/rk33*.dts*
 arch/arm64/boot/dts/socionext/uniphier-ld*.dts*
 arch/arm64/boot/dts/synaptics/berlin4ct-*.dts*
 include/dt-bindings/clock/sun*.h
 include/dt-bindings/dma/axi-dmac.h
 include/dt-bindings/dma/sun4i-a10.h
 include/dt-bindings/pinctrl/sun4i-a10.h
 include/dt-bindings/reset/sun*.h
Copyright: 2012-2018 Linus Torvalds and many others
License: GPL-2+-or-X11

Files: fs/nls/mac-*
Copyright: 1991-2012 Unicode, Inc.
License: Unicode-data
 All rights reserved.  Distributed under the Terms of Use in
 http://www.unicode.org/copyright.html.
 .
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of the Unicode data files and any associated documentation (the "Data
 Files") or Unicode software and any associated documentation (the
 "Software") to deal in the Data Files or Software without restriction,
 including without limitation the rights to use, copy, modify, merge,
 publish, distribute, and/or sell copies of the Data Files or Software, and
 to permit persons to whom the Data Files or Software are furnished to do
 so, provided that (a) the above copyright notice(s) and this permission
 notice appear with all copies of the Data Files or Software, (b) both the
 above copyright notice(s) and this permission notice appear in associated
 documentation, and (c) there is clear notice in each modified Data File or
 in the Software as well as in the documentation associated with the Data
 File(s) or Software that the data or software has been modified.
 .
 THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
 KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
 THIRD PARTY RIGHTS.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS
 INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT
 OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
 USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
 OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THE DATA FILES OR SOFTWARE.
 .
 Except as contained in this notice, the name of a copyright holder shall
 not be used in advertising or otherwise to promote the sale, use or other
 dealings in these Data Files or Software without prior written
 authorization of the copyright holder.

Files: include/xen/interface/*
Copyright: 2002-2006 Keir Fraser
           2004 Tim Deegan
           2004 Andrew Warfield
           2005 Nguyen Anh Quynh
           2005-2006 IBM Corporation
           2005 Anthony Liguori
           2005 Rusty Russell
           2005-2006 XenSource Ltd.
           2006 Ian Campbell
           2006 Red Hat, Inc.
           2010 Ryan Wilson
License: Xen-interface
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to
 deal in the Software without restriction, including without limitation the
 rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 sell copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

Files: certs/extract-cert.c scripts/sign-file.c
Copyright: 2014-2015 Red Hat, Inc.
           2015 Intel Corporation
License: LGPL-2.1

Files: tools/lib/bpf/*
Copyright: 2015-2020 Linus Torvalds and many others
License: LGPL-2.1 or BSD-2-clause

Files: tools/bpf/bpftool/*
Copyright: 2017-2020 Linus Torvalds and many others
License: GPL-2 or BSD-2-clause

License: BSD-2-clause
  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are met:
  .
  1. Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
  .
  2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
  .
  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  POSSIBILITY OF SUCH DAMAGE.

License: GPL-2
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License version 2 as
 published by the Free Software Foundation.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General Public License version
 2 can be found in `/usr/share/common-licenses/GPL-2'.

License: LGPL-2.1
 This program is free software; you can redistribute it and/or modify it
 under the terms of the GNU Lesser General Public License as published by
 the Free Software Foundation; either version 2.1 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 Lesser General Public License for more details.
 .
 You should have received a copy of the GNU Lesser General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU Lesser General Public
 License version 2.1 can be found in `/usr/share/common-licenses/LGPL-2.1'.

License: GPL-2+-or-X11
 This file is dual-licensed: you can use it either under the terms
 of the GPL or the X11 license, at your option. Note that this dual
 licensing only applies to this file, and not this project as a
 whole.
 .
  a) This file is free software; you can redistribute it and/or
     modify it under the terms of the GNU General Public License as
     published by the Free Software Foundation; either version 2 of the
     License, or (at your option) any later version.
 .
     This file is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
 .
 Or, alternatively,
 .
  b) Permission is hereby granted, free of charge, to any person
     obtaining a copy of this software and associated documentation
     files (the "Software"), to deal in the Software without
     restriction, including without limitation the rights to use,
     copy, modify, merge, publish, distribute, sublicense, and/or
     sell copies of the Software, and to permit persons to whom the
     Software is furnished to do so, subject to the following
     conditions:
 .
     The above copyright notice and this permission notice shall be
     included in all copies or substantial portions of the Software.
 .
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
     OTHER DEALINGS IN THE SOFTWARE.