- Update to 5.4.296.
- ACPI: battery: negate current when discharging
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
- ACPI: PAD: fix crash in exit_round_robin()
- ACPICA: Avoid sequence overread in call to strncmp()
- ACPICA: fix acpi operand cache leak in dswstate.c
- ACPICA: fix acpi parse and parseext cache leaks
- ACPICA: Refuse to evaluate a method if arguments are missing
- ALSA: hda: Ignore unsol events for cards being shut down
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
- ALSA: sb: Force to disable DMAs once when DMA mode is changed
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
- amd-xgbe: align CL37 AN sequence as per databook
- aoe: clean device rq_list in aoedev_downdev()
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
- ata: pata_cs5536: fix build on 32-bit UML
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
- atm: atmtcp: Free invalid length skb in atmtcp_c_send().
- atm: clip: Fix infinite recursive call of clip_push().
- atm: clip: Fix memory leak of struct clip_vcc.
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
- atm: clip: Fix potential null-ptr-deref in to_atmarpd().
- atm: idt77252: Add missing `dma_map_error()`
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
- atm: Revert atm_account_tx() if copy_from_iter_full() fails.
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
- bnxt_en: Fix DCB ETS validation
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
- bpf: Fix WARN() in get_bpf_raw_tp_regs
- bpfilter: match bit size of bpfilter_umh to that of the kernel
- btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
- btrfs: fix missing error handling when searching for inode refs during log replay
- btrfs: propagate last_unlink_trans earlier when doing a rmdir
- btrfs: use btrfs_record_snapshot_destroy() during rmdir
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
- bus: fsl-mc: fix double-free on mc_dev
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
- calipso: Don't call calipso functions for AF_INET sk.
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
- calipso: unlock rcu before returning -EAFNOSUPPORT
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
- ceph: fix possible integer overflow in ceph_zero_objects()
- cifs: Fix cifs_query_path_info() for Windows NT servers
- clk: rockchip: rk3036: mark ddrphy as critical
- configfs: Do not override creating attribute file failure in populate_attrs()
- cpufreq: Force sync policy boost with global boost on sysfs update
- crypto: marvell/cesa - Avoid empty transfer descriptor
- crypto: marvell/cesa - Handle zero-length skcipher requests
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2
- dmaengine: xilinx_dma: Set dma_device directions
- dm-mirror: fix a tiny race condition
- dm-raid: fix variable in journal device check
- do_change_type(): refuse to operate on unmounted/not ours mounts
- dpaa2-eth: fix xdp_rxq_info leak
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
- drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
- drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
- drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
- drm/amdgpu/gfx10: fix CSIB handling
- drm/amdgpu/gfx6: fix CSIB handling
- drm/amdgpu/gfx7: fix CSIB handling
- drm/amdgpu/gfx8: fix CSIB handling
- drm/amdgpu/gfx9: fix CSIB handling
- drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
- drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
- drm/bridge: cdns-dsi: Check return value when getting default PHY config
- drm/bridge: cdns-dsi: Fix connecting to next bridge
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
- drm/exynos: fimd: Guard display clock control with runtime PM calls
- drm/i915/gt: Fix timeline left held on VMA alloc error
- drm/i915/selftests: Change mock_request() to return error pointers
- drm/msm/a6xx: Increase HFI response timeout
- drm/msm/hdmi: add runtime PM calls to DDC transfer function
- drm/nouveau/bl: increase buffer size to avoid truncate warning
- drm/sched: Increment job count before swapping tail spsc queue
- drm/tegra: Assign plane type before registration
- drm/tegra: rgb: Fix the unbound reference count
- drm/v3d: Disable interrupts before resetting the GPU
- drm/vkms: Adjust vkms_state->active_planes allocation type
- drm/vmwgfx: Add seqno waiter for sync_files
- EDAC/altera: Use correct write width with the INTTEST register
- EDAC/skx_common: Fix general protection fault
- emulex/benet: correct command version selection in be_cmd_get_stats()
- enic: fix incorrect MTU comparison in enic_change_mtu()
- erofs: remove unused trace event erofs_destroy_inode
- ethernet: atl1: Add missing DMA mapping error checks and count errors
- ext4: fix calculation of credits for extent tree modification
- ext4: inline: fix len overflow in ext4_prepare_inline_data
- f2fs: clean up w/ fscrypt_is_bounce_page()
- f2fs: fix to correct check conditions in f2fs_cross_rename
- f2fs: fix to do sanity check on sbi->total_valid_block_count
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image
- f2fs: use d_inode(dentry) cleanup dentry->d_inode
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
- firmware: psci: Fix refcount leak in psci_dt_init
- fix proc_sys_compare() handling of in-lookup dentries
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
- fs/filesystems: Fix potential unsigned integer underflow in fs_name()
- fs/jfs: consolidate sanity checking in dbMount
- ftrace: Fix UAF when lookup kallsym after ftrace disabled
- gfs2: gfs2_create_inode error handling fix
- gfs2: move msleep to sleepable context
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
- HID: wacom: fix kobject reference count leak
- HID: wacom: fix memory leak on kobject creation failure
- HID: wacom: fix memory leak on sysfs attribute creation failure
- hwmon: (occ) fix unaligned accesses
- i2c: designware: Invoke runtime suspend on quick slave re-registration
- i2c: robotfuzz-osif: disable zero-length read messages
- i2c: tiny-usb: disable zero-length read messages
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw
- i40e: retry VFLR handling if there is ongoing VF reset
- i40e: return false from i40e_reset_vf if reset is in progress
- ice: create new Tx scheduler nodes for new queues only
- iio: adc: ad7606_spi: fix reg write value mask
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp
- Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
- Input: ims-pcu - check record size in ims_pcu_flash_firmware()
- Input: synaptics-rmi - fix crash with unsupported versions of F34
- Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
- Input: xpad - add support for Amazon Game Controller
- Input: xpad - add VID for Turtle Beach controllers
- Input: xpad - support Acer NGR 200 Controller
- ipc: fix to protect IPCS lookups using RCU
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
- jffs2: check that raw node were preallocated before writing summary
- jfs: fix array-index-out-of-bounds read in add_missing_indices
- jfs: Fix null-ptr-deref in jfs_ioc_trim
- jfs: validate AG parameters in dbMount() to prevent crashes
- kbuild: add --target to correctly cross-compile UAPI headers with Clang
- kbuild: hdrcheck: fix cross build with clang
- kbuild: use -MMD instead of -MD to exclude system headers from dependency
- ktls, sockmap: Fix missing uncharge operation
- lib: test_objagg: Set error message in check_expect_hints_stats()
- Logitech C-270 even more broken
- mailbox: Not protect module_put with spin_lock_irqsave
- md/md-bitmap: fix dm-raid max_write_behind setting
- md/raid1: Fix stack memory use after return in raid1_reshape
- media: cxusb: no longer judge rbuf when the write fails
- media: cxusb: use dev_dbg() rather than hand-rolled debug
- media: gspca: Add error handling for stv06xx_read_sensor()
- media: omap3isp: use sgtable-based scatterlist wrappers
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
- media: tc358743: ignore video while HPD is low
- media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
- media: uvcvideo: Return the number of processed controls
- media: uvcvideo: Rollback non processed entities on error
- media: uvcvideo: Send control events for partial succeeds
- media: v4l2-dev: fix error handling in __video_register_device()
- media: vivid: Change the siize of the composing
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
- mfd: max14577: Fix wakeup source leaks on device unbind
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
- MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
- mm: fix ratelimit_pages update error in dirty_ratio_handler()
- mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode
- mm/huge_memory: fix dereferencing invalid pmd migration entry
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
- mtk-sd: Prevent memory corruption from DMA map failure
- mtk-sd: reset host->mrq on prepare_data() error
- net: appletalk: Fix device refcount leak in atrtr_create()
- net: atm: add lec_mutex
- net: atm: fix /proc/net/atm/lec handling
- net: ch9200: fix uninitialised access during mii_nway_restart
- net: dlink: add synchronization for stats update
- net: enetc: Correct endianness handling in _enetc_rd_reg64
- net: ipv6: Discard next-hop MTU less than minimum link MTU
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
- net: macb: Check return value of dma_set_mask_and_coherent()
- net: mdio: C22 is now optional, EOPNOTSUPP if not provided
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
- net: ncsi: Fix GCPS 64-bit member variables
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
- net: rose: Fix fall-through warnings for Clang
- net: usb: aqc111: debug info before sanitation
- net: usb: aqc111: fix error handling of usbnet read calls
- net: usb: qmi_wwan: add SIMCom 8230C composition
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
- netfilter: nft_socket: fix sk refcount leaks
- netlink: Fix rmem check in netlink_broadcast_deliver().
- netlink: Fix wraparounds of sk->sk_rmem_alloc.
- netlink: make sure we allow at least one dump skb
- net/mdiobus: Fix potential out-of-bounds read/write access
- net/mlx4_en: Prevent potential integer overflow calculating Hz
- net/mlx5: Fix return value when searching for existing flow group
- net/mlx5: Wait for inactive autogroups
- net/sched: Abort __tc_modify_qdisc if parent class does not exist
- net/sched: Always pass notifications when child class becomes empty
- net_sched: prio: fix a race in prio_tune()
- net_sched: red: fix a race in __red_change()
- net_sched: sch_sfq: fix a potential crash on gso_skb handling
- net_sched: tbf: fix a race in tbf_change()
- NFC: nci: uart: Set tty->disc_data only in success path
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
- NFSD: Fix ia_size underflow
- NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O
- nilfs2: add pointer check for nilfs_direct_propagate()
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
- nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
- nui: Fix dma_mapping_error() check
- of: Add of_property_present() helper
- of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
- ovl: Check for NULL d_inode() in ovl_dentry_upper()
- PCI: Add ACS quirk for Loongson PCIe
- PCI: Fix lock symmetry in pci_slot_unlock()
- perf: Fix sample vs do_exit()
- perf record: Fix incorrect --user-regs comments
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
- perf tests switch-tracking: Fix timestamp comparison
- perf ui browser hists: Set actions->thread before calling do_zoom_thread()
- perf/core: Fix broken throttling when max_samples_per_tick=1
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
- pinctrl: armada-37xx: set GPIO output value before setting direction
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
- pinctrl: at91: Fix possible out-of-boundary access
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts
- platform: Add Surface platform directory
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
- platform/x86: dell_rbu: Stop overwriting data buffer
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
- power: supply: bq27xxx: Retrieve again when busy
- proc: Clear the pieces of proc_inode that proc_evict_inode cares about
- pwm: mediatek: Ensure to disable clocks in error path
- RDMA/core: Create and destroy counters in the ib_core
- RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
- RDMA/mlx5: Fix CC counters query for MPV
- RDMA/mlx5: Fix vport loopback for MPV device
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
- regulator: gpio: Add input_supply support in gpio_regulator_config
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
- regulator: max14577: Add error check for max14577_read_reg()
- Revert "ACPI: battery: negate current when discharging"
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
- Revert "mmc: sdhci: Disable SD card clock before changing parameters"
- Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
- rose: fix dangling neighbour pointers in rose_rt_device_down()
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
- rtc: Fix offset calculation for .start_secs < 0
- rtc: Improve performance of rtc_time64_to_tm(). Add tests.
- rtc: Make rtc_time64_to_tm() support dates before 1970
- rtc: sh: assign correct interrupts with DT
- rtc: test: Fix invalid format specifier.
- rxrpc: Fix oops due to non-existence of prealloc backlog struct
- scsi: iscsi: Fix incorrect error path labels for flashnode operations
- scsi: lpfc: Use memcpy() for BIOS version
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
- scsi: storvsc: Increase the timeouts to storvsc_timeout
- scsi: ufs: core: Fix spelling of a sysfs attribute name
- sctp: Do not wake readers in __sctp_write_space()
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
- serial: Fix potential null-ptr-deref in mlb_usio_probe()
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
- soc: aspeed: lpc: Fix impossible judgment condition
- sock: Correct error checking condition for (assign|release)_proto_idx()
- spi: sh-msiof: Fix maximum DMA transfer size
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer
- spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
- spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
- Squashfs: check return result of sb_min_blocksize
- staging: iio: ad5933: Correct settling cycles encoding per datasheet
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
- sunrpc: update nextcheck time when adding new cache entries
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
- tee: Prevent size calculation wraparound on 32-bit kernels
- thunderbolt: Do not double dequeue a configuration request
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
- tipc: Fix use-after-free in tipc_conn_close().
- tty: serial: uartlite: register uart driver in init
- uio_hv_generic: Use correct size for interrupt and monitor pages
- um: ubd: Add missing error check in start_io_thread()
- usb: Add checks for snprintf() calls in usb_alloc_dev()
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
- usb: Flush altsetting 0 endpoints before reinitializating them after reset.
- usb: gadget: u_serial: Fix race condition in TTY wakeup
- usb: potential integer overflow in usbg_make_tpg()
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
- usb: renesas_usbhs: Reorder clock handling and power management in probe
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
- usb: typec: altmodes/displayport: do not index invalid pin_assignments
- usb: typec: displayport: Fix potential deadlock
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
- usb: usbtmc: Fix timeout value in get_stb
- vgacon: Add check for vc_origin address range in vgacon_scroll()
- VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
- vsock/vmci: Clear the vmci transport packet properly when initializing it
- vt: add missing notification when switching back to text mode
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
- vxlan: Do not treat dst cache initialization errors as fatal
- watchdog: da9052_wdt: respect TWDMIN
- wifi: ath6kl: remove WARN on bad firmware input
- wifi: ath9k_htc: Abort software beacon handling if disabled
- wifi: carl9170: do not ping device which has failed to load firmware
- wifi: mac80211: do not offer a mesh path if forwarding is disabled
- wifi: mac80211: drop invalid source address OCB frames
- wifi: mac80211: fix beacon interval calculation overflow
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
- wifi: rtw88: do not ignore hardware read error during DPK
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
- x86/boot/compressed: prefer cc-option for CFLAGS additions
- x86/cpu: Sanitize CPUID(0x80000000) output
- x86/mce: Don't remove sysfs if thresholding sysfs init fails
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
- x86/mce/amd: Fix threshold limit reset
- x86/mm: Disable hugetlb page table sharing on 32-bit
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
- xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create