Syzbot CI

Subject	5.15.224-rc1 review
Author	gregkh@linuxfoundation.org
Date	2026-10-28 16:52:28 +0000 UTC
Version
Cc	achill@achill.org akpm@linux-foundation.org broonie@kernel.org conor@kernel.org f.fainelli@gmail.com gregkh@linuxfoundation.org hargar@microsoft.com jonathanh@nvidia.com linux-kernel@vger.kernel.org linux@roeck-us.net lkft-triage@lists.linaro.org patches@kernelci.org patches@lists.linux.dev pavel@nabladev.com rwarsow@gmx.de shuah@kernel.org sr@sladewatkins.com stable@vger.kernel.org sudipm.mukherjee@gmail.com torvalds@linux-foundation.org

Name	Content [All]
[PATCH 5.15 001/571] tls: device: fix out-of-bounds write in tls_append_frag()	[Body]
[PATCH 5.15 002/571] apparmor: fix out-of-bounds write when null terminating a label vec	[Body]
[PATCH 5.15 003/571] device property: Add cleanup.h based fwnode_handle_put() scope based cleanup.	[Body]
[PATCH 5.15 004/571] device property: fix infinite loop in fwnode_for_each_child_node()	[Body]
[PATCH 5.15 005/571] nfsd: fix nfsd_file leak on inter-server COPY setup failure	[Body]
[PATCH 5.15 006/571] ceph: bound copied dentry name length in NFS export get_name	[Body]
[PATCH 5.15 007/571] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()	[Body]
[PATCH 5.15 008/571] HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind	[Body]
[PATCH 5.15 009/571] nouveau/gem: reserve the bo in the info ioctl around the vma lookup	[Body]
[PATCH 5.15 010/571] ocfs2: validate dx_root extent list fields during block read	[Body]
[PATCH 5.15 011/571] ocfs2: validate directory-index entry counts when reading metadata	[Body]
[PATCH 5.15 012/571] nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()	[Body]
[PATCH 5.15 013/571] nvme-tcp: fix host memory disclosure on R2T for a read command	[Body]
[PATCH 5.15 014/571] wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop	[Body]
[PATCH 5.15 015/571] usb: storage: realtek_cr: fix use-after-free on disconnect	[Body]
[PATCH 5.15 016/571] staging: rtl8723bs: fix spacing around operators	[Body]
[PATCH 5.15 017/571] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()	[Body]
[PATCH 5.15 018/571] ftrace: Take trace_array reference before accessing its ftrace_ops	[Body]
[PATCH 5.15 019/571] kprobes: Protect kprobe_blacklist with RCU	[Body]
[PATCH 5.15 020/571] nvme: add missing SRCU grace period in error path	[Body]
[PATCH 5.15 021/571] KVM: s390: Zero initialize data structures for inject_pfault_token	[Body]
[PATCH 5.15 022/571] scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak	[Body]
[PATCH 5.15 023/571] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking	[Body]
[PATCH 5.15 024/571] scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown	[Body]
[PATCH 5.15 025/571] scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]	[Body]
[PATCH 5.15 026/571] f2fs: embed f2fs_gc_kthread in f2fs_sb_info	[Body]
[PATCH 5.15 027/571] tick/broadcast: Plug clockevents replacement race	[Body]
[PATCH 5.15 028/571] Bluetooth: btqcomsmd: Convert to platform remove callback returning void	[Body]
[PATCH 5.15 029/571] Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev	[Body]
[PATCH 5.15 030/571] genetlink: pin family module during policy dump	[Body]
[PATCH 5.15 031/571] io_uring/rw: end write accounting from ->ki_complete	[Body]
[PATCH 5.15 032/571] net: bridge: use option bits for CFM/MRP frame handlers	[Body]
[PATCH 5.15 033/571] smb: client: reject userspace cifs.idmap descriptions	[Body]
[PATCH 5.15 034/571] smb: client: avoid leaking refcount in cifs_queue_oplock_break()	[Body]
[PATCH 5.15 035/571] smb: client: fix heap overflow in DACL owner/group rewrite	[Body]
[PATCH 5.15 036/571] ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling	[Body]
[PATCH 5.15 037/571] ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity	[Body]
[PATCH 5.15 038/571] wifi: libipw: reject TKIP frames without a full MIC	[Body]
[PATCH 5.15 039/571] smb: client: fix potential OOB read in smb3_enum_snapshots()	[Body]
[PATCH 5.15 040/571] smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs	[Body]
[PATCH 5.15 041/571] smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()	[Body]
[PATCH 5.15 042/571] vlan: require the MAC header to be present in __vlan_insert_inner_tag()	[Body]
[PATCH 5.15 043/571] perf tools: Fix a asan issue in parse_events_multi_pmu_add()	[Body]
[PATCH 5.15 044/571] perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg	[Body]
[PATCH 5.15 045/571] usb: xhci: bail out of setup if the controller is inaccessible	[Body]
[PATCH 5.15 046/571] gtp: serialize PDP context updates	[Body]
[PATCH 5.15 047/571] KEYS: trusted: Fix TPM teardown ordering	[Body]
[PATCH 5.15 048/571] zram: fixup read_block_state()	[Body]
[PATCH 5.15 049/571] zram: fix out-of-bounds access in read_block_state()	[Body]
[PATCH 5.15 050/571] nfsd: release path refs on follow_down() error	[Body]
[PATCH 5.15 051/571] nfsd: size fh_verify server sockaddr slot by xpt_locallen	[Body]
[PATCH 5.15 052/571] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()	[Body]
[PATCH 5.15 053/571] nfsd: fix clock domain mismatch in clients_still_reclaiming()	[Body]
[PATCH 5.15 054/571] nfsd: gate nfs2 setacl by argp->mask	[Body]
[PATCH 5.15 055/571] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0	[Body]
[PATCH 5.15 056/571] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior	[Body]
[PATCH 5.15 057/571] kernel/params.c: Use kstrtobool() instead of strtobool()	[Body]
[PATCH 5.15 058/571] params: Do not go over the limit when getting the string length	[Body]
[PATCH 5.15 059/571] params: Use size_add() for kmalloc()	[Body]
[PATCH 5.15 060/571] params: Sort headers	[Body]
[PATCH 5.15 061/571] params: Fix multi-line comment style	[Body]
[PATCH 5.15 062/571] params: fix charp corruption on allocation failure	[Body]
[PATCH 5.15 063/571] dmaengine: Add devm_dma_request_chan()	[Body]
[PATCH 5.15 064/571] i2c: mxs: fix DMA channel leak on probe error	[Body]
[PATCH 5.15 065/571] lockd: fix swapped arguments in nlmsvc_match_ip()	[Body]
[PATCH 5.15 066/571] power: supply: rt9455: Convert to i2cs .probe_new()	[Body]
[PATCH 5.15 067/571] power: supply: rt9455: quiesce delayed work before teardown	[Body]
[PATCH 5.15 068/571] i2c: core: Introduce i2c_client_get_device_id helper function	[Body]
[PATCH 5.15 069/571] power: supply: max17040: Convert to i2cs .probe_new()	[Body]
[PATCH 5.15 070/571] power: supply: max17040: drop incorrect I2C functionality check	[Body]
[PATCH 5.15 071/571] mmc: via-sdmmc: cancel card-detect work on remove	[Body]
[PATCH 5.15 072/571] hwrng: stm32 - Fix runtime PM cleanup on registration failure	[Body]
[PATCH 5.15 073/571] i3c: master: Do not treat master device as a duplicate target	[Body]
[PATCH 5.15 074/571] i3c: master: Fix use-after-free of master->this	[Body]
[PATCH 5.15 075/571] usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()	[Body]
[PATCH 5.15 076/571] spi: bcm63xx: disable clock on resume failure	[Body]
[PATCH 5.15 077/571] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()	[Body]
[PATCH 5.15 078/571] ftrace: Synchronize the initialization of ftrace_ops	[Body]
[PATCH 5.15 079/571] arm64: allow pte_offset_map() to fail	[Body]
[PATCH 5.15 080/571] arm64: mm: Fix the lockless page-table walk in show_pte()	[Body]
[PATCH 5.15 081/571] mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP	[Body]
[PATCH 5.15 082/571] media: rkvdec: Propagate platform_get_irq() errors	[Body]
[PATCH 5.15 083/571] media: saa7164: fix cleanup on resource allocation failure	[Body]
[PATCH 5.15 084/571] media: zoran: Avoid freeing a registered video_device twice	[Body]
[PATCH 5.15 085/571] scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path	[Body]
[PATCH 5.15 086/571] scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate	[Body]
[PATCH 5.15 087/571] scsi: qla2xxx: Quiesce response IRQ before freeing request queue	[Body]
[PATCH 5.15 088/571] scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot	[Body]
[PATCH 5.15 089/571] scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature	[Body]
[PATCH 5.15 090/571] f2fs: limit recovery filename logging to stored length	[Body]
[PATCH 5.15 091/571] f2fs: fix dentry folio leak in find_in_level	[Body]
[PATCH 5.15 092/571] ipmr: account multicast table and route memory	[Body]
[PATCH 5.15 093/571] net/sched: act_api: release all action references on NEWACTION failure	[Body]
[PATCH 5.15 094/571] ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()	[Body]
[PATCH 5.15 095/571] smb: client: fix file type corruption in cifs_reparse_point_to_fattr()	[Body]
[PATCH 5.15 096/571] smb: client: fix cifsFileInfo reference leak in deferred close	[Body]
[PATCH 5.15 097/571] smb: client: avoid leaking refcount when cifs_sb_tlink() fails	[Body]
[PATCH 5.15 098/571] ALSA: virtio: reset device before deleting virtqueues	[Body]
[PATCH 5.15 099/571] btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()	[Body]
[PATCH 5.15 100/571] watchdog: rtd119x: Use devm_clk_get_enabled() helper	[Body]
[PATCH 5.15 101/571] watchdog: rtd119x: Avoid division by zero	[Body]
[PATCH 5.15 102/571] hwmon: (pwm-fan) Stop RPM timer before freeing tach data	[Body]
[PATCH 5.15 103/571] wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown	[Body]
[PATCH 5.15 104/571] smb: client: fix smbd_connection leak on cifs_get_tcp_session() error	[Body]
[PATCH 5.15 105/571] bna: prevent IOC timer rearm during teardown	[Body]
[PATCH 5.15 106/571] tcp: prevent collapsing skbs across boundary in rtx queue	[Body]
[PATCH 5.15 107/571] drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()	[Body]
[PATCH 5.15 108/571] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities	[Body]
[PATCH 5.15 109/571] mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish	[Body]
[PATCH 5.15 110/571] net: openvswitch: conntrack: fix helper UAF due to extensions realloc	[Body]
[PATCH 5.15 111/571] smb3: make query_on_disk_id open context consistent and move to common code	[Body]
[PATCH 5.15 112/571] smb: client: fix create context out-of-bounds reads	[Body]
[PATCH 5.15 113/571] net: ipconfig: Remove outdated comment and indent code block	[Body]
[PATCH 5.15 114/571] net: ipconfig: bound DHCP option construction	[Body]
[PATCH 5.15 115/571] pinctrl: sunxi: Refactor register/offset calculation	[Body]
[PATCH 5.15 116/571] pinctrl: sunxi: Use devm_clk_get_enabled() helpers	[Body]
[PATCH 5.15 117/571] pinctrl: sunxi: keep a shadow copy of the data register output latches	[Body]
[PATCH 5.15 118/571] net: ena: Remove autopolling mode	[Body]
[PATCH 5.15 119/571] net: ena: fix MMIO read buffer leak on probe failure	[Body]
[PATCH 5.15 120/571] netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST	[Body]
[PATCH 5.15 121/571] netfilter: nf_tables: skip expired catchall elements on insert and delete	[Body]
[PATCH 5.15 122/571] smb: client: use finish_no_open() for non-regular inodes	[Body]
[PATCH 5.15 123/571] smb: client: validate POSIX create context length	[Body]
[PATCH 5.15 124/571] Bluetooth: mgmt: fix race in read_unconf_index_list()	[Body]
[PATCH 5.15 125/571] Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table	[Body]
[PATCH 5.15 126/571] HID: core: remove #ifdef CONFIG_PM from hid_driver	[Body]
[PATCH 5.15 127/571] HID: hid-alps: use default remove for hid device	[Body]
[PATCH 5.15 128/571] HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM	[Body]
[PATCH 5.15 129/571] HID: alps: unregister DualPoint Stick input device on remove	[Body]
[PATCH 5.15 130/571] smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()	[Body]
[PATCH 5.15 131/571] smb/client: pass cifs_open_info_data to SMB2_open()	[Body]
[PATCH 5.15 132/571] smb: client: close handle after create-context parsing failure	[Body]
[PATCH 5.15 133/571] smb: client: close completed creates on compound wait errors	[Body]
[PATCH 5.15 134/571] ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices	[Body]
[PATCH 5.15 135/571] audit: fix exe mark UAF in kill_rules()	[Body]
[PATCH 5.15 136/571] of/irq: Fix remaining refcount leaks in of_irq_init()	[Body]
[PATCH 5.15 137/571] of/overlay: put property on deadprops only after changeset add succeeds	[Body]
[PATCH 5.15 138/571] of/overlay: only treat a positive changeset id as registered	[Body]
[PATCH 5.15 139/571] netfilter: nft_flow_offload: drop flowtable reference on init error path	[Body]
[PATCH 5.15 140/571] net/packet: prevent TX_RING byte count overflow	[Body]
[PATCH 5.15 141/571] rtc: spear: initialize IRQ state before requesting alarm IRQ	[Body]
[PATCH 5.15 142/571] sctp: check RCV_SHUTDOWN after the sendmsg connect wait	[Body]
[PATCH 5.15 143/571] wifi: cfg80211: avoid double free if updating BSS fails	[Body]
[PATCH 5.15 144/571] drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs	[Body]
[PATCH 5.15 145/571] drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails	[Body]
[PATCH 5.15 146/571] openvswitch: add nf_ct_is_confirmed check before assigning the helper	[Body]
[PATCH 5.15 147/571] rds_tcp: close NULL deref window in rds_tcp_set_callbacks	[Body]
[PATCH 5.15 148/571] vxlan: use one headroom snapshot for neighbour replies	[Body]
[PATCH 5.15 149/571] of/irq: add missing of_node_put() for interrupt parent node	[Body]
[PATCH 5.15 150/571] vt: skip screen update for DEC alignment test on backgroup consoles	[Body]
[PATCH 5.15 151/571] ALSA: caiaq: unregister the input device when probe fails	[Body]
[PATCH 5.15 152/571] ALSA: line6: reject oversized playback packets	[Body]
[PATCH 5.15 153/571] perf/core: Fix WARN in perf_sigtrap()	[Body]
[PATCH 5.15 154/571] watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger	[Body]
[PATCH 5.15 155/571] hsr: Remove WARN_ONCE() in hsr_addr_is_self().	[Body]
[PATCH 5.15 156/571] scsi: qla2xxx: Initialize NVMe abort_work once at submission	[Body]
[PATCH 5.15 157/571] scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort	[Body]
[PATCH 5.15 158/571] mtd: core: clear out unregistered devices a bit more	[Body]
[PATCH 5.15 159/571] mtd: core: Drop duplicate NULL checks around nvmem_unregister()	[Body]
[PATCH 5.15 160/571] mtd: core: Fix refcount error in del_mtd_device()	[Body]
[PATCH 5.15 161/571] mtd: use refcount to prevent corruption	[Body]
[PATCH 5.15 162/571] mtd: call external _get and _put in right order	[Body]
[PATCH 5.15 163/571] mtd: core: call _get_device() with the master MTD	[Body]
[PATCH 5.15 164/571] nvmet: preserve device path on allocation failure	[Body]
[PATCH 5.15 165/571] of/overlay: dont leak fragment references when changeset init fails	[Body]
[PATCH 5.15 166/571] of/overlay: dont create "//" paths for fragments targeting the root	[Body]
[PATCH 5.15 167/571] ASoC: wm8903: Move the DRC QR threshold to the register that holds it	[Body]
[PATCH 5.15 168/571] wifi: ath11k: reset ar->num_stations on hardware start	[Body]
[PATCH 5.15 169/571] wifi: cfg80211: preserve hidden-group beacon IE ownership	[Body]
[PATCH 5.15 170/571] ASoC: codecs: rt274: Fix format setting for 44100 rate	[Body]
[PATCH 5.15 171/571] Bluetooth: hci_core: free the HCI ID if naming fails	[Body]
[PATCH 5.15 172/571] Bluetooth: btintel: validate DDC record lengths	[Body]
[PATCH 5.15 173/571] mctp: Add refcounts to mctp_dev	[Body]
[PATCH 5.15 174/571] net/mctp: publish the mctp_dev only after it is initialised	[Body]
[PATCH 5.15 175/571] net/sched: cls_api: reclaim an empty proto on the error path	[Body]
[PATCH 5.15 176/571] netfilter: ipset: do not update comments from kernel-side adds	[Body]
[PATCH 5.15 177/571] net: systemport: Fix RUNT MIB counter register offset calculation	[Body]
[PATCH 5.15 178/571] tipc: prevent GCM nonce reuse on peer key changes	[Body]
[PATCH 5.15 179/571] net/sched: fq_codel: match the no-drop threshold to the packet size	[Body]
[PATCH 5.15 180/571] net/sched: sch_codel: match the no-drop threshold to the packet size	[Body]
[PATCH 5.15 181/571] tcp: refresh TS.Recent for accepted old ACKs	[Body]
[PATCH 5.15 182/571] ipvs: fix missing counter decrement in lblc	[Body]
[PATCH 5.15 183/571] ipvs: do not create invisible templates	[Body]
[PATCH 5.15 184/571] ipvs: filter some flags received in the backup server	[Body]
[PATCH 5.15 185/571] netfilter: nf_tables: avoid skb access on nf_stolen	[Body]
[PATCH 5.15 186/571] net: add and use skb_get_hash_net	[Body]
[PATCH 5.15 187/571] ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()	[Body]
[PATCH 5.15 188/571] i2c: at91: release DMA channels when probe defers	[Body]
[PATCH 5.15 189/571] perf: Fix race between perf_event_exit_task() and perf_pending_task()	[Body]
[PATCH 5.15 190/571] PCI: Accept AtomicOps already enabled by the hypervisor	[Body]
[PATCH 5.15 191/571] drm/radeon: Read the VRAM VBIOS signature with readb()	[Body]
[PATCH 5.15 192/571] kgdboc: Fix tty driver reference leak in configure_kgdboc()	[Body]
[PATCH 5.15 193/571] Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11	[Body]
[PATCH 5.15 194/571] Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410	[Body]
[PATCH 5.15 195/571] Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490	[Body]
[PATCH 5.15 196/571] Input: synaptics - limit T440p InterTouch quirk to LEN0036	[Body]
[PATCH 5.15 197/571] nitro_enclaves: fix use-after-free on SLOT_ALLOC failure	[Body]
[PATCH 5.15 198/571] USB: cdc-acm: fix racy TIOCMIWAIT implementation	[Body]
[PATCH 5.15 199/571] USB: serial: fix port tear down use-after-free	[Body]
[PATCH 5.15 200/571] usb: storage: sierra_ms: reject short SWoC info transfers	[Body]
[PATCH 5.15 201/571] usb: hub: use shorter 120ms post resume hold for SS root hubs	[Body]
[PATCH 5.15 202/571] usb: ohci-da8xx: disable controller wakeup on cleanup	[Body]
[PATCH 5.15 203/571] usb: ohci-s3c2410: disable controller wakeup on removal	[Body]
[PATCH 5.15 204/571] usb: ohci-st: disable controller wakeup on removal	[Body]
[PATCH 5.15 205/571] usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd	[Body]
[PATCH 5.15 206/571] usb: gadget: aspeed-vhub: cancel wake work on device removal	[Body]
[PATCH 5.15 207/571] USB: gadget: dummy-hcd: Fix wait for outstanding request completions	[Body]
[PATCH 5.15 208/571] usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC	[Body]
[PATCH 5.15 209/571] usb: core: clear both ep_in and ep_out for non-ep0 control endpoints	[Body]
[PATCH 5.15 210/571] usb: typec: tcpm: recover after failure to start the frs ams	[Body]
[PATCH 5.15 211/571] usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()	[Body]
[PATCH 5.15 212/571] usb: typec: ucsi: Get the connector fwnode based on reg value	[Body]
[PATCH 5.15 213/571] usb: typec: ucsi: displayport: Current CAM OOB index fixup	[Body]
[PATCH 5.15 214/571] usb: cdns3: fix use-after-free in cdns3_gadget_exit()	[Body]
[PATCH 5.15 215/571] usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe	[Body]
[PATCH 5.15 216/571] tty: amiserial: fix broken TIOCMIWAIT	[Body]
[PATCH 5.15 217/571] tty: vcc: zero-initialize control packet in vcc_send_ctl()	[Body]
[PATCH 5.15 218/571] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup	[Body]
[PATCH 5.15 219/571] tty: serial: qcom_geni_serial: Keep console RX functional after deep idle	[Body]
[PATCH 5.15 220/571] serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()	[Body]
[PATCH 5.15 221/571] serial: tegra: dont clear the Tx FIFO on an Rx-only reset	[Body]
[PATCH 5.15 222/571] serial: vt8500: Fix clock reference leak in vt8500_serial_probe()	[Body]
[PATCH 5.15 223/571] ASoC: qcom: lpass-cpu: use DAI table index for playback constraints	[Body]
[PATCH 5.15 224/571] ALSA: ua101: reject mismatched capture/playback packet sizes	[Body]
[PATCH 5.15 225/571] Bluetooth: RFCOMM: Fix initial port reference race	[Body]
[PATCH 5.15 226/571] Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems	[Body]
[PATCH 5.15 227/571] Bluetooth: hci_core: Serialize ACL scheduling with channel deletion	[Body]
[PATCH 5.15 228/571] Bluetooth: btintel: fix buffer over-read in btintel_hw_error()	[Body]
[PATCH 5.15 229/571] ipvs: bound LBLCR and LBLC cache growth	[Body]
[PATCH 5.15 230/571] kprobes: Skip disarmed probes when checking optkprobe overlap	[Body]
[PATCH 5.15 231/571] nvme-multipath: fix underflow in ANA log bounds checks	[Body]
[PATCH 5.15 232/571] mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ	[Body]
[PATCH 5.15 233/571] mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB	[Body]
[PATCH 5.15 234/571] mtd: spinand: fix zero oobavail when no ECC engine is used	[Body]
[PATCH 5.15 235/571] wifi: cw1200: fix TX padding OOB read leaking heap data to device	[Body]
[PATCH 5.15 236/571] wifi: iwlegacy: 3945: free EEPROM data on remove	[Body]
[PATCH 5.15 237/571] wifi: mac80211: drain PS delivery work during station teardown	[Body]
[PATCH 5.15 238/571] wifi: mac80211: minstrel_ht: validate fixed rate index	[Body]
[PATCH 5.15 239/571] wifi: mac80211: release mesh path quota on failed additions	[Body]
[PATCH 5.15 240/571] wifi: mac80211: handle empty FILS association request payload	[Body]
[PATCH 5.15 241/571] USB: serial: cp210x: add Corsair AX1500i Power Supply	[Body]
[PATCH 5.15 242/571] USB: serial: quatech2: fix baud rate overflow	[Body]
[PATCH 5.15 243/571] USB: serial: ssu100: fix baud rate overflow	[Body]
[PATCH 5.15 244/571] USB: serial: fix dynamic id driver deregistration race	[Body]
[PATCH 5.15 245/571] USB: serial: option: add support for SIMCom SIM8260C	[Body]
[PATCH 5.15 246/571] USB: serial: option: add Quectel EG060W	[Body]
[PATCH 5.15 247/571] USB: serial: option: add Compal EXM-G1x support	[Body]
[PATCH 5.15 248/571] USB: serial: option: add Quectel RG660QB	[Body]
[PATCH 5.15 249/571] USB: serial: option: add Compal EXC-T1 support	[Body]
[PATCH 5.15 250/571] thunderbolt: Reject oversized XDomain properties responses	[Body]
[PATCH 5.15 251/571] iio: accel: kxcjk-1013: reject duplicate event disable	[Body]
[PATCH 5.15 252/571] iio: accel: sca3000: fix frequency divider condition check	[Body]
[PATCH 5.15 253/571] iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure	[Body]
[PATCH 5.15 254/571] iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls	[Body]
[PATCH 5.15 255/571] iio: gyro: adis16136: fix unprotected debugfs reads	[Body]
[PATCH 5.15 256/571] iio: imu: adis16400: fix unprotected debugfs reads	[Body]
[PATCH 5.15 257/571] iio: imu: adis16480: fix unprotected debugfs reads	[Body]
[PATCH 5.15 258/571] iio: light: gp2ap020a00f: drain irq_work after free_irq	[Body]
[PATCH 5.15 259/571] iio: proximity: isl29501: Fix return type of isl29501_register_write	[Body]
[PATCH 5.15 260/571] iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure	[Body]
[PATCH 5.15 261/571] iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler	[Body]
[PATCH 5.15 262/571] iio: trigger: cancel reenable_work before freeing trigger	[Body]
[PATCH 5.15 263/571] net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode	[Body]
[PATCH 5.15 264/571] Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones"	[Body]
[PATCH 5.15 265/571] Input: exc3000 - properly stop timer on shutdown	[Body]
[PATCH 5.15 266/571] arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved	[Body]
[PATCH 5.15 267/571] drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read	[Body]
[PATCH 5.15 268/571] SUNRPC: fix gssx_dec_option_array error path bugs	[Body]
[PATCH 5.15 269/571] SUNRPC: reject duplicate CREDS_VALUE options	[Body]
[PATCH 5.15 270/571] vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF	[Body]
[PATCH 5.15 271/571] mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages	[Body]
[PATCH 5.15 272/571] smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races	[Body]
[PATCH 5.15 273/571] wifi: wl12xx: Drop if with an always false condition	[Body]
[PATCH 5.15 274/571] wifi: wlcore: Convert to platform remove callback returning void	[Body]
[PATCH 5.15 275/571] wifi: wlcore: Fix runtime PM leak in wlcore_remove()	[Body]
[PATCH 5.15 276/571] RDMA/hns: Fix WQ_MEM_RECLAIM warning	[Body]
[PATCH 5.15 277/571] vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().	[Body]
[PATCH 5.15 278/571] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response	[Body]
[PATCH 5.15 279/571] net: usb: qmi_wwan: add Quectel EG120K-EA	[Body]
[PATCH 5.15 280/571] serial: imx: Convert to platform remove callback returning void	[Body]
[PATCH 5.15 281/571] serial: imx: serialize imx_uart_ports[] lifetime	[Body]
[PATCH 5.15 282/571] usb: gadget: at91_udc: Convert to platform remove callback returning void	[Body]
[PATCH 5.15 283/571] usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed	[Body]
[PATCH 5.15 284/571] usb: typec: tcpm: fix debug accessory mode detection for sink ports	[Body]
[PATCH 5.15 285/571] usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling	[Body]
[PATCH 5.15 286/571] xen/netfront: drop RX packets with a short Ethernet header	[Body]
[PATCH 5.15 287/571] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions	[Body]
[PATCH 5.15 288/571] drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC	[Body]
[PATCH 5.15 289/571] soc: qcom: geni-se: Correct QUP Core ICC vote constants	[Body]
[PATCH 5.15 290/571] usb: dwc3: gadget: fix IRQ storm on invalid event buffer count	[Body]
[PATCH 5.15 291/571] tty: fix saved termios reset race	[Body]
[PATCH 5.15 292/571] perf: Require kernel access for text poke events	[Body]
[PATCH 5.15 293/571] ALSA: seq: Serialize compat port-info ioctls	[Body]
[PATCH 5.15 294/571] arm64: errata: Factor out broken AMU const counter cap	[Body]
[PATCH 5.15 295/571] arm64: errata: Add Cortex-A725 erratum 3821522 workaround	[Body]
[PATCH 5.15 296/571] iio: buffer: serialize buffer teardown with mode claims	[Body]
[PATCH 5.15 297/571] KVM: arm64: Dont use the VMA to size stage-2 block mappings for VM_PFNMAP	[Body]
[PATCH 5.15 298/571] fsverity: add dependency on 64K or smaller pages	[Body]
[PATCH 5.15 299/571] drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend	[Body]
[PATCH 5.15 300/571] drm/amd/pm/si: Fix updating clock limits on AC/DC	[Body]
[PATCH 5.15 301/571] drm/amdgpu: reset VI ASIC on MacBookPro15,1	[Body]
[PATCH 5.15 302/571] drm/amdgpu: reset VI ASIC on MacBookPro14,3	[Body]
[PATCH 5.15 303/571] drm/amdgpu: fix for coding style issues	[Body]
[PATCH 5.15 304/571] drm/amdgpu: fix ACP MFD device leak on init failure	[Body]
[PATCH 5.15 305/571] drm/amdgpu/gfx6: fix firmware leak on teardown	[Body]
[PATCH 5.15 306/571] usb: octeon-hcd: fix the FIFO-flush timeout computation	[Body]
[PATCH 5.15 307/571] usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()	[Body]
[PATCH 5.15 308/571] usb: ohci-spear: disable controller wakeup on removal	[Body]
[PATCH 5.15 309/571] USB: dwc2: shut down wakeup timer before freeing HCD state	[Body]
[PATCH 5.15 310/571] usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41	[Body]
[PATCH 5.15 311/571] tty: tty_port: restore TTY_IO_ERROR on activation failure	[Body]
[PATCH 5.15 312/571] tty: reformat kernel-doc in tty_io.c	[Body]
[PATCH 5.15 313/571] tty: abort break signalling on hangup	[Body]
[PATCH 5.15 314/571] tty: serial: max3100: shut down timer before freeing port	[Body]
[PATCH 5.15 315/571] Input: s6sy761 - fix resume ordering and restore sensing	[Body]
[PATCH 5.15 316/571] tty: vt: fix memory leak in vc_allocate()	[Body]
[PATCH 5.15 317/571] serial: fix TIOCMIWAIT race	[Body]
[PATCH 5.15 318/571] drm/amd/display: Mark DCE 6.4 as not APU	[Body]
[PATCH 5.15 319/571] wifi: mac80211: shut down RX BA session timer on teardown	[Body]
[PATCH 5.15 320/571] wifi: mac80211: keep fallback association elements alive	[Body]
[PATCH 5.15 321/571] thunderbolt: Fix KASAN reported use-after-free when request is canceled	[Body]
[PATCH 5.15 322/571] USB: serial: fix ioctl hangup race	[Body]
[PATCH 5.15 323/571] mtd: block2mtd: Fix divide error when erase_size is zero	[Body]
[PATCH 5.15 324/571] mtd: spinand: Enable QE on all dies	[Body]
[PATCH 5.15 325/571] wifi: mac80211: account proxy paths against the mesh path limit	[Body]
[PATCH 5.15 326/571] USB: serial: clean up core error labels	[Body]
[PATCH 5.15 327/571] USB: serial: fix driver deregistration order	[Body]
[PATCH 5.15 328/571] bnxt_en: fix DMA mapping length for padded small packets	[Body]
[PATCH 5.15 329/571] tty: introduce and use tty_port_tty_vhangup() helper	[Body]
[PATCH 5.15 330/571] tty: port: fix tty_port_tty_vhangup() race	[Body]
[PATCH 5.15 331/571] wifi: mac80211: keep paired old chanctx alive	[Body]
[PATCH 5.15 332/571] wifi: mac80211: count only matching reservations in reserved switch	[Body]
[PATCH 5.15 333/571] fs: Free any excess xarray nodes in clear_inode()	[Body]
[PATCH 5.15 334/571] mm/hugetlb: fix avoid_reserve to allow taking folio from subpool	[Body]
[PATCH 5.15 335/571] KVM: SVM: Use the active VMCBs MSR bitmap when checking if MSR is intercepted	[Body]
[PATCH 5.15 336/571] wifi: mac80211: set info->band for 802.3 encap offload frames	[Body]
[PATCH 5.15 337/571] smb: client: discard post-EOF pagecache when extending a file via zero range	[Body]
[PATCH 5.15 338/571] iio: adc: aspeed: propagate reset deassert errors	[Body]
[PATCH 5.15 339/571] iio: adc: max1363: sign-extend bipolar differential channel reads	[Body]
[PATCH 5.15 340/571] HID: core: introduce hid_safe_input_report()	[Body]
[PATCH 5.15 341/571] HID: uhid: convert to hid_safe_input_report()	[Body]
[PATCH 5.15 342/571] crypto: drbg - Fix ineffective sanity check	[Body]
[PATCH 5.15 343/571] ipv4: stop PMTU walk when nexthop group shrinks	[Body]
[PATCH 5.15 344/571] ipv4: stop route notification sizing when nexthop group shrinks	[Body]
[PATCH 5.15 345/571] ipv4: do not warn on route notification size race	[Body]
[PATCH 5.15 346/571] ipv6: do not warn on route notification size race	[Body]
[PATCH 5.15 347/571] btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()	[Body]
[PATCH 5.15 348/571] dm ioctl: dont let data_start run past the buffer	[Body]
[PATCH 5.15 349/571] wifi: brcmfmac: fix P2P device removal race in brcmf_detach()	[Body]
[PATCH 5.15 350/571] wireguard: noise: reject response consumption after intermediate initiation	[Body]
[PATCH 5.15 351/571] workqueue: Fix NULL current_pwq deref in chained work check	[Body]
[PATCH 5.15 352/571] xen/netfront: dont leak the skb when xennet_fill_frags() fails	[Body]
[PATCH 5.15 353/571] strparser: make sure __strp_recv isnt running before tearing down the parser	[Body]
[PATCH 5.15 354/571] tipc: destroy topsrv workqueues before closing connections	[Body]
[PATCH 5.15 355/571] tipc: hold a reference to nodes found by link name	[Body]
[PATCH 5.15 356/571] Revert "wifi: libertas: reject short monitor TX frames"	[Body]
[PATCH 5.15 357/571] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts	[Body]
[PATCH 5.15 358/571] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute	[Body]
[PATCH 5.15 359/571] gpio: xilinx: fix runtime PM leak on request error path	[Body]
[PATCH 5.15 360/571] ibmveth: h_free logical LAN on open-fail after register	[Body]
[PATCH 5.15 361/571] keys: finalize persistent keyring timeout after link attempt	[Body]
[PATCH 5.15 362/571] KEYS: Fix add_key() race with keyring restriction	[Body]
[PATCH 5.15 363/571] memstick: core: wait for request completion before freeing card	[Body]
[PATCH 5.15 364/571] memstick: rtsx_usb_ms: complete requests after eject instead of dropping them	[Body]
[PATCH 5.15 365/571] dm-crypt: reject the lmk IV mode with AEAD ciphers	[Body]
[PATCH 5.15 366/571] dm-snap: reject the transient exception store for snapshot-merge	[Body]
[PATCH 5.15 367/571] mmc: cavium-octeon: destroy slot platform devices on remove	[Body]
[PATCH 5.15 368/571] mmc: cavium-thunderx: destroy slot platform devices on remove	[Body]
[PATCH 5.15 369/571] mmc: mtk-sd: Cancel request timeout work on remove	[Body]
[PATCH 5.15 370/571] mmc: sdhci-sprd: disable runtime PM on remove	[Body]
[PATCH 5.15 371/571] net/packet: guard the ll header push in packet_rcv_spkt()	[Body]
[PATCH 5.15 372/571] net/smc: protect clcsock lifetime in smc_getname	[Body]
[PATCH 5.15 373/571] net: bridge: avoid recursive multicast port cleanup	[Body]
[PATCH 5.15 374/571] net: usb: ax88179_178a: fix rx frame length for non-last packets	[Body]
[PATCH 5.15 375/571] nvme: fix swapped ZRASF zone state values for full and read only	[Body]
[PATCH 5.15 376/571] openvswitch: fix soft lockup in the netlink flow dump	[Body]
[PATCH 5.15 377/571] regulator: ltc3676: dont read the write-only HRST and CLIRQ registers	[Body]
[PATCH 5.15 378/571] scsi: qedi: Initialize callback state before registration	[Body]
[PATCH 5.15 379/571] Bluetooth: hci_sock: Serialize dead-device detachment	[Body]
[PATCH 5.15 380/571] Bluetooth: RFCOMM: free the skb when the DLC has no owner	[Body]
[PATCH 5.15 381/571] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown	[Body]
[PATCH 5.15 382/571] drm/gud: dont keep a connector without a CRTC as connector_state	[Body]
[PATCH 5.15 383/571] drm/i915/gem: Prevent overstepping exec array boundary	[Body]
[PATCH 5.15 384/571] drm/vc4: drain the hangcheck timer and works on V3D unbind	[Body]
[PATCH 5.15 385/571] drm/amdgpu: make Mac FB workaround generic	[Body]
[PATCH 5.15 386/571] fs: refuse fspick() on internal superblocks	[Body]
[PATCH 5.15 387/571] namespace: check a submount for references right before unmounting it	[Body]
[PATCH 5.15 388/571] dcache: dont put a mountpoint on a dentry thats being removed	[Body]
[PATCH 5.15 389/571] namespace: refuse an automount below a mount that is in no namespace	[Body]
[PATCH 5.15 390/571] drm/dp: dont mark the AUX backlight enabled when enabling failed	[Body]
[PATCH 5.15 391/571] gpio: exar: initialize the ID before registering its cleanup	[Body]
[PATCH 5.15 392/571] drm/aspeed: Balance the display clock enable on teardown	[Body]
[PATCH 5.15 393/571] drm/vc4: Free the BO cache size list on teardown	[Body]
[PATCH 5.15 394/571] net/sched: em_text: reject unterminated algo before autoload	[Body]
[PATCH 5.15 395/571] cxgb4/ch_ktls: disable softirqs around tid_list erases	[Body]
[PATCH 5.15 396/571] nvmet: use the local P2P device on metadata allocation failure	[Body]
[PATCH 5.15 397/571] ASoC: adau1372: allow sleepy powerdown GPIOs	[Body]
[PATCH 5.15 398/571] ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes	[Body]
[PATCH 5.15 399/571] ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM	[Body]
[PATCH 5.15 400/571] flow_dissector: avoid u16 truncation of skb->len when computing thoff	[Body]
[PATCH 5.15 401/571] flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()	[Body]
[PATCH 5.15 402/571] net/mlx5e: Order ICOSQ cc update after CQ doorbell	[Body]
[PATCH 5.15 403/571] net: openvswitch: validate transport header presence in set_ipv6_addr	[Body]
[PATCH 5.15 404/571] mtd: fix use-after-free in mtd release	[Body]
[PATCH 5.15 405/571] mtd: Clean refcounting with MTD_PARTITIONED_MASTER	[Body]
[PATCH 5.15 406/571] mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters	[Body]
[PATCH 5.15 407/571] mtd: fix double free and WARN_ON in add_mtd_device() error paths	[Body]
[PATCH 5.15 408/571] dlm: validate length in dlm_search_rsb_tree	[Body]
[PATCH 5.15 409/571] openvswitch: defer tunnel netdev_put to RCU release	[Body]
[PATCH 5.15 410/571] openvswitch: vport: fix self-deadlock on release of tunnel ports	[Body]
[PATCH 5.15 411/571] netfilter: nf_tables: release flowtable after rcu grace period on error	[Body]
[PATCH 5.15 412/571] cifs: fix underflow in parse_server_interfaces()	[Body]
[PATCH 5.15 413/571] smb3: fix for slab out of bounds on mount to ksmbd	[Body]
[PATCH 5.15 414/571] smb: client: reject short Next offsets in parse_server_interfaces()	[Body]
[PATCH 5.15 415/571] ipv6: use RCU in ip6_xmit()	[Body]
[PATCH 5.15 416/571] can: fix unique skb identifier regression under RPS	[Body]
[PATCH 5.15 417/571] drm/amd/display: Dont replace a sink mode that shares the native totals	[Body]
[PATCH 5.15 418/571] HID: hid-steam: Fix cleanup in probe()	[Body]
[PATCH 5.15 419/571] HID: hid-steam: Make client_opened a counter	[Body]
[PATCH 5.15 420/571] HID: steam: Fully unregister controller when hidraw is opened	[Body]
[PATCH 5.15 421/571] HID: steam: Rearrange teardown sequence	[Body]
[PATCH 5.15 422/571] HID: steam: Refactor registration	[Body]
[PATCH 5.15 423/571] HID: steam: Clean up locking	[Body]
[PATCH 5.15 424/571] tracing: Set the trace clock before registering the histogram trigger	[Body]
[PATCH 5.15 425/571] ip6_gre: remove obsolete ERSPAN PMTU update	[Body]
[PATCH 5.15 426/571] selinux: fix data race on AVC latest_notif	[Body]
[PATCH 5.15 427/571] EDAC/amd64: Mask UMC chip select to the four implemented selects	[Body]
[PATCH 5.15 428/571] mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP	[Body]
[PATCH 5.15 429/571] mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge	[Body]
[PATCH 5.15 430/571] netfilter: nf_tables: fix bidirectional offload regression	[Body]
[PATCH 5.15 431/571] net: team: Remove unused team_mode_op, port_enabled	[Body]
[PATCH 5.15 432/571] net: team: Rename port_disabled team mode op to port_tx_disabled	[Body]
[PATCH 5.15 433/571] net: team: fix NULL pointer dereference in team_xmit during mode change	[Body]
[PATCH 5.15 434/571] net: team: stop reusing skb after queue override	[Body]
[PATCH 5.15 435/571] Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex	[Body]
[PATCH 5.15 436/571] drm/vmwgfx: validate pitch coming from userspace	[Body]
[PATCH 5.15 437/571] namespace: dont inherit MNT_UMOUNT in clone_mnt()	[Body]
[PATCH 5.15 438/571] namespace: check the mounts before reading their parents in pivot_root()	[Body]
[PATCH 5.15 439/571] dm: fix reading free memory in do_resume	[Body]
[PATCH 5.15 440/571] pmdomain: rockchip: fix clock leak on domain probe failure	[Body]
[PATCH 5.15 441/571] pmdomain: rockchip: dont ignore clock lookup errors on attach	[Body]
[PATCH 5.15 442/571] pmdomain: rockchip: propagate subdomain add errors	[Body]
[PATCH 5.15 443/571] optee: register TEE devices only once fully initialized	[Body]
[PATCH 5.15 444/571] scsi: ch: Do not keep references to data transfer element devices	[Body]
[PATCH 5.15 445/571] drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks	[Body]
[PATCH 5.15 446/571] drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN	[Body]
[PATCH 5.15 447/571] drm/i915/gt: Unmask interrupts only when ACTIVE is true	[Body]
[PATCH 5.15 448/571] namespace: unhash a dentry before detaching the mounts on it	[Body]
[PATCH 5.15 449/571] namespace: dont copy an unmounted mount tree	[Body]
[PATCH 5.15 450/571] namespace: check the target before walking it in do_mount_setattr()	[Body]
[PATCH 5.15 451/571] fcntl: refuse F_SET_RW_HINT on an immutable inode	[Body]
[PATCH 5.15 452/571] namespace: handle mount locking for automounts correctly	[Body]
[PATCH 5.15 453/571] netfilter: nf_tables: fix crash when nf_trace is enabled	[Body]
[PATCH 5.15 454/571] tty: finish kernel-doc of tty_struct members	[Body]
[PATCH 5.15 455/571] tty: add break_wait kernel-doc	[Body]
[PATCH 5.15 456/571] xfrm: prevent policy_hthresh.work from racing with netns teardown	[Body]
[PATCH 5.15 457/571] xfs: log items should have a xlog pointer, not a mount	[Body]
[PATCH 5.15 458/571] xfs: aborting inodes on shutdown may need buffer lock	[Body]
[PATCH 5.15 459/571] xfs: fix super block buf log item UAF during force shutdown	[Body]
[PATCH 5.15 460/571] xfs: buffer pins need to hold a buffer reference	[Body]
[PATCH 5.15 461/571] xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock	[Body]
[PATCH 5.15 462/571] xfs: catch stale AGF/AGF metadata	[Body]
[PATCH 5.15 463/571] xfs: rearrange code in xfs_buf_item.c	[Body]
[PATCH 5.15 464/571] xfs: factor out stale buffer item completion	[Body]
[PATCH 5.15 465/571] xfs: fix unmount hang with unflushable inodes stuck in the AIL	[Body]
[PATCH 5.15 466/571] ksmbd: fix heap out-of-bounds write in krb5_authenticate()	[Body]
[PATCH 5.15 467/571] KVM: x86: Use active memslots for the per-vCPU MMIO cache	[Body]
[PATCH 5.15 468/571] bpf: fix potential 32-bit overflow when accessing ARRAY map element	[Body]
[PATCH 5.15 469/571] power: supply: ds2780: Fix ds2780_get_capacity() returning raw value	[Body]
[PATCH 5.15 470/571] Drivers: hv: Dont reset VMBus connection state on error/exit paths	[Body]
[PATCH 5.15 471/571] vsock: treat TCP_CLOSING as once-established	[Body]
[PATCH 5.15 472/571] net/rds: dont let the rdma_cm destroy an id RDS still owns on route failure	[Body]
[PATCH 5.15 473/571] ASoC: stm32: spdifrx: fix synchronization state check	[Body]
[PATCH 5.15 474/571] ASoC: cs42l56: Put the Limiter Cushion control on the limiter register	[Body]
[PATCH 5.15 475/571] ASoC: cs42l52: Fix the NG Type Switch bit	[Body]
[PATCH 5.15 476/571] ASoC: pcm3168a: Fix the DAC zero flag polarity bit	[Body]
[PATCH 5.15 477/571] ASoC: max98371: Fix the Speaker DHT Min Volume bits	[Body]
[PATCH 5.15 478/571] ASoC: wm8978: Fix the 128x oversampling switch bits	[Body]
[PATCH 5.15 479/571] ASoC: nau8822: Fix the 128x oversampling switch bits	[Body]
[PATCH 5.15 480/571] netlink: remove netlink_broadcast_filtered	[Body]
[PATCH 5.15 481/571] netlink: Reverse the patch which removed filtering	[Body]
[PATCH 5.15 482/571] netlink: reset skb headers before unicast and multicast filtering	[Body]
[PATCH 5.15 483/571] nios2: fix __wsum type degradation in csum_fold()	[Body]
[PATCH 5.15 484/571] scsi: st: Save the visited block for the partition the drive is in	[Body]
[PATCH 5.15 485/571] scsi: target: iscsi: Fix race in discovery auth updates	[Body]
[PATCH 5.15 486/571] ocfs2/dlm: Protect the recovery list during debugfs reads	[Body]
[PATCH 5.15 487/571] samples: pidfd: fix userprogs typo	[Body]
[PATCH 5.15 488/571] clone: add CLONE_AUTOREAP	[Body]
[PATCH 5.15 489/571] exit: fix lost-update race on the child_subreaper bitfields	[Body]
[PATCH 5.15 490/571] pipe: preserve existing fasync readers on writer setup failure	[Body]
[PATCH 5.15 491/571] netlink: avoid hashing the network namespace pointer	[Body]
[PATCH 5.15 492/571] autofs: ignore notification errors from a replaced pipe	[Body]
[PATCH 5.15 493/571] KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry	[Body]
[PATCH 5.15 494/571] fsnotify: prevent mark additions during connector teardown	[Body]
[PATCH 5.15 495/571] net/sched: fix use-after-free in __tcf_action_put()	[Body]
[PATCH 5.15 496/571] net: rds: fix uninitialized trans dereference in CM event handler	[Body]
[PATCH 5.15 497/571] sctp: revalidate output stream after association connect wait	[Body]
[PATCH 5.15 498/571] tools: gpio: fix building from the top level with O=	[Body]
[PATCH 5.15 499/571] i2c: qcom-cci: Fix HALT_ACK reset request being dropped	[Body]
[PATCH 5.15 500/571] scsi: libiscsi: Reject a negative task index from parse_pdu_itt	[Body]
[PATCH 5.15 501/571] scsi: libiscsi: Validate the ITT reflected in a Reject PDU	[Body]
[PATCH 5.15 502/571] scsi: libiscsi: Validate the task named by a management response	[Body]
[PATCH 5.15 503/571] drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang	[Body]
[PATCH 5.15 504/571] drm/amdgpu: dont drop the runtime PM reference twice in amdgpu_gpr	[Body]
[PATCH 5.15 505/571] tracing: Fix the shift out of bounds in the log2 histogram modifier	[Body]
[PATCH 5.15 506/571] tracing: Fix hist trigger timestamps for buffered events	[Body]
[PATCH 5.15 507/571] wifi: p54: validate firmware record lengths	[Body]
[PATCH 5.15 508/571] tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)	[Body]
[PATCH 5.15 509/571] cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children	[Body]
[PATCH 5.15 510/571] dm cache: fix demotion stats in passthrough mode	[Body]
[PATCH 5.15 511/571] dm cache: fix issue with background work locking	[Body]
[PATCH 5.15 512/571] dm-crypt: fix a tiny race condition in crypt_dec_pending	[Body]
[PATCH 5.15 513/571] dm-ebs: fix incorrect device offset check in ebs_ctr()	[Body]
[PATCH 5.15 514/571] net/iucv: fix the recvmsg window update	[Body]
[PATCH 5.15 515/571] tipc: protect node reset trace dump with node lock	[Body]
[PATCH 5.15 516/571] sctp: validate chunk length in the inqueue parser	[Body]
[PATCH 5.15 517/571] page_pool: keep frag_offset aligned for odd-sized requests	[Body]
[PATCH 5.15 518/571] s390/ctcm: Prevent XID null dereference	[Body]
[PATCH 5.15 519/571] s390/pci: Fix leak of uninitialized kernel data in SCLP report	[Body]
[PATCH 5.15 520/571] ipv4: avoid divide by zero in fib_rebalance	[Body]
[PATCH 5.15 521/571] mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF	[Body]
[PATCH 5.15 522/571] drm/amdgpu: Fix VCE 3 ring align_mask	[Body]
[PATCH 5.15 523/571] security/keys: fix missed RCU read section on lookup	[Body]
[PATCH 5.15 524/571] net/sched: cls_u32: skip hash tables in u32_bind_class()	[Body]
[PATCH 5.15 525/571] OPP: Fix race between OPP addition and lookup	[Body]
[PATCH 5.15 526/571] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots	[Body]
[PATCH 5.15 527/571] net: bridge: mcast: dont truncate the port group walk on teardown	[Body]
[PATCH 5.15 528/571] net/sched: cls_flower: validate mask pointer after nla_next()	[Body]
[PATCH 5.15 529/571] tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields	[Body]
[PATCH 5.15 530/571] scsi: st: Fix use-after-free race between st_remove() and st_open()	[Body]
[PATCH 5.15 531/571] KVM: arm64: vgic-its: Dont dereference a NULL collection on ITT save	[Body]
[PATCH 5.15 532/571] hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur	[Body]
[PATCH 5.15 533/571] watch_queue: Fix note pool publication race in watch_queue_set_size()	[Body]
[PATCH 5.15 534/571] unicode: free the map after a grace period	[Body]
[PATCH 5.15 535/571] Input: byd - synchronize timer deletion before freeing private data	[Body]
[PATCH 5.15 536/571] mm/huge_memory: transfer the pmd dirty bit to the folio on zap	[Body]
[PATCH 5.15 537/571] bridge: mcast: Fix use-after-free during router port configuration	[Body]
[PATCH 5.15 538/571] netfilter: nf_tables: always walk all pending catchall elements	[Body]
[PATCH 5.15 539/571] dm-integrity: require stable writes for internal hash modes	[Body]
[PATCH 5.15 540/571] vsock/virtio: validate packet source for connected sockets	[Body]
[PATCH 5.15 541/571] ipv4: udp: Create exceptions before socket matching	[Body]
[PATCH 5.15 542/571] i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()	[Body]
[PATCH 5.15 543/571] futex: Fix mm reuse handling for FUT_OFF_MMSHARED	[Body]
[PATCH 5.15 544/571] drm/i915/dmc: Harden DMC firmware payload parsing	[Body]
[PATCH 5.15 545/571] dm-integrity: fix infinite loop on discard with large tag size	[Body]
[PATCH 5.15 546/571] cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()	[Body]
[PATCH 5.15 547/571] xfs: dont hold buffer locks across sync transaction commit in xfs_sync_sb_buf	[Body]
[PATCH 5.15 548/571] ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION	[Body]
[PATCH 5.15 549/571] ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in	[Body]
[PATCH 5.15 550/571] ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION	[Body]
[PATCH 5.15 551/571] net: bonding: fix use-after-free in bond_xmit_broadcast()	[Body]
[PATCH 5.15 552/571] netfilter: nf_tables: always increment set element count	[Body]
[PATCH 5.15 553/571] netfilter: nf_tables: unconditionally bump set->nelems before insertion	[Body]
[PATCH 5.15 554/571] md: move initialization and destruction of io_acct_set to md.c	[Body]
[PATCH 5.15 555/571] net_sched: codel: fix stale state for empty flows in fq_codel	[Body]
[PATCH 5.15 556/571] Bluetooth: L2CAP: access chan->conn safely in get/setsockopt	[Body]
[PATCH 5.15 557/571] Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn	[Body]
[PATCH 5.15 558/571] tracing: Reject incomplete event filter expressions	[Body]
[PATCH 5.15 559/571] tracing: Save the event file instead of the compatible histogram	[Body]
[PATCH 5.15 560/571] tracing: Unregister field variable histograms when the command fails	[Body]
[PATCH 5.15 561/571] tracing: Fix 64-bit and signed histogram fields on 32-bit kernels	[Body]
[PATCH 5.15 562/571] keys: Avoid the owner account dereference in named keyring lookup	[Body]
[PATCH 5.15 563/571] keys: Check the authorization payload in process keyring searches	[Body]
[PATCH 5.15 564/571] keys: Protect the type name while describing a key	[Body]
[PATCH 5.15 565/571] keys: make keyring indexes independent of kernel addresses	[Body]
[PATCH 5.15 566/571] keys: Protect the read method check against type removal	[Body]
[PATCH 5.15 567/571] KEYS: Fix key_reject_and_link() race with keyring restriction	[Body]
[PATCH 5.15 568/571] KEYS: trusted: Fix blob allocation size in tpm2_key_decode()	[Body]
[PATCH 5.15 569/571] keys/trusted_keys: return immediately after TPM unseal failure	[Body]
[PATCH 5.15 570/571] io-wq: order the exit bit against worker creation task work	[Body]
[PATCH 5.15 571/571] signal: dont retarget shared signals in a dying thread group	[Body]

ID (for dev)	4f421463-2e3a-43c1-a32a-1319ed5d8931
Status	finished
Triaged	OK [Log]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	792fbe1537d8daeca9bd1917e84078b5432aadc2 [Config]		passed [Log]
[KASAN] Boot test: Base	792fbe1537d8daeca9bd1917e84078b5432aadc2 [Config]		passed [Log]
[KASAN] Build Patched		792fbe1537d8daeca9bd1917e84078b5432aadc2 [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		792fbe1537d8daeca9bd1917e84078b5432aadc2 [Config] [patched]	passed [Log]
[KASAN] Fuzz	792fbe1537d8daeca9bd1917e84078b5432aadc2 [Config]	792fbe1537d8daeca9bd1917e84078b5432aadc2 [Config] [patched]	passed [Log] [Artifacts]

Patches (571)

Series Summary

Sessions

Session 2026-10-28