kernel-module-8192du-6.6-desktop-6.6.148-1> )lp 54a60a3e5327da589dc3910c0aabaaa4f6f8d7a4c7175b7ec183b5a9c955bc80e107e2dbebfc949071454bb8ebdaf88da3393a39 Iͫ@"*sןEx>Bi?Yd#+ - Y     9 <@EJpt~(89:G@HDIHXLY\\]^bcdefltuvwXx\y`p|Ckernel-module-8192du-6.6-desktop6.6.1481Binary module 8192du for kernel-6.6-desktopBinary module 8192du for kernel-6.6-desktopjlocalhostD?ROSAROSAGPLv2System/Kernel and hardwarehttps://www.kernel.orglinuxx86_64D?j#59a5fa5bf2f769b88d26691ff458023714f26b5f8104552ab486ce1f4db1b2d6frootrootkernel-6.6-desktop-6.6.148-1.src.rpminstallonlypkg(kernel-module)kernel-module-8192du-6.6-desktopkernel-module-8192du-6.6-desktop(x86-64)kmod(8192du)    kernel-6.6-desktop(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)6.6.148-13.0.4-14.6.0-14.0-15.2-14.17.0jtw@jgH@jL@jL@jj9j Pj Pj Pj Pi@iD@iii@h/Mikhail Novosyolov BiteDasher BiteDasher 6.6.144-1BiteDasher BiteDasher 6.6.126-8BiteDasher 6.6.126-7Mikhail Novosyolov 6.6.126-6Mikhail Novosyolov 6.6.126-5Mikhail Novosyolov Mikhail Novosyolov Mikhail Novosyolov 6.6.126-3Mikhail Novosyolov 6.6.126-2Mikhail Novosyolov 6.6.126-1Mikhail Novosyolov Mikhail Novosyolov 6.6.106-3Mikhail Novosyolov - [bot] upd: 6.6.145 -> 6.6.148 - Changelog: - accel/ivpu: Reject firmware log with size smaller than header - afs: Annotate struct afs_addr_list with __counted_by - afs: Turn the afs_addr_list address array into an array of structs - ALSA: hda: conexant: Remove mic bias threshold override - ALSA: hda: Fix cached processing coefficient verbs - ALSA: seq: close a re-opened queue timer in the destructor - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: cs35l56: Don't use devres to unregister component - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: tas2781: bound firmware description string parsing - ata: libata-core: Reject an invalid concurrent positioning ranges count - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: use platform_get_irq() - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - binfmt_elf_fdpic: only honour the first PT_INTERP - binfmt_misc: set have_execfd only once the interpreter is opened - Bluetooth: btusb: validate Realtek vendor event length - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: hci_sync: Protect UUID list traversal - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: qca: fix NVM tag length underflow in TLV parser - Bluetooth: RFCOMM: Fix session UAF in set_termios - bonding: fix devconf_all NULL dereference when IPv6 is disabled - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bpf: drop bpf_lsm_getselfattr from hook list - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: free mapping node on duplicate reloc root insert - btrfs: reject free space cache with more entries than pages - can: bcm: add locking when updating filter and timer values - can: bcm: add missing device refcount for CAN filter removal - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: isotp: serialize TX state transitions under so->rx_lock - can: j1939: fix lockless local-destination check - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - comedi: comedi_parport: deal with premature interrupt - coredump: fix pidfs file refcount leak in umh_coredump_setup - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - dm-verity: avoid double increment of &use_bh_wq_enabled - dm-verity: make error counter atomic - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amd/display: set new_stream to NULL after release - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amd/pm: make pp_features read-only when scpm is enabled - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gt: use correct selftest config symbol - drm/i915: Return NULL on error in active_instance - drm/i915/selftests: Fix GT PM sort comparators - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/nouveau: fix reversed error cleanup order in ucopy functions - drm/radeon: fix r100_copy_blit for large BOs - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/vc4: Prevent shader BO mappings from becoming writable - drm/virtio: bound EDID block reads to the response buffer - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - drm/vmwgfx: Validate vmw_surface_metadata::array_size - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - exfat: validate cluster allocation bits of the allocation bitmap - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - firewire: net: Fix fragmented datagram reassembly - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - firmware_loader: introduce __free() cleanup hanler - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - ftrace: Add global mutex to serialize trace_parser access - geneve: require CAP_NET_ADMIN in the device netns for changelink - gpio: mt7621: avoid corruption of shared interrupt trigger state - gpio: tegra: do not call pinctrl for GPIO direction - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - hinic: remove unused ethtool RSS user configuration buffers - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: occ: validate poll response sensor blocks - i2c: davinci: Unregister cpufreq notifier on probe failure - i2c: i801: fix hardware state machine corruption in error path - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - i40e: remove read access to debugfs files - IB/mad: Drop unmatched RMPP responses before reassembly - ice: fix LAG recipe to profile association - ice: use READ_ONCE() to access cached PHC time - ila: reload IPv6 header after pskb_may_pull in checksum adjust - Input: ims-pcu - fix firmware leak in async update - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - Input: ims-pcu - fix logic error in packet reset - intel_th: fix MSC output device reference leak - iomap: correct the range of a partial dirty clear - iommu/amd: Bound the early ACPI HID map - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/vt-d: Disallow SVA if page walk is not coherent - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - ipmi: fix refcount leak in i_ipmi_request() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - ipv6: ndisc: fix NULL deref in accept_untracked_na() - ksmbd: bound DACL dedup walk to copied ACEs - ksmbd: defer destroy_previous_session() until after NTLM authentication - ksmbd: pin conn during async oplock break notification - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate ACE size against SID sub-authorities - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - KVM: Introduce vcpu->wants_to_run - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - libceph: bound get_version reply decode to front len - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: guard missing CRUSH type name lookup - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: Reject monmaps advertising zero monitors - libceph: reject zero bucket types in crush_decode - libceph: remove debugfs files before client teardown - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - LoongArch: Fix oops during single-step debugging - lsm: infrastructure management of the sock security - mac802154: hold an interface reference across the scan worker - mac802154: llsec: reject frames shorter than the authentication tag - mctp: serial: handle zero-length frames to prevent rx buffer overflow - media: airspy: Return queued buffers on start_streaming() failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: cedrus: skip invalid H.264 reference list entries - media: cx231xx: fix devres lifetime - media: cx23885: add ioremap return check and cleanup - media: marvell-cam: fix missing pci_disable_device() on remove - media: meson: vdec: Fix memory leak in error path of vdec_open - media: msi2500: Return queued buffers on start_streaming() failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: pci: dm1105: Free allocated workqueue - media: pwc: Drain fill_buf on start_streaming() failure - media: pwc: Return queued buffers on start_streaming() failure - media: radio-si476x: Unregister v4l2_device on probe failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: stm32: dcmi: unregister notifier on probe failure - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: ti: vpe: unwind v4l2 device registration on probe error - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: v4l2-ctrls: validate HEVC active reference counts - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - media: vivid: add vivid_update_reduced_fps() - media: vivid: check for vb2_is_busy() when toggling caps - media: vpif_capture: fix OF node reference imbalance - mei: bus: access mei_device under device_lock on cleanup - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - mm: refactor mm_access() to not return NULL - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - mptcp: decrement subflows counter on failed passive join - mptcp: only set DATA_FIN when a mapping is present - mtd: fix double free and WARN_ON in add_mtd_device() error paths - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: rawnand: Add a helper for calculating a page index - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Pause continuous reads at block boundaries - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - net: bridge: vlan: fix vlan range dumps starting with pvid - net: dpaa: fix mode setting - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - net: hip04: fix RX buffer leak on build_skb failure - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: ipa: fix SMEM state handle leaks in SMP2P init - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/iucv: fix use-after-free of a severed iucv_path - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - net: macb: drop in-flight Tx SKBs on close - net: mana: Validate the packet length reported by the NIC - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/packet: avoid fanout hook re-registration after unregister - net: pcs: xpcs: fix SGMII state reading - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: restrict socket creation to the initial network namespace - net/sched: act_tunnel_key: Defer dst_release to RCU callback - net: slip: serialize receive against buffer reallocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: reset residual action in L3L4 filters on delete - net/x25: fix use-after-free in x25_kill_by_neigh() - nexthop: initialize extack in nh_res_bucket_migrate() - nfp: Check resource mutex allocation - NFS: Charge unstable writes by request size, not folio size - NFSD: pass nfsd_file to nfsd_iter_read() - nfs: remove dead code for the old swap over NFS implementation - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: fix SQB pointer leak on init failure - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: set TC flower flag on MCAM entry allocation - openvswitch: fix GSO userspace truncation underflow - ovl: use linked upper dentry in copy-up tmpfile - pds_core: check for workqueue allocation failure - pds_core: fix auxiliary device add/del races - pds_core: order completion reads after the ownership check - pds_core: reject component parameter in legacy firmware update - pds_core: yield the CPU while waiting for the adminq to drain - phonet: pep: fix use-after-free in pep_get_sb() - pinctrl: remove pinctrl_gpio_direction_output() - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values - platform/x86/amd/pmc: Don't log during intermediate wakeups - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - powerpc/time: Prepare to stop elapsing in dynticks-idle - powerpc/vtime: Initialize starttime at boot for native accounting - ppp: annotate data races in ppp_generic - ppp: convert to percpu netstats - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - ppp: enable TX scatter-gather - pppoe: reload header pointer after dev_hard_header() - ppp: use IFF_NO_QUEUE in virtual interfaces - proc: Fix broken error paths for namespace links - rbd: Reset positive result codes to zero in object map update path - RDMA/cma: Fix hardware address comparison length in netevent callback - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/siw: publish QP after initialization - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add pinned revocable dmabuf import interface - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/umem: Introduce an option to revoke DMABUF umem - RDMA/umem: Move umem dmabuf revoke logic into helper function - rds: drop incoming messages that cross network namespace boundaries - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - RISC-V: KVM: Serialize virtual interrupt pending state updates - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - rxrpc: Pull out certain app callback funcs into an ops table - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Use irq-disabling spinlocks between app and I/O thread - sched/vtime: Get rid of generic vtime_task_switch() implementation - sctp: auth: verify auth requirement when auth_chunk is NULL - sctp: don't free the ASCONF's own transport in DEL-IP processing - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - sctp: fix auth_hmacs array size in struct sctp_cookie - sctp: validate stream count in sctp_process_strreset_inreq() - selftest: af_unix: Add Kconfig file. - selftests: af_unix: add USER_NS config - selftests/alsa: Fix memory leak in find_controls error path - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - selftests: openvswitch: add config file - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - seqlock: Allow KASAN to fail optimizing - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: sc16is7xx: implement gpio get_direction() callback - smb/client: handle overlapping allocated ranges in fallocate - smb: client: validate DFS referral PathConsumed - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - tipc: fix u16 MTU truncation in media and bearer MTU validation - tipc: restrict socket queue dumps in enqueue tracepoints - tls: device: push pending open record on splice EOF - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - udmabuf: Do not create malformed scatterlists - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: io_edgeport: cap received transmit credits - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: option: add TDTECH MT5710-CN - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - VDUSE: avoid leaking information to userspace - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - VFS/audit: introduce kern_path_parent() for audit - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - vxlan: mdb: Fix source list corruption on a failed replace - vxlan: require CAP_NET_ADMIN in the device netns for changelink - wan: wanxl: Only reset hardware after BAR mapping - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath6kl: fix OOB access from firmware ADDBA window size - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: cfg80211: cancel sched scan results work on unregister - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: mac80211: recalculate TIM when a station enters power save - wifi: mac80211: tear down new links on vif update error path - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7915: guard HE capability lookups - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mwifiex: bound uAP association event IEs to the event buffer - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: nl80211: validate nested MBSSID IE blobs - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: wilc1000: validate assoc response length before subtracting header - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - x86/boot/compressed: Disable jump tables - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xprtrdma: Clear receive-side ownership pointers on release - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- [bot] upd: 6.6.144 -> 6.6.145 - Changelog: - 6lowpan: fix NHC entry use-after-free on error path - 9p: skip nlink update in cacheless mode to fix WARN_ON - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: IPMI: Fix message kref handling on dead device - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: resource: Amend kernel-doc style - afs: Fix callback service message parsers to pass through -EAGAIN - afs: Fix error code in afs_extract_vl_addrs() - afs: Fix further netns teardown to cancel the preallocation charger - afs: Fix netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix unchecked-length string display in debug statement - afs: Fix vllist leak - afs: use kvfree() to free memory allocated by kvcalloc() - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - ALSA: aoa: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Clear variable event pointer on read - ALSA: seq: Fix partial userptr event expansion - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: seq: midi: Serialize output teardown with event_input - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: ymfpci: check snd_ctl_new1() return value - amt: fix size calculation in amt_get_size() - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: advertise the tcp fast open fix is applied - apparmor: check label build before no_new_privs test - apparmor: fix label can not be immediately before a declaration - apparmor: fix potential UAF in aa_replace_profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: put secmark label after secid lookup - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - arm64: dts: qcom: sm8450: Fix ICE reg size - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - arm64: Fix early handling of FEAT_E2H0 not being implemented - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - arm64/mm: convert ptep_clear() to ptep_get_and_clear() - arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) - arm64/mm: convert set_pte_at() to set_ptes(..., 1) - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() - arm64: Revamp HCR_EL2.E2H RES1 detection - arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock - arm64: tegra: Fix Tegra234 MGBE PTP clock - arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - ARM: imx31: Fix IIM mapping leak in revision check - ARM: imx3: Fix CCM node reference leak - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - ASoC: codecs: aw88261: fix incorrect masks for boost regs - ASoC: codecs: hdac_hdmi: Validate written enum value - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - ata: libata: Fix ata_exec_internal() - ata: pata_pxa: Fix DMA channel leak on probe error - ata: sata_gemini: unwind clocks on IDE pinctrl errors - audit: add audit_log_nf_skb helper function - audit: Fix data races of skb_queue_len() readers on audit_queue - audit: fix potential integer overflow in audit_log_n_hex() - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: dat: fix tie-break for candidate selection - batman-adv: ensure minimal ethernet header on TX - batman-adv: fix VLAN priority offset - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: gw: acquire ethernet header only after skb realloc - batman-adv: retrieve ethhdr after potential skb realloc on RX - batman-adv: tt: avoid request storms during pending request - batman-adv: tt: prevent TVLV OOB check overflow - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - bitops: make BYTES_TO_BITS() treewide-available - bitops: use common function parameter names - block: Avoid mounting the bdev pseudo-filesystem in userspace - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - Bluetooth: btmtk: Fix btmtk.c undefined reference build error - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c - Bluetooth: btmtk: remove #ifdef around declarations - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: btrtl: validate firmware patch bounds - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - Bluetooth: hci_sync: annotate data-races around hdev->req_status - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci: validate codec capability element length - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: separate CIS_LINK and BIS_LINK link types - Bluetooth: vhci: validate devcoredump state before side effects - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - bonding: 3ad: fix mux port state on oper down - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - bonding: fix type confusion in bond_setup_by_slave() - bonding: fix xfrm offload feature setup on active-backup mode - bonding: prevent potential infinite loop in bond_header_parse() - bonding: use common function to compute the features - bpf: Add missing access_ok call to copy_user_syms - bpf: Allow LPM map access from sleepable BPF programs - bpf, arm64: Reject out-of-range B.cond targets - bpf: Check tail zero of bpf_prog_info - bpf: Consistently use bpf_rcu_lock_held() everywhere - bpf: Disable xfrm_decode_session hook attachment - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - bpf: Fix effective prog array index with BPF_F_PREORDER - bpf: Fix stack slot index in nospec checks - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - bpf,fork: wipe ->bpf_storage before bailouts that access it - bpf, lsm: Add disabled BPF LSM hook list - bpf: Prefer dirty packs for eBPF allocations - bpf: Prefer packs that won't trigger an IBPB flush on allocation - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Restrict JIT predictor flush to cBPF - bpf: Run generic devmap egress prog on private skb - bpf: Skip redundant IBPB in pack allocator - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Support for hardening against JIT spraying - bpf: Tighten cgroup storage cookie checks for prog arrays - bpftool: Use libbpf error code for flow dissector query - bpf: Update transport_header when encapsulating UDP tunnel in lwt - bpf: zero-initialize the fib lookup flow struct - bridge: cfm: reject invalid CCM interval at configuration time - bridge: stp: Fix a potential use-after-free when deleting a bridge - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - btrfs: do not trim a device which is not writeable - btrfs: fix false IO failure after falling back to buffered write - btrfs: fix incorrect buffered IO fallback for append direct writes - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - btrfs: zoned: don't account data relocation space-info in statfs free space - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - bus: sunxi-rsb: Always check register address validity - can: bcm: add missing rcu list annotations and operations - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: esd_usb: kill anchored URBs before freeing netdevs - can: isotp: use unconditional synchronize_rcu() in isotp_release() - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - char: tlclk: fix use-after-free in tlclk_cleanup() - cifs: invalidate cfid on unlink/rename/rmdir - cifs: remove all cifs files before kill super - cifs: validate DFS referral string offsets - clk: at91: keep securam node alive while mapping it - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - clk: scmi: Fix clock rate rounding - clk: scpi: Unregister child clock providers on remove - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - configfs: fix lockless traversals of ->s_children - configfs_lookup(): don't leave ->s_dentry dangling on failure - coresight: cti: Fix DT filter signals silently ignored - coresight: etb10: restore atomic_t for shared reading state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Documentation: fix conservative governor freq_step description - cpufreq: Documentation: fix sampling_down_factor range - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - crypto: af_alg - Remove zero-copy support from skcipher and aead - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: ccp - Treat zero-length cert chain as query for blob lengths - crypto: crypto4xx - Remove ahash-related code - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix the fips_enabled priority boost - crypto: ecc - Fix carry overflow in vli multiplication - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: hisilicon/qm - disable error report before flr - crypto: hisi-trng - Remove crypto_rng interface - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - crypto: pcrypt - restore callback for non-parallel fallback - crypto: qat - fix restarting state leak on allocation failure - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - crypto: qat - validate RSA CRT component lengths - crypto: rng - Free default RNG on module exit - crypto: sun4i-ss - Remove insecure and unused rng_alg - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - stop using crypto_ahash::init - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - cxgb4: Fix decode strings dump for T6 adapters - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - cxl/test: Fix integer overflow in mock LSA bounds checks - cxl/test: Zero out LSA backing memory to avoid leaking to user - dax/kmem: account for partial discontiguous resource upon removal - debugobjects: Plug race against a concurrent OOM disable - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - devlink: Fix parent ref leak in devl_rate_node_create() - dlm: fix add msg handle in send_queue ordered - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: Fix possible use after free - dmaengine: imx-sdma: Refine spba bus searching in probe - dmaengine: qcom: gpi: set DMA_PRIVATE capability - dmaengine: tegra: Fix burst size calculation - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm_early_create: fix freeing used table on dm_resume failure - dm era: fix NULL pointer dereference in metadata_open() - dm era: fix out-of-bounds memory access for non-zero start sector - dm-integrity: don't increment hash_offset twice - dm-ioctl: fix a possible overflow in list_version_get_info - dm-ioctl: report an error if a device has no table - dm-log: fix a bitset_size overflow on 32bit machines - dm-stats: fix dm_jiffies_to_msec64 - dm-stats: fix merge accounting - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - dm-verity: fix a possible NULL pointer dereference - dm-verity: increase sprintf buffer size - Documentation: proc: fix section numbering in table of contents - dpaa2-switch: fix VLAN upper check not rejecting bridge join - drbd: reject data replies with an out-of-range payload size - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() - driver core: Guard deferred probe timeout extension with delayed_work_pending() - driver core: Use mod_delayed_work to prevent lost deferred probe work - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amd/display: Add missing kdoc for ALLM parameters - drm/amd: Fix set but not used warnings - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/amdgpu: initialize irq.lock spinlock earlier - drm/amdgpu: set sub_block_index for mca ras sub-blocks - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - drm/edid: fix OOB read in drm_parse_tiled_block() - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/msm/dp: fix HPD state status bit shift value - drm/msm/dp: Fix the ISR_* enum values - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - drm/tegra: Fix iommu_map_sgtable() return value check - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - drm/tidss: Drop extra drm_mode_config_reset() call - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - dt-bindings: power: imx93: Add MIPI PHY power domain - EDAC/i10nm: Don't fail probing if ADXL is missing - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - espintcp: use sk_msg_free_partial to fix partial send - evm: terminate and bound the evm_xattrs read buffer - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: bound uniname advance in exfat_find_dir_entry() - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: move free cluster out of exfat_init_ext_entry() - exfat: preserve benign secondary entries during rename and move - exfat: remove unnecessary read entry in __exfat_rename() - exfat: rename argument name for exfat_move_file and exfat_rename_file - ext2: fix ignored return value of generic_write_sync() - ext4: fix kernel BUG in ext4_write_inline_data_end - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - ext4: get rid of ppath in get_ext_path() - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: validate orphan inode entry count - fbcon: fix NULL pointer dereference for a console without vc_data - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: sm501fb: Fix buffer errors in OF binding code - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - firmware: arm_scmi: Read sensor config as 32-bit value - firmware_loader: fix device reference leak in firmware_upload_register() - firmware_loader: Fix recursive lock in device_cache_fw_images() - flow_dissector: check device type before reading ETH_ADDRS - fpga: dfl: add bounds check in dfh_get_param_size() - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - fs: efs: remove unneeded debug prints - fsl/fman: Free init resources on KeyGen failure in fman_init() - fs/ntfs3: add bounds check to run_get_highest_vcn() - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - gpio-f7188x: Add support for NCT6126D version B - gpio: htc-egpio: use managed gpiochip registration - gpio: mlxbf3: fail probe if gpiochip registration fails - gpio: mvebu: fail probe if gpiochip registration fails - gpio: sch: use raw_spinlock_t in the irq startup path - gpios: palmas: add .get_direction() op - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - gpu: host1x: Allow entries in BO caches to be freed - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - gpu: host1x: Fix iommu_map_sgtable() return value check - gue: validate REMCSUM private option length - handshake: Require admin permission for DONE command - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: add haptics page defines - HID: appleir: fix UAF on pending key_up_timer in remove() - HID: core: Fix OOB read in hid_get_report for numbered reports - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - HID: playstation: validate num_touch_reports in DualShock 4 reports - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: wacom: stop hardware after post-start probe failures - HID: wiimote: Fix table layout and whitespace errors - hwmon: adm1275: Prevent reading uninitialized stack - hwmon: (asus_atk0110) Check package count before accessing element - hwmon: (it87) Clamp negative values to zero in set_fan() - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - hwmon: (occ) unregister sysfs devices outside occ lock - hwmon: (pmbus) Fix passing events to regulator core - hwmon: (w83627hf) remove VID sysfs files on error and remove - hwmon: (w83793) remove vrm sysfs file on probe failure - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - hwrng: virtio: clamp device-reported used.len at copy_data() - hwspinlock: qcom: avoid uninitialized struct members - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: core: fix adapter registration race - i2c: core: fix hang on adapter registration failure - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: mediatek: fix WRRD for SoCs without auto_restart option - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - i3c: master: Prevent reuse of dynamic address on device add failure - i40e: Fix i40e_debug() to use struct i40e_hw argument - ia64: Make acpi_cpufreq_cpu_exit return void - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - IB/mlx4: Fix refcount leak in add_port() error path - IB/mlx5: Don't take the rereg_mr fallback without a new translation - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - IB/mlx5: Properly support implicit ODP rereg_mr - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - ice: fix ice_init_link() error return preventing probe - ieee802154: admin-gate legacy LLSEC dump operations - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: pressure: mpl115: fix runtime PM leak on read error - iio: tcs3472: power down chip on probe failure - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: ims-pcu - add response length checks - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix use-after-free and double-free in disconnect - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - validate control endpoint type - Input: maplecontrol - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - fix NULL pointer dereference in open() - Input: maplemouse - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: mms114 - reject an oversized device packet size - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: touchwin - reset the packet index on every complete packet - iommu/amd: Fix a stale comment about which legacy mode is user visible - ionic: Fix check in ionic_get_link_ext_stats - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - ipv4: fib: Don't ignore error route in local/main tables. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - ipv4: igmp: remove multicast group from hash table on device destruction - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - ipv6: fix error handling in disable_ipv6 sysctl - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix more places with wrong ipv6 transport offsets - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: pass parsed transport offset to state handlers - ipvs: reload ip header after head reallocation - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - ipvs: use parsed transport offset in TCP state lookup - irqchip/crossbar: Fix parent domain resource leak - irqchip/crossbar: Use correct index in crossbar_domain_free() - irqchip/gic-v3-its: Fix OF node reference leak - irqchip/ts4800: Fix missing chained handler cleanup on remove - isofs: bound Rock Ridge symlink components to the SL record - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - kcm: use WRITE_ONCE() when changing lower socket callbacks - kconfig: fix potential NULL pointer dereference in conf_askvalue - KEYS: Use acquire when reading state in keyring search - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - ksmbd: fix integer overflow in set_file_allocation_info() - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: fix use-after-free in same_client_has_lease() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - ksmbd: reject undersized DACLs before parsing ACEs - ksmbd: require source read access for duplicate extents - ksmbd: run set info with opener credentials - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: track the connection owning a byte-range lock - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for FSCTL mutations - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - KVM: arm64: Initialize HCR_EL2.E2H early - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - leds: uleds: Fix potential buffer overread - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - libbpf: Report error when a negative kprobe offset is specified - lib/test_meminit: use && for bools - llc: fix SAP refcount leak in llc_ui_autobind() - llc: fix SAP refcount leak when creating incoming sockets - lockd: Plug nlm_file leak when nlm_do_fopen() fails - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - LoongArch: Add PIO for early access before ACPI PCI root register - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - mac802154: remove interfaces with RCU list deletion - macsec: don't read an unset MAC header in macsec_encrypt() - macsec: fix promiscuity refcount leak in macsec_dev_open() - mailbox: mtk-adsp: fix UAF during device teardown - md/raid10: reset read_slot when reusing r10bio for discard - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - media: cedrus: Fix failure to clean up hardware on probe failure - media: mtk-jpeg: cancel workqueue on release for supported platforms only - media: nxp: imx8-isi: Convert to platform remove callback returning void - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: qcom: venus: drop extra padding in NV12 raw size calculation - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: relax encoder frame/blur step size on v6 - media: rockchip: rga: fix too small buffer size - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - media: uvcvideo: Avoid partial metadata buffers - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Fix sequence number when no EOF - media: v4l2-common: Add YUV24 format info - memstick: ms_block: reject a card that reports too many blocks - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mfd: cs42l43: Sanity check firmware size - mfd: sm501: Fix reference leak on failed device registration - mfd: tps6586x: Fix OF node refcount - minix: avoid overflow in bitmap block count calculation - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: DEC: Ensure RTC platform device deregistration upon failure - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix gio device memory leak - MIPS: ip22-gio: fix kfree() of static object - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mmc: vub300: defer reset until cmd_mutex is unlocked - mm/damon/core: make charge_addr_from aware of end-address exclusivity - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm: do file ownership checks with the proper mount idmap - mm/fake-numa: fix under-allocation detection in uniform split - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix NULL pointer dereference in debugfs - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - mm/vmscan: flush deferred TLB before freeing large folios - module: decompress: check return value of module_extend_max_pages() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - mtd: rawnand: fix condition in 'nand_select_target()' - mtd: rawnand: fsl_ifc: return errors for failed page reads - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: pl353: fix probe resource allocation - mtd: slram: remove failed entries from the device list - mtd: spi-nor: Drop duplicate Kconfig dependency - mtd: spi-nor: swp: Improve locking user experience - net/9p: fix infinite loop in p9_client_rpc on fatal signal - net/9p: fix race condition on rdma->state in trans_rdma.c - net: add a common function to compute features for upper devices - net: af_key: initialize alg_key_len for IPComp states - net: atm: reject out-of-range traffic classes in QoS validation - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net, bpf: check master for NULL in xdp_master_redirect() - net: Drop the lock in skb_may_tx_timestamp() - net: dsa: sja1105: round up PTP perout pin duration - net: ena: clean up XDP TX queues when regular TX setup fails - net: enetc: check the number of BDs needed for xdp_frame - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: conntrack: revert ct extension genid infrastructure - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: Use vmalloc_array() to improve code - netfilter: ebtables: zero chainstack array - netfilter: ecache: fix inverted time_after() check - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: Fix data race between add and dump in all hash types - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: fix race between dump and ip_set_list resize - netfilter: nf_conncount: callers must hold rcu read lock - netfilter: nf_conncount: fix zone comparison in tuple dedup - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: xt_connmark: reject invalid shift parameters - netfilter: xt_nat: reject unsupported target families - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - net: gianfar: dispose irq mappings on probe failure and device removal - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: lan743x: Initialize eth_syslock spinlock before use - net: liquidio: fix BAR resource leak on PF number failure - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net: marvell: prestera: initialize err in prestera_port_sfp_bind - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5: Check max_macs devlink param value against max capability - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - net/mlx5: Fix L3 tunnel entropy refcount leak - net: mvneta: re-enable percpu interrupt on resume - net: openvswitch: reject oversized nested action attrs - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - net: psample: fix info leak in PSAMPLE_ATTR_DATA - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net/sched: cake: reject overhead values that underflow length - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - net/sched: cls_flow: Dont expose folded kernel pointers - net/sched: hhf: clear heavy-hitter state on reset - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_drr: annotate data-races around cl->deficit - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - net/sched: sch_hfsc: Don't make class passive twice - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - net: sit: require CAP_NET_ADMIN in the device netns for changelink - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net: sparx5: unregister blocking notifier on init failure - net: sungem: fix probe error cleanup - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - net: thunderbolt: Fix frags[] overflow by bounding frame_count - net/tls: Consume empty data records in tls_sw_read_sock() - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - net: wwan: iosm: bound device offsets in the MUX downlink decoder - net: wwan: t7xx: check skb_clone in control TX - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: Don't reset the write verifier on a commit EAGAIN - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: release layout stid on setlease failure - nfsd: reset write verifier on deferred writeback errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - NFSv4/flexfiles: reject zero filehandle version count - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pnfs: defer return_range callbacks until after inode unlock - nilfs2: fix backing_dev_info reference leak - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - NTB: epf: Make db_valid_mask cover only real doorbell bits - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - nvdimm/btt: Free arenas on btt_init() error paths - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Handle preemption in BTT lane acquisition - nvme-multipath: fix flex array size in struct nvme_ns_head - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet-auth: validate reply message payload bounds against transfer length - nvmet-rdma: handle inline data with a nonzero offset - nvmet: remove superfluous initialization - nvmet: return DHCHAP status codes from nvmet_setup_auth() - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - nvmet-tcp: Fix potential UAF when ddgst mismatch - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: avoid moving extents to occupied clusters - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: don't BUG_ON an invalid journal dinode - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2: kill osb->system_file_mutex lock - ocfs2: rebase copied fsdlm LVB pointers in locking_state - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: use kzalloc for quota recovery bitmap allocation - octeontx2-af: fix VF bringup affecting PF promiscuous state - octeontx2-af: mcs: Fix unsupported secy stats read - octeontx2-pf: check DMAC extraction support before filtering - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - of: cpu: add check in __of_find_n_match_cpu_property() - OPP: of: Fix potential memory leak in opp_parse_supplies() - orangefs: keep the readdir entry size 64-bit in fill_from_part() - partitions: aix: bound the pp_count scan to the ppe array - PCI: Add kerneldoc for pci_resize_resource() - PCI: altera: Do not dispose parent IRQ mapping - PCI: altera: Fix resource leaks on probe failure - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - PCI/ASPM: Don't reconfigure ASPM entering low-power state - PCI: Check ROM header and data structure addr before accessing - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - PCI: Fix restoring BARs on BAR resize rollback path - PCI: Free saved list without holding pci_bus_sem - PCI: host-common: Request bus reassignment when not probe-only - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - PCI: Introduce named defines for PCI ROM - PCI: iproc: Restore .map_irq() for the platform bus driver - PCI: loongson: Do not ignore downstream devices on external bridges - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: Move Resizable BAR code to rebar.c - PCI: Prevent resource tree corruption when BAR resize fails - PCI: rcar-host: Remove unused LIST_HEAD(res) - PCI: Skip Resizable BAR restore on read error - perf/core: Detach event groups during remove_on_exec - perf: Fix dangling cgroup pointer in cpuctx backport - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - perf trace beauty fcntl: Fix build with older kernel headers - perf/x86/amd/brs: Fix kernel address leakage - perf/x86/amd/core: Always use the NMI latency mitigation - perf/x86/amd/lbr: Fix kernel address leakage - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - phy: phy-can-transceiver: Check driver match and driver data against NULL - pinctrl: cs42l43: Fix polarity on debounce - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: meson: restore non-sleeping GPIO access - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - platform/x86/amd/pmc: Add delay_suspend module parameter - platform/x86/amd/pmc: Check for intermediate wakeup in function - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - pmdomain: imx: Fix i.MX8MP power notifier - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - PM: sleep: Use complete() in device_pm_sleep_init() - pNFS/filelayout: fix cheking if a layout is striped - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - powerpc/pseries: fix memory leak on krealloc failure in papr_init - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - power: supply: charger-manager: fix refcount leak in is_full_charged() - power: supply: core: fix supplied_from allocations - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - proc: only bump parent nlink when registering directories - proc: protect ptrace_may_access() with exec_update_lock (FD links) - proc: protect ptrace_may_access() with exec_update_lock (part 1) - proc: rename proc_setattr to proc_nochmod_setattr - pwm: imx27: Fix variable truncation in .apply() - qede: fix off-by-one in BD ring consumption on build_skb failure - qede: fix out-of-bounds check for cqe->len_list[] - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - RDMA/hns: Fix warning in poll cq direct mode - RDMA/irdma: Fix OOB read during CQ MR registration - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Remove raw RSS QP restrack tracking - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/srpt: fix integer overflow in immediate data length check - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - remoteproc: qcom: Fix leak when custom dump_segments addition fails - reset: sunxi: fix memory region leak on ioremap failure - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - Revert "PCI/MSI: Unmap MSI-X region on error" - Revert "treewide: Fix probing of devices in DT overlays" - ring-buffer: Fix event length with forced 8-byte alignment - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - riscv: probes: save original sp in rethook trampoline - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - rpmsg: use generic driver_override infrastructure - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: mpfs: fix counter upload completion condition - rtc: msc313: fix NULL deref in shared IRQ handler at probe - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - s390/monwriter: Reject buffer reuse with different data length - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - s390/process: Fix kernel thread function pointer type - s390/zcrypt: Remove the empty file - sched/fair: Fix cpu_util runnable_avg arithmetic - sched/fair: Only update stats for allowed CPUs when looking for dst group - sched: restore timer_slack_ns when resetting RT policy on fork - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: sg: Report request-table problems when any status is set - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Fix hexadecimal CHAP_I handling - scsi: target: Remove tcm_loop target reset handling - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - sctp: fix SCTP_RESET_STREAMS stream list length limit - sctp: hold socket lock when dumping endpoints in sctp_diag - sctp: validate embedded address parameter length - sctp: validate STALE_COOKIE cause length before reading staleness - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - seg6: validate SRH length before reading fixed fields - selftests/bpf: Add simple strscpy() implementation - selftests/bpf: Fix bpf_iter/task_vma test - selftests/bpf: Initialize operation name before use - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: do not manually call headers_install - selftests/hid: ensure CKI can compile our new tests on old kernels - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - selftests/hid: force using our compiled libbpf headers - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - selftests/mm: fix exclusive_cow test fork() handling - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - selinux: check connect-related permissions on TCP Fast Open - selinux: fix incorrect execmem checks on overlayfs - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: fix scoped_seqlock_read kernel-doc - seqlock: Introduce scoped_seqlock_read() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - smb/client: always return a value for FS_IOC_GETFLAGS - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix double-free in SMB2_open() replay - smb/client: Fix error code in smb2_aead_req_alloc() - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: fix overflow in passthrough ioctl bounds check - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: harden POSIX SID length parsing - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - smb: client: mask server-provided mode to 07777 in modefromsid - smb/client: preserve errors from smb2_set_sparse() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: resolve SWN tcon from live registrations - smb: client: restrict implied bcc[0] exemption to responses without data area - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - smb: client: use unaligned reads in parse_posix_ctxt() - smb: move some duplicate definitions to common/cifsglob.h - smb/server: do not require delete access for non-replacing links - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - sparc: led: avoid trimming a newline from empty writes - spi: dw: fix wrong BAUDR setting after resume - spi: ep93xx: fix double-free of zeropage on DMA setup failure - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure - spi: meson-spifc: fix runtime PM leak on remove - spi: rpc-if: Use correct device for hardware reinitialization on resume - spi: sh-msiof: abort transfers when reset times out - spi: uniphier: Fix completion initialization order before devm_request_irq() - spi: xilinx: use FIFO occupancy register to determine buffer size - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: most: video: avoid double free on video register failure - staging: nvec: fix use-after-free in nvec_rx_completed() - staging: rtl8723bs: core: move constants to right side in comparison - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: vme_user: bound slave read/write to the kern_buf size - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sysfs: clamp show() return value in sysfs_kf_read() - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - team: fix header_ops type confusion with non-Ethernet ports - thermal: hwmon: Fix critical temperature attribute removal - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - time: Fix off-by-one in compat settimeofday() usec validation - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - tipc: fix UAF in tipc_l2_send_msg() - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: reject inverted service ranges from peer bindings - tipc: require net admin for TIPCv2 netlink mutators - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - tools/power/x86/intel-speed-select: Harden daemon pidfile open - tools/testing: add linux/args.h header and fix radix, VMA tests - tools/virtio: check mmap return value in vringh_test - tpm: fix event_size output in tpm1_binary_bios_measurements_show - tpm: Make the TPM character devices non-seekable - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - tracing: Bound synthetic-field strings with seq_buf - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - tracing/osnoise: Call synchronize_rcu() when unregistering - tracing: Prevent out-of-bounds read in glob matching - tracing/probes: Fix double addition of offset for @+FOFFSET - tracing: probes: fix typo in a log message - treewide: Switch/rename to timer_delete[_sync]() - udf: validate free block extents against the partition length - udf: validate sparing table length as an entry count, not a byte count - udf: validate VAT header length against the VAT inode size - udmabuf: fix DMA direction mismatch in release_udmabuf() - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: dwc3: run gadget disconnect from sleepable suspend context - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: f_fs: initialize reset_work at allocation time - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - usb: gadget: f_printer: take kref only for successful open - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - usb: host: max3421: Reject hub port requests for non-existent ports - USB: idmouse: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - usb: iowarrior: remove inherent race with minor number - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - USB: ldusb: fix use-after-free on disconnect race - USB: legousbtower: fix use-after-free on disconnect race - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - userfaultfd: gate must_wait writability check on pte_present() - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - vduse: hold vduse_lock across IDR lookup in open path - vduse: Requeue failed read to send_list head - veth: fix NAPI leak in XDP enable error path - vfio/mlx5: Fix racy bitfields and tighten struct layout - vfio/pci: Fix racy bitfields and tighten struct layout - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Use a private flag to prevent power state change with VFs - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vhost/net: complete zerocopy ubufs only once - vhost/vdpa: validate virtqueue index in mmap and fault paths - virtio-mmio: fix device release warning on module unload - virtio_net: disable cb when NAPI is busy-polled - virtio-net: fix len check in receive_big() - virtio_net: Support dynamic rss indirection table size - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - watchdog: apple: Add "apple,t8103-wdt" compatible - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: unregister PM notifier on watchdog unregister - wifi: ath9k: fix OOB access from firmware tx status queue ID - wifi: cfg80211: fix grammar in MLO group key error message - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: mac80211: free ack status frame on TX header build failure - wifi: mt76: fix argument to ieee80211_is_first_frag() - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: rt2x00: avoid full teardown before work setup in probe - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - workqueue: drop spurious '*' from print_worker_info() fn declaration - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - X.509: Fix validation of ASN.1 certificate header - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - x86/bugs: Enable IBPB flush on BPF JIT allocation - x86/mm: Fix check/use ordering in switch_mm_irqs_off() - x86/platform/olpc: xo15: Drop wakeup source on driver removal - xen/gntdev: fix error handling in ioctl - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: use compat translator only for u64 alignment mismatch - xfrm: Use the XFRM_GRO to indicate a GRO call on input - xfrm: validate selector family and prefixlen during match - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfs: dump the recovered xattri log item if corruption happens - xfs: fail recovery on a committed log item with no regions - xfs: fix stupid compiler warning - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: move ->iop_recover to xfs_defer_op_type - xfs: recreate work items when recovering intent items - xfs: resample the data fork mapping after cycling ILOCK - xfs: use null daddr for unset first bad log block - xfs: use xfs_defer_finish_one to finish recovered work items - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Check frwr_wp_create() during connect - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Remove temp allocation of rpcrdma_rep objects - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Use sendctx DMA state for Send signaling - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Remove rudiment CVE patches- [bot] upd: 6.6.126 -> 6.6.144 - Changelog: - 6lowpan: fix off-by-one in multicast context address compression - 6pack: propagage new tty types - 9p: avoid putting oldfid in p9_client_walk() error path - accel/qaic: Add overflow check to remap_pfn_range during mmap - accel/qaic: Handle DBC deactivation if the owner went away - ACPI: AGDI: fix missing newline in error message - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - ACPI: PM: Save NVS memory on Lenovo G70-35 - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - af_key: validate families in pfkey_send_migrate() - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Give up GC if MSG_PEEK intervened. - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - af_unix: Reject SIOCATMARK on non-stream sockets - af_unix: Set gc_in_progress to true in unix_gc(). - agp/amd64: Fix broken error propagation in agp_amd64_probe() - alarmtimer: Fix argument order in alarm_timer_forward() - ALSA: 6fire: Fix input volume change detection - ALSA: 6fire: fix use-after-free on disconnect - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - ALSA: aoa: Use guard() for mutex locks - ALSA: asihpi: avoid write overflow check warning - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - ALSA: core: Fix potential data race at fasync handling - ALSA: core: Serialize deferred fasync state checks - ALSA: core: Validate compress device numbers without dynamic minors - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Limit PTP to a single page - ALSA: firewire-lib: fix uninitialized local variable - ALSA: firewire-motu: Protect register DSP event queue positions - ALSA: firewire-tascam: Do not drop unread control events - ALSA: fireworks: bound device-supplied status before string array lookup - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: add quirk for Framework F111:000F - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: misc: Use guard() for spin locks - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - ALSA: scarlett2: Add missing sentinel initializer field - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - ALSA: timer: Fix UAF at snd_timer_user_params() - ALSA: ua101: Reject too-short USB descriptors - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - ALSA: usb-audio: Add sanity check for OOB writes at silencing - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Evaluate packsize caps at the right place - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Improve Focusrite sample rate filtering - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Update the number of packets properly at receiving - ALSA: usb-audio: Use correct version for UAC3 header validation - ALSA: usb-audio: Use inclusive terms - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - amd-xgbe: fix sleep while atomic on suspend/resume - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - APEI/GHES: ensure that won't go past CPER allocated record - apparmor: fix aa_label to return state from compount and component match - apparmor: fix differential encoding verification - apparmor: Fix double free of ns_name in aa_replace_profiles() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix: limit the number of levels of policy namespaces - apparmor: fix memory leak in verify_header - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix NULL sock in aa_sock_file_perm - apparmor: fix race between freeing data and fs accessing it - apparmor: fix race on rawdata dereference - apparmor: fix rlimit for posix cpu timers - apparmor: fix side-effect bug in match_char() macro usage - apparmor: fix unprivileged local user can do privileged policy management - apparmor: fix use-after-free in rawdata dedup loop - apparmor: make label_match return a consistent value - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: provide separate audit messages for file and policy checks - apparmor: refcount the pdb - apparmor: remove apply_modes_to_perms from label_match - apparmor: replace recursive profile removal with iterative approach - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: validate DFA start states are in bounds in unpack_pdb - arm64: Add support for TSV110 Spectre-BHB mitigation - arm64: cpufeature: Make PMUVer and PerfMon unsigned - arm64: cputype: Add C1-Premium definitions - arm64: cputype: Add C1-Ultra definitions - arm64: cputype: Add NVIDIA Olympus definitions - arm64: Disable branch profiling for all arm64 code - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - arm64: dts: rockchip: Fix rk356x PCIe range mappings - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - arm64: errata: Mitigate TLBI errata on various Arm CPUs - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - arm64: Fix sampling the "stable" virtual counter in preemptible section - arm64: Force the use of CNTVCT_EL0 in __delay() - arm64: io: Extract user memory type in ioremap_prot() - arm64: io: Rename ioremap_prot() to __ioremap_prot() - arm64: kexec: Remove duplicate allocation for trans_pgd - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - arm64: probes: Handle probes on hinted conditional branch instructions - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - arm64/scs: Fix handling of advance_loc4 - arm64/scs: Fix potential sign extension issue of advance_loc4 - arm64: tegra: smaug: Add usb-role-switch support - arm64: tlb: Allow XZR argument to TLBI ops - arm64: tlb: Flush walk cache when unsharing PMD tables - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - arm64/xor: fix conflicting attributes for xor_block_template - ARM: 9467/1: mm: Don't use %pK through printk - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: clean up the memset64() C wrapper - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: group is_permission_fault() with is_translation_fault() - ARM: integrator: Fix early initialization - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - ARM: omap2: Fix reference count leaks in omap_control_init() - ARM: socfpga: Fix OF node refcount leak in SMP setup - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ASoC: codecs: ab8500: Fix casting of private data - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - ASoC: codecs: simple-mux: Fix enum control bounds check - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - ASoC: cs42l43: Correct handling of 3-pole jack load detection - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: detect empty DMI strings - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - ASoC: es8328: Add error unwind in resume - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: fix comment typo - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: Intel: catpt: Fix the device initialization - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm: move component registration to unmanaged version - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6asm-dai: close stream only when running - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: SOF: compress: return the configured codec from get_params - ASoC: SOF: Don't allow pointer operations on unconfigured streams - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda: Place check before dereference - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - atm: fore200e: fix use-after-free in tasklets during device removal - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - atm: lec: fix use-after-free in sock_def_readable() - audit: add fchmodat2() to change attributes class - audit: add missing syscalls to read class - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - audit: fix incorrect inheritable capability in CAPSET records - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - auxdisplay: arm-charlcd: fix release_mem_region() size - auxdisplay: line-display: fix OOB read on zero-length message_store() - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - batman-adv: Avoid double-rtnl_lock ELP metric worker - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: dat: prevent false sharing between VLANs - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix fragment reassembly length accounting - batman-adv: fix integer overflow on buff_pos - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: hold claim backbone gateways by reference - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: prevent ELP transmission interval underflow - batman-adv: reject new tp_meter sessions during teardown - batman-adv: reject oversized global TT response buffers - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: prevent TVLV entry number overflow - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tt: track roam count per VID - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: v: stop OGMv2 on disabled interface - bcache: fix cached_dev.sb_bio use-after-free and crash - bcache: fix uninitialized closure object - binder: don't use %pK through printk - binfmt_misc: restore write access before closing files opened by open_exec() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - blk-cgroup: fix UAF in __blkcg_rstat_flush() - blk-cgroup: wait for blkcg cleanup before initializing new disk - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - blktrace: fix __this_cpu_read/write in preemptible context - block: add pgmap check to biovec_phys_mergeable - block: relax pgmap check in bio_add_page for compatible zone device pages - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: bnep: reject short frames before parsing - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - Bluetooth: btmtk: add the function to get the fw name - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Allow firmware re-download when version matches - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: hci_conn: fix potential UAF in create_big_sync - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: HIDP: Fix possible UAF - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: MGMT: Fix backward compatibility with userspace - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: MGMT: validate mesh send advertising payload length - Bluetooth: qca: fix ROM version reading on WCN3998 chips - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: serialize accept_q access - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - bnxt_en: Fix NULL pointer dereference - bonding: 3ad: implement proper RCU rules for port->aggregator - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - bonding: add support for per-port LACP actor priority - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - bonding: fix NULL pointer dereference in actor_port_prio setting - bonding: fix use-after-free due to enslave fail after slave array update - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - bonding: only set speed/duplex to unknown, if getting speed failed - bonding: print churn state via netlink - bonding: refuse to enslave CAN devices - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - bpf, devmap: Remove unnecessary if check in for loop - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: Fix OOB in pcpu_init_value - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix RCU stall in bpf_fd_array_map_clear() - bpf: Fix regsafe() for pointers to packet - bpf: Fix stack-out-of-bounds write in devmap - bpf: Fix stale offload->prog pointer after constant blinding - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Forget ranges when refining tnum after JSET - bpf: Free reuseport cBPF prog after RCU grace period. - bpf: handle fake register spill to stack with BPF_ST_MEM instruction - bpf: preserve constant zero when doing partial register restore - bpf: preserve STACK_ZERO slots on partial reg spills - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Release module BTF IDR before module unload - bpf: Remove mark_precise_scalar_ids() - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix FIONREAD for sockmap - bpf, sockmap: Fix incorrect copied_seq calculation - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - bpf, sockmap: Take state lock for af_unix iter - bpf: support non-r10 register spill/fill to/from stack in precision tracking - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpftool: Fix truncated netlink dumps - bpf: track aligned STACK_ZERO cases as imprecise spilled registers - bpf: Track equal scalars history on per-instruction level - bpf: use kvfree() for replaced sysctl write buffer - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: verifier improvement in 32bit shift sign extension pattern - bridge: br_nd_send: linearize skb before parsing ND options - bridge: br_nd_send: validate ND option lengths - bridge: mcast: Fix a possible use-after-free when removing a bridge port - btrfs: abort transaction on failure to update root in the received subvol ioctl - btrfs: add raid stripe tree definitions - btrfs: add support for inserting raid stripe extents - btrfs: always fallback to buffered write if the inode requires checksum - btrfs: continue trimming remaining devices on failure - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: do not strictly require dirty metadata threshold for metadata writepages - btrfs: don't take device_list_mutex when querying zone info - btrfs: fix block_group_tree dirty_list corruption - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - btrfs: fix double free in create_space_info() error path - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: fix NULL dereference on root when tracing inode eviction - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix the qgroup data free range for inline data extents - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: handle user interrupt properly in btrfs_trim_fs() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - btrfs: move btrfs_crc32c_final into free-space-cache.c - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: read raid stripe tree from disk - btrfs: reject root items with drop_progress and zero drop_level - btrfs: remove btrfs_crc32c wrapper - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: replace BUG() with error handling in __btrfs_balance() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - Buffer overflow in drivers/xen/sys-hypervisor.c - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - bus: fsl-mc: fix use-after-free in driver_override_show() - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - bus: omap-ocp2scp: Convert to platform remove callback returning void - bus: omap-ocp2scp: fix OF populate on driver rebind - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - cache: enforce cache groups - can: bcm: fix locking for bcm_op runtime updates - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: gs_usb: gs_can_open(): always configure bitrates before starting device - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - can: mcp251x: add error handling for power enable in open and resume - can: mcp251x: fix deadlock in error path of mcp251x_open - can: raw: fix ro->uniq use-after-free in raw_rcv() - can: statistics: add missing atomic access in hot path - can: ucan: fix devres lifetime - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - cdc-acm: new quirk for EPSON HMD - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: only d_add() negative dentries when they are unhashed - ceph: supply snapshot context in ceph_uninline_data() - ceph: supply snapshot context in ceph_zero_partial_object() - cgroup/cpuset: Reset DL migration state on can_attach() failure - cgroup: fix race between task migration and iteration - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - char: tpm: cr50: Remove IRQF_ONESHOT - checkpatch: add support for Assisted-by tag - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - cifs: Fix busy dentry used after unmounting - cifs: Fix locking usage for tcon fields - cifs: make default value of retrans as zero - cifs: open files should not hold ref on superblock - cifs: some missing initializations on replay - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx8-acm: fix flags for acm clocks - clk: mediatek: Fix error handling in runtime PM setup - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: microchip: core: correct return value on *_get_parent() - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sc7180: Add missing MDSS resets - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - clk: qoriq: avoid format string warning - clk: renesas: rzg2l: Fix intin variable size - clk: renesas: rzg2l: Select correct div round macro - clk: rk808: fix OF node reference imbalance - clk: tegra: tegra124-emc: fix device leak on set_rate() - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - clk: visconti: pll: initialize clk_init_data to zero - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clsact: Fix use-after-free in init/destroy rollback asymmetry - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: dt2815: add hardware detection to prevent crash - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - coresight: etm3x: Fix cpulocked warning on cpuhp - counter: Fix refcount leak in counter_alloc() error path - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - cpufreq: conservative: Reset requested_freq on limits change - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - cpuidle: powerpc: avoid double clear when breaking snooze - cpuidle: Skip governor when only one idle state is available - cpuset: Fix missing adaptation for cpuset_is_populated - crypto: af_alg - Cap AEAD AD length to 0x80000000 - crypto: af-alg - fix NULL pointer dereference in scatterwalk - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel - Remove cfb and ofb - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - reject short ahash digests during instance creation - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: caam - fix DMA corruption on long hmac keys - crypto: caam - fix overflow on long hmac keys - crypto: caam - guard HMAC key hex dumps in hash_digest_key - crypto: cavium - fix dma_free_coherent() size - crypto: ccp - Add an S4 restore flow - crypto: ccp - copy IV using skcipher ivsize - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - crypto: ccp - Factor out ring destroy handling to a helper - crypto: ccp - Move direct access to some PSP registers out of TEE - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable - crypto: hisilicon/trng - modifying the order of header files - crypto: hisilicon/trng - support tfms sharing the device - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function - crypto: hisilicon/zip - remove zlib and gzip - crypto: hisilicon/zip - support deflate algorithm - crypto: jitterentropy - replace long-held spinlock with mutex - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - crypto: nx - fix context leak in nx842_crypto_free_ctx - crypto: nx - Migrate to scomp API - crypto: octeontx - fix dma_free_coherent() size - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - crypto: qat - fix warning on adf_pfvf_pf_proto.c - crypto: qat - remove unused character device and IOCTLs - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - use swab32 macro - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: scatterwalk - Backport memcpy_sglist() - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - cxl: Fix premature commit_end increment on decoder commit failure - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - dcache: Limit the minimal number of bucket to two - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - device property: Allow secondary lookup in fwnode_get_next_child_node() - device property: Make modifications of fwnode "flags" thread safe - device property: set fwnode->secondary to NULL in fwnode_init() - dev_printk: add new dev_err_probe() helpers - devres: fix missing node debug info in devm_krealloc() - Disable -Wattribute-alias for clang-23 and newer - dlm: prevent NPD when writing a positive value to event_done - dma-buf: Include ioctl.h in UAPI header - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - dmaengine: idxd: Fix crash when the event log is disabled - dmaengine: idxd: Fix freeing the allocated ida too late - dmaengine: idxd: Fix leaking event log memory - dmaengine: idxd: Fix memory leak when a wq is reset - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dma-mapping: add missing `inline` for `dma_free_attrs` - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - dm cache: fix concurrent write failure in passthrough mode - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: fix missing return in invalidate_committed's error path - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache metadata: fix memory leak on metadata abort retry - dm cache policy smq: check allocation under invalidate lock - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: support shrinking the origin device - dm: clear cloned request bio pointer when last clone bio completes - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - dm init: ensure device probing has finished in dm-mod.waitfor= - dm-integrity: fix a typo in the code for write/discard race - dm-integrity: fix recalculation in bitmap mode - dm log: fix out-of-bounds write due to region_count overflow - dm mirror: fix integer overflow in create_dirty_log() - dm mpath: make pg_init_delay_msecs settable - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - dm-thin: fix metadata refcount underflow - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm: use bio_clone_blkg_association - dm-verity: correctly handle dm_bufio_client_create() failure - dm-verity: disable recursive forward error correction - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - docs: fix WARNING document not included in any toctree - Documentation: fix a hugetlbfs reservation statement - Documentation: ioctl-number: Extend "Include File" column width - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - Documentation: tracing: Add ring-buffer mapping - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2-switch: do not clear any interrupts automatically - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - drbd: Balance RCU calls in drbd_adm_dump_devices() - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - driver core: Don't let a device probe until it's ready - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - driver core: reject devices with unregistered buses - drivers/base/memory: fix memory block reference leak in poison accounting - drivers/base/memory: set mem->altmap after successful device registration - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - drivers: iio: mpu3050: use dev_err_probe for regulator request - drm: Account property blob allocations to memcg - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: Do not skip unrelated mode changes in DSC validation - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - drm/amd/display: Remove conditional for shaper 3DLUT power-on - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amd: Drop special case for yellow carp without discovery - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - drm/amdgpu: Add basic validation for RAS header - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu: Add default case in DVI mode validation - drm/amdgpu: Add HAINAN clock adjustment - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amdgpu: Adjust usleep_range in fence wait - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - drm/amdgpu: fix spelling typos - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amdgpu: fix zero-size GDS range init on RDNA4 - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu: zero-initialize GART table on allocation - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix debug watchpoints for logical devices - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amd: Set num IP blocks to 0 if discovery fails - drm/arcpgu: fix device node leak - drm/ast: dp501: Fix initialization of SCU2C - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/display/dp_mst: Add protection against 0 vcpi - drm/dp: Add eDP 1.5 bit definition - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - drm/i915/acpi: free _DSM package when no connectors - drm/i915: Constify watermark state checker - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Fix potential overflow of shmem scatterlist length - drm/i915: Fix potential UAF in TTM object purge - drm/i915/gem: Fix phys BO pread/pwrite with offset - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - drm/i915/gt: Check set_default_submission() before deferencing - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/i915/psr: Do not use pipe_src as borders for SU area - drm/i915/psr: Read Intel DPCD workaround register - drm/i915: Simplify watermark state checker calling convention - drm/i915: skip __i915_request_skip() for already signaled requests - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - drm/i915/wm: Verify the correct plane DDB entry - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - drm/ioc32: stop speculation on the drm_compat_ioctl path - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - drm/msm/a2xx: fix pixel shader start on A225 - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: don't dump registers past the mapped region - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm: Fix dma_free_attrs() buffer size - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/shrinker: Fix can_block() logic - drm/msm/snapshot: fix dumping of the unaligned regions - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/radeon: Add HAINAN clock adjustment - drm/radeon: add missing revision check for CI - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm: Remove plane hsub/vsub alignment requirement for core helpers - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - drm/solomon: Fix page start when updating rectangle in page addressing mode - drm/ssd130x: Replace .page_height field in device info with a constant - drm/ssd130x: Store the HW buffer in the driver-private CRTC state - drm/ssd130x: Use bool for ssd130x_deviceinfo flags - drm/sun4i: backend: fix error pointer dereference - drm/sun4i: Fix resource leaks - drm/sysfb: ofdrm: fix PCI device reference leaks - drm/tegra: dsi: fix device leak on probe - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - drm/v3d: Reject empty multisync extension to prevent infinite loop - drm/v3d: Set DMA segment size to avoid debug warnings - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: fix krealloc() memory leak - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: platform_get_irq_byname() returns an int - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Release runtime PM reference after binding V3D - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/virtio: Fix driver removal with disabled KMS - drm/virtio: use uninterruptible resv lock for plane updates - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - dt-bindings: connector: add pd-disable dependency - dt-bindings: gpio: fix microchip #interrupt-cells - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - e1000: check return value of e1000_read_eeprom - e1000/e1000e: Fix leak in DMA error cleanup - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - e1000e: Unroll PTP in probe error handling - EDAC/altera: Remove IRQF_ONESHOT - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/mc: Fix error path ordering in edac_mc_alloc() - efi: Allocate runtime workqueue before ACPI init - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - EFI/CPER: don't dump the entire memory region - EFI/CPER: don't go past the ARM processor CPER record buffer - efi: Fix reservation of unaccepted memory table - erofs: add GFP_NOIO in the bio completion if needed - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - erofs: fix the out-of-bounds nameoff handling for trailing dirents - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - err.h: use __always_inline on all error pointer helpers - esp: fix skb leak with espintcp and async crypto - eth: bnxt: always recalculate features after XDP clearing, fix null-deref - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - eventfs: Hold eventfs_mutex and SRCU when remount walks events - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - eventpoll: defer struct eventpoll free to RCU grace period - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: Fix integer overflow in ep_loop_check_proc() - eventpoll: kill __ep_remove() - eventpoll: move epi_fget() up - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - exfat: fix potential use-after-free in exfat_find_dir_entry() - exit: prevent preemption of oopsing TASK_DEAD task - exit: Sleep at TASK_IDLE when waiting for application core dump - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ext4: always allocate blocks only from groups inode can use - ext4: always drain queued discard work in ext4_mb_release() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: avoid infinite loops caused by residual data - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert inline data to extents when truncate exceeds inline size - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - ext4: don't cache extent during splitting extent - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: fix e4b bitmap inconsistency reports - ext4: fix fsync(2) for nojournal mode - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix journal credit check when setting fscrypt context - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix stale xarray tags after writeback - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix use-after-free in update_super_work when racing with umount - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_extent_at() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: mark group add fast-commit ineligible - ext4: mark group extend fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: publish jinode after initialization - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: use optimized mballoc scanning regardless of inode format - ext4: validate p_idx bounds in ext4_ext_correct_indexes - extcon: ptn5150: handle pending IRQ events during system resume - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to avoid mapping wrong physical block for swapfile - f2fs: fix to avoid memory leak in f2fs_rename() - f2fs: fix to avoid migrating empty section - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix to detect potential corrupted nid in free_nid_list - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - f2fs: fix to round down start offset of fallocate for pin file - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - f2fs: fix zoned block device information initialization - f2fs: keep atomic write retry from zeroing original data - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: validate compress cache inode only when enabled - f2fs: zone: fix to avoid inconsistence in between SIT and SSA - fanotify: fix false positive on permission events - fat: avoid parent link count underflow in rmdir - fbcon: Avoid OOB font access if console rotation fails - fbcon: check return value of con2fb_acquire_newinfo() - fbcon: Remove struct fbcon_display.inverse - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: fix use-after-free in store_modes() - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: offb: fix PCI device reference leak on probe failure - fbdev: rivafb: fix divide error in nv3_arb() - fbdev: smscufx: properly copy ioctl memory to kernelspace - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - file: add fput() cleanup helper - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_scpi: Fix device_node reference leak in probe path - firmware: dmi: Correct an indexing error in dmi.h - firmware: google: framebuffer: Do not mark framebuffer as busy - firmware: google: framebuffer: Do not unregister platform device - fix it87_wdt early reboot by reporting running timer - flow_dissector: do not dissect PPPoE PFC frames - fork: defer linking file vma until vma is fully initialized - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - fpga: of-fpga-region: Fail if any bridge is missing - fpga: region: fix use-after-free in child_regions_with_firmware() - fs: add for 'init_fs' - fs/adfs: validate nzones in adfs_validate_bblk() - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - fs/nfs: Fix readdir slow-start regression - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - fs/ntfs3: validate rec->used in journal-replay file record check - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs: prepare for adding LSM blob to backing_file - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Update the mcount_loc check of skipped entries - fuse: Check for large folio with SPLICE_F_MOVE - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fuse: quiet down complaints in fuse_conn_limit_write - fuse: reject fuse_notify() pagecache ops on directories - fuse: reject oversized dirents in page cache - fuse: re-lock request before replacing page cache folio - futex: Clear stale exiting pointer in futex_lock_pi() retry path - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - genetlink: Use internal flags for multicast groups - gfs2: Add metapath_dibh helper - gfs2: add some missing log locking - gfs2: Call unlock_new_inode before d_instantiate - gfs2: fiemap page fault fix - gfs2: Fix unlikely race in gdlm_put_lock - gfs2: fix use-after-free in gfs2_qd_dealloc - gfs2: Fix use-after-free in iomap inline data write path - gfs2: Improve gfs2_consist_inode() usage - gfs2: prevent NULL pointer dereference during unmount - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Validate i_depth for exhash directories - gpio: aspeed-sgpio: Change the macro to support deferred probe - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: acpi: Fix gpio count with string references - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: mvebu: fix NULL pointer dereference in suspend/resume - gpio: mxc: fix irq_high handling - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: of: clear OF_POPULATED on hog nodes in remove path - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - gpio: sprd: Change sprd_gpio lock to raw_spin_lock - gpio: tegra: fix irq_release_resources calling enable instead of disable - gro: change the BUG_ON() in gro_pull_from_frag0() - gve: defer interrupt enabling until NAPI registration - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - hdlc_ppp: sync per-proto timers before freeing hdlc state - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix volume corruption issue for generic/498 - hfsplus: pretend special inodes as regular files - hfsplus: return error when node already exists in hfs_bnode_create - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - HID: apple: avoid memory leak in apple_report_fixup() - HID: asus: add xg mobile 2023 external hardware support - HID: asus: avoid memory leak in asus_report_fixup() - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: core: clamp report_size in s32ton() to avoid undefined shift - HID: core: Fix size_t specifier in hid_report_raw_event() - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: hid-pl: handle probe errors - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: magicmouse: Do not crash on missing msc->input - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: mcp2221: cancel last I2C command on read error - HID: multitouch: add eGalaxTouch EXC3188 support - HID: multitouch: Check to ensure report responses match the request - HID: pass the buffer size to hid_report_raw_event - HID: playstation: Add missing check for input_ff_create_memless - HID: playstation: Clamp num_touch_reports - HID: prodikeys: Check presence of pm->input_ep82 - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - HID: quirks: really enable the intended work around for appledisplay - HID: roccat: fix use-after-free in roccat_report_event - HID: uclogic: Fix regression of input name assignment - HID: usbhid: fix deadlock in hid_post_reset() - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - hisi_acc_vfio_pci: update status after RAS error - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Fix trace oddity - hrtimer: Reduce trace noise in hrtimer_start() - hrtimers: Update the return type of enqueue_hrtimer() - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - hv_sock: fix ARM64 support - hv: utils: handle and propagate errors in kvp_register - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: axi-fan: don't use driver_override as IRQ name - hwmon: (corsair-psu) Close HID device on probe errors - hwmon: (f71882fg) Add F81968 support - hwmon: (it87) Check the it87_lock() return value - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (occ) Fix division by zero in occ_show_power_1() - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - hwmon: (pmbus/core) Protect regulator operations with mutex - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: s3c24xx: check the size of the SMBUS message before using it - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: stub: Reject I2C block transfers with invalid length - i2c: tegra: Don't mark devices with pins as IRQ safe - i2c: tegra: Fix NOIRQ suspend/resume - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: master: Update hot-join flag only on success - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: Move device name assignment after i3c_bus_init - i40e: Cleanup PTP pins on probe failure - i40e: don't advertise IFF_SUPP_NOFCS - i40e: Fix preempt count leak in napi poll tracepoint - i40e: fix registering XDP RxQ info - i40e: fix src IP mask checks and memcpy argument names in cloud filter - i40e: use xdp.frame_sz as XDP RxQ info frag_size - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: fix VLAN filter lost on add/delete race - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - IB/cache: update gid cache on client reregister event - IB/core: Fix zero dmac race in neighbor resolution - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - ibmveth: Disable GSO for packets with small MSS - ice: fix double-free of tx_buf skb - ice: fix locking in ice_dcb_rebuild() - ice: Fix memory leak in ice_set_ringparam() - ice: fix NULL pointer dereference in ice_reset_all_vfs() - ice: fix retry for AQ command 0x06EE - ice: fix setting promisc mode while adding VID filter - ice: fix VF queue configuration with low MTU values - ice: reintroduce retry mechanism for indirect AQ - ice: Remove jumbo_remove step from TX path - ice: use ice_update_eth_stats() for representor stats - icmp: fix NULL pointer dereference in icmp_tag_validation() - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage - icmp: prevent possible overflow in icmp_global_allow() - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - igc: fix missing update of skb->tail in igc_xmit_frame() - iio: accel: fix ADXL355 temperature signature value - iio: adc: ad7768-1: fix one-shot mode data acquisition - iio: adc: npcm: Convert to platform remove callback returning void - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: buffer: Fix wait_queue not being removed - iio: buffer: hw-consumer: fix use-after-free in error path - iio: chemical: bme680: Fix measurement wait duration calculation - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: common: st_sensors: Fix use of uninitialize device structs - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: fix ref bit initialization for single-channel parts - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: dac: ds4424: reject -128 RAW value - iio: dac: max5821: fix return value check in powerdown sync - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: gyro: adis16260: fix division by zero in write_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: itg3200: Fix unchecked return value in read_raw - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: light: bh1780: fix PM runtime leak on error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: light: vcnl4035: fix scan buffer on big-endian - iio: magnetometer: Remove IRQF_ONESHOT - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: pressure: mprls0025pa: fix scan_type struct - iio: sca3000: Fix a resource leak in sca3000_probe() - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: Use IRQF_NO_THREAD - ima: check return value of crypto_shash_final() in boot aggregate - ima: verify the previous kernel's IMA buffer lies in addressable RAM - include: uapi: netfilter_bridge.h: Cover for musl libc - indirect_call_wrapper: do not reevaluate function pointer - inet: add indirect call wrapper for getfrag() calls - inet: frags: add inet_frag_queue_flush() - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: move icmp_global_{credit,stamp} to a separate cache line - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: elan_i2c - validate firmware size before use - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - fix out-of-bounds access for Share button - iomap: allocate s_dio_done_wq for async reads as well - iomap: don't revert iov_iter on partially completed buffered writes - iomap: fix submission side handling of completion side errors - iomap: reject delalloc mappings during writeback - iommu/amd: move wait_on_sem() out of spinlock - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - iommufd: Fix a race with concurrent allocation and unmap - iommufd: vfio compatibility extension check for noiommu mode - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - iommu/vt-d: Flush cache for PASID table before using it - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - ionic: fix persistent MAC address override on PF - ionic: Rate limit unknown xcvr type messages - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - io_uring/filetable: clamp alloc_hint to the configured alloc range - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix multishot recv missing EOF on wakeup race - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/sync: validate passed in offset - io_uring/timeout: check unused sqe fields - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ip6_gre: Use cached t->net in ip6erspan_changelink(). - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - ip6_vti: set netns_immutable on the fallback device. - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipc: don't audit capability check in ipc_permissions() - ipc: limit next_id allocation to the valid ID range - ipc/shm: serialize orphan cleanup with shm_nattch updates - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ipmi: ipmb: initialise event handler read bytes - ipmi:si: Return state to normal if message allocation fails - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi:ssif: Clean up kthread on errors - ipmi:ssif: Fix a shutdown race - ipmi:ssif: NULL thread on error - ipmi:ssif: Remove unnecessary indention - ipv4: account for fraggap on the paged allocation path - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - ipv4: icmp: validate reply type before using icmp_pointers - ipv4: igmp: annotate data-races around idev->mr_maxdelay - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ipv6: account for fraggap on the paged allocation path - ipv6: add NULL checks for idev in SRv6 paths - ipv6/addrconf: annotate data-races around devconf fields (II) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: avoid overflows in ip6_datagram_send_ctl() - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: exthdrs: refresh nh after handling HAO option - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - ipv6: Fix a potential NPD in cleanup_prefix_route() - ipv6: fix a race in ip6_sock_set_v6only() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible UAF in icmpv6_rcv() - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - ipv6: mcast: Fix use-after-free when processing MLD queries - ipv6: prevent possible UaF in addrconf_permanent_addr() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - ipv6: sit: reload inner IPv6 header after GSO offloads - ipv6: use RCU in ip6_xmit() - ipv6: validate extension header length before copying to cmsg - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - ipvs: clear the svc scheduler ptr early on edit - ipvs: fix MTU check for GSO packets in tunnel mode - ipvs: fix NULL deref in ip_vs_add_service error path - ipvs: skip ipv6 extension headers for csum checks - irqchip/ath79-cpu: Remove unused function - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - ixgbevf: add missing negotiate_features op to Hyper-V ops table - ixgbevf: fix link setup issue - ixgbevf: fix use-after-free in VEPA multicast source pruning - jbd2: gracefully abort on checkpointing state corruptions - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - kbuild: Add objtool to top-level clean target - kbuild: Leave objtool binary around with 'make clean' - kexec: derive purgatory entry from symbol - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - kprobes: avoid crash when rmmod/insmod after ftrace killed - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - ksmbd: add durable scavenger timer - ksmbd: add support for supplementary groups - ksmbd: avoid reclaiming expired durable opens by the client - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: Compare MACs in constant time - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: do not expire session on binding failure - ksmbd: Don't log keys in SMB3 signing and encryption key generation - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix OOB write in QUERY_INFO for compound requests - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - ksmbd: reject non-VALID session in compound request branch - ksmbd: replace connection list with hash table - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: require minimum ACE size in smb_check_perm_dacl() - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: unset conn->binding on failed binding request - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: validate inherited ACE SID length - ksmbd: validate owner of durable handle on reconnect - ksmbd: validate response sizes in ipc_validate_msg() - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Fix the month in the name of the failure directory - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - kunit: config: Enable KUNIT_DEBUGFS by default - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: tool: copy caller args in run_kernel to prevent mutation - KVM: arm64: Discard PC update state on vcpu reset - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: PMU: Preserve AArch32 counter low bits - KVM: arm64: Remove VPIPT I-cache handling - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: check validity of VMCB controls when returning from SMM - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - KVM: VMX: Update SVI during runtime APICv activation - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: x86: Fix KVM_GET_MSRS stack info leak - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - KVM: x86: Fix shadow paging use-after-free due to unexpected role - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - KVM: x86: Use scratch field in MMIO fragment to hold small write values - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - l2tp: Drop large packets with UDP encap - landlock: Fix handling of disconnected directories - leds: lgm-sso: Remove duplicate assignments for priv->mmap - leds: qcom-lpg: Check for array overflow when selecting the high resolution - leds: qcom-lpg: Check the return value of regmap_bulk_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: check xbc_init_node() return in override path - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - libbpf: Fix OOB read in btf_dump_get_bitfield_value - libbpf: Fix -Wdiscarded-qualifiers under C23 - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: define and enforce CEPH_MAX_KEY_LEN - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix slab-out-of-bounds access in auth message processing - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libsubcmd: Fix null intersection case in exclude_cmds() - lib: test_hmm: evict device pages on file close to avoid use-after-free - lib/ts_kmp: fix integer overflow in pattern length calculation - locking: Fix rwlock support in - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - LoongArch: Add spectre boundry for syscall dispatch table - LoongArch: Add WriteCombine shadow mapping in KASAN - LoongArch: Add writecombine support for DMW-based ioremap() - LoongArch: Disable instrumentation for setup_ptwalker() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: Give more information if kmem access failed - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE - LoongArch: Prefer top-down allocation after arch_mem_init() - LoongArch: Remove unused code to avoid build warning - LoongArch: Rework KASAN initialization for PTW-enabled systems - LoongArch: Show CPU vulnerabilites correctly - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - loop: fix partition scan race between udev and loop_reread_partitions() - lsm: add backing_file LSM hooks - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - mac802154: llsec: add skb_cow_data() before in-place crypto - macsec: fix replay protection at XPN lower-PN wrap - macvlan: annotate data-races around port->bc_queue_len_used - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - mailbox: add sanity check for channel array - mailbox: Allow controller specific mapping using fwnode - mailbox: bcm-ferxrm-mailbox: Use default primary handler - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: free channels on probe error - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: sprd: clear delivery flag before handling TX done - mailbox: sprd: mask interrupts that are not handled - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use of_property_match_string() instead of open-coding - mctp: i2c: fix skb memory leak in receive path - mctp i2c: initialise event handler read bytes - mctp: route: hold key->lock in mctp_flow_prepare_output() - md/bitmap: fix GPF in write_page caused by resize race - md-cluster: fix NULL pointer dereference in process_metadata_update - md/raid10: fix any_working flag handling in raid10_sync_request - md/raid10: fix deadlock with check operation and nowait requests - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - md/raid1: fix data lost for writemostly rdev - md/raid1,raid10: don't ignore IO flags - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - media: amphion: Fix race between m2m job_abort and device_run - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - media: ccs: Accommodate C-PHY into the calculation - media: ccs: Avoid possible division by zero - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: dvb-core: dmxdevfilter must always flush bufs - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - media: dvb-net: fix OOB access in ULE extension header tables - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - media: i2c: imx412: Assert reset GPIO during probe - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix digital gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov08d10: fix image vertical start setting - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: mediatek: vcodec: fix use-after-free in encoder release path - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: omap3isp: drop the use count of v4l2 pipeline - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: set initial format - media: pci: zoran: fix potential memory leak in zoran_probe() - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: radio-keene: fix memory leak in error path - media: rc: fix race between unregister and urb/irq callbacks - media: rc: igorplugusb: fix control request setup packet - media: rc: igorplugusb: heed coherency rules - media: rc: streamzap: Error handling in probe - media: rc: ttusbir: fix inverted error logic - media: rc: ttusbir: respect DMA coherency rules - media: rc: xbox_remote: heed DMA restrictions - media: rkisp1: Fix filter mode register configuration - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - media: saa7164: add ioremap return checks and cleanups - media: solo6x10: Check for out of bounds chip_id - media: staging: imx: request mbus_config in csi_start - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: uvcvideo: Fix allocation for small frame sizes - media: v4l2-async: Fix error handling on steps after finding a match - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tile info buffer size - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - media: vidtv: fix pass-by-value structs causing MSAN warnings - memfd: deny writeable mappings when implying SEAL_WRITE - memory: mtk-smi: Convert to platform remove callback returning void - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: core: Add locking around 'mfd_of_node_list' - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mfd: wm8350-core: Use IRQF_ONESHOT - minix: Add required sanity checking to minix_check_superblock() - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - MIPS: Fix the GCC version check for `__multi3' workaround - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - mips: mm: Allocate tlb_vpn array atomically - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - mips: ralink: update CPU clock index - MIPS: rb532: Fix MMIO UART resource registration - MIPS: Work around LLVM bug when gp is used as global register variable - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: possible double-free of cctx->remote_heap - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mmc: block: use single block write in retry - mmc: core: Avoid bitfield RMW for claim/retune flags - mmc: core: Fix host controller programming for fixed driver type - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: vub300: fix NULL-deref on disconnect - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: use time_in_range_open() for damos quota window start - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/ops-common: call folio_test_lru() after folio_get() - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - mm/highmem: fix __kmap_to_page() build error - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm/huge_memory: update file PMD counter before folio_put() - mm/hugetlb: avoid false positive lockdep assertion - mm/hugetlb_cma: round up per_node before logging it - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() - mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mm/kasan: fix double free for kasan pXds - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mm/kfence: fix KASAN hardware tag faults during late enablement - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - mm/page_alloc: clear page->private in free_pages_prepare() - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - mm/tracing: rss_stat: ensure curr is false from kthread context - modpost: Amend ppc64 save/restfpr symnames for -Os build - module: add helper function for reading module_buildid() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - module: Fix kernel panic when a symbol st_shndx is out of bounds - mpls: add missing unregister_netdevice_notifier to mpls_init - mptcp: add-addr: always drop other suboptions - mptcp: allow subflow rcv wnd to shrink - mptcp: cleanup fallback dummy mapping generation - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: do not drop partial packets - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fastclose msk when linger time is 0 - MPTCP: fix lock class name family in pm_nl_create_listen_socket - mptcp: fix missing wakeups in edge scenarios - mptcp: fix receive space timestamp initialization - mptcp: fix retransmission loop when csum is enabled - mptcp: fix rx timestamp corruption on fastopen - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: fix slab-use-after-free in __inet_lookup_established - mptcp: handle first subflow closing consistently - mptcp: introduce the mptcp_init_skb helper - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: in-kernel: always set ID as avail when rm endp - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: reset rcv wnd on disconnect - mptcp: sockopt: check timestamping ret value - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: sync the msk->sndbuf at accept() time - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use plain bool instead of custom binary enum - mtd: Avoid boot crash in RedBoot partition table parser - mtd: docg3: Convert to platform remove callback returning void - mtd: docg3: fix use-after-free in docg3_release() - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: physmap_of_gemini: Fix disabled pinctrl state check - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - mtd: rawnand: pl353: Fix software ECC support - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: spinand: Fix kernel doc - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - mtd: spi-nor: sst: Fix SST write failure - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - myri10ge: avoid uninitialized variable use - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - net: add proper RCU protection to /proc/net/ptype - net: Add skb_dstref_steal and skb_dstref_restore - net: add support for segmenting TCP fraglist GSO packets - net: af_key: zero aligned sockaddr tail in PF_KEY exports - net: ag71xx: check error for platform_get_irq - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - net: annotate data-races around sk->sk_{data_ready,write_space} - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: fix leaking free_bds - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: fix racing timeout handler - net: bcmgenet: increase WoL poll timeout - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: keep RBUF EEE/PM disabled - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bonding: add broadcast_neighbor option for 802.3ad - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: bonding: fix use-after-free in bond_xmit_broadcast() - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: bridge: Flush multicast groups when snooping is disabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net: bridge: use a stable FDB dst snapshot in RCU readers - net: caif: clear client service pointer on teardown - netconsole: avoid out-of-bounds access on empty string in trim_newline() - netconsole: propagate device name truncation in dev_name_store() - net: consume xmit errors of GSO frames - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - netdevsim: zero initialize struct iphdr in dummy sk_buff - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: dsa: microchip: Fix error path in PTP IRQ setup - net: dsa: mt7530: fix FDB entries not aging out with short timeout - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: properly keep track of conduit reference - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - net: enetc: fix the output issue of 'ethtool --show-ring' - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - net: ethernet: xscale: Check for PTP support properly - net: fec: fix pinctrl default state restore order on resume - net: fec: fix the PTP periodic output sysfs interface - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: bridge: make ebt_snat ARP rewrite writable - netfilter: conntrack: add missing netlink policy validations - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: conntrack: remove sprintf usage - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - netfilter: ctnetlink: ensure safe access to master conntrack - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: use netlink policy range checks - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: flowtable: strictly check for maximum number of actions - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: ip6t_hbh: reject oversized option lists - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: ipset: drop logically empty buckets in mtype_del - netfilter: ipset: stop hash:* range iteration at end - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conncount: fix tracking of connections from localhost - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: nf_conntrack_sip: get helper before allocating expectation - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_log: account for netlink header size - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: nf_tables: always walk all pending catchall elements - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - netfilter: nf_tables: reject immediate NF_QUEUE verdict - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_ct: add seqadj extension for natted connections - netfilter: nft_ct: bail out on template ct in get eval - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: nft_ct: fix missing expect put in obj eval - netfilter: nft_ct: fix use-after-free in timeout object destroy - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: nft_inner: Fix IPv6 inner_thoff desync - netfilter: nft_osf: restrict it to ipv4 - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_tunnel: fix use-after-free on object destroy - netfilter: reject zero shift in nft_bitwise - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: skip recording stale or retransmitted INIT - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: x_tables: ensure names are nul-terminated - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: xtables: restrict several matches to inet family - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: x_tables: unregister the templates first - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: xt_socket: enable defrag after all other checks - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: xt_time: use unsigned int for monthday bit shift - net: fix fanout UAF in packet_release() via NETDEV_UP race - net: Fix icmp host relookup triggering ip_rt_bug - net: fix segmentation of forwarding fraglist GRO - netfs: fix error handling in netfs_extract_user_iter() - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net: ftgmac100: fix ring allocation unwind on open failure - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: gro: don't merge zcopy skbs - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: guard timestamp cmsgs to real error queue skbs - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix double free issue for tx spare buffer - net: hsr: defer node table free until after RCU readers - net: hsr: fix potential OOB access in supervision frame handling - net: hsr: fix VLAN add unwind on slave errors - net: ifb: report ethtool stats over num_tx_queues - net: intel: fix PCI device ID conflict between i40e and ipw2200 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipv4: stop checking crypto_ahash_alignmask - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net: ipv6: stop checking crypto_ahash_alignmask - net/iucv: fix locking in .getsockopt - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - netlabel: validate unlabeled address and mask attribute lengths - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: lan966x: avoid unregistering netdev on register failure - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - net: libwx: fix VF illegal register access - net: macb: fix clk handling on PCI glue driver removal - net: macb: Fix tx/rx malfunction after phy link down and up - net: macb: fix uninitialized rx_fs_lock - net: macb: fix use-after-free access to PTP clock - net: macb: Introduce gem_init_rx_ring() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: properly unregister fixed rate clocks - net: macb: queue tie-off or disable during WOL suspend - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - net: macb: Shuffle the tx ring before enabling tx - net: macb: Use dev_consume_skb_any() to free TX SKBs - net: macb: use the current queue number for stats - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: mana: fix use-after-free in add_adev() error path - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - net: mana: Ring doorbell at 4 CQ wraparounds - net: mana: validate rx_req_idx to prevent out-of-bounds array access - net: mctp: ensure our nlmsg responses are initialised - net: mctp: fix don't require received header reserved bits to be zero - net: mctp i2c: check length before marking flow active - net: mctp-i2c: fix duplicate reception of old data - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Do not restore destination-less TC rules - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: Fix race condition during IPSec ESN update - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: Fix multiport device check over light SFs - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5: IFC updates for disabled host PF - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5: Query to see if host PF is disabled - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net/mlx5: Update the list of the PCI supported devices - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mv643xx: fix OF node refcount - net: mvpp2: Add metadata support for xdp mode - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: mvpp2: limit XDP frame size to the RX buffer - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: sync RX data at the hardware packet offset - net: ncsi: fix skb leak in error paths - net: netconsole: move newline trimming to function - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - net: nfc: nci: Fix parameter validation for packet data - net: nfc: nci: Fix zero-length proprietary notifications - netns-ipv4: reorganize netns_ipv4 fast path variables - net: openvswitch: Avoid releasing netdev before teardown completes - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - net: phonet: free phonet_device after RCU grace period - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: phy: clean the sfp upstream if phy probing fails - net: phy: dp83869: fix setting CLK_O_SEL field. - net: phy: DP83TC811: add reading of abilities - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: qrtr: ns: Fix use-after-free in driver remove() - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the total number of nodes - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - net: rds: clear i_sends on setup unwind - net/rds: Clear reconnect pending bit - net/rds: Fix circular locking dependency in rds_tcp_tune - net: rds: fix MR cleanup on copy error - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - net/rds: handle zerocopy send cleanup before the message is queued - net/rds: No shortcut out of RDS_CONN_ERROR - net/rds: Optimize rds_ib_laddr_check - net/rds: rds_sendmsg should not discard payload_len - net/rds: reset op_nents when zerocopy page pin fails - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: zero per-item info buffer before handing it to visitors - net: remove WARN_ON_ONCE when accessing forward path array - net: rfkill: prevent unlimited numbers of rfkill events from being created - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: sched: act_csum: validate nested VLAN headers - net/sched: act_ct: Only release RCU read lock after ct_ft - net/sched: act_gate: snapshot parameters with RCU on replace - net/sched: act_ife: Fix metalist update behavior - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - net/sched: cls_flower: revert unintended changes - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: ets: fix divide by zero in the offload path - net/sched: fix pedit partial COW leading to page cache corruption - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: taprio: fix NULL pointer dereference in class dump - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - net/sched: teql: Fix double-free in teql_master_xmit - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: sfp: improve Huawei MA5671a fixup - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net: skb: fix cross-cache free of KFENCE-allocated skb head - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - net: skbuff: fix pskb_carve leaking zcopy pages - net: skbuff: preserve shared-frag marker during coalescing - net: skbuff: propagate shared-frag marker through frag-transfer helpers - net: skmsg: preserve sg.copy across SG transforms - net/smc: avoid early lgr access in smc_clc_wait_msg - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - net/smc: Do not re-initialize smc hashtables - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: sparx5/lan969x: fix PTP clock max_adj value - net: stmmac: avoid shadowing global buf_sz - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - net: stmmac: Fix error handling in VLAN add and delete paths - net: stmmac: fix integer underflow in chain mode - net: stmmac: Fix PTP ref clock for Tegra234 - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: remove support for lpi_intr_o - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: strparser: fix skb_head leak in strp_abort_strp() - net: sunhme: Fix sbus regression - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - net: tcp: accept old ack during closing - net/tcp-md5: Fix MAC comparison to be constant-time - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: fix strparser anchor skb leak on offload RX setup failure - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - net: tls: prevent chain-after-chain in plain text SG - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - net: txgbe: fix firmware version check - net: txgbe: fix RTNL assertion warning when remove module - net: txgbe: leave space for null terminators on property_entry - net: usb: aqc111: Do not perform PM inside suspend callback - net: usb: catc: enable basic endpoint checking - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - net: usb: kalmia: validate USB endpoints - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: kaweth: validate USB endpoints - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: pegasus: enable basic endpoint checking - net: usb: pegasus: validate USB endpoints - net: usb: r8152: add TRENDnet TUC-ET2G - net: usb: r8152: fix transmit queue timeout - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: sr9700: remove code to drive nonexistent multicast filter - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - nexthop: fix IPv6 route referencing IPv4 nexthop - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - nfc: hci: fix out-of-bounds read in HCP header parsing - nfc: hci: shdlc: Stop timers and work before freeing context - nfc: llcp: add missing return after LLCP_CLOSED checks - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: complete pending data exchange on device close - nfc: nci: fix circular locking dependency in nci_close_device - nfc: nci: free skb on nci_transceive early error paths - NFC: nxp-nci: allow GPIOs to sleep - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - nfc: nxp-nci: remove interrupt trigger type - nfc: pn533: allocate rx skb before consuming bytes - NFC: pn533: bound the UART receive buffer - nfc: pn533: properly drop the usb interface reference on disconnect - nfc: rawsock: cancel tx_work before socket teardown - nfc: s3fwrn5: allocate rx skb before consuming bytes - NFC: trf7970a: Ignore antenna noise when checking for RF field - nfnetlink_osf: validate individual option lengths in fingerprints - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - nfsd: check get_user() return when reading princhashlen - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - NFSD: Fix SECINFO_NO_NAME decode error cleanup - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: never defer requests during idmap lookup - NFS: Fix a deadlock involving nfs_release_folio() - nfs: pass explicit offset/count to trace events - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - NTB: ntb_transport: Fix too small buffer for debugfs_name - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ntfs: ->d_compare() must not block - nvdimm/bus: Fix potential use after free in asynchronous initialization - nvdimm: virtio_pmem: serialize flush requests - nvme-apple: drop invalid put of admin queue reference count - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme: fix admin queue leak on controller reset - nvme: fix memory allocation in nvme_pr_read_keys() - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: layouts: onie-tlv: fix hang on unknown types - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme-pci: cap queue creation to used queues - nvme-pci: ensure we're polling a polled queue - nvme-pci: fix missed admin queue sq doorbell write - nvme-pci: Fix race bug in nvme_poll_irqdisable() - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme: reject invalid pr_read_keys() num_keys values - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - objtool: Fix Clang jump table detection - objtool: Handle Clang RSP musical chairs - objtool: Remove max symbol name length limitation - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2: fix listxattr handling when the buffer is full - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix reflink preserve cleanup issue - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: reject oversized group bitmap descriptors - ocfs2: split transactions in dio completion to avoid credit exhaustion - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - ocfs2: validate inline data i_size during inode read - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep: Relocate counter updates before NAPI - octeon_ep: restructured interrupt handlers - octeon_ep: set backpressure watermark for RX queues - octeon_ep: support Octeon CN10K devices - octeon_ep: support to fetch firmware info - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: CGX: fix bitmap leaks - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: Fix default entries mcam entry action - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - octeontx2-af: Fix PF driver crash with kexec kernel booting - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - octeontx2-af: replace deprecated strncpy with strscpy - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - octeontx2-pf: avoid double free of pool->stack on AQ init failure - octeontx2-pf: Unregister devlink on probe failure - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - of: unittest: fix use-after-free in testdrv_probe() - openrisc: define arch-specific version of nop() - openvswitch: cap upcall PID array size and pre-size vport replies - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - openvswitch: vport: fix self-deadlock on release of tunnel ports - ovl: Fix uninit-value in ovl_fill_real - padata: Fix pd UAF once and for all - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove comment for reorder_work - padata: Remove cpu online check from cpu add and removal - params: Replace __modinit with __init_or_module - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - parisc: Fix IRQ leak in LASI driver - parisc: Flush correct cache in cacheflush() syscall - parisc: Increase initial mapping to 64 MB with KALLSYMS - parisc: kernel: replace kfree() with put_device() in create_tree_node() - parisc: _llseek syscall is only available for 32-bit userspace - parisc: Prevent interrupts during reboot - parport: Fix race between port and client registration - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - PCI: Do not attempt to set ExtTag for VFs - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Enable AtomicOps only if Root Port supports them - PCI: endpoint: Avoid creating sub-groups asynchronously - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - PCI: endpoint: Remove unused field in struct pci_epf_group - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - PCI: Fix pci_slot_lock () device locking - PCI: Fix pci_slot_trylock() error handling - PCI: hv: Set default NUMA node to 0 for devices without affinity info - PCI: Initialize RCB from pci_configure_device() - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI/MSI: Unmap MSI-X region on error - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - PCI/portdrv: Fix potential resource leak - PCI: Supply bridge device, not secondary bus, to read window details - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Use DWC IP core version - PCI: Update BAR # and window messages - PCI: Use resource names in PCI log messages - PCI: Use resource_set_range() that correctly sets ->end - PCMCIA: Fix garbled log messages for KERN_CONT - pcnet32: stop holding device spin lock during napi_complete_done - pds_core: add an error code check in pdsc_dl_info_get - pds_core: ensure null-termination for firmware version strings - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - perf/arm-cmn: Reject unsupported hardware configurations - perf/arm-cmn: Support CMN-600AE - perf: arm_spe: Properly set hw.state on failures - perf branch: Avoid incrementing NULL - perf callchain: Fix srcline printing with inlines - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf: Extract a few helpers - perf: Fix dangling cgroup pointer in cpuctx - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - perf lock: Fix option value type in parse_max_stack - perf: Make sure to use pmu_ctx->pmu for groups - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf unwind-libdw: Fix invalid reference counts - perf util: Kill die() prototype, dead for a long time - perf/x86/intel/uncore: Skip discovery table for offline dies - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - phonet/pep: disable BH around forwarded sk_receive_skb() - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: tegra: xusb: Fix per-pad high-speed termination calibration - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - pidfd: refuse access to tasks that have started exiting harder - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - pinctrl: mediatek: common: Fix probe failure for devices without EINT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - ping: annotate data-races in ping_lookup() - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - platform/chrome: cros_ec_lightbar: Fix response size initialization - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - platform/surface: surfacepro3_button: Drop wakeup source on remove - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - platform/x86/amd/pmc: Add support for Van Gogh SoC - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - platform/x86: classmate-laptop: Add missing NULL pointer checks - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: hp-bioscfg: Support allocations of larger data - platform/x86: hp-wmi: Ignore backlight and FnLock events - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - platform/x86: ISST: Correct locked bit width - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - platform/x86: panasonic-laptop: Fix sysfs group leak in error path - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - pmdomain: bcm: bcm2835-power: Fix broken reset status read - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - pmdomain: core: Fix detach procedure for virtual devices in genpd - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: runtime: Fix a race condition related to device removal - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - pNFS: Fix a deadlock when returning a delegation during open() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - pNFS: Fix use-after-free in pnfs_update_layout() - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - powerpc64/bpf: do not increment tailcall count when prog is NULL - powerpc: 83xx: km83xx: Fix keymile vendor prefix - powerpc/crash: fix backup region offset update to elfcorehdr - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - powerpc/warp: Fix error handling in pika_dtm_thread - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: axp288_charger: Do not cancel work before initializing it - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: max17042: avoid overflow when determining health - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - pppoe: drop PFC frames - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - printk: add print_hex_dump_devel() - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - pstore: ram_core: fix incorrect success return when vmap() fails - pstore/ram: fix buffer overflow in persistent_ram_save_old() - pstore/ram: fix resource leak when ioremap() fails - ptp: vclock: Switch from RCU to SRCU - ptrace: Convert ptrace_attach() to use lock guards - ptrace: slightly saner 'get_dumpable()' logic - pwm: imx-tpm: Count the number of enabled channels in probe - qed: fix double free in qed_cxt_tables_alloc() - quota: fix livelock between quotactl and freeze_super - quota: Fix race of dquot_scan_active() with quota deactivation - r8152: fix incorrect register write to USB_UPHY_XTAL - r8152: handle the return value of usb_reset_device() - randomize_kstack: Maintain kstack_offset per task - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - rbd: fix null-ptr-deref when device_add_disk() fails - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: s/boost_kthread_mutex/kthread_mutex - RDMA/bnxt_re: zero shared page before exposing to userspace - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - RDMA/core: Fix a couple of obvious typos in comments - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - RDMA/core: Prefer NLA_NUL_STRING - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/efa: Fix typo in efa_alloc_mr() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Notify ULP of remaining soft-WCs during reset - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Fix double free related to rereg_user_mr - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana_ib: Disable RX steering on RSS QP destroy - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA: Move DMA block iterator logic into dedicated files - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rtrs-clt: For conn rejection use actual err number - RDMA/rtrs: Fix use-after-free in path file creation cleanup - RDMA/rtrs: server: remove dead code - RDMA/rtrs-srv: fix SG mapping - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - RDMA/srp: bound SRP_RSP sense copy by the received length - RDMA/umad: Reject negative data_len in ib_umad_write - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/umem: fix kernel-doc warnings - RDMA/umem: Fix truncation for block sizes >= 4G - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - rds: ib: reject FRMR registration before IB connection is established - rds: mark snapshot pages dirty in rds_info_getsockopt() - regmap: Synchronize cache for the page selector - regset: use kvzalloc() for regset_get_alloc() - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - regulator: core: fix locking in regulator_resolve_supply() error path - regulator: core: move supply check earlier in set_machine_constraints() - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - regulator: pca9450: Correct interrupt type - regulator: pca9450: Make IRQ optional - regulator: rk808: fix OF node reference imbalance - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - remoteproc: imx_rproc: Fix invalid loaded resource table detection - remoteproc: mediatek: Break lock dependency to `prepare_lock` - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: xlnx: Only access buffer information if IPI is buffered - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - resource: Add resource set range and size helpers - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "ALSA: usb: Increase volume range that triggers a warning" - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" - Revert "crypto: nx - Migrate to scomp API" - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "mfd: da9052-spi: Change read-mask to write-mask" - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - Revert "mptcp: add needs_id for netlink appending addr" - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - Revert "perf unwind-libdw: Fix invalid reference counts" - Revert "ptp: add testptp mask test" - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" - Revert "tcpm: allow looking for role_sw device in the main node" - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - Revert "wireguard: device: enable threaded NAPI" - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - Revert "x86/vdso: Fix output operand size of RDPID" - Revert "xattr: switch to CLASS(fd)" - ring-buffer: Fix reporting of missed events in iterator - ring-buffer: Remove ring_buffer_read_prepare_sync() - riscv: kgdb: fix several debug register assignment bugs - riscv: Sanitize syscall table indexing under speculation - rnbd-srv: Zero the rsp buffer before using it - romfs: check sb_set_blocksize() return value - rpmsg: char: Fix use-after-free on probe error path - rpmsg: core: fix race in driver_override_show() and use core helper - rseq: Clarify rseq registration rseq_size bound check comment - rtc: abx80x: Disable alarm feature if no interrupt attached - rtc: interface: Alarm race handling should not discard preceding error - rtc: ntxec: fix OF node reference imbalance - rtc: zynqmp: correct frequency value - rtmutex: Use waiter::task instead of current in remove_waiter() - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - rust: kunit: fix warning when !CONFIG_PRINTK - rust: pin-init: add references to previously initialized fields - rust: pin-init: internal: init: document load-bearing fact of field accessors - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix data-race warning and potential load/store tearing - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix key quota calculation for multitoken keys - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - rxrpc: Fix potential UAF after skb_unshare() failure - rxrpc: Fix recvmsg() unconditional requeue - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix the ACK parser to extract the SACK table for parsing - rxrpc: only handle RESPONSE during service challenge - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - s390/cio: make sch->lock spinlock pointer a member - s390/cio: use generic driver_override infrastructure - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - s390/debug: Reject zero-length input before trimming a newline - s390/debug: Reject zero-length input in debug_input_flush_fn() - s390/entry: Scrub r12 register on kernel entry - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - s390/pci: Handle futile config accesses of disabled devices directly - s390/perf: Disable register readout on sampling events - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - sched/fair: Fix pelt clock sync when entering idle - sched: idle: Consolidate the handling of two special cases - sched: idle: Make skipping governor callbacks more consistent - sched/rt: Skip currently executing CPU in rto_next_cpu() - sched: Use u64 for bandwidth ratio calculations - scripts/dtc: Remove unused dts_version in dtc-lexer.l - scripts: generate_rust_analyzer.py: avoid FD leak - scripts: generate_rust_analyzer.py: define scripts - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Have mcount rela sort use direct values - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused macro defines - scripts/sorttable: Remove unused write functions - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Zero out weak functions in mcount_loc table - scsi: buslogic: Reduce stack usage - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - scsi: csiostor: Fix dereference of null pointer rn - scsi: efct: Use IRQF_ONESHOT and default primary handler - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - scsi: hisi_sas: Use macro instead of magic number - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: isci: Fix use-after-free in device removal path - scsi: lpfc: Properly set WC for DPP mapping - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: qla2xxx: Fix bsg_done() causing double free - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - scsi: ses: Fix devices attaching to different hosts - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - scsi: target: core: Fix integer overflow in UNMAP bounds check - scsi: target: Fix recursive locking in __configfs_open_file() - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: tcm_loop: Drain commands in target_reset handler - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix use-after free in init error and remove paths - scsi: ufs: core: Flush exception handling work when RPM level is zero - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - scsi: ufs: host: mediatek: Require CONFIG_PM - sctp: diag: reject stale associations in dump_one path - sctp: discard stale INIT after handshake completion - sctp: fix missing encap_port propagation for GSO fragments - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - sctp: fix race between sctp_wait_for_connect and peeloff - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - sctp: purge outqueue on stale COOKIE-ECHO handling - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - sctp: stream: fully roll back denied add-stream state - security/keys: fix missed RCU read section on lookup - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - selftest/arm64: Fix sve2p1_sigill() to hwcap test - selftest: memcg: skip memcg_sock test if address family not supported - selftests/bpf: add stack access precision test - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: veristat: fix printing order in output_stats() - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests/memfd: delete unused declarations - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - selftests/mm: skip migration tests if NUMA is unavailable - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: add test for extra_subflows underflow on userspace PM - selftests: mptcp: drop nanoseconds width specifier - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: join: check RM_ADDR not sent over same subflow - selftests: mptcp: more stable simult_flows tests - selftests/mqueue: Fix incorrectly named file - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selinux: don't reserve xattr slot when we won't fill it - selinux: fix overlayfs mmap() and mprotect() access checks - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - serdev: make serdev_bus_type const - serdev: Provide a bustype shutdown function - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_dw: handle clock enable errors in runtime_resume - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: 8250: Fix TX deadlock when using DMA - serial: 8250_pci: add support for the AX99100 - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: caif: fix use-after-free in caif_serial ldisc_close() - serial: caif: hold tty->link reference in ldisc_open and ser_release - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: samsung_tty: Use port lock wrappers - serial: sh-sci: fix memory region release in error path - serial: SH_SCI: improve "DMA support" prompt - serial: uartlite: fix PM runtime usage count underflow on probe - serial: zs: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: zs: Switch to using channel reset - sfc: fix error code in efx_devlink_info_running_versions() - sh: platform_early: remove pdev->driver_override check - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: fix OF node refcount - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - smb: client: add proper locking around ses->iface_last_update - smb: client: Compare MACs in constant time - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: correct value for smbd_max_fragmented_recv_size - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix broken multichannel with krb5+signing - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix krb5 mount with username option - smb: client: fix off-by-8 bounds check in check_wsl_eas() - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - smb: client: fix OOB reads parsing symlink error response - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix possible infinite loop and oob read in symlink_data() - smb: client: fix potential UAF and double free in smb2_open_file() - smb: client: prevent races in ->query_interfaces() - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: reject userspace cifs.spnego descriptions - smb: client: require a full NFS mode SID before reading mode bits - smb: client: require net admin for CIFS SWN netlink - smb: client: Use FullSessionKey for AES-256 encryption key derivation - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - smb: client: validate the whole DACL before rewriting it in cifsacl - smb: common: change the data type of num_aces to le16 - smb: move some duplicate definitions to common/smbacl.h - smb: server: fix active_num_conn leak on transport allocation failure - smb/server: Fix another refcount leak in smb2_open() - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix use-after-free in smb2_open() - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - soc: fsl: qbman: fix race condition in qman_destroy_fq - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: smem: handle ENOMEM error during probe - soc/tegra: cbb: Set ERD on resume for err interrupt - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - soc: ti: k3-socinfo: Fix regmap leak on probe failure - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - sound: ua101: fix division by zero at probe - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - soundwire: cadence: Clear message complete before signaling waiting thread - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - spi: at91-usart: fix controller deregistration - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - spi: coldfire-qspi: fix controller deregistration - spi: dln2: fix controller deregistration - spi: fix resource leaks on device setup failure - spi: fix statistics allocation - spi: fix use-after-free on controller registration failure - spi: fsl-espi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: fsl-qspi: Use reinit_completion() for repeated operations - spi: geni-qcom: Check DMA interrupts early in ISR - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: imx: fix use-after-free on unbind - spi: intel-pci: Add support for Nova Lake mobile SPI flash - spi: lantiq-ssc: fix controller deregistration - spi: meson-spicc: Fix double-put in remove path - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - spi: mpc52xx: fix use-after-free on unbind - spi: mtk-nor: fix controller deregistration - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - spi: omap2-mcspi: fix controller deregistration - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: qup: fix controller deregistration - spi: qup: fix error pointer deref after DMA setup failure - spi: rockchip: fix controller deregistration - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - spi: rspi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: s3c64xx: fix NULL-deref on driver unbind - spi: sh-hspi: fix controller deregistration - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - spi: spidev: fix lock inversion between spi_lock and buf_lock - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: spi-ti-qspi: switch to use modern name - spi: sprd: fix controller deregistration - spi: sprd: fix error pointer deref after DMA setup failure - spi: stm32: fix Overrun issue at < 8bpw - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: tools: Add include folder to .gitignore - spi: topcliff-pch: fix use-after-free on unbind - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - spi: zynqmp-gqspi: fix controller deregistration - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - Squashfs: check metadata block offset is within range - staging: greybus: lights: avoid NULL deref - staging: media: atomisp: Disallow all private IOCTLs - staging: rtl8723bs: fix memory leak on failure path - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - staging: rtl8723bs: fix null dereference in find_network - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: sm750fb: fix division by zero in ps_to_hz() - staging: vme_user: fix root device leak on init failure - string: add mem_is_zero() helper to check if memory area is all zeros - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - sunrpc: fix cache_request leak in cache_release - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Remove queue-shortening warnings - sysctl: fix uninitialized variable in proc_do_large_bitmap - sysfs: don't remove existing directory on update failure - tap: free page on error paths in tap_get_user_xdp() - taskstats: set version in TGID exit notifications - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: call sk_data_ready() after listener migration - tcp: defer regular ACK while processing socket backlog - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. - tcp: Fix imbalanced icsk_accept_queue count. - tcp: optimize inet_use_bhash2_on_bind() - tcp: Rearrange tests in inet_csk_bind_conflict(). - tcp: restrict SO_ATTACH_FILTER to priv users - tcp: Set pingpong threshold via sysctl - tcp: tcp_tx_timestamp() must look at the rtx queue - tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. - tee: optee: prevent use-after-free when the client exits before the supplicant - test_kprobes: clear kprobes between test runs - tg3: Fix race for querying speed/duplex - tg3: replace placeholder MAC address with device property - thermal: core: Fix thermal zone device registration error path - thermal: core: Fix thermal zone governor cleanup issues - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal: int340x: Fix sysfs group leak on DLVR registration failure - thunderbolt: Bound root directory content to block size - thunderbolt: Clamp XDomain response data copy to allocation size - thunderbolt: Fix property read in nhi_wake_supported() - thunderbolt: Limit XDomain response copy to actual frame size - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - thunderbolt: Reject zero-length property entries in validator - thunderbolt: Validate XDomain request packet size before type cast - time: Fix off-by-one in settimeofday() usec validation - time/jiffies: Mark jiffies_64_to_clock_t() notrace - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - tipc: fix divide-by-zero in tipc_sk_filter_connect() - tipc: fix double-free in tipc_buf_append() - tipc: fix duplicate publication key in tipc_service_insert_publ() - tipc: fix RCU dereference race in tipc_aead_users_dec() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - tls: Preserve sk_err across recvmsg() when data has been copied - tls: Purge async_hold in tls_decrypt_async_wait() - tools/accounting: handle truncated taskstats netlink messages - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - tools: Fix bitfield dependency failure - tools/power cpupower: Reset errno before strtoull() - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - tools/rv: Fix cleanup after failed trace setup - tpm: avoid -Wunused-but-set-variable - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - tracing: Add NULL pointer check to trigger_data_free() - tracing: Add recursion protection in kernel stack trace recording - tracing: Avoid NULL return from hist_field_name() on truncation - tracing: branch: Fix inverted check on stat tracer registration - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - tracing: Fix checking of freed trace_event_file for hist files - tracing: Fix false sharing in hwlat get_sample() - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Fix syscall events activation by ensuring refcount hits zero - tracing: Fix to set write permission to per-cpu buffer_size_kb - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - tracing/probe: reject non-closed empty immediate strings - tracing/probes: Limit size of event probe to 3K - tracing/probes: Point the error offset correctly for eprobe argument error - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Rebuild full_name on each hist_field_name() call - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Wake up poll waiters for hist files when removing an event - tty: hvc_iucv: fix off-by-one in number of supported devices - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - tun: free page on build_skb failure in tun_xdp_one() - tun: free page on short-frame rejection in tun_xdp_one() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - ublk: Validate SQE128 flag before accessing the cmd - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - udf: fix partition descriptor append bookkeeping - udf: reject descriptors with oversized CRC length - udp: clear skb->dev before running a sockmap verdict - udp: Fix wildcard bind conflict check when using hash2 - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - um: drivers: call kernel_strrchr() explicitly in cow_user.c - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - unshare: fix unshare_fs() handling - USB: add QUIRK_NO_BOS for video capture several devices - usb: bdc: fix sleep during atomic - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: remove redundant if branch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: core: convert ci_role_switch to local variable - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: class: cdc-wdm: fix reordering issue in read code path - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: core: Fix SuperSpeed root hub wMaxPacketSize - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: core: Limit the length of unkillable synchronous timeouts - usb: core: new quirk to handle devices with zero configurations - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - usb: dwc2: fix resume failure if dr_mode is host - usb: dwc2: Fix use after free in debug code - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc3: Move GUID programming after PHY initialization - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: ehci-brcm: fix sleep during atomic - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: image: mdc800: kill download URB on timeout - usbip: validate number_of_packets in usbip_pack_ret_submit() - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: mdc800: handle signal and read racing - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - USB: omap_udc: DMA: Don't enable burst 4 mode - usb: port: add delay after usb_hub_set_port_power() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: digi_acceleport: fix memory corruption with small endpoints - USB: serial: f81232: fix incomplete serial port generation - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: kl5kusb105: fix bulk-out buffer overflow - USB: serial: mct_u232: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: option: add MeiG Smart SRM825WN - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: option: add Telit Cinterion FN990A MBIM composition - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: serial: option: add Telit FN920C04 RNDIS compositions - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: storage: Add quirks for PNY Elite Portable SSD - usb: storage: Expand range of matched versions for VL817 quirks entry - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: ucsi: Check if power role change actually happened before handling - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: Don't update power_supply on power role change if not connected - usb: typec: ucsi: Move unregister out of atomic section - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - usb: typec: ucsi: validate connector number in ucsi_connector_change() - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: ulpi: fix memory leak on ulpi_register() error paths - USB: usbcore: Introduce usb_bulk_msg_killable() - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - userfaultfd: allow registration of ranges below mmap_min_addr - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - vfio: Create vfio_fs_type with inode per device - vfio/pci: Insert full vma on mmap'd MMIO fault - vfio/pci: Use unmap_mapping_range() - vhost: fix caching attributes of MMIO regions by setting them explicitly - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - virtiofs: fix UAF on submount umount - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - virt: vbox: uapi: Mark inner unions in packed structs as packed - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - vrf: Fix a potential NPD when removing a port from a VRF - vsock: fix buffer size clamping order - vsock: keep poll shutdown state consistent - vsock/virtio: fix accept queue count leak on transport mismatch - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: reset connection on receiving queue overflow - vsock/vmci: fix sk_ack_backlog leak on failed handshake - vsock/vmci: fix UAF when peer resets connection during handshake - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - vxlan: validate ND option lengths in vxlan_na_create - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - watchdog: imx7ulp_wdt: handle the nowayout option - watchdog: starfive-wdt: Fix PM reference leak in probe error path - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: clear shared SRNG pointer state on restart - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - wifi: ath11k: fix warning when unbinding - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: skip status ring entry processing - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath5k: do not access array OOB - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: brcmfmac: Fix error pointer dereference - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: brcmfmac: validate bsscfg indices in IF events - wifi: brcmsmac: Fix dma_free_coherent() size - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - wifi: cfg80211: wext: fix IGTK key ID off-by-one - wifi: cw1200: Fix locking in error paths - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: libertas: fix use-after-free in lbs_free_adapter() - wifi: libertas: fix WARNING in usb_tx_block - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: mac80211: remove station if connection prep fails - wifi: mac80211: set default WMM parameters on all links - wifi: mt76: connac: introduce helper for mt7925 chipset - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - wifi: nl80211: reject oversized EMA RNR lists - wifi: radiotap: reject radiotap with unknown bits - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: rt2x00usb: fix devres lifetime - wifi: rtl8xxxu: fix potential use of uninitialized value - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: check for PCI upstream bridge existence - wifi: rtw88: fix device leak on probe failure - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw89: pci: restore LDO setting after device resume - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: wl1251: validate packet IDs before indexing tx_frames - wifi: wlcore: Fix a locking bug - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - wireguard: send: append trailer after expanding head - workqueue: Factor out assign_rescuer_work() - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - X.509: Fix out-of-bounds access when parsing extensions - x86/apic: Disable x2apic on resume if the kernel expects so - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - x86/CPU: Fix FPDSS on Zen1 - x86/efi: defer freeing of boot services memory - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/hyperv: Fix error pointer dereference - x86/kexec: add a sanity check on previous kernel's ima kexec buffer - x86/kexec: Copy ACPI root pointer address from config table - x86/kexec: Disable KCOV instrumentation after load_segments() - x86/platform/uv: Handle deconfigured sockets - x86/sev: Allow IBPB-on-Entry feature for SNP guests - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - x86: shadow stacks: proper error handling for mmap lock - x86/shstk: Prevent deadlock during shstk sigreturn - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - x86/xen: Fix xen_e820_swap_entry_with_ram() - x86/xen: make some functions static - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - xattr: switch to CLASS(fd) - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - xenbus: Use .freeze/.thaw to handle xenbus devices - xen-netback: reject zero-queue configuration from guest - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: fix double free via VMA splitting - xen/privcmd: restrict usage in unprivileged domU - xen/virtio: Don't use grant-dma-ops when running as Dom0 - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: ah: account for ESN high bits in async callbacks - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - xfrm: call xdo_dev_state_delete during state update - xfrm: Check for underflow in xfrm_state_mtu - xfrm: clear trailing padding in build_polexpire() - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: esp: avoid in-place decrypt on shared skb frags - xfrm: espintcp: do not reuse an in-progress partial send - xfrm: esp: restore combined single-frag length gate - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - xfrm: Fix the usage of skb->sk - xfrm: input: hold netns during deferred transport reinjection - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: route MIGRATE notifications to caller's netns - xfrm: skip templates check for packet offload tunnel mode - xfrm_user: fix info leak in build_mapping() - xfrm_user: fix info leak in build_report() - xfrm: Wait for RCU readers during policy netns exit - xfs: avoid dereferencing log items after push callbacks - xfs: delete attr leaf freemap entries when empty - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix a resource leak in xfs_alloc_buftarg() - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix integer overflow in bmap intent sort comparator - xfs: fix remote xattr valuelblk check - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: fix undersized l_iclog_roundoff values - xfs: mark data structures corrupt on EIO and ENODATA - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: stop reclaim before pushing AIL during unmount - xhci: tegra: Fix ghost USB device on dual-role port unplug - xprtrdma: Decrement re_receiving on the early exit paths - xsk: Fix fragment node deletion to prevent buffer leak - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: Fix zero-copy AF_XDP fragment drop - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: introduce helper to determine rxq->frag_size - xsk: respect tailroom for ZC setups - xsk: s/free_list_node/list_node/ - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: validate MTU against usable frame size on bind - zonefs: handle integer overflow in zonefs_fname_to_fno - zram: do not forget to endio for partial discard requests - zram: fix use-after-free in zram_bvec_write_partial() - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Fix CIFSwitch vulnerability- FIX GPO Frag vulnerability- Fix PinTheft- Fix memory leak in AFS code- Fix CVE-2026-46300, CVE-2026-46333, CVE-2025-54518- Remove dead, not used patches- Fix Dirtyfrag- Fix CVE-2026-31431 (Copyfail)- Fix regression with touchpad on notebook Positron Proxima 15 and probably others (bz#19950) - https://bugzilla.rosa.ru/show_bug.cgi?id=19950- [bot] upd: 6.6.106 -> 6.6.126 - Changelog: - 6pack: drop redundant locking and refcounting - 9p: fix cache/debug options printing in v9fs_show_options - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - accel/habanalabs/gaudi2: fix BMON disable configuration - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() - ACPI: battery: Add synchronization between interface updates - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - acpi: Break out nesting for hmat_parse_locality() - ACPI: button: Call input_free_device() on failing input device registration - ACPICA: Allow to skip Global Lock initialization - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - ACPICA: Fix largest possible resource descriptor index - ACPICA: Update dsmethod.c to get rid of unused variable warning - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: debug: fix signedness issues in read/write helpers - acpi, hmat: calculate abstract distance with HMAT - acpi/hmat: Fix lockdep warning for hmem_register_resource() - acpi, hmat: refactor hmat_register_target_initiators() - ACPI: HMAT: Remove register of memory node for generic target - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Add setting of generic port system locality attributes - acpi: numa: Create enum for memory_target access coordinates indexing - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - ACPI: property: Return present device nodes only on fwnode interface - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - acpi,srat: Fix incorrect device handle check for Generic Initiator - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - afs: Fix potential null pointer dereference in afs_put_server - af_unix: Initialise scc_index in unix_add_edge(). - allow finish_no_open(file, ERR_PTR(-E...)) - alpha: don't reference obsolete termio struct for TC* constants - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - ALSA: ctxfi: Fix potential OOB access in audio mixer handling - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - ALSA: lx_core: use int type to store negative error codes - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: serial-generic: remove shared static buffer - ALSA: uapi: Fix typo in asound.h comment - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: add mono main switch to Presonus S1824c - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: fix control pipe direction - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: fix uac2 clock source at terminal parser - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - ALSA: usb-audio: Kill timer properly at removal - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Update for native DSD support quirks - ALSA: usb: Increase volume range that triggers a warning - ALSA: usb-mixer: us16x08: validate meter packet indices - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: wavefront: Clear substream pointers on close - ALSA: wavefront: Fix integer overflow in sample size validation - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Use standard print API - amba: tegra-ahb: Fix device leak on SMMU enable - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - amd-xgbe: avoid misleading per-packet error log - amd-xgbe: Avoid spurious link down messages during interface toggle - amd-xgbe: reset retries and mode on RX adapt failures - arc: Fix __fls() const-foldability via __builtin_clzl() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - arm64: cputype: Add Neoverse-V3AE definitions - arm64: dts: add off-on-delay-us for usdhc2 regulator - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - arm64: dts: imx8mp: Correct thermal sensor index - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 - arm64: dts: imx8mp-venice-gw702x: remove off-board uart - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: qcom: msm8916: Add missing MDSS reset - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64: kprobes: call set_memory_rox() for kprobe page - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - arm64: mte: Do not flag the zero page as PG_mte_tagged - arm64: Set __nocfi on swsusp_arch_resume() - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() - ARM: 9468/1: fix memset64() on big-endian - ARM: at91: pm: fix MCKx restore routine - ARM: at91: pm: save and restore ACR during PLL disable/enable - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - ARM: dts: imx51-zii-rdu1: Fix audmux node names - ARM: dts: imx6q-ba16: fix RTC interrupt level - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: renesas: gose: Remove superfluous port property - ARM: dts: renesas: porter: Fix CAN pin group - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - ARM: tegra: transformer-20: add missing magnetometer interrupt - ARM: tegra: transformer-20: fix audio-codec interrupt - arp: do not assume dev_hard_header() does not change skb->head - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - ASoC: ak4458: Disable regulator when error happens - ASoC: ak5558: Disable regulator when error happens - ASoC: amd: acp: Adjust pdm gain value - ASoC: amd: fix memory leak in acp3x pdm dma ops - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ASoC: amd: yc: Fix microphone on ASUS M6500RE - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: codecs: wsa881x: Drop unused version readout - ASoC: codecs: wsa881x: fix unnecessary initialisation - ASoC: codecs: wsa883x: fix unnecessary initialisation - ASoC: codecs: wsa884x: fix codec initialisation - ASoC: cs4271: Fix regulator leak on probe failure - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe - ASoC: fsl: imx-card: Do not force slot width to sample width - ASoC: fsl_sai: Add missing registers to cache default - ASoC: fsl_sai: fix bit order for DSD format - ASoC: fsl_xcvr: clear the channel status control memory - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - ASoC: Intel: catpt: Fix error path in hw_params() - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - ASoC: qcom: audioreach: fix potential null pointer dereference - ASoC: qcom: q6adm: the the copp device only during last instance - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - ASoC: qcom: q6asm-dai: perform correct state check before closing - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - ASoC: qdsp6: q6asm: do not sleep while atomic - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - ASoC: stm32: sai: fix clk prepare imbalance on probe failure - ASoC: stm32: sai: fix device leak on probe - ASoC: stm32: sai: fix OF node leak on probe - ASoC: stm32: sai: manage context in set_sysclk callback - ASoC: tas2781: fix getting the wrong device number - ASoC: tlv320adcx140: fix null pointer - ASoC: tlv320adcx140: fix word length - ASoC: tlv320adcx140: Propagate error codes during probe - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - ASoC: wm8940: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8974: Correct PLL rate rounding - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Print features also for ATAPI devices - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - ata: libata-scsi: Fix system suspend for a security locked drive - atm: Fix dma_free_coherent() size - atm/fore200e: Fix possible data race in fore200e_open() - audit: record fanotify event regardless of presence of rules - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - bcma: don't register devices disabled in OF - be2net: fix data race in be_get_new_eqd - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - be2net: pass wrb_params in case of OS2BMC - bfs: Reconstruct file type when loading from disk - binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - binder: remove "invalid inc weak" check - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - blk-cgroup: fix possible deadlock while configuring policy - blk-crypto: fix missing blktrace bio split events - blk-mq: Abort suspend when wakeup events are pending - blk-mq: add helper for checking if one CPU is mapped to specified hctx - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - blk-mq: don't schedule block kworker on isolated CPUs - blk-mq: setup queue ->tag_set before initializing hctx - blk-mq: skip CPU offline notify on unmapped hctx - block,bfq: fix aux stat accumulation destination - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: fix race between set_blocksize and read paths - block: make REQ_OP_ZONE_OPEN a write operation - block: rate-limit capacity change info log - block: rnbd-clt: Fix leaked ID in init_dev() - block: rnbd-clt: Fix signedness bug in init_dev() - block: use int to store blk_stack_limits() return value - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: bcsp: receive data only if registered - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: btrtl: Avoid loading the config file on security chips - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: btusb: revert use of devm_kzalloc in btusb - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: L2CAP: export l2cap_chan_hold for modules - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - Bluetooth: rfcomm: fix modem control handling - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - bnxt_en: correct offset handling for IPv6 destination address - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Fix potential data corruption with HW GRO/LRO - bonding: annotate data-races around slave->last_rx - bonding: check xdp prog when set bond mode - bonding: don't set oif to bond dev when getting NS target destination - bonding: limit BOND_MODE_8023AD to Ethernet devices - bonding: provide a net pointer to __skb_flow_dissect() - bonding: return detailed error when loading native XDP fails - bonding: set random address only when slaves already exist - bpf: account for current allocated stack depth in widen_imprecise_scalars() - bpf: Add bpf_prog_run_data_pointers() - bpf, arm64: Do not audit capability check in do_jit() - bpf: Avoid RCU context warning when unpinning htab with internal structs - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Clear pfmemalloc flag when freeing all fragments - bpf: Do not audit capability check in do_jit() - bpf: Do not let BPF test infra emit invalid GSO types to stack - bpf: Do not limit bpf_cgroup_from_id to current's namespace - bpf: Don't use %pK through printk - bpf: Enforce expected_attach_type for tailcall compatibility - bpf: Explicitly check accesses to bpf_sock_addr - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Fix invalid prog->stats access when update_effective_progs fails - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - bpf: Free special fields when update [lru_,]percpu_hash maps - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Improve program stats run-time calculation - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Reject bpf_timer for PREEMPT_RT - bpf: Reject negative offsets for ALU ops - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - bpf/selftests: test_select_reuseport_kern: Remove unused header - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Sync pending IRQ work before freeing ring buffer - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - bridge: mcast: Fix use-after-free during router port configuration - bridge: Redirect to backup port when port is administratively down - broadcom: b44: prevent uninitialized value usage - btrfs: always detect conflicting inodes when logging inode refs - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - btrfs: do not assert we found block group item when creating free space tree - btrfs: do not skip logging new dentries when logging a new name - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - btrfs: don't rewrite ret from inode_permission - btrfs: ensure no dirty metadata is written back for an fs with errors - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: factor out init_space_info() from create_space_info() - btrfs: fix a potential path leak in print_data_reloc_error() - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - btrfs: fix incorrect readahead expansion length - btrfs: fix invalid extref key setup when replaying dentry - btrfs: fix leaf leak in an error path in btrfs_del_items() - btrfs: fix memory leak of fs_devices in degraded seed device path - btrfs: fix memory leaks in create_space_info() error paths - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() - btrfs: fix reservation leak in some error paths when inserting inline extent - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - btrfs: introduce btrfs_space_info sub-group - btrfs: mark dirty extent range for out of bound prealloc extents - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() - btrfs: ref-verify: handle damaged extent root tree - btrfs: scrub: always update btrfs_scrub_progress::last_physical - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: send: check for inline extents in range_is_hole_in_parent() - btrfs: store fs_info in space_info - btrfs: tree-checker: fix the incorrect inode ref size check - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: use readahead_expand() on compressed extents - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - bus: fsl-mc: Check return value of platform_get_resource() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - cachestat: do not flush stats in recency check - caif: fix integer underflow in cffrml_receive() - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - can: etas_es58x: allow partial RX URB allocation to succeed - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - can: gs_usb: gs_can_open(): fix error handling - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: increase max interface to U8_MAX - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: make j1939_session_activate() fail if device is no longer registered - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: netlink: can_changelink(): allow disabling of automatic restart - can: peak_usb: fix shift-out-of-bounds issue - can: rcar_canfd: Fix CAN-FD mode as default - can: rcar_canfd: Fix controller mode setting - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - can: sja1000: fix max irq loop handling - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - ceph: add checking of wait_for_completion_killable() return value - ceph: fix crash in process_v2_sparse_read() for encrypted directories - ceph: refactor wake_up_bit() pattern of calling - cgroup: split cgroup_destroy_wq into 3 workqueues - char: applicom: fix NULL pointer dereference in ac_ioctl - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: restrict the dynamic range to exclude reserved minors - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - cifs: client: fix memory leak in smb3_fs_context_parse_param - cifs: Fix memory and information leak in smb3_reconfigure() - cifs: fix memory leak in smb3_fs_context_parse_param error path - cifs: fix pagecache leak when do writepages - cifs: Fix TCP_Server_Info::credits to be signed - cifs: fix typo in enable_gcm_256 module parameter - cifs: Fix uncached read into ITER_KVEC iterator - cifs: parse_dfs_referrals: prevent oob on malformed input - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - cifs: stop writeback extension when change of size is detected - clk: at91: clk-master: Add check for divide by 3 - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: peripheral: fix return value - clk: keystone: fix compile testing - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - clk: renesas: cpg-mssr: Read back reset registers to assure values latched - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - clk: renesas: r9a06g032: Fix memory leak in error path - clk: renesas: rzg2l: Remove critical area - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() - clk: renesas: Use str_on_off() helper - clk: samsung: exynos-clkout: Assign .num before accessing .hws - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - clk: tegra: do not overallocate memory for bpmp clocks - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clocksource/drivers/clps711x: Fix resource leaks in error paths - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - cnic: Fix use-after-free bugs in cnic_delete_task - comedi: c6xdigio: Fix invalid PNP driver unregistration - comedi: check device's attached status in compat ioctls - comedi: dmm32at: serialize use of paged registers - comedi: fix divide-by-zero in comedi_buf_munge() - comedi: Fix getting range information for subdevices 16 to 255 - comedi: multiq3: sanitize config options in multiq3_attach() - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - compiler_types.h: add "auto" as a macro for "__auto_type" - compiler_types: Move unused static inline functions warning to W=2 - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - coresight: etm4x: Add context synchronization before enabling trace - coresight-etm4x: Conditionally access register TRCEXTINSELR - coresight: etm4x: Correct polling IDLE bit - coresight: etm4x: Extract the trace unit controlling - coresight: etm4x: Support atclk - coresight: Only register perf symlink for sinks with alloc_buffer - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - coresight: trbe: Return NULL pointer for allocation failures - counter: 104-quad-8: Fix incorrect return value in IRQ handler - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - cpufreq: Initialize cpufreq-based invariance before subsys - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - cpufreq/longhaul: handle NULL policy in longhaul_exit - cpufreq: nforce2: fix reference count leak in nforce2 - cpufreq: s5pv210: fix refcount leak - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() - cpufreq: tegra186: Initialize all cores to max frequencies - cpufreq: tegra186: Set target frequency for all cpus in policy - cpuidle: Fail cpuidle device registration if there is one already - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: teo: Drop misguided target residency check - cpuidle: menu: Use residency threshold in polling state override decisions - cpuidle: qcom-spm: fix device and OF node leaks at probe - cpuset: Treat cpusets in attaching as populated - cramfs: Verify inode mode when loading from disk - crash: fix crashkernel resource shrink - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: aspeed-acry - Convert to platform remove callback returning void - crypto: aspeed - Fix dma_unmap_sg() direction - crypto: aspeed - fix double free caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - crypto: atmel - Fix dma_unmap_sg() direction - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: caam - Add check for kcalloc() in test_len() - crypto: caam - double the entropy delay interval for retry - crypto: ccree - Correctly handle return of sg_nents_for_len - crypto: essiv - Check ssize for decryption and in-place encryption - crypto: hisilicon/qm - check whether the input function and PF are on the same device - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value - crypto: hisilicon/qm - restore original qos values - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs - crypto: hisilicon - re-enable address prefetch after device resuming - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations - crypto: keembay - Add missing check after sg_nents_for_len() - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - crypto: rng - Ensure set_ent is always present - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - crypto: sha256 - fix crash at kexec - crypto: starfive - Correctly handle return of sg_nents_for_len - crypto: sun8i-ce - remove channel timeout field - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - csky: fix csky_cmpxchg_fixup not working - dax: skip read lock assertion for read-only filesystems - devcoredump: Fix circular locking dependency with devcd->mutex. - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Disable SLUB_TINY for build testing - dlm: check for defined force value in dlm_lockspace_release - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - dmaengine: apple-admac: Add "apple,t8103-admac" compatible - dmaengine: at_hdmac: fix device leak on of_dma_xlate() - dmaengine: bcm-sba-raid: fix device leak on probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - dmaengine: dw: dmamux: fix OF node leak on route allocation failure - dmaengine: dw-edma: Set status for callback_result - dmaengine: idxd: fix device leaks on compat bind and unbind - dmaengine: idxd: Fix double free in idxd_setup_wqs() - dmaengine: idxd: Fix refcount underflow on module unload - dmaengine: idxd: Remove improper idxd_free - dmaengine: lpc18xx-dmamux: fix device leak on route allocation - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: omap-dma: fix dma_pool resource leak in error paths - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() - dmaengine: sh: setup_xref error handling - dmaengine: stm32: dmamux: fix device leak on route allocation - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - dmaengine: tegra-adma: Fix use-after-free - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - dmaengine: ti: k3-udma: fix device leak on udma lookup - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing - dmaengine: xilinx: xdma: Fix regmap max_register - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - dma/pool: distinguish between missing and exhausted atomic pools - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - dm-bufio: align write boundary on physical block size - dm-ebs: Mark full buffer dirty even on partial write - dm: fix NULL pointer dereference in __dm_suspend() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm-integrity: limit MAX_TAG_SIZE to 255 - dm log-writes: Add missing set_freezable() for freezable kthread - dm-raid: fix possible NULL dereference with undefined raid type - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - dm-verity: fix unreliable memory allocation - doc: fix seg6_flowlabel path - docs: networking: can: change bcm_msg_head frames member to support flexible array - Documentation: process: Also mention Sasha Levin as stable tree maintainer - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - dpaa2-switch: add bounds check for if_id in IRQ handler - dpaa2-switch: fix buffer pool seeding for control traffic - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - driver core: enforce device_lock for driver_match_device() - driver core/PM: Set power.no_callbacks along with power.no_pm - drivers/base/node: fix double free in register_one_node() - drivers/base/node: handle error properly in register_one_node() - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - drivers/perf: hisi: Relax the event ID check in the framework - drivers/usb/dwc3: fix PCI parent check - drm/amd: add more cyan skillfish PCI ids - drm/amd: Avoid evicting resources at S5 - drm/amd: Check whether secure display TA loaded successfully - drm/amd: Clean up kfd node on surprise disconnect - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd/display: Check dce_hwseq before dereferencing it - drm/amd/display: Check NULL before accessing - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/amd/display: ensure committing streams is seamless - drm/amd/display: Fix black screen with HDMI outputs - drm/amd/display: Fix DP no audio issue - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - drm/amd/display: Fix null pointer deref in dcn20_resource.c - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Remove redundant semicolons - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: use udelay rather than fsleep - drm/amd: Fix suspend failure with secure display TA - drm/amdgpu: Add additional DCE6 SCL registers - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/amdgpu: csa unmap use uninterruptible lock - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: fix a memory leak in fence cleanup when unloading - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amdgpu: Forward VMID reservation errors - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amdgpu: reject gang submissions under SRIOV - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdkfd: Don't use sw fault filter if retry cam enabled - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/amd/powerplay: Fix CIK shutdown temperature - drm/ast: Use msleep instead of mdelay for edid read - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/bridge: it6505: select REGMAP_I2C - drm/bridge: lt9211: Drop check for last nibble of version register - drm/etnaviv: fix flush sequence logic - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/gma500: Fix null dereference in hdmi teardown - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - drm/i915/backlight: Return immediately when scale() finds invalid parameters - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/i915/guc: Skip communication warning on reset in progress - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/imx/tve: fix probe device leak - drm/mediatek: Disable AFBC support on Mediatek DRM driver - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - drm/mediatek: Fix device use-after-free on unbind - drm/mediatek: fix potential OF node use-after-free - drm/mediatek: Fix probe memory leak - drm/mediatek: Fix probe resource leaks - drm/mgag200: Fix big-endian support - drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/msm/a2xx: stop over-complaining about the legacy firmware - drm/msm/a6xx: fix bogus hwcg register updates - drm/msm/a6xx: Fix GMU firmware parser - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - drm/msm/dpu: Add missing NULL pointer check for pingpong interface - drm/msm/dpu: fix incorrect type for ret - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - drm/msm: make sure to not queue up recovery more than once - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/nouveau: restrict the flush page to a 32-bit address - drm/panel: novatek-nt35560: Fix invalid return value - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - drm/panel: visionox-rm69299: Don't clear all mode flags - drm/pl111: Fix error handling in pl111_amba_probe - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] - drm/rcar-du: dsi: Fix 1/2/3 lane support - drm/rockchip: vop2: use correct destination rectangle height check - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/sched: Fix race in drm_sched_entity_select_rq() - drm: sti: fix device leaks at component probe - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/tegra: Add call to put_pid() - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/tidss: Use the crtc_* timings when programming the HW - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - drm/ttm: Avoid NULL pointer deref for evicted BOs - drm/vgem-fence: Fix potential deadlock on release - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix copy-paste typo in validation - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Use kref in vmw_bo_dirty - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - dt-bindings: power: qcom,rpmpd: Add SM7150 - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 - dt-bindings: power: rpmpd: Update part number to X1E80100 - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - e1000: fix OOB in e1000_tbi_should_accept() - EDAC/altera: Delete an inappropriate dma_free_coherent() call - EDAC/altera: Handle OCRAM ECC enable after warm reset - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - EDAC/i3200: Fix a resource leak in i3200_probe1() - EDAC/mc_sysfs: Increase legacy channel support to 16 - EDAC/x38: Fix a resource leak in x38_probe1() - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - efi/cper: Fix cper_bits_to_str buffer handling and return value - efi/libstub: Fix page table access in 5-level to 4-level paging transition - efivarfs: fix error propagation in efivar_entry_get() - epoll: Remove ep_scan_ready_list() in comments - espintcp: fix skb leaks - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - ethernet: Extend device_get_mac_address() to use NVMEM - ethernet: rvu-af: Remove slash from the driver name - ethtool: Avoid overflowing userspace buffer on stats query - eventpoll: Replace rwlock with spinlock - exec: Fix incorrect type for ret - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - exfat: fix remount failure in different process environments - exfat: limit log print for IO error - Expand the type of nfs_fattr->valid - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - ext4: align max orphan file size with e2fsprogs limit - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: clear i_state_flags when alloc inode - ext4: correctly handle queries for metadata mappings - ext4: correct the checking of quota files before moving extents - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - ext4: filesystems without casefold feature cannot be mounted with siphash - ext4: fix an off-by-one issue during moving extents - ext4: fix checks for orphan inodes - ext4: fix error message when rejecting the default hash - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: free orphan info with kvfree - ext4: guard against EA inode refcount underflow in xattr update - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: increase IO priority of fastcommit - ext4: introduce ITAIL helper - ext4: refresh inline data size before write operations - ext4: remove unused return value of __mb_check_buddy - ext4: validate ea_ino and size in check_xattrs - ext4: verify orphan file size is not too big - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: xattr: fix null pointer deref in ext4_raw_inode() - extcon: adc-jack: Cleanup wakeup source only if it was enabled - extcon: adc-jack: Fix wakeup source leaks on device unbind - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: drop inode from the donation list when the last file is closed - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix condition in __allow_reserved_blocks() - f2fs: fix infinite loop in __insert_extent_tree() - f2fs: fix return value of f2fs_recover_fsync_data() - f2fs: fix to avoid overflow while left shift operation - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating compression context during writeback - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix wrong block mapping for multi-devices - f2fs: fix zero-sized extent for precache extents - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: remove unused GC_FAILURE_PIN - f2fs: use f2fs_err_ratelimited() to avoid redundant logs - f2fs: use global inline_xattr_slab instead of per-sb slab cache - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - fbdev: atyfb: Check if pll_ops->init_pll failed - fbdev: bitblit: bound-check glyph index in bit_putcs* - fbdev: Fix logic error in "offb" name match - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - fbdev: tcx.c fix mem_map to correct smem_start offset - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - filelock: add FL_RECLAIM to show_fl_flags() macro - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - firewire: core: fix overlooked update of subsystem ABI version - firewire: nosy: Fix dma_free_coherent() size - firmware: arm_scmi: Account for failed debug initialization - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - firmware: arm_scmi: Fix unused notifier-block in unregister - firmware: firmware: meson-sm: fix compile-test default - firmware: imx: scu-irq: fix OF node leak in - firmware: imx: scu-irq: Init workqueue before request mbox channel - firmware: imx: scu-irq: Set mu_resource_id before get handle - firmware: meson_sm: fix device leak at probe - firmware: stratix10-svc: Add mutex in stratix10 memory management - firmware: stratix10-svc: fix bug in saving controller data - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - Fix memory leak in posix_clock_open() - fjes: Add missing iounmap in fjes_hw_init() - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - flex_proportions: make fprop_new_period() hardirq safe - floppy: fix for PAGE_SIZE != 4KB - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - fs: Add 'initramfs_options' to set initramfs mount options - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - fs/nfs/io: make nfs_start_io_*() killable - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - fs/nls: Fix utf16 to utf8 conversion - fs/notify: call exportfs_encode_fid with s_umount - fsnotify: do not generate ACCESS/MODIFY events on child for special files - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - fs/ntfs3: Initialize allocated memory before use - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs/ntfs3: Support timestamps prior to epoch - fs/proc: fix uaf in proc_readdir_de() - fs: quota: create dedicated workqueue for quota_release_work - fs: udf: fix OOB read in lengthAllocDescs handling - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - ftrace: Fix BPF fexit with livepatch - ftrace: Fix softlockup in ftrace_module_enable - ftrace/samples: Fix function size computation - fuse: allocate ff->release_args only if release is needed - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: check if copy_file_range() returns larger than requested size - fuse: fix livelock in synchronous file put from fuseblk workers - fuse: fix readahead reclaim deadlock - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - fuse: prevent overflow in copy_file_range return value - fuse: zero initialize inode private data - futex: Don't leak robust_list pointer on exec race - futex: Prevent use-after-free during requeue-PI - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - gcov: add support for GCC 15 - genalloc.h: fix htmldocs warning - genirq/irq_sim: Initialize work context pointers properly - gfs2: fix freeze error handling - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - gfs2: fix remote evict for read-only filesystems - gfs2: Fix use of bio_chain - gpio: 104-idio-16: Define maximum valid register address offset - gpio: idio-16: Define fixed direction of the GPIO lines - gpiolib: acpi: Add quirk for Dell Precision 7780 - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpiolib: Extend software-node support to support secondary software-nodes - gpio: ljca: Fix duplicated IRQ mapping - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - gpio: omap: do not register driver in probe() - gpio: pca953x: Add support for level-triggered interrupts - gpio: pca953x: fix wrong error probe return value - gpio: pca953x: handle short interrupt pulses on PCAL devices - gpio: pca953x: mask interrupts in irq shutdown - gpio: pca953x: Utilise dev_err_probe() where it makes sense - gpio: pca953x: Utilise temporary variable for struct device - gpio: pci-idio-16: Define maximum valid register address offset - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - gpio: rockchip: mark the GPIO controller as sleeping - gpio: rockchip: Stop calling pinctrl for set_direction - gpio: update Intel LJCA USB GPIO driver - gpio: wcd934x: mark the GPIO controller as sleeping - gpu: host1x: Fix race in syncpt alloc/free - gue: Fix skb memleak with inner IP protocol 0. - gve: Correct ethtool rx_dropped calculation - gve: Fix stats report corruption on queue count change - hfs: clear offset and space out of valid records in b-tree node - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix volume corruption issue for generic/073 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfsplus: Verify inode mode when loading from disk - hfs: validate record offset in hfsplus_bmap_alloc - HID: amd_sfh: Stop sensor before starting - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - HID: asus: add support for missing PX series fn keys - HID: asus: add Z13 folio to generic group for multitouch to work - HID: core: Harden s32ton() against conversion to 0 bits - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - HID: hid-input: Extend Elan ignore battery quirk to USB - HID: hid-input: only ignore 0 battery events for digitizers - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: logitech-dj: Remove duplicate error logging - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - HID: multitouch: fix name of Stylus input devices - HID: multitouch: fix sticky fingers - HID: playstation: Center initial joystick axes to prevent spurious events - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 - HID: quirks: work around VID/PID conflict for appledisplay - HID: uclogic: Fix potential memory leak in error path - HID: usbhid: paper over wrong bNumDescriptor field - hrtimer: Fix softirq base check in update_needs_ipi() - hrtimer: Remove unused function - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimers: Unconditionally update target CPU base after offline timer migration - hsr: Fix supervision frame sending on HSRv0 - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (k10temp) Add device ID for Strix Halo - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - hwmon: (occ) Mark occ_init_attribute() as __printf - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - hwmon: (sht3x) Fix error handling - hwmon: sy7636a: add alias - hwmon: sy7636a: Fix regulator_enable resource leak on error path - hwmon: (tmp401) fix overflow caused by default conversion rate value - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - hwrng: nomadik - add ARM_AMBA dependency - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* - i2c: amd-mp2: fix reference leak in MP2 PCI device - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Add quirk for Intel Xe - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - i2c: designware: Fix clock issue when PM is disabled - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: Inherit DMA masks and parameters from parent device - i3c: master: svc: Prevent incomplete IBI transaction - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - i40e: add mask to apply valid bits for itr_idx - i40e: add max boundary check for VF filters - i40e: add validation for ring_len param - i40e: fix idx validation in config queues msg - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix input validation logic for action_meta - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - i40e: fix scheduling in set_rx_mode - i40e: fix validation of VF state in get resources - i40e: improve VF MAC filters accounting - i40e: increase max descriptors for XL710 - i40e: remove redundant memory barrier when cleaning Tx descs - iavf: fix off-by-one issues in iavf_config_rss_reg() - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - IB/sa: Fix sa_local_svc_timeout_ms read race - ice: Avoid detrimental cleanup for bond during interface stop - ice: Don't use %pK through printk or tracepoints - ice: initialize ring_stats->syncp - ice: stop counting UDP csum mismatch as rx_errors - idr: fix idr_alloc() returning an ID out of range - igb: fix link test skipping when interface is admin down - igc: fix race condition in TX timestamp read for register 0 - iio: accel: bmc150: Fix irq assumption regression - iio: accel: fix ADXL355 startup race condition - iio: accel: iis328dq: fix gain values - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: adc: ad7280a: handle spi_setup() errors in probe() - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: exynos_adc: fix OF populate on driver rebind - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: rtq6056: Correct the sign bit index - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - iio: chemical: scd4x: fix reported channel endianness - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: add separate lockdep class for info_exist_lock - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - iio: frequency: adf4350: Fix prescaler usage. - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: xilinx-ams: Unmask interrupts after updating alarms - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - ima: Handle error code returned by ima_filter_rule_match() - ima: limit the number of ToMToU integrity violations - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - inet: ping: Fix icmp out counting - init: handle bootloader identifier in kernel parameters - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: imx_sc_key - fix memory corruption on unload - Input: iqs7222 - avoid enabling unused interrupts - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - intel_th: fix device leak on output open() - intel_th: Fix error handling in intel_th_output_open - interconnect: debugfs: Fix incorrect error handling for NULL path - interconnect: debugfs: initialize src_node and dst_node to empty strings - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - iomap: account for unaligned end offsets when truncating read range - iomap: adjust read range correctly for non-block-aligned positions - iomap: always run error completions in user context - iomap: factor out a iomap_dio_done helper - iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - iommu/amd/pgtbl: Fix possible race while increase page table level - iommu/amd: Skip enabling command/event buffers for kdump - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/apple-dart: fix device leak on of_xlate() - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - iommu: disable SVA when CONFIG_X86 is set - iommu/exynos: fix device leak on of_xlate() - iommufd: Don't overflow during division for dirty tracking - iommufd: Make vfio_compat's unmap succeed if the range is already empty - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED - iommu/ipmmu-vmsa: fix device leak on of_xlate() - iommu/mediatek: fix device leak on of_xlate() - iommu/mediatek: fix use-after-free on probe deferral - iommu/mediatek-v1: fix device leak on probe_device() - iommu/mediatek-v1: fix device leaks on probe() - iommu/omap: fix device leaks on probe_device() - iommu/qcom: fix device leak on of_xlate() - iommu/sun50i: fix device leak on of_xlate() - iommu/tegra: fix device leak on probe_device() - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - iommu/vt-d: PRS isn't usable if PDS isn't supported - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - io_uring: backport io_should_terminate_tw() - io_uring: correct __must_hold annotation in io_install_fixed_file - io_uring: fix filename leak in __io_openat_prep() - io_uring: include dying ring in task_work "should cancel" state - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - io_uring: move local task_work in exit cancel loop - io_uring/poll: correctly handle io_poll_add() return value on update - ip6_gre: make ip6gre_header() robust - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - ipmi: Fix handling of messages with provided receive message pointer - ipmi: Fix __scan_channels() failing to rescan channels - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Rework user message limit handling - ipv4: Fix reference count leak when using error routes with nexthop objects - ipv4: ip_gre: make ipgre_header() robust - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - ipv6: add exception routes to GC list in rt6_insert_exception - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - ipv6: annotate data-race in ndisc_router_discovery() - ipv6: avoid possible NULL deref in modify_prefix_route() - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv6: clear RA flags when adding a static route - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ipv6: Fix use-after-free in inet6_addr_del(). - ipv6: np->rxpmtu race annotation - ipv6: use the right ifindex when replying to icmpv6 from localhost - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - ipvlan: Make the addrs_lock be per port - ipvs: Defer ip_vs_ftp unregister during netns cleanup - ipvs: fix ipv4 null-ptr-deref in route error path - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - irqchip/gic-v3-its: Avoid truncating memory addresses - irqchip/imx-mu-msi: Fix section mismatch - irqchip/irq-bcm7038-l1: Fix section mismatch - irqchip/irq-bcm7120-l2: Fix section mismatch - irqchip/irq-brcmstb-l2: Fix section mismatch - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - irqchip/qcom-irq-combiner: Fix section mismatch - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - irqchip/sifive-plic: Respect mask state when setting affinity - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - jbd2: ensure that all ongoing I/O complete before freeing blocks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - kallsyms: Fix wrong "big" kernel symbol type read from procfs - kasan: fix GCC mem-intrinsic prefix with sw tags - kasan: refactor pcpu kasan vmalloc unpoison - kbuild: uapi: Strip comments before size type check - kbuild: Use objtree for module signing key path - kconfig: fix static linking of nconf - kconfig/mconf: Initialize the default locale at startup - kconfig/nconf: Initialize the default locale at startup - kernel.h: Move ARRAY_SIZE() to a separate header - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - kernfs: Fix UAF in polling when open file is released - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - KEYS: trusted_tpm1: Compare HMAC values in constant time - KEYS: X.509: Fix Basic Constraints CA flag parsing - kmsan: fix out-of-bounds access to shadow memory - ksmbd: add max ip connections parameter - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - ksmbd: close accepted socket when per-IP limit rejects connection - ksmbd: fix buffer validation by including null terminator size in EA length - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - ksmbd: Fix memory leak in get_file_all_info() - ksmbd: fix null pointer dereference in alloc_preauth_hash() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix recursive locking in RPC handle list access - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix use-after-free in ksmbd_session_rpc_open - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: fix use-after-free in session logoff - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: smbd: fix dma_unmap_sg() nents - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: transport_ipc: validate payload size before reading handle - ksmbd: use sock_create_kern interface to create kernel socket - ksmbd: vfs: fix race on m_flags in vfs_cache - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - ktest.pl: Fix uninitialized var in config-bisect.pl - kunit: kasan_test: disable fortify string checker on kasan_strings() test - KVM: arm64: Check the untrusted offset in FF-A memory share - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - KVM: Don't clobber irqfd routing type when deassigning irqfd - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - KVM: nSVM: Fix and simplify LBR virtualization handling with nested - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - KVM: SVM: Fix redundant updates of LBR MSR intercepts - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - KVM: SVM: Set synthesized TSA CPUID flags - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - l2tp: avoid one data-race in l2tp_tunnel_del_work() - lan966x: Fix sleeping in atomic context - leds: flash: leds-qcom-flash: Update torch current clamp setting - leds: led-class: Only Add LED to leds_list when it is fully ready - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: Enable chip before any communication - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: netxbig: Fix GPIO descriptor leak in error paths - leds: spi-byte: Use devm_led_classdev_register_ext() - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - libbpf: Fix reuse of DEVMAP - libceph: fix invalid accesses to ceph_connection_v1_info - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: make calc_target() set t->paused, not just clear it - libceph: make decode_pool() more resilient against corrupted osdmaps - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: reset sparse-read state in osd_fault() - libceph: return the handler error from mon_handle_auth_done() - lib/crypto: aes: Fix missing MMU protection for AES S-box - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - lib/genalloc: fix device leak in of_gen_pool_get() - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - libperf event: Ensure tracing data is multiple of 8 sized - lib/vsprintf: Check pointer before dereferencing in time_and_date() - livepatch: Match old_sympos 0 and 1 in klp_find_func() - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - lockd: fix vfs_test_lock() calls - locking/spinlock/debug: Fix data-race in do_raw_write_lock - LoongArch: Add machine_kexec_mask_interrupts() implementation - LoongArch: Add more instruction opcodes and emit_* helpers - LoongArch: Add new PCI ID for pci_fixup_vgadev() - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Automatically disable kaslr if boot from kexec_file - LoongArch: BPF: Sign extend kfunc call arguments - LoongArch: BPF: Zero-extend bpf_tail_call() index - LoongArch: Check the return value when creating kobj - LoongArch: Correct the calculation logic of thread_count - LoongArch: Don't panic if no valid cache info for PCI - LoongArch: Enable exception fixup for specific ADE subcode - LoongArch: Fix build errors for CONFIG_RANDSTRUCT - LoongArch: Fix PMU counter allocation for mixed-type event groups - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Mask all interrupts during kexec/kdump - LoongArch: Refactor register restoration in ftrace_common_return - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED - LoongArch: Update help info of ARCH_STRICT_ALIGN - LoongArch: Use correct accessor to read FWPC/MWPC - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - LoongArch: Use __pmd()/__pte() for swap entry conversions - LoongArch: Use UAPI types in ptrace UAPI header - LoongArch: Use unsigned long for _end and _text - loop: Avoid updating block size under exclusive owner - m68k: bitops: Fix find_*_bit() signatures - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse - macvlan: fix error recovery in macvlan_common_newlink() - macvlan: fix possible UAF in macvlan_forward_source() - mailbox: mailbox-test: Fix debugfs_create_dir error checking - mailbox: pcc: don't zero error register - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - maple_tree: fix tracepoint string pointers - md/raid5: fix IO hang when array is broken with IO inflight - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - media: amphion: Add a frame flush mode for decoder - media: amphion: Cancel message work before releasing the VPU core - media: amphion: Delete v4l2_fh synchronously in .release() - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: cec: Fix debugfs leak on bus_register() failure - media: cx18: Add missing check after DMA map - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: fix uninitialized symbol warnings - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: i2c: imx214: Fix link frequency validation - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - media: i2c: mt9v111: fix incorrect type for ret - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - media: imon: make send_packet() more robust - media: lirc: Fix error handling in lirc_register() - media: mc: Clear minor number before put device - media: mc: Fix MUST_CONNECT handling for pads with no links - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - media: mediatek: vcodec: Use spinlock for context list protection lock - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: ov08x40: Fix the horizontal flip control - media: pci: ivtv: Add missing check after DMA map - media: pci: ivtv: Don't create fake v4l2_fh - media: pvrusb2: Fix incorrect variable used in trace message - media: rc: fix races with imon_disconnect() - media: rc: st_rc: Fix reset control resource leak - media: redrat3: use int type to store negative error codes - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: st-delta: avoid excessive stack usage - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: tunner: xc5000: Refactor firmware load - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - media: uvcvideo: Use heuristic to find stream entity - media: v4l2-mem2mem: Fix outdated documentation - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: verisilicon: Fix CPU stalls on G2 bus error - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: verisilicon: Store chroma and motion vectors offset - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vidtv: initialize local pointers upon transfer of memory ownership - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: zoran: Remove zoran_fh structure - mei: me: add nova lake point S DID - mei: me: add wildcat lake P DID - mei: trace: treat reg parameter as string - memcg: fix data-race KCSAN bug in rstats - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - memory tiering: add abstract distance calculation algorithms management - memory tiers: use default_dram_perf_ref_source in log message - memstick: Add timeout to prevent indefinite waiting - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup - mfd: da9055: Fix missing regmap_del_irq_chip() in error path - mfd: da9063: Split chip variant reading in two bus transactions - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: madera: Work around false-positive -Wininitialized warning - mfd: max77620: Fix potential IRQ chip conflict when probing two devices - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - mfd: rz-mtu3: Fix MTU5 NFCR register offset - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - migrate: correct lock ordering for hugetlb file folios - minixfs: Verify inode mode when loading from disk - minmax: add a few more MIN_T/MAX_T users - minmax: avoid overly complicated constant expressions in VM code - minmax: don't use max() in situations that want a C constant expression - minmax: fix up min3() and max3() too - minmax.h: add whitespace around operators and after commas - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: update some comments - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax: improve macro expansion and type checking - minmax: make generic MIN() and MAX() macros available everywhere - minmax: simplify and clarify min_t()/max_t() implementation - minmax: simplify min()/max()/clamp() implementation - MIPS: Fix a reference leak bug in ip22_check_gio() - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add missing properties to cpu node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - misc: fastrpc: Add missing dev_err newlines - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - misc: fastrpc: Fix fastrpc_map_lookup operation - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Skip reference for DMA handles - misc: genwqe: Fix incorrect cmd field being reported in error - mISDN: annotate data-race around dev->work - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats - mlxsw: spectrum_router: Fix neighbour use-after-free - mlxsw: spectrum_router: Fix possible neighbour reference count leak - mm: add folio_expected_ref_count() for reference count calculation - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mmc: core: SPI mode remove cmd7 - mmc: host: renesas_sdhi: Fix the actual clock - mmc: mvsdio: Fix dma_unmap_sg() nents value - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-cadence: add Mobileye eyeQ support - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm: fix arithmetic for bdi min_ratio - mm: fix arithmetic for max_prop_frac when setting max_ratio - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: check ref_count instead of lru before migration - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - mm: hugetlb: avoid soft lockup when mprotect to large memory area - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/hugetlb: fix folio is still mapped when deleted - mm: introduce and use {pgd,p4d}_populate_kernel() - mm, kfence: describe @slab parameter in __kfence_obj_info() - mm/kfence: randomize the freelist on initialization - mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios - mm/khugepaged: fix the address passed to notifier on testing young - mm: kmsan: fix poisoning of high-order non-compound pages - mm/ksm: fix exec/fork inheritance support for prctl - mm/ksm: fix flag-dropping behavior in ksm_madvise - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - mm: memcg: add per-memcg zswap writeback stat - mm: memcg: add THP swap out info for anonymous reclaim - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: make stats flushing threshold per-memcg - mm: memcg: move vmstats structs definition above flushing code - mm: memcg: optimize parent iteration in memcg_rstat_updated() - mm: memcg: restore subtree stats flushing - mm/memory: do not populate page table entries beyond i_size - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-tier: fix abstract distance calculation overflow - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() - mm: migrate_device: use more folio in migrate_device_finalize() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/page_alloc: prevent pcp corruption with SMP=n - mm, percpu: do not consider sleepable allocations atomic - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/secretmem: fix use-after-free race in fault handler - mm: simplify folio_expected_ref_count() - mm/truncate: unmap large folio on split failure - mm: workingset: move the stats flush into workingset_test_recent() - most: usb: fix double free on late probe failure - most: usb: Fix use-after-free in hdm_disconnect - most: usb: hdm_probe: Fix calling put_device() before device initialization - mptcp: avoid deadlock on fallback while reinjecting - mptcp: avoid dup SUB_CLOSED events after disconnect - mptcp: avoid unneeded subflow-level drops - mptcp: clear scheduled subflows on retransmit - mptcp: decouple mptcp fastclose from tcp close - mptcp: Disallow MPTCP subflows from sockmap - mptcp: do not fallback when OoO is present - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: ensure context reset on disconnect() - mptcp: fallback earlier on simult connection - mptcp: fix ack generation for fallback msk - mptcp: fix a race in mptcp_pm_del_add_timer() - mptcp: fix duplicate reset on fastclose - mptcp: fix MSG_PEEK stream corruption - mptcp: fix premature close in case of fallback - mptcp: Fix proto fallback detection with BPF - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - mptcp: only reset subflow errors when propagated - mptcp: pm: ignore unknown endpoint flags - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - mptcp: pm: in-kernel: usable client side with C-flag - mptcp: pm: nl: announce deny-join-id0 flag - mptcp: propagate shutdown to subflows when possible - mptcp: restore window probe - mptcp: schedule rtx timer only after pushing data - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - mptcp: tfo: record 'deny join id0' info - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - mtdchar: fix integer overflow in read/write ioctls - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - mtd: nand: raw: atmel: Fix comment in timings preparation - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: relax ECC parameter validation check - mtd: onenand: Pass correct pointer to IRQ handler - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - mtd: rawnand: fsmc: Default to autodetect buswidth - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - mtd: rawnand: stm32_fmc2: fix ECC overwrite - nbd: defer config put in recv_work - nbd: defer config unlock in nbd_genl_connect - nbd: restrict sockets to TCP and UDP - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - net/9p: fix double req put in p9_fd_cancelled - net: Add locking to protect skb->dev access in ip_output - net: add skb_header_pointer_careful() helper - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - net: allow small head cache usage with large MAX_SKB_FRAGS values - net: Allow to use SMP threads for backlog NAPI. - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: atlantic: fix fragment overflow handling in RX path - net: bcmasp: fix early exit leak with fixed phy - net: bonding: fix possible peer notify event loss or dup issue - net: bridge: annotate data-races around fdb->{updated,used} - net: bridge: Bounce invalid boolopts - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - net: bridge: fix MST static key usage - net: bridge: fix static key check - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: Install FDB for bridge MAC on VLAN 0 - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry - net: call cond_resched() less often in __release_sock() - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - net/cls_cgroup: Fix task_get_classid() during qdisc run - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - netdevsim: add Makefile for selftests - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - net: dlink: handle copy_thresh allocation failure - net: dlink: handle dma_map_single() failure properly - net: don't touch dev->stats in BPF redirect paths - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: dsa: b53: skip multicast entries for fdb_dump() - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: fix off-by-one in maximum bridge ID determination - net: dsa: hellcreek: fix missing error handling in LED registration - net: dsa: improve shutdown sequence - net: dsa: lantiq_gswip: do also enable or disable cpu port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: microchip: common: Fix checks on irq_find_mapping() - net: dsa: microchip: Fix reserved multicast address table programming - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: lan937x: Fix RGMII delay tuning - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: do not transmit redirected XDP frames when the link is down - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - net: enetc: fix the deadlock of enetc_mdio_lock - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - net: fec: cancel perout_timer when PEROUT is disabled - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not register PPS event for PEROUT - net: fec: do not update PEROUT if it is enabled - net: fec: ERR007885 Workaround for XDP TX path - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: ipset: Remove unused htable_bits in macro ahash_region - netfilter: nf_conncount: fix leaked ct in error paths - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nf_conncount: update last_gc only when GC has been performed - netfilter: nf_reject: don't reply to icmp error messages - netfilter: nf_tables: allow loads only when register is initialized - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_tables: missing objects with no memcg accounting - netfilter: nf_tables: pass context structure to nft_parse_register_load - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: remove redundant chain validation on register store - netfilter: nft_connlimit: update the count if add was skipped - netfilter: nft_objref: validate objref and objrefmap expressions - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation - netfilter: nft_synproxy: avoid possible data-race on update operation - netfilter: replace -EEXIST with -EBUSY - net: fix memory leak in skb_segment_list for GRO packets - net: fix NULL pointer dereference in l3mdev_l3_rcv - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - net: gro: fix outer network offset - net/handshake: duplicate handshake cancellations leak socket - net/handshake: Fix memory leak in tls_handshake_accept() - net/handshake: restore destructor on submit failure - net: hns3: add VLAN id validation before using - net: hns3: fix data race in hns3_fetch_stats - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - net: hns3: return error code when function fails - net: hns3: using the num_tqps in the vf driver to apply for resources - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - net: hsr: Add support for MC filtering at the slave device - net: hsr: Add VLAN CTAG filter support - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - net: hv_netvsc: reject RSS hash key programming without RX indirection table - net: intel: fm10k: Fix parameter idx set but not used - net/ip6_tunnel: Prevent perpetual tunnel growth - net: ipv6: fix field-spanning memcpy warning in AH output - net/ipv6: Remove expired routes with a separated list of routes. - net: lan743x: Allocate rings outside ZONE_DMA - net: lan966x: Fix the initialization of taprio - net: libwx: fix device bus LAN ID - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: liquidio: fix overflow in octeon_init_instr_queue() - net: liquidio: Initialize netdev pointer before queue setup - net: macb: avoid dealing with endianness in macb_set_hwaddr() - net: macb: fix unregister_netdev call order in macb_remove() - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - net: mdio: fix resource leak in mdiobus_register_device() - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - net/mlx5: Clean up only new IRQ glue on request_irq() failure - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5e: Account for netdev stats in ndo_get_stats64 - net/mlx5e: Consider aggregated port speed during rate configuration - net/mlx5e: Don't print error message due to invalid module - net/mlx5e: Don't query FEC statistics when FEC is disabled - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Fix validation logic in rate limiting - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Harden uplink netdev access against device unbind - net/mlx5e: Report rx_discards_phy via rx_dropped - net/mlx5e: Restore destroying state bit after profile cleanup - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - net/mlx5e: TC, delete flows only for existing peers - net/mlx5e: Use extack in get module eeprom by page callback - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - net/mlx5: fw reset, add reset timeout work - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Serialize firmware reset with devlink - net/mlx5: Skip HotPlug check on sync reset using hot reset - net/mlx5: Stop polling for command response if interface goes down - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: mscc: ocelot: Fix crash when adding interface under a lag - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - net: netpoll: ensure skb_pool list is always initialized - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - net: netpoll: flush skb pool during cleanup - net: netpoll: Individualize the skb pool - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: nfc: nci: Add parameter validation for packet data - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - net: phy: adin1100: Fix software power-down ready condition - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY - net: phy: clear link parameters on admin link down - net: phy: dp83867: Disable EEE support as not implemented - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - net: phy: fix phy_uses_state_machine() - net: phy: marvell: Fix 88e1510 downshift counter errata - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - netpoll: remove netpoll_srcu - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - net: ravb: Enforce descriptor type ordering - net: ravb: Ensure memory write completes before ringing TX doorbell - net: Remove conditional threaded-NAPI wakeup based on task state. - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - netrom: fix double-free in nr_route_frame() - netrom: Fix memory leak in nr_sendmsg() - net: rose: fix invalid array index in rose_kill_by_device() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net/sched: act_ife: avoid possible NULL deref - net/sched: act_ife: convert comma to semicolon - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/sched: cls_u32: use skb_header_pointer_careful() - net/sched: Enforce that teql can only be used as root qdisc - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - net/sched: ets: Remove drr class from the active list if it changes to strict - net_sched: limit try_bulk_dequeue_skb() batches - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - net/sched: sch_qfq: do not free existing class in qfq_change_class() - net/sched: sch_qfq: Fix null-deref in agg_dequeue - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - net: sh_eth: Disable WoL if system can not suspend - net/smc: fix mismatch between CLC header and proposal - net: sock: fix hardened usercopy panic in sock_recv_errqueue - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - net: stmmac: Correctly handle Rx checksum offload errors - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: stmmac: Fix accessing freed irq affinity_hint - net: stmmac: fix rx limit check in stmmac_rx_zc() - net: stmmac: fix the crash issue for zero copy XDP_TX action - net: stmmac: make sure that ptp_rate is not 0 before configuring EST - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: tls: Cancel RX async resync request on rcd_delta overflow - net: tls: wait for async completion on last message - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - net: update netdev_lock_{type,name} - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - net: usb: asix_devices: Check return value of usbnet_get_endpoints - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - net: usb: asix: validate PHY address before use - net: usb: dm9601: remove broken SR9700 support - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - net: usb: rtl8150: Fix frame padding - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - net: usb: sr9700: fix incorrect command used to write single register - net: usb: sr9700: support devices with virtual driver CD - net: vlan: sync VLAN features with lower device - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nexthop: Forbid FDB status change while nexthop is in a group - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - nfc: nci: Fix race between rfkill and nci_unregister_device(). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - nfp: fix RSS hash key size when RSS is not supported - NFS4: Fix state renewals missing after boot - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - NFS: Avoid changing nlink when file removes and attribute updates race - NFS: check if suid/sgid was cleared after a write as needed - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno - NFSD/blocklayout: Fix minlength check in proc_layoutget - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - nfsd: convert to new timestamp accessors - nfsd: decouple the xprtsec policy check from check_nfsd_access() - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - nfsd: don't ignore the return code of svc_proc_register() - nfsd: Drop the client reference in client_states_open() - nfsd: Fix a regression in nfsd_setattr() - NFSD: Fix crash in nfsd4_read_release() - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - NFSD: Fix last write offset handling in layoutcommit - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() - NFSD: Fix permission check for read access to executable-only files - NFSD: fix race between nfsd registration and exports_proc - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - nfsd: Mark variable __maybe_unused to avoid W=1 build break - NFSD: Minor cleanup in layoutcommit processing - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: NFSv4 file creation neglects setting ACL - nfsd: provide locking for v4_end_grace - NFSD: Remove NFSERR_EAGAIN - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - NFSD: Rework encoding and decoding of nfsd4_deviceid - nfsd: set security label during create operations - NFSD: use correct reservation type in nfsd4_scsi_fence_client - NFS: enable nconnect for RDMA - NFS: Fix inheritance of the block sizes when automounting - NFS: Fix up the automount fs_context to use the correct cred - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Serialise O_DIRECT i/o and truncate() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFS: trace: show TIMEDOUT instead of 0x6e - NFSv4.1: fix backchannel max_resp_sz verification check - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Don't clear capabilities that won't be reset - NFSv4: ensure the open stateid seqid doesn't go backwards - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - nilfs2: Fix potential block overflow that cause system hang - nios2: ensure that memblock.current_limit is set when setting pfn limits - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - NTB: epf: Allow arbitrary BAR mapping - ntfs3: Fix uninit buffer allocated by __getname() - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: init run lock for extend inode - ntfs3: pretend $Extend records as regular files - ntfs: Do not overwrite uptodate pages - ntfs: set dummy blocksize to read boot_block when mounting - null_blk: fix kmemleak by releasing references to fault configfs items - null_blk: Fix the description of the cache_size module argument - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - nvme-auth: use kvfree() for memory allocated with kvcalloc() - nvme-fc: don't hold rport lock when putting ctrl - nvme-fc: release admin tagset if init fails - nvme-fc: rename free_ctrl callback to match name pattern - nvme-fc: use lock accessing port_state and rport state - nvme: fix admin request_queue lifetime - nvme: fix PCIe subsystem reset controller state transition - nvme-multipath: fix lockdep WARN due to partition scan work - nvme-multipath: Skip nr_active increments in RETRY disposition - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - nvme-pci: do not directly handle subsys reset fallout - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-fc: avoid scheduling association deletion twice - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - nvmet-tcp: remove boilerplate code - nvme: Use non zero KATO for persistent discovery connections - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - ocfs2: clear extent cache after moving/defragmenting extents - ocfs2: fix double free in user_cluster_connect() - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - ocfs2: fix memory leak in ocfs2_merge_rec_left() - ocfs2: fix recursive semaphore deadlock in fiemap call - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - octeon_ep: Fix memory leak in octep_device_setup() - octeontx2-af: Fix error handling - octeontx2: cn10k: fix RX flowid TCAM mask handling - octeontx2: Fix otx2_dma_map_page() error return code - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - once: fix race by moving DO_ONCE to separate section - openat2: don't trigger automounts with RESOLVE_NO_XDEV - orangefs: fix xattr related buffer overflow... - padata: Reset next CPU when reorder sequence wraps around - page_pool: always add GFP_NOWARN for ATOMIC allocations - page_pool: Clamp pool size to max 16K pages - page_pool: Fix use-after-free in page_pool_recycle_in_ring - parisc: Do not reprogram affinitiy on ASP chip - parisc: don't reference obsolete termio struct for TC* constants - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace - parisc: Remove spurious if statement from raw_copy_from_user() - PCI: Add PCI_VDEVICE_SUB helper macro - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - PCI: brcmstb: Fix disabling L0s capability - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - PCI: Disable MSI on RDC PCI to PCIe bridges - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - PCI: j721e: Fix programming sequence of "strap" settings - PCI: keystone: Exit ks_pcie_probe() for invalid mode - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - PCI/PM: Skip resuming to D0 if device is disconnected - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/sysfs: Ensure devices are powered for config reads (part 2) - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - perf arm-spe: Extend branch operations - perf arm_spe: Fix memset subclass in operation - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - perf arm-spe: Rename the common data source encoding - perf evsel: Avoid container_of on a NULL leader - perf evsel: Ensure the fallback message is always written to - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf lock contention: Load kernel map before lookup - perf maps: Add maps__load_first() - perf python: split Clang options when invoking Popen - perf record: skip synthesize event when open evsel failed - perf: sched: Fix perf crash with new is_user_task() helper - perf session: Fix handling when buffer exceeds 2 GiB - perf: Skip user unwind if the task is a kernel thread - perf subcmd: avoid crash in exclude_cmds when excludes is empty - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf test stat: Avoid hybrid assumption when virtualized - perf tools: Add fallback for exclude_guest - perf tools: Fix split kallsyms DSO counting - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf util: Fix compression checks returning -1 as bool - perf/x86/amd: Check event before enable to avoid GPF - perf/x86/intel: Correct large PEBS flag check - perf/x86/intel: Do not enable BTS for guests - phy: broadcom: bcm63xx-usbh: fix section mismatches - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - phy: cdns-dphy: Store hs_clk_rate and return it - phy: drop probe registration printks - phy: freescale: imx8m-pcie: assert phy reset during power on - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - phy: mscc: Fix PTP for VSC8574 and VSC8572 - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - phy: phy-snps-eusb2: refactor constructs names - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - phy: rockchip: inno-usb2: fix communication disruption in gadget mode - phy: rockchip: inno-usb2: fix disconnection in gadget mode - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: stm32-usphyc: Fix off by one in probe() - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 - phy: tegra: xusb: fix device and OF node leak at probe - phy: ti: omap-usb2: fix device leak at unbind - phy: ti-pipe3: fix device leak at unbind - phy: Use device_get_match_data() - pid: Add a judgment for ns null in pid_nr_ns - pinctrl: check the return value of pinmux_ops::get_function_name() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - pinctrl: keembay: release allocated memory in detach path - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - pinctrl: meson-gxl: add missing i2c_d pinmux - pinctrl: meson: mark the GPIO controller as sleeping - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - pinctrl: qcom: msm: Fix deadlock in pinmux configuration - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - pinctrl: renesas: Use int type to store negative error codes - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: samsung: Drop unused S3C24xx driver data - pinctrl: single: fix bias pull up/down handling in pin_config_set - pinctrl: single: Fix incorrect type for error return variable - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling - pinctrl: stm32: fix hwspinlock resource leak in probe function - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - platform/x86: acer-wmi: Ignore backlight event - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - platform/x86: hp-bioscfg: Fix automatic module loading - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - platform/x86: hp-bioscfg: Skip empty attribute names - platform/x86: huawei-wmi: add keys for HONOR models - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - platform/x86: intel: chtwc_int33fe: don't dereference swnode args - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - platform/x86: intel: punit_ipc: fix memory corruption - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - platform/x86: intel_telemetry: Fix PSS event register mask - platform/x86: intel_telemetry: Fix swapped arrays in PSS output - platform/x86: msi-laptop: add missing sysfs_remove_group() - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - pmdomain: imx: Fix reference count leak in imx_gpc_probe() - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - pmdomain: samsung: plug potential memleak during probe - pmdomain: Use device_get_match_data() - PM: runtime: Add new devm functions - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - PM: sleep: core: Clear power.must_resume in noirq suspend error path - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - posix-clock: introduce posix_clock_context concept - posix-clock: Store file pointer in struct posix_clock_context - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - powerpc/32: Fix unpaired stwcx. on interrupt exit - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - powerpc/64s/radix/kfence: map __kfence_pool at page granularity - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - powerpc/addnote: Fix overflow on 32-bit builds - powerpc/eeh: Use result of error_detected() in uevent - powerpc/kexec: Enable SMT before waking offline CPUs - powerpc, mm: Fix mprotect on book3s 32-bit - powerpc/powernv/pci: Fix underflow and leak issue - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - powerpc/pseries/msi: Fix potential underflow and leak issue - power: supply: apm_power: only unset own apm_get_power_status - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: cw2015: Fix a alignment coding style issue - power: supply: max77976_charger: fix constant current reporting - power: supply: qcom_battmgr: add OOI chemistry - power: supply: qcom_battmgr: handle charging state change notifications - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: sbs-charger: Support multiple devices - power: supply: wm831x: Check wm831x_set_bits() return value - pps: fix warning in pps_register_cdev when register device fail - proc: fix type confusion in pde_set_flags() - ps3disk: use memcpy_{from,to}_bvec index - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - ptp: add testptp mask test - ptp: Limit time setting of PTP clocks - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - pwm: berlin: Fix wrong register in suspend/resume - pwm: stm32: Always program polarity - pwm: tiehrpwm: Fix corner case in clock divisor calculation - qed: Don't collect too many protection override GRC elements - quota: remove unneeded return value of register_quota_format - r8152: add error handling in rtl8152_driver_init - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - r8169: fix RTL8117 Wake-on-Lan in DASH mode - r8169: set EEE speed down ratio to 1 - rbd: check for EOD after exclusive lock is ensured to be held - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - RDMA/bnxt_re: fix dma_free_coherent() pointer - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Fix to use correct page size for PDE table - RDMA/cm: Fix leaking the multicast GID table reference - RDMA/cm: Rate limit destroy CM ID timeout error message - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/core: Resolve MAC of next-hop device without ARP support - RDMA/efa: Remove possible negative shift - RDMA/hns: Fix the modification of max_send_sge - RDMA/hns: Fix wrong WQE data when QP wraps around - RDMA/irdma: Add support to re-register a memory region - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/mlx5: Fix vport loopback forcing for MPV device - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/rtrs: server: Fix error handling in get_or_create_srv - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - RDMA/rxe: Fix race in do_task() when draining - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests - RDMA/rxe: Remove the direct link to net_device - RDMA/siw: Always report immediate post SQ errors - rds: Fix endianness annotation for RDS_MPATH_HASH - rds: ib: Increment i_fastreg_wrs before bailing out - regmap: Fix race condition in hwspinlock irqsave routine - regmap: maple: free entry on mas_store_gfp() failure - regmap: Remove superfluous check for !config in __regmap_init() - regmap: slimbus: fix bus_context pointer in regmap init calls - regulator: core: disable supply if enabling main regulator fails - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - regulator: fixed: fix GPIO descriptor leak on register failure - regulator: scmi: Use int type to store negative error codes - regulator: sy7636a: fix lifecycle of power good gpio - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - remoteproc: qcom: q6v5: Avoid handling handover twice - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - reset: fix BIT macro reference - resource: introduce is_type_match() helper and use it - resource: replace open coded resource_intersection() - resource: Reuse for_each_resource() macro - Revert "cpuidle: menu: Avoid discarding useful information" - Revert "driver core: enforce device_lock for driver_match_device()" - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Revert "gfs2: Fix use of bio_chain" - Revert "iommu/amd: Skip enabling command/event buffers for kdump" - Revert "ipmi: fix msg stack when IPMI is disconnected" - Revert "loop: Avoid updating block size under exclusive owner" - Revert "mtd: rawnand: marvell: fix layouts" - Revert "net: Allow to use SMP threads for backlog NAPI." - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - Revert "net: Remove conditional threaded-NAPI wakeup based on task state." - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "perf dso: Add missed dso__put to dso__load_kcore" - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - Revert "SUNRPC: Don't allow waiting for exiting tasks" - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - riscv: bpf: Fix uninitialized symbol 'retval_off' - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - riscv: clocksource: Fix stimecmp update hazard on RV32 - riscv: compat: fix COMPAT_UTS_MACHINE definition - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - RISC-V: Don't print details of CPUs disabled in DT - riscv: Improve exception and system call latency - riscv: kprobes: Fix probe address validation - RISC-V: KVM: Fix guest page fault within HLV* instructions - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - RISC-V: Remove unnecessary include from compat.h - riscv: Replace function-like macro by static inline function - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: stacktrace: fix backtracing through exceptions - riscv: uprobes: Add missing fence.i after building the XOL buffer - rocker: fix memory leak in rocker_world_port_post_fini() - rpmsg: glink: fix rpmsg device leak - rseq: Protect event mask against membarrier IPI - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: gamecube: Check the return value of ioremap() - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - rtc: optee: fix memory leak on driver removal - rtc: pcf2127: clear minute/second interrupt - rtc: pcf2127: fix SPI command byte for PCF2131 backport - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - rtc: rx8025: fix incorrect register reference - rtc: x1205: Fix Xicor X1205 vendor prefix - rtnetlink: Allow deleting FDB entries in user namespace - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target - s390/ap: Don't leak debug feature files if AP instructions are not available - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/cio: Update purge function to unregister the unused subchannels - s390/cpum_cf: Deny all sampling events by counter PMU - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - s390/ctcm: Fix double-kfree - s390/dasd: Fix gendisk parent after copy pair swap - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - s390/ipl: Clear SBP flag when bootprog is set - s390/mm: Fix __ptep_rdp() inline assembly - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - s390/pci: Restore IRQ unconditionally for the zPCI device - s390/pci: Use pci_uevent_ers() in PCI recovery - s390/smp: Fix fallback CPU detection - samples/ftrace: Adjust LoongArch register restore order in direct calls - samples: work around glibc redefining some of our defines wrong - sched/balancing: Rename newidle_balance() => sched_balance_newidle() - sched/deadline: Fix race in push_dl_task() - sched/deadline: only set free_cpus for online runqueues - sched/fair: Fix pelt lost idle time detection - sched/fair: Forfeit vruntime on yield - sched/fair: Proportional newidle balance - sched/fair: Revert max_newidle_lb_cost bump - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - sched: Remove never used code in mm_cid_get() - sched/rt: Fix race in push_rt_task - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep - scs: fix a wrong parameter in __scs_magic - scsi: aic94xx: fix use-after-free in device removal path - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - scsi: core: Fix a regression triggered by scsi_host_busy() - scsi: core: Fix error handler encryption support - scsi: core: Wake up the error handler when final completions race against each other - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - scsi: myrs: Fix dma_alloc_coherent() error check - scsi: pm8001: Use int instead of u32 to store error codes - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: pm80xx: Fix race condition caused by static variables - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: edif: Fix dma_free_coherent() size - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix improper freeing of purex item - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - scsi: qla2xxx: Sanitize payload size to prevent member overflow - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: sg: Do not sleep in atomic context - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - scsi: smartpqi: Fix device resources accessed after device removal - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: target: Do not write NUL characters into ASCII configfs output - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - scsi: target: Reset t_task_cdb pointer in error case - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - sctp: avoid NULL dereference when chunk data buffer is missing - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - sctp: Fix MAC comparison to be constant-time - sctp: Hold RCU read lock while iterating over address list - sctp: Hold sock lock while iterating over address list - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: Prevent TOCTOU out-of-bounds write - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - selftest/ptp: update ptp selftest to exercise the gettimex options - selftests: arg_parsing: Ensure data is flushed to disk before reading. - selftests: arm64: Check fread return value in exec_target - selftests: bonding: add delay before each xvlan_over_bond connectivity check - selftests: bonding: add ipvlan over bond testing - selftests: bonding: add missing build configs - selftests: bonding: Add more missing config options - selftests/bpf: Check for timeout in perf_link test - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - selftests/bpf: Fix failure paths in send_signal test - selftests/bpf: Improve reliability of test_perf_branches_no_hw() - selftests/bpf: make arg_parsing.c more robust to crashes - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - selftests: Disable dad for ipv6 in fcnal-test.sh - selftests: drv-net: fix RPS mask handling for high CPU numbers - selftests: fib_nexthops: Fix creation of non-FDB nexthops - selftests/ftrace: traceonoff_triggers: strip off names - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: check no dup close events after error - selftests: mptcp: check subflow errors in close events - selftests: mptcp: connect: catch IO errors on listen side - selftests: mptcp: connect: fix fallback note due to OoO - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: disable add_addr retrans in endpoint_tests - selftests: mptcp: join: endpoints: longer transfer - selftests: mptcp: join: fix local endp not being tracked - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: properly kill background tasks - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: join: validate C-flag + def limit - selftests: mptcp: pm: ensure unknown flags are ignored - selftests: mptcp: sockopt: fix error messages - selftests: mptcp: userspace pm: validate deny-join-id0 flag - selftests: net: amt: wait longer for connection before sending packets - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace - selftests/net: convert sctp_vrf.sh to run it in unique namespace - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - selftests: netdevsim: set test timeout to 10 minutes - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests: net: fib-onlink-tests: Convert to use namespaces by default - selftests: net: fix "buffer overflow detected" for tap.c - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - selftests: net: fix server bind failure in sctp_vrf.sh - selftests: net: local_termination: Wait for interfaces to come up - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - selftests: net: replace sleeps in fcnal-test with waits - selftests: net: use BASH for bareudp testing - selftests/net: use destination options instead of hop-by-hop - selftests/nolibc: fix EXPECT_NZ macro - selftests: openvswitch: Fix escape chars in regexp. - selftests: Replace sleep with slowwait - selftests: traceroute: Use require_command() - selftests/tracing: Run sample events to clear page cache events - selftests/user_events: fix type cast for write_index packed member in perf_test - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - serial: add support of CPCI cards - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - serial: max310x: Add error checking in probe() - serial: sc16is7xx: fix bug in flow control levels init - serial: sc16is7xx: refactor EFR lock - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - serial: sc16is7xx: remove useless enable of enhanced features - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready - serial: stm32: allow selecting console when the driver is module - sfc: fix potential memory leak in efx_mae_process_mport() - shmem: fix tmpfs reconfiguration (remount) when noswap is set - slimbus: core: fix device reference leak on report present - slimbus: core: fix runtime PM imbalance on report present - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - smack: fix bug: unprivileged task can create labels - smb: client: fix cifs_pick_channel when channel needs reconnect - smb: client: fix crypto buffers in non-linear memory - smb: client: fix incomplete backport in cfids_invalidation_worker() - smb: client: fix memory leak in cifs_construct_tcon() - smb/client: fix memory leak in smb2_open_file() - smb: client: fix missing timestamp updates after utime(2) - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb: client: fix potential cfid UAF in smb2_query_info_compound - smb: client: fix potential UAF in smb2_close_cached_fid() - smb: client: Fix refcount leak for cifs_sb_tlink - smb: client: fix refcount leak in smb2_set_path_attr - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - smb: client: fix wrong index reference in smb2_compound_op() - smb: client: introduce close_cached_dir_locked() - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - smb: client: transport: avoid reconnects triggered by pending task work - smb: client: validate change notify buffer before copy - smb: fix invalid username check in smb3_fs_context_parse_param() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: fix IRD/ORD negotiation with the client - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix refcount leak in parse_durable_handle_context() - smb/server: fix refcount leak in smb2_open() - smb/server: fix return value of smb2_ioctl() - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - smc91x: fix broken irq-context in PREEMPT_RT - smp: Fix up and expand the smp_call_function_many() kerneldoc - smsc911x: add second read of EEPROM mac when possible corruption seen - soc: amlogic: canvas: fix device leak on lookup - soc: aspeed: socinfo: Add AST27xx silicon IDs - soc: qcom: ocmem: fix device leak on lookup - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: qcom: smem: fix hwspinlock resource leak in probe error paths - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - sparc64: fix hugetlb for sun4u - sparc64: fix prototypes of reads[bwl]() - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix error handling in scan_one_device() - sparc/module: Add R_SPARC_UA64 relocation handling - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: cadence-quadspi: Fix clock disable on probe failure path - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Implement refcount to handle unbind during busy - spi: fsl-cpm: Check length parity before switching to 16 bit mode - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - spi: imx: keep dma request disabled before dma transfer setup - spi: loopback-test: Don't use %pK through printk - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: rpc-if: Add resume support for RZ/G3E - spi: spi-mem: Add a new controller capability - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-nxp-fspi: add extra delay after dll locked - spi: spi-sprd-adi: Fix double free in probe error path - spi: sprd-adi: switch to use spi_alloc_host() - spi: sprd: adi: Use devm_register_restart_handler() - spi: tegra114: Preserve SPI mode bits in def_command1_reg - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - spi: tegra210-quad: Fix timeout handling - spi: tegra210-quad: Move curr_xfer read inside spinlock - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer - spi: tegra: Fix a memory leak in tegra_slink_probe() - spi: Try to get ACPI GPIO IRQ earlier - spi: xilinx: increase number of retries before declaring stall - Squashfs: add additional inode sanity checking - Squashfs: fix uninit-value in squashfs_get_parent - Squashfs: reject negative file sizes in squashfs_read_inode() - staging: axis-fifo: fix maximum TX packet length check - staging: axis-fifo: fix TX handling on copy_from_user() failure - staging: axis-fifo: flush RX FIFO on read errors - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 - staging: most: remove broken i2c driver - staging: rtl8712: Remove driver using deprecated API wext - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - strparser: Fix signed/unsigned mismatch bug - SUNRPC: call xs_sock_process_cmsg for all cmsg - sunrpc: fix null pointer dereference on zero-length checksum - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - svcrdma: bound check rq_pages index in inline path - svcrdma: return 0 on success from svc_rdma_copy_inline_range - task_work: Fix NMI race condition - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - tcp: fix __tcp_close() to only send RST when required - tcp: fix tcp_tso_should_defer() vs large RTT - tcpm: allow looking for role_sw device in the main node - tcpm: switch check for role_sw device with fw_node - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - team: fix check for port enabled in team_queue_override_port_prio_changed() - team: Move team device type change at the end of team_port_add - tee: allow a driver to allocate a tee_device without a pool - testptp: Add option to open PHC in readonly mode - textsearch: describe @list member in ts_ops search - tg3: prevent use of uninitialized remote_adv and local_adv variables - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - thunderbolt: Add support for Intel Wildcat Lake - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - timers: Fix NULL function pointer race in timer_shutdown_sync() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - tipc: use kfree_sensitive() for session key material - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - tls: always set record_type in tls_process_cmsg - tls: don't rely on tx_work during send() - tls: make sure to abort the stream if headers are bogus - tls: trim encrypted message to match the plaintext on short splice - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools build: Align warning options with perf - tools/cpupower: fix error return value in cpupower_write_sysfs() - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/testing/nvdimm: Use per-DIMM device handle - tools: ynl: Specify --no-line-number in ynl-regen.sh. - tpm: Cap the number of PCR banks - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - tracefs: fix a leak in eventfs_create_events_dir() - tracing: Do not register unsupported perf events - tracing: dynevent: Add a missing lockdown check on dynevent - tracing: Fix crash on synthetic stacktrace field usage - tracing: Fix fixed array of synthetic event - tracing: Fix ftrace event field alignments - tracing: Fix memory leaks in create_field_var() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - tracing: Fix tracing_marker may trigger page fault during preempt_disable - tracing: Silence warning when chunk allocation fails in trace_pid_write - tracing/tools: Fix incorrcet short option in usage text for --threads - tty: fix tty_port_tty_*hangup() kernel-doc - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - tty: introduce and use tty_port_tty_vhangup() helper - tty: n_gsm: Don't block input queue by waiting MSC - tunnels: reset the GSO metadata before reusing the skb - uacce: ensure safe queue release with state management - uacce: fix cdev handling in the cleanup path - uacce: fix isolate sysfs check condition - uacce: implement mremap in uacce_vm_ops to return -EPERM - ublk: complete command synchronously on error - ublk: fix deadlock when reading partition table - ublk: make sure io cmd handled in submitter task context - ublk: prevent invalid access with DEBUG - udp_tunnel: use netdev_warn() instead of netdev_WARN() - uio_hv_generic: Let userspace take care of interrupt mask - uio_hv_generic: Set event for all channels on the device - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - um: Fix help message for ssl-non-raw - um: virtio_uml: Fix use-after-free after put_device in probe - Unbreak 'make tools/*' for user-space targets - uprobe: Do not emulate/sstep original instruction when ip is changed - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - usb: chaoskey: fix locking for O_NONBLOCK - usb: core: Add 0x prefix to quirks debug output - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: dwc3: Check for USB4 IP_NAME - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: keep susphy enabled during exit to avoid controller faults - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: dwc3: pci: Sort out the Intel device IDs - USB: Fix descriptor count when handling invalid MBIM extended descriptor - usb: gadget: configfs: Correctly set use_os_string at bind - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - usb: gadget: f_hid: Fix zero length packet transfer - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: lpc32xx_udc: fix clock imbalance in error path - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - usbip: Fix locking bug in RT-enabled kernels - USB: lpc32xx_udc: Fix error handling in probe - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usbnet: Fix using smp_processor_id() in preemptible code warnings - usbnet: limit max_mtu based on device's hard_mtu - usbnet: Prevents free active kevent - usb: ohci-nxp: fix device leak on probe failure - usb: ohci-nxp: Use helper function devm_clk_get_enabled() - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal - usb: phy: Initialize struct usb_phy list_head - usb: phy: isp1301: fix non-OF device reference imbalance - usb: phy: twl6030: Fix incorrect type for ret - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - usb: raw-gadget: do not limit transfer length - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() - usb: renesas_usbhs: Fix synchronous external abort on unbind - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: ftdi_sio: match on interface number for jtag - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Quectel RG255C - USB: serial: option: add SIMCom 8230C compositions - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: move Telit 0x10c7 composition in the right place - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: typec: tipd: Clear interrupts first - usb: typec: ucsi: Handle incorrect num_connectors capability - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - usb: udc: Add trace event for usb_gadget_set_state - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - usb: vhci-hcd: Prevent suspending virtually attached devices - usb: xhci: Apply the link chain quirk on NEC isoc endpoints - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: xhci: move link chain bit quirk checks into one helper function. - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - vdpa/pds: use %pe for ERR_PTR() in event handler registration - veth: fix data race in veth_get_ethtool_stats - vfio/pds: replace bitmap_free with vfree - vfio: return -ENOTTY for unsupported device feature - vfs: Don't leak disconnected dentries on umount - vhost: Take a reference on the task in struct vhost_task. - vhost: vringh: Fix copy_to_iter return value check - vhost: vringh: Modify the return value check - vhost/vsock: improve RCU read sections around vhost_vsock_get() - via_wdt: fix critical boot hang due to unnamed resource allocation - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - virtio_console: fix order of fields cols and rows - virtio: fix typo in virtio_device_ready() comment - virtio: fix virtqueue_set_affinity() docs - virtio: fix whitespace in virtio_config_ops - virtio-net: fix incorrect flags recording in big mode - virtio-net: fix received length check in big packets - virtio_vdpa: fix misleading return in void function - vmxnet3: unregister xdp rxq info in the reset path - vsock: fix lock inversion in vsock_assign_transport() - vsock: Ignore signal/timeout on connect() if already established - vsock/test: add a final full barrier after run all tests - vsock/test: fix seqpacket message bounds test - vsock/test: verify socket options after setting them - vsock/virtio: cap TX credit to local buffer size - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - w1: fix redundant counter decrement in w1_attach_slave_device() - w1: therm: Fix off-by-one buffer overflow in alarms_store - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - watchdog: starfive: Fix resource leak in probe error path - watchdog: wdat_wdt: Fix ACPI table leak in probe function - wifi: ath10k: avoid unnecessary wait for service ready message - wifi: ath10k: Fix connection after GTK rekeying - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode - wifi: ath11k: fix peer HE MCS assignment - wifi: ath11k: fix RCU stall while reaping monitor destination ring - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - wifi: ath12k: fix dma_free_coherent() pointer - wifi: ath12k: free skb during idr cleanup callback - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - wifi: avoid kernel-infoleak from struct iw_point - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - wifi: ieee80211: correct FILS status codes - wifi: mac80211: collect station statistics earlier when disconnect - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: Discard Beacon frames to non-broadcast address - wifi: mac80211: do not use old MBSSID elements - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - wifi: mac80211: fix CMAC functions not handling errors - wifi: mac80211: Fix HE capabilities element check - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: move TDLS work to wiphy work - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: mac80211: reject address change while connecting - wifi: mac80211: remove RX_DROP_UNUSABLE - wifi: mac80211: skip rate verification for not captured PSDUs - wifi: mt76: Fix DTS power-limits on little endian systems - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: mwifiex: send world regulatory domain to driver - wifi: rsi: Fix memory corruption due to not set vif driver data size - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - wifi: rtw88: sdio: use indirect IO for device registers before power-on - wifi: rtw89: avoid circular locking dependency in ser_state_run() - wifi: virt_wifi: Fix page fault on connect - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: wlcore: ensure skb headroom before skb_push - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - x86/boot: Fix page table access in 5-level to 4-level paging transition - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - x86: disable image size check for test builds - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - x86/fpu: Ensure XFD state on signal delivery - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers - x86/kfence: avoid writing L1TF-vulnerable PTEs - x86/kfence: fix booting on 32bit non-PAE systems - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - x86: make page fault handling disable interrupts properly - x86/microcode/AMD: Add more known models to entry sign checking - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - x86/microcode/AMD: Limit Entrysign signature checking to known generations - x86/microcode/AMD: Select which microcode patch to load - x86/microcode: Fix Entrysign revision check for Zen1/Naples - x86/ptrace: Always inline trivial accessors - x86/resctrl: Add missing resctrl initialization for Hygon - x86/resctrl: Fix memory bandwidth counter width for Hygon - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - x86/umip: Check that the instruction opcode is at least two bytes - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - x86/vdso: Fix output operand size of RDPID - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - x86/xen: Fix sparse warning in enlighten_pv.c - x86/xen: Move Xen upcall handler - xen/events: Cleanup find_virq() return codes - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - xen/manage: Fix suspend error path - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: flush all states in xfrm_state_fini - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: state: fix out-of-bounds read during lookup - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfs: always warn about deprecated mount options - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - xfs: use deferred intent items for reaping crosslinked blocks - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - xhci: dbgtty: fix device unregister: fixup - xhci: fix memory leak regression when freeing xhci vdev devices depth first - xsk: Fix race condition in AF_XDP generic RX path - xtensa: simdisk: add input size check in proc_write_simdisk - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Patch from Hans to fix SYNA3602 touchpads- Update initrd size (kb#456)6.6.148-1.module.8192du6.6.148-16.6.148-14.0.108192du.ko/lib/modules/6.6.148-desktop-1rosa2021-x86_64/kernel/net/wireless/-O2 -fomit-frame-pointer -gdwarf-4 -Wstrict-aliasing=2 -pipe -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -m64 -mtune=generichttps://rosa.rucpioxz6Tx86_64-rosa-linux-gnuELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=be60afe2dc9c4b015c8c51bd3e41d1ed424f5a32, not strippedPooorosa2021https://bugzilla.rosa.rubasesystem-minimalfilesystemsetup@@@utf-8a11f9280de72b0e4b7fd6315a2d76f7a88b35a07f2fcc3926b5e5c7de6fb6506366f822621509223a065f930464fe28f8c51e5af9aa158e06701efe2ba652f71?7zXZ }!! ] crv(vX0bRb+jD&d'dW)CuMaNY@0q!> ?'cߙv7b1 FoBueqI6Z< =d @<ݛ>F"7 M6;_c?kT !Ck-UްL"[ZwclF+Ϡm@9i}ɼF+OI;+\~D0E,Rm-MT+|󺐦 F :IQ\kaG~[4q,!$ϟ3? mv wxܕ:83?kİ~JS"<=оu'Qq/8\h#rX -9b~t{k;)GXPr~Vțb(2G"4&ꐱnRV%Rl`mӖ՗ $9pC3l(4GAޟRc[Z]zPCb^<M]$E87? 狃T( kva ih5'\!#fwyJlg$ 32M.: :t)yK渮U>(Ũc:Ím,y_TUmF C(:=+1&CQZ|i\{.=]6QR 9j(YH/~qXڣ~в#1Ėq7P05|t φLŬjVwЛ`{+@ [Ahjl~bZsOH=͹՝",/#M5u'.!.𡆿Y)L4E8c0wK;-FIV>;?>VdTi|) *^=Q)>P/!7Lyv(z}zo-B/ܪFHshKB<Ʌ*M^\kA,"g'QL~^DVQ/ . Е<\4qaG ؎7}X@kizfz;ǴͪUxVɖDiPH!I$1*uE'bF6# årC8bJpb۟_rb8BA THzmBDm$PȨdRFruEr;E{e~p,{d@E{- jimɶdyOw<pG.C:Yin+\`=o-mXkJ/atsII4LXthP5J5ؘgp[:EkB g0( }ɇYSg9Kg *tx肬7`M6)mie sJUD3zf=f`'Vk}-E2MzOqΛio^&}k^aj[%[ yǤ^p2f8iTȶ(:â7)ˮB\Ǭ (}^RLՃ}Ub ՛GR0]YG3Gdj%aBtHDxXgOYs$3K0hYmRjuXNt[@bid#TWcNC;4Gsץb0bBm6X5$9~[.A+3fPW#I‰1tS3䯕Lz8&.&KUR7jaπ(>qqF.^ ^hŝvPT cKC;@/8&0*]jwǧؙ?!ďjfHVw97 d9ll Sȶ>^?"C }ZKIanqRieG*مLiWZ}>ދˁj͐ҳ{V}MX-AZLMˊO t)SdK)L oKčjRS1KZIK)jÎSU KkI[@r>ou/\,cC=<3AVrj[^c牍n)uJ1j3eUuc+b9m/w;h UF%cdMk h{n"7oo85ZR! zf"'iFh 50jki5AaO_ }XО%6>;Mu;b4oDwQhgܬVrB[l.LKΌ1 ͯL0r V:`~ ?@rZ}Sw[qX99O: ?%6lO`9qVE3L'm5(X v'AykX*m/ w @(؎U 2<³E lp*?:>M ,^ӿy@m· cZ8Fۚ[j灹[k)(3 WBoS%m ڥ NW*kjd5̾ccm/-uT%ghV}(k&c^ld@2^ĝLn4gRE0&F3 d|J?d_L;32K[*zpH.6>q\ڌS; 4p1% x<-`6Ffe}l{R<)r 0F|1ZLxve08dUj&@hrKeAlg}%WXWIGiųj/OqIiaCzQ_TōÿbW#-wצ"[z`(b*5S_RP2C?I NpP(侻9IS^`M{Ѣ"S&YVa#Ι2h@wBu{HZbAjC1@TW`[u#46|amrVH/lbdqR|FV-ݼxgz 1ZAw jwz)|V]&V7o0"\n`:Y\zA6b7j8yhu%Lp=UpmfzA{B`BtRNŃ1 0='oK9,?LΧ@N8G~3:^!  EHPwm.?bRGBKvnT3m=Y;1]_ 50Qq1[-Qm̵^CPBQ\3yAl34'BKZ72vxe%;[Sٯ$0vEN ?qr3w5-U!ԽS9?wJ Ъ#;/' A{dG+jL+m>lwN$GXjO_ Uchv|ĝ >"cy1P)[-f'(ZU2pwp(\Z t.`74Qxݽuj8_ ?o7HC1** ?}xlc4⮕_E-l73Q1)J8FnQcLF Wވ:NqlC(3XxnX%]<\|*_߾B֑+n L}\K}:u䒫j_ h'hlBY0mwkm$1zRK'7,d0½&gz\!Aqךk/&n"tD"Q]r&PYì=1|V/GD0rZyTHَ٭;u(oFG+H=9ΥX9 ~xR'hc#@2P-'6 j~T$ǯ3DwǬD27I-o޴i,>j˘ N"B^18XAVA$]C8xQn%L2@(Yo23`O9X} _}bR=6C99+)FwD SB. ؤ>9S7]|>rbI%묲ڈs6[&XoGEwv$L~eQ[mHRUTNrѓ1r+^5մWRf#h+X/%d눱~ Z;#f2ʜ^`sGLdȰ @e&͌F* GXsEˏ5(SЅ2cO:$|X2NFEa[r(ҧb `_u!}@NCNEɫeN 1Y12Lƿ=%=9QR>ϒ"uZ滵iaC?m!Ҟd]0ZN&__D|)BeN#lx͇֛/o!kzzckgf1z,Pnɾ],)u[_Bǵ:@lg^Q& #19Ksj-tCc ᕡkv"oKz>&"įɢO;0.B$N"0@B_^'@)']p ;P^nH5g3@t{eBF琎w Vx'&qWd죏8}6OɚM|c <4FG_ݧ(,kn΄{Y?X#g[јjMuȈHKpL2F GCD,^i[]7ދxr_` ˓x l }W\12VAhA?U|(?)(SΠxU߱R 4kݱ9@)"qP@x`-ςxb+ CY|pm.'#TlWc?g#"J 68*nj5B[CJAgMyw Ȓ4M D4_G HT V-&ayUc#Ac Lpd S]V0h^Q)_ ];gu(diLmbO)qWC 0TeZ.Ch{6iB<]a9>`*=MzJZ2lEs25Y(߽TPd4,K{2&!D*vV6`>PՉ4 H /Y$^v$ӬgGItϐpc`nvZ0;$$11/xI})'plǏ`x3P˵N,0@kMTP كAI`uAgnӹ (7'b?)`]ұo@ hZ3 Fs ?VR(ۨA,DHA)0\CX6X<-"D⠋yj_R]QaoTŸS$rn6WMة2S&ǼQ'o,_r/]\PbU& w/)*0ؙ2$, NN\\~|'&f"kEepP8 2^<M^zuwuN$ckaP?ǓI?鉄Y#]L(.)g֣O&܀`^c@,0O-yVkpS-qQI~ wVS\};w4LtVd _<"#pdA;cS2jVF% V?c`+C#zǥBZaVPealy CDvx̘Fn VEA?РoGZB?Po m& ցї2{Ft0ȏYL IWvy-` `uPM!nOb_d1@pY/~,+:*C9S A_`mMbF1>EHsdtGd>cPOuq$Og';.ZFk\ӧ˓&g[eFpF Fp|ݠ TaL D|N|RDh՘FDljhszAlQT%Ea,gR>0dܖ][㑕'M6HpH劙f;v4F(WKjkՄ!f{i.`E':9:L4:eH2UVD;Y:vJ0O>h+\N08@yK5漻1qJpb5%[ݨAUƀ2FьN[|QYtЌ|\./uvefvܟ>ׂ`:0,ФV <C|ھ]*QksTIp1u =_̠p:Oqܨ4Ma%eg.Q1< ~Z'9#mQFn%Hv2Bٖqn/lGޮbs2J=*/vlN  rb[ƀ!iIӪw齐v G[x5;a!0@t4XDoѾޜV2g~B?xhrmV)5=>LzmW&0`jmq ٜM~ۥYAM/"9>Sv>,D$kFbbd8vŞۿ?”.Z/5_ܷld: xC9%vڝ0 &@Zٌ9Ԫ/ngB!@K ʰ۰]UNlXP{]z{MY=J,}28[l9!}oڪF@AgaD*gMG]W澑XэFsR<%˕sJg2>=4lj6)Ůb_Ӻ`X#:7r.a@s[>3d p~LX'- 3_6x[y!jrmx,W,o([u8+vU=cPM(F F׆0㿦F>W̼T$^(Ï)DF7AXQ)_k9ml:AocELߵ`ݝ~enʛhh!Tl$`ɚ&|chonl9@y8Pga䫭$ygN4X%zL xr-Юc[e:W K޾{lkrϦ>A@qSy pO_ؼ+ϏS|`{= lG ]Y<;0zb&k(z%^#l_AX[2pD v~m=Y"[p LYɢ&?ha[rЊkZ]rB:ݝ>`]cͷ]Vɾq2 ӘȳNGO05ѕk6 GtĪX]2Y@j[[*Jڱ"n:R ,UOjX͡G :90Jg\$Fſ]ncT)c*)" sxA©O.Jstc(]%uаoOɼӰZ iMqlwuV?.M! +YzQWBT] hMn&0p< vPvxDo:5a5;ʓTq: kC6vĺ\D̄BVbZ[h[7igFa !HۅmH8x#-c4n\hRҢTX8iCqx X :y_U5&7N M4 ]7d٢:`-Tw  9 'D;elDo[l"/6hD}8Iͫԫ8;XC6!y(DY5xkUCn$A*fa*@sT6o'[Y"2\䒛u3R"G4u@ ;9JUN+W[sM(`9PhY㸜0Eriΰi fĄTydιzsG̹2W6u՛CŕCkz%r!3-@fl"8j̈|{A*E@v/(:\{6Se M#Ԩ5S#zJi1Q6udT }d)? ›S+Y{98cRX x Pq<$JΑXǖnʦbʾ@CԂQX6{4^Un'L~cRQ#:RaS/zD<v;zCL:x8z&I&\]d,nv"Pb+`hqtY52s}a9tfvi0͡g$ߠG`:AkӎQ0,2>qz/kjD2*"9$zvP֚t('z1n.z%B/~kFUU`K C2ã fo;r4|wrrBg#õgЂ$/(N͑yi[d †UsbNmUQdEzl 1M&&ȍ"4b@M)sƊ'&8e>՟#+ó=8AeD8_ICɅhKG.+Ybg+&=m,`2 h;D~h+kss +9%jK7"z d12c &]tFxd ^dżYd{ΖQ/<*z0ډG]DÊ{L-]hp*κ!Rud#*^~MDHBTx=eKS>4UQ]vnw/Jq~.M}Z-xB(Xe`"zx]f=@o.c˨9qw /n1tab,[Hx%\/BCUuw Vb nؖ> ¼3]~6oD{* Bɴ BZT;>0Dl+vk1L)A6U$tuzuEʹq9ցm>R`8vq}~nXC 1D|:̢B5E~>{l̽wkWAݷɓV7aIU/~#} I/ CԄ#āЖQ뜭3P:Q` QI,C|尻=y׭؎rd莝u&"T4PN%Fr-n EȬ/li VnrӰ&fayl^RnVAQ VMB9.`amhpz~@IúC~& 4bP"=Mi {𗭪+koDL{ϸšnR!Ud wZ?ˎ#ӦI%Օ~PؚOJ,?IQl̕l<(a $lX{wO.҅Uü,kk %6d3QkE,wB [iU.H+X_iUj~٨zW֠%~C=AlbgKa:S"m r\l^ׅWp@&JP{x]D*1=wcWt_o"frM 'lWEþ`~l/x;l\P~3*rV'ƞ$d.AFvy۴Fέ2hY W*jh*Z^'n&+"#[Q.n۵qme{P0D˙ccFΖRkǁ-o@2 |Y4RfǕA'O {Dgfg?P3angm% KeE|JF3ɾd ep{Nz=ˇO=[j'ͽɽY-h0~؋{S7PͤV^לʻs6bb??hшoL(Z|JCŒzG2i{Q4r*,i~b~( Jzh. 6NJ9\ߦ;f |5#fv,yc}Ǭ53?R Z%:hWGOOu_&{?MciM [*Yc#5@ة!"+$\gŁHUԢ3I}r&;lwSg8Ge9>I$f8Ŀ0q֟*3T`gu+-#49UM ߅ӪS"x򆸠Ge%!4z%phyh[UgBp@,q׫l={}"}{9]ܞ/%s/}IL#L䏟d="NyE zMFUD5'j @Ė3.zۼqY!Y@`j"@pr B )[0YiHR],L*ٕ =i_j %D ,>g!ep9,.:%ģӃIӅ -O#7#fsb[Hi!LNrP/yp,%OdK@B؁W%11z=; =<4@shrv~eV@|p~ZDNP)\HN;VFtm/iÕ}lqdmbUO48@́" O=a,kӆt{[ꌟ8npGd}jc,I\yMɻQWU~%~^*k?OyqViyYIb}I~*zї"z!{) V# >9cix.cm`^wm)gcƸuYNG>pKB{LL9B N(t%uz#~4dq5w.U;  hm#9r&Rր &_V8 ǰ5efue#l UjNOEvhnnJ@bdJY,d63E:ry(A z.kV@,kl-ɷ6d *ng6m/3{1y u;c ;;rQӘbؕ;"fE!*"_& u:Ldaz)W/]Jzy!;9_&~6x?R?񟸙r#Gq ;ZѨ\P }ްFo;ZTٻ:/u累g̘VKB1hؠW^DLL ĕH8:-)Y)C^/iy& U7 P>UH>0%zoOބ> ,s0e8ӷ.ّ#7A787]{3tK kֺʼL8ǒAA5*I),r:Q$1vt]"=:!-S[Jf"\d)G7NvJnB)PB#!$CeK cawQ]<-s8(%npKmjb]vaPXl4̉`Ս] \BsܡK6&b縭G*:2K)`NQҗ.VW \ƘuMlpE>? o+%U:3~ME(>I\5!/lа3P=5jJa O 'uܺޘVGġ)cђvsɺ5qW=/E+W$n`T,a}Oy1e<WT~m"67eV*RIH"rr+ݮӓexZ@\4тM{!\ֱU78tW\,@E bkؔfù UlM5=J>-H;`*QŗEc8vDžn^Ë)׌D|F %r elOKx|6+L`0z$NЇ!=ϋQ0 #|\hrqR2â$DV?;׈h3]=hq3leQZ J4 r8 8Dj0 29[: m w^T/+g3sإWy0?mK)'uꂦ|̉3['GVYGPEInRq4uC)QHRb1I M`kϬ>@}Av7]̧Ig+tҡ |։6 ϕ遥&p2g@C1V:wA\,]k^BahT֣Xeh*@S `a7$T'w;np{0q삸Ebp$d>/WB-6"H=Sa4?om)'}@YxmtIl~E p6>'(PW FL\:ibqY 7?X6'nU !n`Z+"hV Bu J(駓kKtUFgg--G!R4;0s`:f(xb?Ƚ*EXV1 "l+ ,DגXggM o=&Z#cd}ܻ I\cԶc`U, *#t-(|o8n$ܪ g5N׺C0u#%'c?@3Yg+O^>@zuĘ_#1,὇\+cutOQwЌADNjQx˜l ˜?H8 qr#CeqG7cf>x뒆ew-%߀K(2e4I#ٓQ WE|JgWɃl" f4],T$|/#bk?*I= |_Lv\omr-Qx0@sB_ v6`E=^~΂FI DR ~?y-t Efj DrL_-K.bKPgHgpg 9a_WcYjZ9_1.1z&ӕ8ZdEP^3,Qblp)wuombhUMRORg^c?v܎!_XteTx=DDk7-O-v1Pw^yF}Zd"L~ԜOfFʶ*$+cmY{yU(t<TkF]p ٜeX*[t, pg- =yY,Vrĥ묿 rz#ȔB6NuOT0Oٹôkj!Հ'MGߍXn0ib@b# {ܮw%E^Lռ]=]דΩ7=mGe3:XcucTO!g(~ԗ c#>Eoud勞(#A=Lτ$}x9[r =fݬ_!ar ȘU75ĀO p$ X[rXg S2җ%wv*kXD9%%|YMrKAG_|Bi.m*CLJpy.Xص$ O~IءwL=:~gd{;WMK$I]m^N҂3 z#E#$TFʱq ƘxIOK:9oDHr1 (0hr2N~)Z}SE/viM h)سRnh']È s%SÇٛ,Ҡg!hXro6 G nQW; y;3unɠO[ЙslTx;6"c۝ohnFjã 1bq)`ç'k-{?;Zp PQv4}&} -zNXKfjs v=DSP2ƆvK-a0ku%_@]4zkԡU?|g$Jh*Mi Ph178oezvYX!ph"3^1~p z3!Mw $|}t: C22D7zѐZjykxOћ-4 lkR({bBXf.I  9C "+ǿCr;?CqyEn7 GO"AhC X|Q3 MLj^lC Heճ.xv2躑|6DVafѢqnY -PS{qW{GxnЯѺ{ur3 g&gڰp ro4I / `C }wY̩3#7Cy̕$Y12zЛ"z^l=:=E\:|ǻVy42?Z >)KOmT{0.>-z4eVkGwfV?Hp)p}Ak]Hg]%F 5tα()ܗ? ;k0>?Z> =kP)o@s0, Z/84n[$8ňe{J$rw^ ۜ{>:\vd\^ Bd2ǻ*O؂^`j*[mz? :K^?K+S⾪%]BУtCG+V6bvNɤ==*|bOJ"<`UA,ŗ=.lw gDo|v$tESޭt4nU|[YG)tr}(3qk􏇄l,.DMʨrcO N@C+'M# ը߭m5#u=I SZ=Dz!5,:'Jls,UM-Kjh>ܡhKِ5Ym+GDLR6wXT6Zqu40] LP˴5j.:[~+G->gU5('32)噼2a>."`[!HC!W`4Ӷv0?>:4)xd3N)f1PYdФXE/ uϴSA N> 7G&' UT:LK}ke1bpl^(_1OxH] A V#g-,NiFf Y# E5b)ϊ F%1k;,vƾ,/XZP2P*|%`*wVb=@ 4jN#yCt.hʴ\ףͽ o^)d(bYuڹJ𸴹~Okg>%DwF+Qv?X68m%w/X@98c{% ym620/WzF0^`n6!Oc μ?*TR[uIb8f;x]fg}^9ihMۉU@`|R5aZvE$ϟT9>KjK6ݝZߔ94!!A%uQDr@'#%˾>$!C$* wSniZʟVA$ֲl 2YxeZ}:ܶ.q0Y0YRBZ*5;ɽ̟5 -\_v UJGccy)L vߔ}Ћ@9br8s(؊=a: ZsNnE;F] vKj;9k捿wvi[hRp&IbhӖmz ˆI;}C]ǡ5~"TjqJ෪v|q'H %/e*2)97%qAX D,DΞw]zϊvG-Z{4Ψjg{.0R GbMۯGv:A1t`%`r='qln "ҩS, ҏ1t"4Z6X`I2&y߽Ą;8KP) Ud$k!PK5Fc[T1C*9pꙣo1ǡ ♍XEQɩpG.Fѵ8(i R l{2uJ>&šK712K$¥ =tek\DAFuWO8W%B/Fm5,((zO(wvɥhvRlRVRPsw<]o {cYϰA=.?~idR?ւ3Je((L>;{PriӸ=Ďj,y5=B|)%t *Uj p16CH7v Ltw s(X6YyD:mx7z[Р_%׃lEO=# zg,T50)_5s65:Cd6~sWR(!W&-M2'mG#>+^U֌]6nCN'G\:n?U }l2\3xvblK(,~]Ju$ދ)Cc}@\f r ^1Ww(FGԤxķԓxcϸ夑>?pT%+e~³"tpU!ހP2agْ-TZOsg757Xcy={}].b y4pSb3%[^@8 Elx6[lsSP[&+ -VOUK]}&LJ3HAXia:(Oߡ`qo* uz pJVD!dI|Cn($=)x=yT(JԔ]ڍ'߿O |'!rNCXJIWGKߣ.DR?S֒fzßMy^V~9>%z" W yzPϣ J1MC/ >msQ7Fexo. Yˊyo˔7]9:SKis%9]H?)B@73%O8*EbDR[5|V*"<؆$ļtD%U ;g& f}>Dg~{䙢Sq+qpO j,[m{MmG8ɽH:~[-MgFbQmqt'bE! xcC 􏮝<+;Aj iAj5/&/'_\>E(qFԹRUP2?SwHV|֓YSUSBً[~,K -7?E'Mz(&;D6[ANzPd#֋]konj Pʜ{IQjh8%<;SbR"bhЈNu[?DϞlbEѝ2yܖd0@u4nn3M8MP'$zż#$67ssHR fw1ܔqpc,~bXﾐMR_+,glJmLsI=*փR3Z1_Ϋ(%IVܭ.ZijcM?SlQar@[\` eQ"+M8v >no=lcB^:[q"謏0W,l(gIg.بrʓGyvA`!CO`kZSsV n E2ՑR}?eLx]g]uHn-mQ/RbəeQT&qk$^~ϲӯ_L&;xp/drsvek ae&d+-';Wv=}},ZYł E^ ݳ2opx!)ʤWu!!MȥwpSPkǖGaK jBXZ5x=95 o9߃nxpJ +()ĖʃIaRnCN ;CKyA^]!^׊8On똸׺ FmÓi+0&)e56[ou>YՋ/*&&wPeEӿs :RX[7I@#f) \j*ZFNu[ |\Z9]*>jPEn,g%*>O-6a̘H"j0)4 iaMJ :˾CT2:`Co5M>gDH>B!]*7Ƀ'Tn0X ܁|t{DeE="~I{& S%qW#rЄ>W._:6"xs֠۱&EjQ4 h7e4Qz?+O@bB\&o עAm'Var3d" ;lJlZnVYaa 0q PD%}̺KwH.:ܵüC0/!YRjgl l\%RpN|HX_rTƺdj ˕`oe=*|@LÐC8| 8]I 3I2x/Np*`,pmFGN~X2:Qw q4;^!!sWgι9[U^iqxy{iEEHmP`;ޓ(o/[R*peZnT.ޕ^"YgXqW9;Kmթ̎`]T2 yLv[iͶľ,(&lΘ>G@s}gEfUY M8m."{MTݦ#9 z OLR_QڜQa˽B[%,8BļV`PJOpy8J=tG-| Aӓ Dk_T;+2lq_lGKR6V^Qp£'d)^)=0tVOU`^x{cQ`ܜC, 1wv^HubE+XķV.B2T +3)1n@ZޝL; Og~_Icѕ?ǝʒϮ|t"i햀Ĩo:B&9Z$&o*Z] <8a1Da҂tR8T1/+| ~>T'IUW˞O-GϮxOcymV ӆ^6 I7Ikٕ+Ȝ6?<; f? }!}ёW+GOxk}sdr0vF,;00o5؉I: f+$u ԯ>B-5v b7Me:b5=<}D rH1I'9Yo#Dl *u qyGGa^yW;kY bqB;Q};CJPN| wU(6]r 1̅h5jyf rVʫf";ϚG5:" dUrHK!;(eޕq[vo`slL-(N ܀{m;oW|>yzMT" e[/B#g5In.LLz NO-mGzshmUPr&oD?S.m&ξ V~)D94bz"V7B„M뇁OO iA^QM=|$i}x_R}˘Z8V$p_еȟ G-Z'C .}^MS~iÂom+^_ʑqh c*g~P3 QYsЀζ̘B@u:rL "CO%Zp?ltX"2ouPKRTb2x.:VN9qTy`(4(wAE롘lۛS;<쵹(*2.GyF4T^FB +B9Zof؋ߢ;䅗iV<['̈́wj@E6kan儁-kkw\8[M/P]h*Bq-gUMiС1=noDZ:]~[]SeNaWGVszG*c PfnƵx>i[% hL|?[d.?kesB'N.O!NYF0r d*'TzPR'ЭK| 9}(-IAh:DZV{̐g,4>;c=妍aNGD̵KLSi^<~F]IU/~T $OHvp}DžR\qb %dl)wN̤)r(b CF. hC\?g,Z㮰y(ʮVYb8>$"کqཱྀ}9?#F,h!*AK˫:U=hRUN.ٻ&S 3rd9t"%x2tbe!mbX;uWO,8^Jy]b0N)`Wr=c%_O~#f$HpOT5p r^2ю|jܦ 9k] rOsK%PcYs}~g"|kMW C;[NOm^nJzxsE]dKT.!vy"YKB4&ɨJ8r{gɝo2/ E<5"6b͎ęjKs962c!D/yb/2 0rJ NZM`РmMU/R9~">I8a${bէ!?[jdJ+A;QðeУQT5ޅD2D?$BVF]{#63|L&nUoWрIk PvTR9XdWgGk2fubV%p^nC{^bb[r|?'7oLc/wfÌX=C'Y0)sX80ᰠtj#^ PDp7ǘ+_:\>'9&j}Bh-=\sDM$L_aYGD+6Qj/%48'^66^f֐P {NI>r3Ç'wH Z4xg\SAhUr< CwPXA+P*.MeOLɊ-~ϝ=xpxNwzi8Ѭ-zoogd>z_=nqIS/Kl7f<59Io;U/,|/qJEF}mGqZe9Lb5†ISK0#Ec@Ph7 MSk՘-ˈI/sG5-DsN}65,cDiݗPAOcbϢs6t,)w4񾈒^&2.:'07j,k!ho"0UCOlbvSkEO-pb1eZA<ٞ& dr"Vo5l98l A]F}Ftʰ)GJd(gx ERLTMM_\}z+J0so(OPVo/ůe1~u._)Stg q5&|k^(Sc7dO(W}ݣl *G8D+"47E@`>ʝy6|W |t@jYz!/Pllc-Y=P * D1r7xw,5 .rjSFn9;QA&K5U~Jɋ.̇tdcpcĴ qȌD9G-2.1d,bD3RU3U!cJql.*Zֶ Bv(7`U@쓴62)#E:3psYԏ4iJ eDbH5[O/7AizjwH*6Y\3vՉ 8 29aЍ}HͣբCEJWl^\?*m5V/\%xS]c@/ M3*Z!3˞{mYRuͤ2]E! n6Np H^/n>ZTKO\tBc!(Ub&<LLBHٍed"Vg{ș&p3B]a@G[-E1tkRv]'ߴ1½s_,-\Z,gî*PJbyЊA;I)9Kd=D[6V nyc7+1D{~N5Qz{,w4+h(K"c7f"\-!S- ͷKuRX"%dA46yu7V4*y/z +Ľׅ"-I>Bb$\ |~-d_=v$o;\O׼xgϱȯ&[ZD"2cjq By[U<[Gޝ0&f]Ћ6հNcls9gSKcy cLf_8ɋE{LA9ŀҎ/IѽJ#9b`NP\$r^4ыL<Вn;^ƧB8fRUdfe-~=O0 o.BZꡤhXa躿Ug O@-1,08a Q'>/. q/sϋg bйPqnA?~˰E6 VJC@cƕ8y!D]'+j6,]Ks\Edpy-12J5-sqX  0FFh`+# l:`tV]\V `sE۲~4^"SD=AEpu^48{65Yաxe|6{at(+"8}iups)]DzRzʫbЍjIŅ$üSެ> UD?ӎ2t/I/$ZG5ԏ.>N-^V`ݙ q|?K3NB¡ s MGeN+.q"(抭- \/51.'9}[J j aW&tg?J3X1 c;4'Dkx#Rz!*o0bN#F{F(bV1-TcU G6=C@H]rc+_Ǻ[ZA_uOMVR" T v]V䫏?sUSN/v^FnX!E #vS{C賾*ekHTS.q*;(kU h1'}':&2O^S6!+S8*;@o;jQUԋ퍣!}lfV2֬8FZ_u7  S^ST5x}tx謟)C` *dLYhS*N&x*I5")%c B *Nng|mM5PHap!wDi4e\xh߷1YQWcJ-ekL:>+Dp:!( RfYUCK|Re&- Z]@dIWzTP{Vo&R4e~sUj|hH`]7xFi<a sGxc}۰p6Y*(0|F~ %!ˑ6)`\n~vnYwLqDu0/?= saxyPBBR0e} \^hs鴒-W:ԨGA%ц۠A'N6I r~'ʫKj)P P6kMm[ì8{+lO_mHV Uv!$fOšө쥣{.U }%xp- [CKaigrpl#?val۠-! @Mhmp݌Bڀ? J֙r/Xh |vGx4D|g _A(>&>2 Ͷyt}O7D <tNݟ)k){kA'\vLS1;dD l+ԏ[[qPӈ'"c^ Aj#QjkFXΡY2zB M1귔Y/S䈦9PD*a@R9pH%`\MSb[bՒJAĎR#(BPlzb=0AGyj`|ַ1i|-zH\d"!Jh\`X%8#W÷eEVXy{ !6$x`BN y9uy?&k3ēUJzO|سLڊ$W$ jrG!~`L|5&G^xz#Ҽی NX~GZPO|0蛘\jkQ!ؿf<U"39!*7Ud(`vJP-lMDMsCTo)}&&Is斥݁hӢu0kJ@kF2uD-թћ욪n{/m-ii>f)`  P@Pτ~!ЅMuI!b.4y=\Uꖇzf\A4.bqYӗjb k.cl]n~ xVF `ķop i%BJTd)<~38F Ź0D.ey"s@t =52 F}67pJؐBGUR }]A^Z rPpc{cIoAV~|lJV8ݪ{ܲL,~+a@CYowQTYWd<|G J$w'6"ځ g4Zfߒ]^ V'[5PiLtS1C!\S YL Ñ6wGj5r"%=4O$miQʘKsDq)yzN/cDl01d;6:P<{)C?:2U,T(wμ٨@^UVM9`Y ®}HotKdh0k* %#Sk&ʥMv6_Y3gJ^]'~sg}tQ#ƋxfEs~$tjZag)8S '-$k{$!o>?ւ1C~`F(EKnhk'fR&w`pCXxyЃ{Fш;Jr]ƴ9wE^J`i.T>ߊ㵣}hɭ3ELkGucZ "tP?Zmgvg$|nJ@.w{1{cX('Њ-zstj7:46v4Lb!6BEšdD՗9.E?Ņ `3/dg W- &ҕ&P?{hL$1.wK? UIט[Icr\ǖ!pTc.e(=ʄ#,:' |f\HF TϽ+2.)qS&A A,2Zΰ5s݁GONb,̺1=2W3a!G$㿩Φ{o:A(53Cx^&P7 /5u]6)Qbn" \&NohSd -P:RVŔ7.?Cܹ+z^ѿt-gKlCo)Ga,,(~WwXNy7k@5dB㯆8f9m'Aîit`OV~'?{K3B̗=uGdmqq%$V!2([:4(`Y1F%'4@F%~~8sꗲnUgm1_} %қ^ȕ1-T{"Hr.:oYM~=R=դB@BcTlPd'B.X΄v'R@6'2`~^ 7oE.SH3} J#@RiF7T*w OL \B' Esû9G:.5΁!1̀2鷔記]$4چ?D$0 ߶u+eZE&>R쾽Hrk)*NWSJe֍mZMI-Q=THRI Z,1|M)o l}me81LJU{lV1PFCiSeg% $t3mVd(l' -L[AZT1d:DŋwkqRCJB?%}ͭe-COQ,M[Y/M)S~ƥ[Je}PdJC< W(W)85~ Zet\Lx%d[Dp|?;RØ8 e7]pc&z1XqEwjf(#[1e#@=Ja]O,fJtP$O:Cjn'̰rͫ0ggfMo[i[ul@],UyC_հS"E䇦$ ~0tf@U̗Y4d;OEwo=g!c>TPL ,rrw#&D&g.2Ngj,fYL*|y9%~14*1Tv:OOu"[8GYs?|!&O*1g..fipWt{&1W);)%_/J* zpƺ 8WEL rf[k\~=N[;6kb!+4rOvT7Eg{22W3{Dͬi"T>yрoIZnxл >oH: Сǒ.ƿƅSԵzm>bɑEܙKj[}C J}n/B>cLG\>^\kU#p"cy7yM)}Q}Lwn4s똆ݯg6"B!l8ħҽ^Jze@h|'8.1%57nqƘaL1J~;νa[)@}H{"kp yLbEJ Y% R$48o@MԵ^Jءpv4QF ~Hho,E$%׶U%䒵86k~%CFZAрȭ6i&!phgB:׏#ed EKX^yŃ)䴧lj@M؆NiC/##A;M[3$!9\' w%G]UӞ䂁G}q=Ɗ-<Cd0+K^ ^njΏH6VAQ6lUOߔB^M-yˆf`_cEk 2ߛ[-Bk.h`ʦ6֭n#k/xdjg_IJH.+E1`FQ "_]ۤu-ȅŜI'L7иP0,DV:'r쵕;K2d;`_N:=Q?8ܝ|>gl \:O8*hP,ⵒLb#d^9vp.Ut&N2~HM4GO {*mVq mFK0ĜfL<>BԹP &Ti@5rcQqPT1Y"֖ݬ;NvPi!P)Y[QU=${~y !E0?Geb~mTaP*5&F-^=7'1r&0pJ+)bE a)%.wwvHQ'E%hcd8Wְ 07?~+IOAq4_WrFf/|3>O'aiՇ`9iWD,/l|{ u܉bM.@:m&p:} ;,$ƳNJڥj_jlDx/EGU.r:_D KBXQaѽ`u?Jr̤Ș$3W4"v /ҝj gb;%VPyWaxbk_bhiڊ35]dwxЫhn \ h'<|Ka >y-(Vq+6AG5hSUaYs@n:%%xՠmrcݢg+KU3Gk;NnxP,Ago)CE[-fzu wݼTϣ &no}  K++;-=65ףl#nTb!ɿ޸]Hߑ}/ާ|8(`NC*P\9S=D ̸:geG);눓+ϋE2oAvL;^XiM]=|D0>MJqv/ [J޿;1]m]C;@&+߳44R&T^{Z:?/$2bqo,t*º`""c1vW/D BtFQ. I`NEE V - pt;DTRoQb\~bhnE [Ml wCG~B @2/҉'4T`s3SE>6&ś"Nz)~3!*N3d fU)gqe/q 7? 7a )\009#ݍ`=~烼~L~ T5;D32es'oGWFT 2"D? '2.ꏥ`˦:iWRcI~. OUSθ]SpC=D([T,~/wYH&_!_Biqu@ ZWeK*{Ga<@|jOlCb_;/`X<:-R2wμҹ6l=D0#A35nNSEnmna)bcjBaK?eģe4b<#3)K_3: IS"Q(=+'qj =mȐj#w.Upe`ksmr[-7h["P-<q!B~{仚)%, 1dj[6 H(PwuAff1HT{7>ȹKr1_2j jdwLUј:uϱD2Nϖm0*BPb0u2Af_<"M`ۘwA[<#h@pWNu!?!nm5zX 2PHX=QzR-/!}#Nu/qZ7/ ؍‘TJAv Z_Km O?l' 7S.LP/suE KgS:P? _^* #H89r2[l=?:{Ggp 0=ݽ'WC>EY~7fG1 mWǍKĴ.M+'i?-$? n#Q|j}|Ժ?6+OݮP AWv’EҖ6!zfڳ&M%L0_[yӤw( UV̺Lզvh[j>o~,D{\6Щ[^?BXnM5H!jE\ (APq8H%ۯpẢS,ÐB "}5ǯ-&x0&#vX5!břvE΁e/s ^;z܉X=w'/7l{q؄_C*^R xZNK*vɂ~9e8JΖ{Xk,@Nipץ݋Y5=ŹwGXPV觉y ʚ2*B]7h^/cmmT6hqXӀzB=2\r;bV8N,t$(*6A{csI58% Oghɕ%V!qצICDp*}o5AߒL*0!^REQS,]3-5 ;ȝͫc5@,F\l<]w&Ct:81 -wk;H;YÐOfHI@./e%-Z3\VvW8݁ty+%0A!V^NEIyŇ̄`@^d5P.Y bHvMJ줥RPSXDԜ"r\%〮UApL6-7vUL]{)-)`Yt)}lrfiu0v MPwt%5k3OrAV9{$5x{,OkG&Z |$"(=u@/?Jmau56,pβD2œڬq#,}Nhkh7I|HykTg_#Ոx;}x!h4M0׀pY-D(]}>_a '.2' {|{ .I|8H}*{.z^"+b|$BDtQc^Oݝ3InD."f Ue@C."?ú7:>m;a: 1w Y[3 Ƙ cZM&#_hKU߽% *&v$ZQf ,J3c횗!"HHWqa.?ǣhB܈/8~^] WpG0&zvARS.jSap*yJ4N"@TUfp5t![Q  x5΋kmc/kA ": glވz$9b-ƿ2[8P\L?1l?9$lC _#k2!!~=\G cD~lg}WզL)4(xEV:}Ś'T#|Rc''I׍KZ҈5ٙVj VqB- ᷯ UNz^[Q?OMu$_9v;pQ6cߌˡ=n 8UK*5U|x`(<>_$J:, X\ '.ҭ{1r4qCnn[`uD^o۞@[ȑR#c}[T{ٶee-< 3 8"k0d>Q1[)2wV&X1 ((,N2LAN_W wd=?ʺV5/MYN QLZ1 ?r)TmBMӳ'\-j>EGb"p^\AOюmW6'nX+ j@J4lZ;iJד1.q S|n bP+"zp2WKjl۠kD&<}fQJנ.k -:jADOaBO cӏ/:vW.޼.W,NgAME`]b\ho,KP{I0F ʗh N`Z)0|+Um0#z^o*o ח.)_)KyY6MGe>]j،g|<,a~v<5|Zk Y07X>;χS>c5֌A3v!-(6I ˌ 172v~z4niUC VK|jfJΏɺ.G/Gk<@l`̲2f e|#G:x#~hZ]Ǐ(U9f0o%ATWO@.KK>|HòƄqwmg #Պ_]v vhV1,O$Z|I|>R"snTx7LaΘYo!S*e5a `zG>*NIE'F^!dI` X9P[.B3xLF.27t.Q]kƓ,4e9=Va.9yࡪuR"ySek`9[s66R {13jd*!+1KRYaM6Do|sc ώK ͈ R@CXk;4_l 2J?\ &]$"CW4GDsw Q搚)3is2q$pM-Leêo,ţ|glZ뀛7J t9bGc+| mwy 4sҕUz!-W.R5g$vS;NH%yXq[M(ԸA8>خ*BJ=HK\&ro 3?A_\E8iX D_b [aܠOE7+ۄ;jA?0*g"Uxi}tGݥ>re Nv0hy;Y9/UNx9-Gfm1FiL\yTZ.4 QP BYܟ\8JIj0\g\Tt%?CbQlY_#k"&[s~}`Nď2'g8cgE9dk"BiHE}֚z=f̽⚎!u=LM/f?Rn/ɋC(P_%bV[DCs#DQsP.EG9&t_E]t;wӊ[HT{[ÝO칐[e!_s~(I8lЛUo(R!xL%]8AEߟR14ZK]AF*1nO>r(/x@BR ebG\ xPd:>1vh5j5ƣ:J471a 9%]0YC@&,A)RW`^{J0%&5?׆+{sHc EATZw4˻)8N*  6.垒z  QWSTE0^e.H*}DEC 0_$wFY.rHwI7;؍egO37s8+ חJ㢻C:%dƢzXkM[2'O^]#f1aʔ.g1zi'V} Ry`9=d!2,Q6̭+;J4&o>Ӎy'XnXNnZ1W4*3[Eե*t7h! SW c!\RxY Qbû7̠ ^3Y7:(*a#SO[FboOLj3W(5+:T( Q[GTC,gyۮډ3+K}܃zI!mvR"?wC:6P˷E~}}+߿WSIm܁i(2FKndP(6ޝdhn ȪK3cގ'Q\[=LI*rS9, Du%pnyadhSdW;5-/EKh33qqԠC;9=֪ckܘE1e*uݶ5}|닯bGP2?K auehAyvay ##w ʑ+4MG Bl *cfCٌujl-P =%iϐ2tSqڮpG !';2ԮDR$-kJAh2P~r?۟*m b۶Ǽp# W1@W9~(rtm?#GK|-0 xm%q/)]D ?I͐ŀ#/;)v;Y+t\S_p2a }+'ǫ )Qɗ1z2_-uYsP5ǃ+P~ɗ`_-O!yK?Vȼ_Aycr -g ,OZdFUȽq=Qss|4DKtP1٣P?N~wxf!Sk%LFdï&܆lw~JwR.Ck;F~P9GD0d4vXTRX@$lqI׭5R1^:՛ť5s%::'G؋rbVbP`xAN`UlT+jh'1HqɋV}&+;YȒ:?nS!!fKrfYx *ӎdAQF1-Ycߵu%;u@s?TSȸ{<tHqI͞rZq)10$ywIk4T9TkPUU;IeuZ~ƟT1mDR="áH>j,J1UBqS-9iWHD3]݋3n2޵ ի`4iiIQdSadN#\"tm رkgdCc h`ᩧ~La@/=QO⮍:[_XҕPU#[5EJIӭ~{ +۟8 u)Ɖ3 [&Z e:ԁ@xzm?9&ʟu~Y*7WfAٓXwb]E~` ݎPyY%RVе[jj2.׵-{Ӹgڳ' &:'$3m7&LÎq6U+.@ܤ`,[q6`n̟4?3(3=vMw\_̊d\$0TgwTkS.B@? 1FRQ8i3lU΃-BI(&ɱz(}Ӂ[ uU?`bA7SaWV/ݾNi ֭'\ZHF[zleݍwu^oawtjp(Ғ4uI640zf[AWn0$哹%JӖ it"lN㹊U2WޫvB8'$d8"LnzM߾)T*l|w*eF@ߊl"ZZuCˁ78+[fv5݅b_ [_]Ub =W;{WQ'Z9K?ߝn[gV"%[Lg[= %u #ɳ|fhvjOZgpaswq㡥Cq1hY1,W-rDZH1rOE _l><,b:I#p&:"ԗ`d-y5ﺜbW,I8VyVmyߝ;U G":iqN ޻"V$Zv%1EiCmAyϨLBI @T:Lzkw%d8w] ≅KaD儼+މᘴBϐ ]RDoKJ1Um1^nKIvl'"Gb_xa:!*ARS%a s]IDZ6`Wg1UƅCu[L ᶛ`/ɼGdÒjc$M?c$A&i)2B~-NxTy(G Džd@Wr5$}>KV/x09.W:Cȕ FBv`w%m)C~Y4D`LO\W:[KCKNמ  3sR(658٬;ܘ'"dU#~d= 4Ua Q3a6]|o+(E;:G$|@^we( (Ɗd=ʜq1^mR'x@#5%e=;#Gkq]108g,3,bjIxs+Uwyo)Ͷ$D *Hy<\ *@Ԃ tr/"^C˱3-'>%՞jt a՗G+UIAz*&bo˘Jy]L7: 4h 8k4z VnE eGs'vl3,jcH&?&_Y&EwzQTI<tkIP>WC-jtD6KFUWr#G <{T.͜_~"dp#7 =ir@qRKj,Zɲ`EY:+I̢{sj/^fxtpK"dPXˈ377Dd9XYzWC4t?`#7 JOs'+&kJ+Q,6\›Cͯ }k9O?F @XE8ueXUK7Хjc:H: L]KԮ/"ù]4ԇڬn` ri{Z@FoUwDv1#†- Q+.fg~dh,>F<2W6R5wHŤ[eV,cH&Kf{s Y=/@wqq -Q؋>JU?yrHt\F;B y]=ich$P>O ;J y7aƓl D(a;7uLl)#AaU?hABUچ7Wail#HJ&B=+ۺR$r&Q`1r]^&uOvi=N2Aٌ,cejpV_^>P=;}nBb znکe1ʍQXN"ɰE͝u6V0F+M]r~Y%jgO)+[4Bm\D\{z-?ŷ,Fo'=j4%oh?Њ1ZQ78gW`=Ձ wiW֗`ZOh)Då?{_h|C)T.uP}RJ@7E_$$Lr'ZģEP;}gw%λr L&?'fLםLݙ'͕ğg LDg#Xt)PX ~5idN)ˆSE9[)o۸N e5 +[$B8r |;wkT 3&Vٽ5A/2?SuNUK8g>Zwנ`Fc9G)N{ƳqKT )-Ve$l/Iyf{E1 3$,Q녧Fu=L;OdݡbrDK$ rZLZ\SBc""]K }T?ȧĉ u }5o#\o7J&us[8>JBK@6"pXRvua.oM+I6͂& D~c Ml{bӟK$FYwVFqT[cAVpT܀M ζJnP&ԀZc)Z'bsv'isVw,/^rC#(#XPSV RE*"j'ZyS@ZTr21ySN$Ù u)'jSO _#cv&8i D R};s|3iݹɩԦ>-£E0ۄ E͖13:tB2d:JUv'z=I zY yxv$lN`TWH{sU':VPz ^:pd+5x^"Q1xV›XZ1Nag場1^̪Yy7@(1<5xNH pexE^y<)} I_=` wad"d=5"/JB2&wo]6zUiT{9]TKP}VIڀu$w7f!ՄB GM<cA؄r18 W%TVe_,#/.}Z-bM7x7]Z1$<$җnP5H5!zNT]230o:^,1v ˶ՅKz<ib`qnءjb~ė^tkViHk͝moB[ʞǥZU왉O|S*r<y\.7x֚ge,Fm yY|oo*؄ U~Bxg/;X&T ,$kM^9cv&trfu%0{(MVPrm{I}R33 tm셼Vdl;22cg` s\Բ˨Xp}݇W6qb 3CwyZ?+c+Чd"/yBtbK٤v܆(1tF%yL-/>UϽ.Ypv\,S.3ʧ[ FA1~OƢL@gfQ|ۃWrAnMj'TTCQ݁R ee\1!(ڢtIs6!>F傽\! @Di?;ϣ-h' !t͸!I)*$5rBۡ3.1":IoGnsԳ曈=Ug+g11z`v[5|g6* غp8e8%o-HˈbbGK׌_j^3 xhR(T|s)T A٩L Vt,1dbg`-MM,7Q 5EE0N`S}>$5}q5<&E9"@uUvm\.`\*.yN¸C\dU;1JV\>Rd?WWE'Sz7Lџ p硺BSW/p-x4,标A/?9` ,-LE}aHGɐFpM~!>~/q6,ͭ(TIBS j/ZjqI]6k-"ڔÑ8d6mSe*ڧ{Ry*nppӞ?rKT=N<|*OyP'0vMh0S 1x?q8ܧWQai ʆ-:wR@c#bÑ7yqIJhyF q`,OC~e˼/wB8QOT;4oi`wheXB#ʳ.T,uWsAbk!Q?`xNQ[PkZ°_e#v;A+.F ʟ-"^٪1`E&B0mϞjz5"K*M)Ÿފ'.GN]D''.ƠkiP8Olp,,QT#eƚڋ-  H7mwI3.6;J /ȏ,`% )5^C;LGf=\vY R 32 &>"2SNg ?*v pjz`m׆hK@ܬ*Koo 1ə(`} V un-v-noy34¨]gLhai38Fk%;N@ t #BxT?*C]*nfdb~DQ~+~Iwϧu!82ܤ| D+ɆJ~oxEo!jpɢٚ[RL\!7BHv-[2LmK 㼔ѣ~l9 T6 |sF;߹g|ǖA[QA\G>֔ T` dnIy#(ED:vX@a?Ӓ˿"~1 ;r> qfݬnOdҦy_qx|j&Bs܁gY/*+aO$l )s!T`v2..`'p/H!lox(NFZp19n /C7aދT@5[` dumq258?eԋ[P(>Vjf.t6Mtāj@ƈB,M!JG+} |V}ֺu 4HTIږ ;#Eˣ3忠=ܘ o2q "`?))۪cWcjj$q.Wq>#14K i@ڶSWi.gQowvs-o֭Y+E1׭JoO \8.o㌃D\eOڏރcn1{7Wo>?=h*o=Eãd`גS -sjZaкE-LZpGW'RZ굨dk&'(s&C '@^Pg7G[izZ%ï PpPFs0΋Lְ2bV/+gaJe&-{ý͆) ҥ#5^AL^|zPQ*{#zH ͖LDQ UUf,lF8=Emx1?,gg${nsc#Z"67-g,8G4FD|X[&&kzg5st]ҧfj3=g8OH`^usfDl'aЪNEB7l`lxt32sOHrޠyw+P"2kBml{DD2/F]*dR`mQ)k?:>F1~'F\fT K//Z5f_ZUwGSdC`2'_ГsԮҎGNՑ@9'# 7`؆iaͱ\So|$To *y k+w>ӽpm,Lj9?eÌRDijL2eBDaٱmQBotIu@M)d=D UuV!Ľ< i+vpg|-6AnypBty P@ $nl8@`q)Ӛ3Z 9W1YuzM"S6.]9zk_awo}JDӯ nYU{lmwMw> ZStN&4qlм]e#nݻ$ vJiF٪i:ݦٌeP*Iݝt&8CV,ޢxѰѲ] U`Z2܆ׂBz FCCE N5li_Hc F++%Ի'`ΗT2/UFB*- }MT 빻1ӱ[n_G Gk-^x=3PԄO^s)fq(8CMY9|a E [[SS\ț6;E+M6 )k<)B6^~L_fr"?-'ߚJ^h&F1"MZD;w:҃ӫR ܷІ2oQ̱Ҭ:䮇~~8]mzs=ݟGuԞ.SbD *IտTL/=ej,k #0޵3} %maowLM`thp-T1]4씤ś+JT^ .Ș$55D32 4D:(kHat'C>O30J Ћy C&{ ?' Q1;z.R? I'KׅKf3q5V:ә^4:,g[g?;՗;tWyGuږ@Fg'~U>:3yz/jhC1+E¸|^>E*,8_lq(׈ZxY mWmFe9%ҚPN9MEHZ8$y׽_+&5scqkN;'OmsŒ/OZ\>|2ۄ׼ASF9a\ˤizwk~ 95W ^嬕DNh7.mq=;J׷}tǎS~ՖB2pjovU8ԋk~S3ҳ1PfZ\wqGi|[zI^dJhQb@;4wsD5,kU_Fg%A Α'SSUM8*v̀EݗU`!ܒ/h%:vL+ɻy&8ʪ=t M nP~Nv*Zf{' 54,=p߬GRM|9%DDBR[Djg 9{j C{6 F [e}O\n 7W5澌5qYA*E]NmW8shOGE"/o D "yO*Pz^|B.Z},Ƞ49:8qw*K`~JdMGa= /~֍zю]Q-HyI\+_RAht;i &g) @EvȻ)4+-A5"޹]_Xb3GgڵpV/e;~~^5*Z`_kw w!vŷ*x@| '24A:tKF}{=ι_t&fmN;_z7m۠X UffuB( E4vNK'r;60s4o~F}>1Y'-+] *tod=[Ƀ>f%EkX)$fX`M\a7 =趓6?$w{Y W[1[#?1 Mܘ9W+eQü^$y]r?-;Q:p4dVp xf@zs}߹B1+p-Krev&TZ0eI8 .)dl5rvl[*w<ҁ$["[.gFH-ՒhŪ0{7[o,ރC MZFFBCc:$ӌ]Rc:O`+3=rj3%!JW%* ~$gy1cgYSleo˧`JrƂ'ev( R7Qq>(Z.x4~:ڵ0"w>[ܙy[Lׅ&~ Ӌ>w!MWy`g&"`4qh&=1' Fv*(etqOgڥan@Uc |\zcT 4#4}fkgIoE k$zp‬uJ+xZo*rb˻S pف VnF('AVocvDp^n` ; [̎s:mrz0?Xąonrԝ6sk̛eFo=~ ]Ц4ei>Z WŻ`SD/OJYwJ~zA3v4|}\U9KSG$] W49K)lG@=#c` K)䝻Qlַa{@EK# Z͊uv;g[#=ܫ2X8WdFЄj;xڙLTS} m8K& OX_Z] M!x~i&ģs@M8taO䆨w@'qfk)2՜S91JRu,j{6+>!bD).OGa ,sO4k@Ó:wD'hdzcƌ8f;Zm9X"9|-Sxn 9a@}QC2 dlu$D.ؓ 7P+ 7g8»sC~I jR" :u&!*u8;OMy_wyg}$ >(34Y?hGW^uob,Ir"3`}Ԙ.1N T&q9.hhHZ.rߥZpIzClyͮuF#V BziM_~6}4dDG%ٴXReE@O(7 ppH=OԜQu?ټDo675Z||ٴGp9~AVblr)n?XiVԱg AϷp;綁Ja5Sd_E)?2=6鳷-ȵ8lO_Sw PKjk VµH:DcMr-wnW6l4梘4*=Օr_֞o}7^P:C1Q#ϥ>]\㛽j˛JSNE|Ň8<!ŒHɃ#~M>U C2 Ft`~_-[Tn܀{!aBL]lXR[tI'O%'lLcga>A?j_ugcɒ4ZmMJ'Ǩ%q'*YsCBς@q|ƋϬ\e*hCyIf:So\x~?k^p-Fg^@ad,8gXۖυX,)jBv9WHN <eO:\V؍$d'V wA%;?}3nPِ ]2;NׂkAVG.~9Td@{3]oȣ'N6MU-1t0+q(9FU[ЩPCQ-p8tNsT/V4\M*Y:G~+tHfVpf5zg\' TY 5t;{%>'/t>R:'g%%D7z?Ktc? $~1zO*XKΜҠpXx<;"i\]+ĀNr2RȯFi8(ɭO8GY1NplGEM  p:KzObyHq7`[M^7f Q)~9AM+,phSvڤ@jN>Tv$Z.~@EY۟ Y,g˼_XsX$kzR?3' l2PJrefRb;Q8R=˪'M *4)ޕ:غoZ\13(DjPt0~ó\;*wR4ޕ5RG j`DUx'R*3 0D8*z˧rQ3Cr&{fi!4~:qSf, ENoҲQ^ru>I7`_AwJT(QdFYo)2Hey[w2 a*Vڮ?& 3˂7D9P##G"D PdvBFԌo߫_Zg]EFkdt(k8/;NF+/aqn;l) VeE)Sl 'P/Llcz Me eFC0w<"ͮxFWaShsnP/X{&|H͒R.>rXrg9Ŀaоzƚ*,rt56zmeS;θ-я EL;܍I8S, 8[KT$<u] . Nv`e{V^xiL:K6rve4f#ڒv |r 1tV dIH#AI/7Ԏ9̱m'L=ˤ7[uI%+G̬'(4;Po#". RF1ݮHNύ[qK6&i|J͙UV݀Pb2#͘>.0(ʂn?0VūAtJ_U—&L뒫d|vxqZLs?vaI@o͇"`Vw(Uȯ(1صgj+7]x|H]N#QrF:Z5ї!q6Du[Hپ"C~F}?@'7ΧY ZiT)ڛȦ]W{ WCۮmd+U?d&<~fmrz՝3,Z:jG2NFVnϿ뜮B9d uG|NEP1G#ԟƠZ+N[+y"HӠ)les.y=8l=Z~p0((HQVjxZ~ ;K][9$f?I=P#&?ɬ*o!CqlQqaAsd:ǛnILPjrj׳!6:2L G.Ї$ed?=ӱͰaUm>XGk;QFOeZ@JNRdѦ+)Rf3:W%+$%>* '}6Ǎk;@?#l|["fAdqe_ `U_ s٣Ad+I }S8?, NhI?(c VTN Fz"~=RM"eV,@VieMt[G,xXk\mۿkH* Yх4 RM,_q#\cm??*< 7c*)+pNBS&!XItsv?YM{p/nRƗЖO b ' ː cۢC.,KX`#(kz - m5=o 0g.? kDMٔQhm'Տ4S"{]4.]#>qDfZ}~m*9e @Ix"J%\$H~|\"p\cOru8Ɩd+CiUEL+*(P*m-Uu7~l /uuksb1w̝}[M.2vVH+ <(bH`04c?Z:0b=eAirmEr+yS@F6\az'4#[𘈦7S;hpQ^q'm1K]Mm?pY % Ͱ>2d~D 3j=~7VܬL1޵~Q%61~ C-\aSsBZ" ʓݘmua<:0O]2w-DWחǯcjo mâ`3矣9hP~ԦP:khk'& GeH[seduO/ >d/*KO׀|vAScNȿlâ}I3^~GʙyYWV0OspŜ`RN~{T0,F \eNI"+h\$ah'^UU٣!n|-j~Z$ve*Plޟ^ @>6MTy]LmJk>\]wmm꣄^9:IԩjUX"x_m׶QxT{sdI+@x5t}M^0@'nKMLشJry-ZmSb'J,'Vz F.,_!>AJN6Vy#Ԯj?aO|_ďdj*h iǥnی-{\E,w--Ib6 ޡ(iA%A$W l@J^t"$f?B򟩁tc6$60sYb 9{I-L~Zb)Ͻ V-,()uq2 Sn E >\rFw_gkv:uhɕ^9IK޹p~"y j /:'#.}Y' ǣuq͂@aeʫf~wYA*{VXb[ps;9 ~+-w?r@r?(e}ojD_I/dl*'w$/bZs5q)8Rx{v&cխ>_E2`.4AtQ>qs徠 ?u$' ?5C鋇|**B((x|#c}|wOp 01P;Eƭש{g:RB{8$^a$"dVv@Syg0+׶C-L~ Fד GBqZ Ji2XvĚGޏvqPAaԨb^+֧9Tb䓙*XEJG͉LNٕC DGP<KNvUs %qKb\n<57Znڲ} Pi63)t0DǡӺEbDRlf><o8v&[8(!!nͦTp _17(գc:Knoj]乪JXlV< H@6:”r1 Wp!=;PU.)oЎhγ ,h5$McQ ey,=9? VaXC$W\H.ͷC? +ڕX{2;j̎u1EG!Aǎ,❨7 ޅZC{D2t짣ڭ{l#LŵtM0|6? )-K<OOɫάuV89.Wr å]osDBk~O()|Jib\$E!8s&nXu՞=D6.Y#~C\ >`EyANzx(\ '0[͍H;Wه~a*łh4E|)=#YJe `?+du"}q"'8lSɟ)n$V8SpgfS[ֺ )!U>;:&Hݓ[(YO`tjqyU779d&-\0 N"M rnröRe8b7ES/#V3oFI* G LJLLH%kVz?ŷ+;=-X:qj2@ZQȆur@SP:{{І X1 Ya`|ohZhC'W4~?%gXy3 i>wPVbWz ]+ A뒈 .tA*1 T*e%5OT\{䍻Y:c'>F nHfgǏXf$,6M2wr!)C|R,6z&] O9Z f}x4$ +ʹ@ s&rǪVI×O0;[n#lc@G yGCVa}.9E'>-tt|,/uF\rhetL2}ΪryV?njm!t^-!g}z|TE+U0q+ֹZQ_7AZ_"g`!ZLLʲ TXt{>σb:s+<3t4<cd~I4hH;Qͱp)m ^E:hQ7GހW5(gM 1vzۇr6٤$, K}[̡Ӎh0KrQ7UTlc 9 G"19Fak: J-߅_ރu(H6=?N;B%W/s.t<6C[xx^\4x,/3I0)$vjQa h1U@V |ӽ/gimdf?JKޞ+7b\z&O+W~N0a9 %h =s sY,Cſ4gG-qY3Q 7pQz>Q2՘3R3 f |.Cxh Ϝۙc,HB{ݞҜ5$@`,=N V>>LfYTv(I-*`쏄^;nj#!3B`Rt9)|*T˨oD/Ӳm/l0bB oW7#u'7ߗW[Xt5 RlERQ>hr>7mƥ/(;҆c~WjJ#8N'Ńjy{2|u 116,A$QփTĨb+b 9b:Mh\ePG&90!x띬:Bo_#t !Xb၃O)`= z>"i0' !H%N2%!OuDhU>oKk 8y H),F66Y}Y,l-1OALKk&J6N qzwC Oa==; ZAwqvkjG\YbГIBq1XTm1;Ggwp0ch+ϱ ϞΜR||tmC}5iQ~Og X~7TS]zp<:o6{=)wLvZe "_\fm,CXAMiwde./#^rZ.CD^31-VR)1ӎ2B|cDECuXnR+8 ؃+=P4QCE!&g~44ROL|pD`OB!sZQ"8Zg[+h߫^s5U{&[¿/ zίl岥]f̈Hdڄ]!>$Wl ]Ij h+8*dJ bO*OHwjX*PF2cB,[" J'qѪ!sqʨttoߝbԫemK2DmE0i6Rn x]H ȅVMt:My-3#}` οҗx\]9[E^!9Y~ @jO$812SRd1qҤjGNPWOxm-ɖCd5_I^*V&'m{E271MWLUfA6@< %@KIӔZ⯉į(Pc`}0O8I5݆Gyǖyƃ4uu H*\-)dg5Ϊ.Hr\ۼW,gڕn𤇼@Rˆ`聹n'돌 C8xYM5qJwXʉWB 9#W^$gì!< by |;#Cz&}UNEѦ b"U9_ܝ]?$~61CmՕ*"MJ% to AU6 ˹զu?4 979w6hP.;=!/i?@jJnQbqRE 0>vO$xV(ѴB#FM )suo-jc`!(&-U)j }s KCA34m{O)?!8 |^kW 5ОZ.3X #Ld&jvԻS ;~okLS/~F#=_ +zU< Ai#~Ug3!ؘLvZd\t"// 2!6+b)aJZŴhڠX c#7_ Z{QCjCd^疦 LUjp4gB$PMZ  ovB`#,#erWIߙFzZyc-F]˯@ryQz::yMՌ&{K?=X'\V 7kGu1>H-SSl$+XahiL̡GSV>2FHeVDE(σD -ܓ\2H4>HzHOsG8 0.a S<|=ICjۃݜm)stIJѰoKE;5.juXj#l""*VH?ʗBxJ9zJjxHV@靖81xjg&YFH[3OG`XN`: &E tgzwf)EbrF=F/]`=>OSNvJ HANW-A톙_{N\mfO({ǬR_ 'l7#/OTfԸ;ٚxwtqZ]JF$KxW m3w >%0z%(%0sk@гz݋zэ%9x`fgŶ8ٻy)E䛪%3k 8`Cȗ0Y Kd)|xf?g#jxXJx}naAfWȋ0tس Z6X!p 0\c Kj˱*Rz *eE #D0-x)ɠ"E/5vPly+z $|sG4[’\Ƨ6qSdtG VjrEUZ={~ބ|!X̂j7-XvߕQpPs3G=$jʵۍ!j,QLrO66^V3:"ʞ8EZwY%"5*qO!C$;b<,.ڋM'ng\2F7 ޏÞ;iupnV0hGIjWVEBS\HeD(r0'$FUlSCEJxw U S|@{ɚH 'ùCJ[Dyu#Uy(ZmB1hV]6b)nUSE|\W%{>҃Q".@"x?ƖHOEf:pР<ԕ.$sO b0!=v_jb^1'Y.8o˃R:lIڽ,مaIvF^ 5 Ͷ=oz[65(W-nd6x_?ISzR+9hoyѶXl:r-]I7|'4S,*+;lK)/MQ sI9v _ Mn͆yj'?*𪶽KY٩<ݴZ$o^laqDS _£;z2q?bM7dGͷgm8׊J~L>$w$]ҍ#ݠ;U@Vb<MKUKցoUԮ.)y B~ {cTwAvS=2cܺ] ֪ 26wV c=`WJb%{{'4h^F'&DS|OLyl^hr2)k .S"DcMeHS,&XVZsGv4^RJi܅ ep{[L=aY\PzxH8C)zCq{,E؅8!n;i3$ -[^dW2~h&yGlيv[Ek&O(،2( _kۯevImy*IvJPW: )/X, { B"`P@P6+B4.Ǒe#.]3~-0?Nl"NpSEV;j^+ZZܹɆ}D$1(b6e::sZ5cM2+Zgy#0I]yAr ,7NT]Ie^i>_yzǟ`NR Zx[ݛZ9!;fD -O6L2㢁:v' wIJ2US#wвR&h.Eq:UYt0~F]OKeɷβ%@ӅDêz :?jv,1%U`a u{ˣV#|+\0'g6`&IL7qnP➢|9`?&q"O!׸1d@8j7]\Umž"U 4}LF>f;4g: yg֗JP),+X"1M .(O&F%Z,*Ph}88pNy( sA\V1r_<0&cB.FRo\^Ir6NƿyhP 5wddQHl1;V!5 RAG/8r@m 9EZh4w WPg_+dU)ѦhU:̋1K/ ISi}9IOD}jnL\+L9vF^ Q=޹PVQl@a7{S zuu?@4={R]G?)A ,nowP=1Rr:ᙏ~m3^L77lnƔp9iPԳyJ*ALj3BY9A/W,И>|A㩷Ze%@=_m֔!nOn=0#`Їp58=25O4f⊓%8X~ޢ*"ӽZZ9LH+Aٸ)ݔL/=;̫E~@ ('+ v{A) [ F5N( y:N]} q.%:hԉ`H-NDG[=O[0583D ;PUTZ f$kGx{2$8xɬ"^?1\6JVBR'KLWzs*LS8"aK##`aSܭ] 3=0qjt3ݚ\ ?<%"QO$;Q'X׊< w/T, + %D[\pA#P]{0X 5>'U縛:!>oiﲣ M}t %Sn/k7Fp-`aSQ n <@F:RxU:p72Fbm;JwDcp42X=蒟i%_nEZAѳMuԠ}᢬I+1mP d4[zk)T0 '= ţ,@3˛v+kklk0Yz"Ƃ D,zPvnH"io,>1J/Gܱ¹j$nF&:;fKw$|uؿ/ąi]gOZn-PkC{赳6 A|k"96EW\ D+q ]K]ڑj.њtE> 1HTځjǘ)`iicsE ɋ:3g sD biQj\!t?8wxn썦>zh\nZStA+ClÏ'$D73'͋0SL⿲Qe/ڟYէ2=VJkossCz</,TS(@lxyop=_ /5Y<3HET 0:*âm{<˙uϒJ!LQm9Njn5oҢxC}meyc!)F/NW&2޿[MĎx'434 ڌB "gkyQ6~Mx10wab wP^բ#ȄdLlyqѴ=lJCTUX еo5 x*U6hFZ*Nu3"}=,<+NR\:PK`d3Bi]H|NNe~4(|*< n8g.ԼYnT!TE޶3ccņ59 ce`rE|3=g2zPoH?խh[YR12B{t;5XOR(V?‘^֜t[eK/̬}8ԫ#|w)\aKʀ, ?Qİ+–7rZ|hJ^ZIL}T4I>ơb:Ƕv6 @7[6.YNQCΘ{p3]ғNvw˔EWݖdl5tGH=KZ@Y6 )ꃰ6'y7 I#Rω69(!2K|GpU̷Oy16* cLpF} ˘8\=+&S#qkr'J"2 #_Ģt&'B@ OJ-3fQux!<%&e g6cyt`TէTK$﵇ Z4!%³*GyT{gfyP<21z6tr~7_n8}4P`^CMwvY?mܱ/1# {Y?^_H4i] @ %ۯy#$3KqsWQtJ6&85{e I4^iVoh+ٰ6SvFsG^e_C\2fgN%(k:Bڒ ,>_@rhB%cd%ВQU 4e~TTa̪EtM$Xǐt N:#axkUz'lԜJmBSa֬TLo9/29 btD9z)H5T^d}LJV1٭8T,^[=߂7Yu{ն}0g$[.k3KfMesi5= )+>>RA,/kv|#urz&_,v]VJ^'; Rjn/Qz/zwO~8"M-Ndžj! }ZAlb=K>A~}`E~*_ .}߁Lfɫ6yU7 Xny/@GI=+.&rFkR<3[Մl8J?Q&zBWGI>dt&afSSش_aLH嚭}vu}S={ ;V]_JSs홣\͐`5_?}dZ=({I \Q Cg<: u랗uvx"a 8`┝,7tÐNNL5n(͏uO&蘶2:cۺEP|/]mAI/>쒝#LMa;%9 Ka+/s)9.M(q)Cm9Hˣ PtaZf]2?;45qNh %ɡO?/V0$:S+k)G F'^GH.٬*)8$V۝< ގ،?A tw%}U)K6!"b6FCUy\+ͥܤ1,dlVϡjza"VY\OˌmjgY-4>Lk]Ƅ kT>M(3kt 4t+2.CSCv$cyqB2*O.twdAԫ*wV|.} #dY@Xx9j*&8Q{^bRicR4`rcN,~#U3s4-[!aE7 G;ISjJ>o;ZP!)WefZ'8G!A-Ű79&dSJ{`*z" }m03Y,c}+7SVT2LK Bd/sv`G L%Idc"Y]fuE"" O!B*e.|D|]9w2$R{[4K*5W $h N]Nï_`0^{T'Ao}f#|Rs *S>* G-]Śj.5؋IZ[_j RjP,ׅo6r L:6L i,۳߉b iJ-$oXL k{lܳ&KE_L tsI]W吐; $[Q];( wّ4 qw+b c4vW#M1 nx:kNp!4Pe2y:n@] t8ˠ^]\p­#d>,WYLYP$X7N˲ 5m{BO?} OgعQ@ j,Ԍn沰&(JD+{m.op|57]Fx[먊>ɿp aLwԫʶۜk@qTL̺*-fc>6ǒU8-rϔ >Uz2];LHZg(t,*W#A.ryu*X$cm3,$X @׊-0<~|3~`֥zxy^fcL{="P)e0g"6ˆ\ܶ{,IVugHe O?!jeHV|pɯJSFp *џ }34( \rq_{=Re"E$6.Fյ9.|ŜPҸ7> .m\7PDNk k:X6)8[^mRۢdy] e%a!sE3ٓ]q`:$'TF̝IFrՏU[74ǭ]/n y Uwiұ`letvS _A/U|0~ΪHjGIe|'K7"mԬ}&jc(~Vʣ"*]lDϥg?46c62k98^eet/= gԹRXww .G#Mcʃ]]mHvVDմvΝ v({A )Q.MaoLjlh؛&-F`LT_h֏ 8plAifjkdt(y=Sg"^_?o :`%CZR Fz+3˵ :#"ʖ 0bd4HP>o9/uSH[ ꎌ8v1YwXo;$P*:@ؗ 2@V[P?gj,0]vNxtW0pV Ӟֿ͍}_+3nI%:҆4􋬡]<.Y0%T38ȻEz~-N_nmv ̄z@8H:k!)dYȞ~ؾk VB@!3( P;` ĄG kKbZ̕^=m==mE30ot4-V#F0((0>$"%==_!m&G өy,6VAۍ߁t7.{[?f?kҐtopWZqW삼5cJŋw†' G.)}~ݶ K0!^$ҩk31閏{aKb&j7骉yC+qbY+\ZP= EzHaYK/ b{h6!Ivpԥnup&2Sensez_gh97z@wuBs71Vuиn_K}nږ#*Ξ  )U'2/[Eã}0̀8 q5a5||CRGZp<< OFD:,LqY}|iAR%vR#(73aù)히z[8Y 8{B@)pkbM vo +\NNuTk~"#v%ҽېzf{ u=c3X~~F6j5$UbD1ZKGb8ӹf~=jJ셓:j^$&nlU 4I`<[MHK r#g/u@m K)x>ܙ}=t'u΀f-9@$SlzF/rhf:Fav2c9+CЉ\HRa^[QjE-+uL1eF+O8yBo RJr#9 z;֕lM;49O.]s1߉0{#T{AȆ!WBZĽob4q1gNrv9H{=rv€ ?GQ>XHҴ_2 45. F[8'!׆)qY= #o0|+KQCrZRX}  MøؔƘ+jZIw Nޕϋa,4rv>۩^èB(NY+:u~mf&>rq 1 RABQF^K d]2% TG]OD3ʘU10EԆ<00m qJ]N^1JZt-}8-WžO_O"iMKMt> JS0ߙ&Hߴ8^ei`w[،Q+۬}֔ᘃQs"<*WV"nhv5 z$1yԀ7D֠컃A.z'Xͷɴ .ݗYj7V2Һru 06>eAHD;[4scHGA}#_x|Q?fT٬yzeV5b銓\T0gnuR͏uOcݍB$R$NzA):mͰ'Z>_3ڱE:l<23;A]~v&^v4;3xD(啬Pmlm;\Տ:k: cTÆ Ji<}m2}/ CBE+t E&di?CT603/QY"蜎d?a.szQז寗S`#I ìt,A5?7~\=L`ܨBMocLHnb!fM8W~JQSvBGu d4ނߴF5'^0qXHv64%ODPUK٬D X^۸Z1~x|LBA<$!QW^ j +yWӯf,UrSQAv*z㉑I’f1xoL*Xo+fh%7LlXZRiڂͬ7dh9euEz.oF#u[?TVsDoֱcuCsT6Klv.^č4x dPm kM,Njlu_@LФ*L~u9'<>رUqV([\0A:qZ`i{-W-qsGYw1hsJcn!Z<n= P(6E6}Ҋbs8ZJȳe4m5`}w:M#P"@y+ԱJ4\Fdb F&ڨ/㪭BnQ/aG᪐6T8N Pf^N#!^ƖGzYFgIHX83cxѕϔ0`Y_/AF&+>4ҡSlEiuESEH{E؇?[S`Ĥq-V?G}EM[gţ ^Lg!t?p_A}AJ dOoX-,R٣82YĨ\5iG/W/9Xs|Q_MAԹn?kv9c93luHJfbBL#ƿYӬ 8?'|[UJVW-|Jڼ9.7殝骒pYjMX/I`YqB|Š^1z)S1 GV MR)   vzjn$[_[/R1!]`!Aj/ \0C\N nf 9'س~M.p؋<ǐ'niRm\|q"J ɔ,Jӟ{W0kFZokog‰} ׍;>qnB1y(tE#ӮmK=tI, !%yXxqҁDaؽLd^9ֱ=1nҜlxWg_bpYRǔk¿ 1Ȱlgfe_ɢW>{?m5m^^O0)3_.tp,GR1]tm3`!Dm!d&2| =fZT/}u݂v퇓zӘ"]ͽTI!a>k S<+r[^czu  J/ Pr6]Ք,FA\F$i/oZt_Ob [<=9"j5 `O L_,6I=T.K@vS/7V#Uf'Zǁ.\p*VJGh7ۢ_l:!|UM@dFz0]}jt)穾"I=4$eXXK4Ji2MU`ĭ%*<٩;vMKɡCOʪÝPi:3* A^k7سYt2z u"|pnL)j8ӕEf49/|jr &;q{ _i?-%=" wjiU 4j&FHUgs W{>EmiVգJ60KC9*q0XY\֌MʥM쎓+ |K[F~!4rN*62}3^oTNN},i)̩sͰbƀ(.jzU/ڋ'6ձl8qռnf;ytj~/Xܣ]AkPוw`T7?$H5Xq:aX(/cM _DdD67B?6D],rx.X+koʓgQYfQƻ>Bij7`Yzj iNx$ϒqi)0K豕Z aY0$uI9wtXsL,hHN-~n ׉A ngR$A+5-g}ΫRP'dJk ,Po:9틔l%K'{AO3 i\}[֪hI5cra7 `ŋlFg9C/'\NoAJ׫4ܡ:6CIyr#c1Hǡ ?awVR |Ʉ.UJkA]ܝօy "o&9"դ-Ġ3-))}Xd|h8n?&>*tkd].KIJ r%|AQӓў ^S?;Q7#eaED7*Ckz.?C_`]yv#Y6}iXAF4^x3ۦ.0\v5=`\ojERFqD}Y>WGPTruċ vѹ*kqjn ti_ܼon+I(Ӫ<@„J2 Z!7OŝQ!_dݼ+H< u vf$EC`/X1I91+'+W G77/1t.%հ<(H}Ud|ݗ%6jwd;%::/Ɠ_T+@/x= Wpqe7{8$fL@ʖ v@b"hDHN!-,Ŷ=OƽYAd,XSj|% !1EꍏG\/5yFs8rc )L?EQ0gtB&0aȱo XQG[^ WxvU&lȍ%ϨS  V89;Aƕ64 ^ʾД?xM=|8r~I IuZ5.fvd'z~.d>j=K\Fl%IlUمb'4غ!@ʣQNM-Ȧ煾gA ?%Pq4'U6ۄmm V"`&(1T9º3mm"s'W$З ?>ճrySaL[GRk4.Rz4ע֠|O0툛'ZfDq-q|<Lɢ_px4f.YI% /|wxU=[bC FFiɈ.LL٥Cg AS7qޝ)Dت_\^d9zwj0dkt(*Fq 1߳W:-g7P@fsfG~uJ^z~{n˵< 'ni;Fd:sݏՐ8F+h~ŞW ^[G/U%PoIw]FL$ybєFuA;`F2^:6qojWvJ[N3n 9uri(F2q{Z meNwX?/qٔLHap'>ʃ:$zKX~> VDX}{]:hS]ެ!;%"nԁ 6 W& @%lDyy԰[omi!ԆW P0;iZF^x;ps!}.^ə{-B+=fp5R]^vH0ǰjD)6룒.b2O $*l'Ge\\F8ӈl5BK﵅~QF7]"d>"TO0*-1"Yqh8R짤5wYLj{#|vȖ(6u alVu txPG6_x~@NK$=]t `3'ϬY #ZT n G-r~ngePbHq`S\OvXVC+ JggтR_gKʟ{]zD.5MT gBI]9EnvvEK$`"-Ngj8oHE:bU][= PQN)oG&F|}ZmWvsOOwAN`料IT{0Wﾵxx}od.n1? ]Zx̐Lm H mFE!t E`g;l:ja8m]C$-r9Eڞ{CIỦ8FjM{+|6Jd-ƿAuXN.V_d< #zW ulol.6M]U2e,{'&4njXWyߋixtw{Nt29Of4ߩPPv:tP)1{g9.:k4\zE&6N>կ*Zd]drrLus6WJ+6P$A *Sܗ˖ս0p{AapX;WOF/xͿ!gUN{ ~3G@7vtjol pbG>j y 3;TLH ɠ% y8(n#+JIc$2DԈ*q1.!aI|>ip)X"ǀ9t!%#= 䩍MGa<*RMEҪ1U"jWe'sl0X;x__ z@A߻XR/38F8lCd;i _44H(`?^şqLx(iHXH䝄0LjbQsLYO z.9N]w>S1 >px22 = LUXpnp3?b5?#vAl'7վHCC%gLI ?}XP3*]g9ňMA9?JϪCi0@%d_:R6kLsضb_s#*奟8LW$,.[iKa a? ûFBS+5v_)jx8邱T`ۼƲs9AO%ce~臶wn٣*\RV`K[- g)H(]%k/7ZPGMą37q-R|C}ݠ\@v̷cd#SQ"CzO {tΨ-R-i -09ό ;{z1O~M{-n9hշX xJڝoaVv|O'4=v%3f2:=*gQ_R$SwU*w,G ((_I#ݐ(NjZ-Jt%jcsdcK>^šP87ŃG:!VyooΟ yDO,==\Kj&ꛫSG5bd`|pK_D>,I (:=5| ,:6eBxI}Tzw^E _f~/9_x7ŗM]K/y4> Elqx-p[0;BTZ*!WQߡT1s߉]B_# :2$qp],e.H@4;Xt-[um?okI7QZ<4(:>X.cnр .8'SAb ^ w\}`5&lܮ9fQHSbDl&mSWq, Nʈ(_Ԉ<{nec?xcnkR  xƷkɃ\,qǀ+pzio9Tŋl(*fGvAL<;L,_~(ЫUGm36QWHnKE+6 kt5\Gb:@=$VKE3 7NêB8ϥwP\眽9ypB)e0VWHZjD##.儐v}sE,0zq |g;^=.fD]@?N B-ϲy x4sǝύ6c!K;|܆撺yY![l'Tis)9geU7d6#cX>؆,\@YgG}qGoiub(}KϐW枘H<=mR@ݾ\@k#`/^L`W3GRk$lj5%aYږ.-(ze:/)3.e#lȌ˛v(.Si8b1ŬY3oGGK&kj Й:̂Dn28Zkk2"mfC g߂c?-CMaBM'z I1}ܶ!BH=رy_z_D ve=׿j(7|kf1n+t `LZA'i%7Qзm ޷}WZ@6ۜ-8Q:t币&8XT3. |LE R}&P$}?pgy"U(e R _[~c[=$[Qz~Fg)Q \uyj;6.I_@uU+u7,-ǙWT$pz_PKfZmLj<*˸X6SD"=&>g)W͛Z2hnGׂ-jS0}|#$3ԱyYzxQbcF$4-B]7w&rfIy$-[צc搂ïcjمdBU5SY0%.Q&7HNGXs[A͵[AlUi#dZ#^ǟFa?$5b{_ h?kZ@C1rZXXΤ)npf! PPIV@{(ZF)gϕnIZv{6a>-{X0 EZrWdF, B+xg]a82|SK xa2 kIӤf` aWa5jł{&Xߒvͣ} lg_@V؍c1SipwC m'Έ5hi91տk?\M{ ~nEc*mwof"j*c} W3Xȏt-A_rrsnE:L8!KB}ҟkN5Axy&= Wlv]{Hԡ Z7967Q!F\%qHlI އGM:YҊħ(t=5TD@!2m8~pE؎ GBP$-ɘ䵢”,f0^3 _~*N?.U^yp4%k*|~fqa<噿ald+7R8O/~QP ;G3>Vu$䲺+`RpVX9[̦]ת|<9ԧr]Ԃ?cž )d[Ћg'-CqoHFCxR$kB@: \WJ.ےTM,7BYz2Qxdb;rԂ؏N0(i{cɠi p Igj_-&wljLG]/+*@,ّj$BYM&A.lrsVu[V'B ]xi$ڐ涹l"SɊeӷZNץOFwcwgA1^߲Jᵷ_, in,v4mwX=) Elykljx ȵJ3' 1Bl^ގ(G0zGc̊ p@+VIWRқvBFy 欏cgq͝a2`WP <<^GZ% F;i&lo,WyY80;-m`YP+v0>#A>V|Z6ŭ݄y 9c]uy5ߎwA&1M]Ac`E2j6%t=X oBqH 2"B'nnZsϺ6W ƻkVYXwRv"=HF1Cr,Nu q)˼8t R9x^:yՠ޾/jZrgj=[磟6 7',웋,AsHC 2|E,['Բi KKJI^ `VW+ uzRIŇ5'A׀'+7@.3{CY|B -hUi1X:ʍ060w+PB q=[Oƹqz1E+v  y0dxz|3P[yZr%KA k%FgeʝC7rN"q"!Yz'8w\Yd_uxH X r6u .zm 륙cw61Fζbq9#t)&#~468O,_tBIw;Xxgw,$/9:AHu$6ڡ&oݜElMP2H>c_MN{P`KWCh$hl/z=enϕTH7P:1ϑ9~k}KrL C I |'BU)5k=Ze}c)g,}$zxXC@F 6 5\ZQZV 9+觝065\W@Ttٱ>agǀ}q),!6;/b~j+w4$ɮ&2 7KVui\XMF<UzWBUAG+ !U+;BbkWGR1t(h/GuCaV!9s&O{HԄ#4Ұz|ޥzZ7UtaNjPыՍM7&TA-!o"6m#M#[QA*R -: '3IG׀x$U| >5ui܂CP@ZST7ڰfԺn7Q3bp"H<_.$2wN*oI2hK03@ϺS< {K@aY &Hs6L=^=V| (߷ƕ6e8IbxșKLeNj@y/tUт`L% lyn.˄.aل"F\ մpu,Llo~h C [EYz#^Z{ͦrϯbJ%8 NdOs"s4ފh›ՍR0T,6-*&7&d`w!9RpuǠɿv|p5 sS ߋvKAᵌ⌍4g]uMcLq;VݧIW"Tuړ9H*]3,|i \l"V~5\Ce@SnI{:Xfşz+普2p!Vd3v(3|cƃ޴kGb,E@?gXŊCAJ]+kffbUTՒiUF*)hեn#̥bŽ~;QE^_MŞ^ ߫8zAlB$L;uO)&2ebH!tVNAT&I&9>Ws.`3B<0`YoR3{q-O}g|zeJ;tlK8R-e_^|bJO٪FQ\1c#kz2~~d] @c*n59)bA\J 4b9ƾԂs@7,&(tIY.]rwndub-Zse0+RY؋_}{z!֠k+֛-@ kߊ{`D3kF;hZd1Z%R7G_hjFVo'E~([Ulqe<NGnR ܢAKo <F)YxesR Occ(x8Z|:B=ݝwuFY- mvɈ|uRecĥw! $ R SWd m Vfe+|"a˺+hcvv>8vߊ dʿ!,+43TYj+)IhӸqf2Tmn"/VJ̖z)q_2Bh{rs^ {\ɋ]f˧UfKT4bh%˸ܩ ?7}n3UY<1X+9&3iZfآ`67j=|xOѺl"G*q l %8`GTù2ڤӏ%/.Sm"pR V/x6/h*'Jm? q 'gt7M a|>͠Q$S)VE ?#bOfTs؅&6wִtl>0 Z~9B\}>|cNh8gVj А9$؎Dg/ 处T\v5`(Gܧ0{މEš?nuV9Û`0<$B\$l;{͔~Z6/oy"Ah̛IuYyЕ)фx~ dt# {9#62A l)؈Z )+!TVZ;Mo&rXE{D)\HFZ  {WOkAΰuXڅ[CEg:B~,SBBTQ*[Y}i.,x#b_xGy3 \oբ.|AuEhDAtÍ B~]d(*i,:FM{}(-Nx@Uʯre5۝{Ql?GӗOHi^ 3PK-kA`_qriD˸uygbjuT! 5]Me|ɼ#֝iPvi qv ƘP m;)SRH0U@AVDqT8{ tA Mpx٦(.3~jP(sVE[+z~ A1(Q7[LOk9h,D|m %$tYx+c*'#1|`?A 61| ]GSWa U.0 !BP ČՏ8۝c]8 qnVͷ.X?wQ٩Vf5X2Հ<5H;Fc6#&d95Pb2Z^(.P|SGWPddԄyE0b#IpqhijKrg%0\RB\[ꟀاJx8}Lȿ;'iL~8Ќp)J 6`\WpqNWݯI[Q:/V6m$`o*G"c$.Y])챶{ ` 50 $twj]2]!# VVU':ilC;*HFl7)1PEꐧhhU/85(zhX̯> W˓\Y#X,x'ͤ&}ȢRD`FgFOr%1g mVgꤥ4A(LM+Crrd<oQrٝF% h6Esg KɨNn|pRF$old)z^>E,+Bkܮ=,Y% D_osaWb _U9BpqIf 'G_eفofQpV |D;tֱ(eA˔܊LIsbAd_./GZ;]{ c+]ODj"3fk;ښ'A(j>Vb r 0ho -ȿ2t9k<0yAg?qTr XvH7@\iR-Xb6he$#;]F?'3U@WSyɁ>0* ls$/[cΓ?IR; A+&{3a/u뮄TϞYa|y2=Lǯ浞 [~޹dH?̂,ZU_ pq!#.6|McUaG_s{wHTbY aHChJM'JrTŔ/2D6 B ~këTUt aJ=urCO c)ɆL}f@<(S]mb堟Wz,8!] qNǿu3n!uѤHr :{;6NUp~xkT)K%3ZT99=ۅSxYKl6ptV\]*/۽HHv$EPCD JRXjH)aAǂf}#vY1ZVhص-霈/z06{<?{s3j2t`䍑D 3aאLI< 8Lբy "l46xP# (:%7ݪy32-T&xgꢻnt20o+޽ w .* xx6f `BVR,q7Q64ny sD5%dOPyfA SGm9*Dd.h3]CN߹[c.8=;s[]qN_P5`'r%%8Ą׷"~IMLq >Bʐ!v?OJ[I cIpɝN=G9ǎy8AF$![8rDn9)%mO.Px(/tvbQ>Ĝn`^6=Gd~PJMʰvj|_&VWC%y~v9`O9NjmvlS ϩnT >Z}%:Zrd ?FgacluFEuv|JVk8;T@FO˒J)p T[i =֛+ ܲ7qk"jv4mWsz74HZ`{Q㜁hi-A2G̕B]pa? K[t\;It&p'@ xoqѐf/qO,$1U$w6NܨD ; q\-x=#9τW ׾s{@0OoWLDm2uS[ "xP2[ HnN%YhRu ̺aOS*g&NbcH !J%̅A@Rϰ 0wcębPj|lq[A̭$TFC3q-/ sp4@-yexUG] Zj&IkU'H-#nb w: M; **F ?OY4ۿxYi=.00gS<d5=rjx-hЎ 2JL^^\)u;tZxFHM8-Z% l{hߗPq*=I)ov>$(5,6m,Z;Loakyf k>|wC߻:'x9A}lWSiT E.˒Uӥܢ! MwR/*&Zpz>$Z%SO=b F]9K~~0HOV[9gMhiG#8c2dkQu?,>F.dtPȲ#p̛Jpmg5xGjWo6)p 57&{,u ,Q5b:m gɃ\ :.!ߒvw^Y5~ԌJT3|3盭+NOsK%Kň ByUr5ڻn {eƚO~[95}y7%Dv$4K\B7pw*P]\b_{/j#iLyF0zguܓ|T6{:/60.5sp;Zh3QؤiV31 |jzWH$c4g13%(쾗[Ioͱ[`YXsNi+HoF6뫗[ vlaD@?el1S+a5\XOy9l ܸͩyB:ղo͏O2Zk-Hǚo,t2dS Je6 MisxrC"e1(§ wa1A"P7B=i-LmF`+fR0jR_ާR77  lHȩ=MV# W6~0-la5C喡zkE6:5;7\mK9sMN[4̥T^j:ʅm0V >󣎎>di{lZ8딨لx %z<>a8haz`&BaM򦨽կDŴRϧhLj4إăo ou9ӹpJxAF٠0.1~ZCv:#pU/B`[b*;TThd&/43p -`gSiѕ x>T|4x@r[-;]mtn jqNCiVWxx-*ϼ-gAƈlXVƈ{t èo^[\Kb9NT~՘mGʟ q_nmG?ȜÝ+;fmɊ|^ Z2ܵIauDgn]>/=~}ttZ?Is'Ec睱X&ʃi҅cB=bwⶓ-VJPwtTP6 X$.y6V FuBԓNW/߆ȀqD>5ټ!I§[<*H6%GʷOu ':-73-{L*{}3;LB8Usnbғͦ3K"]yn%c. !RZGs3|_6Ade5UU}(Fygx_}vf Q!HkCt@4եl^C%&zyџ[L+Y;\NAg!=&76޶CP&ړm釀F;V07CH2ߏESmV5+}͸T-ЬnGtXDnco"NY] 8dquc#+j0+Wol"Z-4]"PTUioЬADbe="0 5k>" ;Xl4WUJED/"2Qz+#`՚CPlkKjm`7!Xsغ 'kـ!+h!Q-&@:yܪ"TUm7:/[ fBW5YeNRQ1؁(T,f8NufD *a80Q"T'58 X2iLgm!Q*Yx`=ANku9jp=)h,vz/NL͙28,/-ٮ9 uqo֎UmㄑH6CeޞD:3]H>5F|o@vu@~6 :9u^ozҬ (f*=SeXo+qӺ:9K#c$|(,#v*\8PZȱ@卖,bqGsI?}S/><5,lk)*. Ϻ &wNiVe(-3sK?fl0YIⷸ푋&AH >߽V.l罹@c`kW.0zEown 4AǍo oN ZmHiD[Le'̋Gev{baحv+)`QAb;Pt7uJbO(޻ͼCN4s˄&r {!CĎSq4vQ/ A~ r\<"9Yn)]^`NdkBst1{( .23z}]/$c*v뀀TEmsP`7@vq՛x%,lG9ZG ͹آc =Bȥ;S?r&9Zx<ֱدAz a_DZo4q`k*;!_j ]k/ИYD}wB8-9yb{ʡT@k 79Nw&ko%:ro%GEm`\!l⤊JK_vQvE7SYS'&MMn@Oǚ6ĕW͗'SG20]ѝc-Z'88x0<`\E7kt^ ]ߟ;2 JoFZ2nE8ԝ*vVQ2K~߽Fb,[Kg2ԭG1`f̂g1:94aDrMNp a@K8DP.ydr'8p䪔xAWy+g,BTc#s>}l3i_ ?X]"ZE]@чĿ1)a v24tS2 )fD JבLbxq.=GoRT)F(nq !xnm%rs_ Jg@5,rA(a,[Mdn^nҦsAK}ȅiS50]?wSl*k}wRsB"QcYin` ‡E~M$!܀=3?B9A!A ]['iOVcA\@xq2f^짼251tA, פ"ɒZֻɓBf6Cg8\yavd_vNO,blznxD_2YdݚNmYc@ҢW{G (.օwzỻ0AKM(<l1!fc˔Jѓy!t@ 7dk49"JbMRJ H{%#}FSnB(4g({9 }p==Y۶0nQ]^ )T(F ~vZI|;VNwiCoY["@k#yϑ 1`ݓeK2>+E)^{z 2ѷ>eTN!h[62yǘnC]Lu>pi(+<AʛYfU\o9$w/8ܒ->"k{ |{odVEc/ #VyO#?7nA *-f@ 0__2!S,AE%{r n\Uf',j e !i\19b|V3GA G WWzї-PV*JҟgZ[@dymK 3(ɠ"Vr#M= +tλ]Ebe@ernBAh>lgQ$)$,34z;6V %SkDTwz?FVƱRQx=Man+"XubL+볭CJ /ǩjێP|s4>#&5ȎI%FV,͈m*yi2n|yzL٢xk B(O+ ˺"bEwoW.֣4 \9QWBi-J}ўpe0-E2zx.ya~38ѩ z5EfӍd? JhS\ V h=kN5!2H5Usya&(;Q|o`lBWm_ق -ߌ, :vP*}!MH~߬F4솉#۷$d)v/[=E7ܴ˧}Ʉn=167 O) yj^[d5+^H3ۺQPۘڴ{S}Yhs:g2Txqq=$ )U,GDkn VL@Uuh{ۇE(Ge3^[DZv_闇{5RޭO_ވuk}kwoL}JhMʤAEyfie+6l3 Jn`c>Ϯb29̝~6Xiaaf[1M3#X]/~hZ9{1&ԈaV'eOy62<`B(x%kjVOgI`1Q=^Ϯ91yx4Zpq|4;dsvs3a/lAǹ4ԢCy Ave ;- gP$华 jNV٢01S IiT<6Y9+bU:)ghx$ cٔT^9Q9fV'h"ӮAC7B wkL 1D.qsN8HFۼ[2CJxFC+/|1: F9̿k/UIq4ܲg&:#u̽gRIhz]LW?Am_}(|+xd1‡q9M}' mJJ[%bQ80xy!^Gn"TӇKl \ze-A]~tSAǚƼxiنCwaܬ ("z.JrmΗt>N'.k}WӤqGG ?ۡh Th~@fD&-;؟ Rԃ侑543VT|L 8.׏a>oǰ;, ,G$KLK56,LΟu#i$#cSpDsȿn`ۇp+9ڠxL+p;?1@Jwo I6#'}q0 iQN,"?0yܩQnɗ뒆$4#7)$B<03cգWQ'Sw 0Mo'>0ү!Ubľ\ipy`¸&KVCc-dc~LPW,u}Kl^E<4_r?P1h Ս'^]-\í*/XBjc}luu0ż?"sޠN~s@ PAQr7]Ϟsk Ig >yJ;);&}!_$@Hs U8t?SGp>2Q ]4E)+)-Tf2;` "džKD.N "K{EH:;eHEHBhv2n _s7+P=zli&`ކMUm?LgGSP0ŰtIrpQō)d/@y['kfRYJ5{?> lncp)sa\^k;N*0H׫0h!MguaNBʟMF~?vi0ūqicF%vG 4@059vO5Y@& ۆbā$ `MI<([ơ/D2c!!#b/t Kn}SBuۢW܎Gb' 1Wgqe 90QYSIٱnUC8IѮLގz8͟8Mĵ3:TfcEk [qlB [ނb%c}4^Ck~8U5IY=Qx_~d^T4"}jȁ,Ev~A*;bf͡~ma1iH!4eb+!acN7+䣆2$H:^J8ӧ;˲[~L<#)8 5pO@e`OW3i+IwbriW-?EGL?8i} 9P2UC=$fL"FQLn ?KXKar\$bgX<lJvEhf@ 4Wn ff1\ֽ\?(5-_b:-l gES_u &rKd~.>?/ 3[/C"i%\`3YZnK3:>iQUQF3S^#pO64nR0ZGWFM3Xۍlփ 8"]rQ[g_YF@+t# ~%sMH4!=:@r{BEҒ*s7NRyhHp HZdVJ%iImfw!bin5]DU%Ì \q!C1{AcY8MQt"H-T T5Qw, ͼqoY?!nT%42QB^(.F=sx c2V9dOx\b}w!1$T3ۉ5wGĥZ}DE%LF>3=}\ɱ2?SN'hD 6S-O-嫹Xov()g=i&eai2Ɏ;oFdonj,ao7X XΖ;4OTj:y(̖bR،Ǧ}Gy7[YuV?*vރO!MMFa;vBgd}z=TN̰Xj+1 0{+$WT5ղ"YV]hHi^hLfbج6W/*7K0 Y[P>[Z+˩jQn6ӦxZ"!r5lN]A *ztpA3^Hakc71<͂#ڙO\Hm/Bcݯ;9pxƩLFTw; +?`s +YBT :BGhk@}KxVA8wDS.{Pw&s;uC0[ɗIA34"MV7#lhȥ[ZWH޿,yOP:R!R~άʦo>`Hgե|3E7J߬GQW zqiXҾ!19ng A-6f[{z Se쬄h; ~V)نëi{ إ1c_"M+-OyDəAK_(x0D$(5)G$%(k3JEq-_^!„r8'Qlq7>ӰPBx:S^/j̴1dh-'KZ99z"}itoiQ* Z~a ud 3ЈWχTbrn{ *laؚXr-Ra2j%S E< sHhEg+Rxce4ࡠ 3$W({CE:ӫ f ))ڌg{ V)Ef\nH>B ї?o: 0$6)$RB(gx+E%+V>o4X/7ZoXϸIF5QɁiQ]8Ia$ԛSe Iɡ͏5_,_㩷K,kYkϣQB_ BS'T NN.5sƗqF//NOA zTvBGRv- q'(#j}EW)aыC#(uOY30PL;û< \b|yIlf(=6͹ !]qk./ SۜYvK59 8"T*t29P^MC{<02%r:^џ霱/G?tafԡh6O^xT$ inY(o|epIfgAPTSHYkh#6%8{: јsxRݻL_SVZ 5>'"9OMV6={2- MvbH{}z{B>C,eZ=F+&@QeD;4>sm$.r_}O?=1s.ؑvٍgM:l V\7lhQe* -?=KA 2TϠ9iïD.͚J$X{L~Kf 7$ >kz9j9|/p[ )#goEembv" CqG1I]ܑ[c1^ '񢟐k~D i:u+ ߱^;=5pd \ǤP@T0y 1*JCk&^A̽pQnp1in`I{z8,Cs.#@>9,(8 V08:r 1cիFS#Iby9ChRN'T6O^0%̧Gwj:}( 'Bhk.drP`"R'z#&@ mV5yKd awҸw^ױ`+2{&3w74JQC*/nJV6N,lcpX5CG7=!b>ۀOզ'EΘ"e/q} j' uKmTe+fTo4CҍvѐCN}Im UON`VN1w^ijїEFڵEě Z U%EF>m\\ن]Ԕ}e:Bj3!eT 'A >َ[ V9& eVƇr8CU.k *zŐl9G%lI]G{`Z?N`k/V| "C'n k1^ Q mYF$٫f-ꡙA3{'VF+ ;~K@/ tz]usxI.?!S(uҏ8P]?eIRH,'p®$^ۘUƵ:Ry b@ԼD_:qО'?ELj&n ~C)g㑧-_V;3i*~5''}Od5 *.s/%+Mb]5.xfja,A)%xq'0Z%č4 ]b-5!N QuT-3c /s?7gN*ZM|"<]{cͩW4m]SrݑW F_P)^ЂXVFO"PËjm`={ Ծ%I\tYNTrYFŁ3kL%>z2 8ׄ$* 5 }45*󑘸phe/靿pИ?ڞq΁?u!C<&$Sɣ񗰦<0 E~V{wNQhC$|z4YN9yg? `s&Z _ԍiN"2Ic'Xj[,&|^ՀzbHwlwZ`'=<^sd"\nzunq PC\ Y: 1f9YGf9pIdaNԵ21hE^E/,;>zQZ[CvBף^ոߛaVKF Ҍ0Cl}Gr><<O/ԚhsF\Z N_TY5}Fcف]sܮVD}!~ gF4Lr_bYT0CꩩKq[V!ޙB"| zż 18oX=8XOb8'+-;5`uW'<ܳy0$n.jΟOv,096J7tzFj`hci?wdPSS8A74" 0ٟ4Xs &(k5gs!ΪNA<"eyrNNuP<'Ʌ h}ghEbƃf_l̦_c%WXdç 3mL-ԃ#\|W1'ĸ}%X( |[6 rB%HC=|@/IEEݩ@l;H[[hLˑ?MnarcF?7 w1leTVEMɘ5U~&}a;k5FDیe] <FV`S,Bes$qIű4I@l=4wxǎB%n u s͏v5;j*ʶSrD/ԍCpIK[txѪv>m?DxOΧ @nֲaI8w9I$kb8(؄: ]8TY'֗[|i֬'pB"X~v[^z_%5%ޮ :HOZ٥`+|;t2wDM\tyK5Fٽ_6URG*93.LlvѢWWV_"a9& HbYF0Zf#Jq4O]ꐁdV)Η8`9Z@kՌy_cWpOwC,Gx0o RNÀA^F8: fZ1tF8A%`xs sJ⅐5sJ"տ\B5r%ҿ1ZA&8ۊ "[.͙X*%7'f@ڿ`+v^¸>ϳy+$"7Ry?Uw:ӍpU ryBZSŚ?Wq Q蟠49`SW;9]붏57ť;`|m=l SBɬ-vψ4mI%a=/(%ՏKa61,s?^%C06@sЏ?W-iR Y3N>Q4ҹck0< kFhguC"Y=DsunP%yNJ6^.6>7/qZ\i~-{XK]gCMΆ{c8\MskQaGg.lҗW] G $O)#Jٍ&Nw)yYв5[V%v J{Cx:CGM FQ8+k8-Atxf6|+6n6wHG.I(';)_=lZk K|n 6Ee\Y~8:zLmZh2FTHn&Spa>Wf(֛ ]a:ݦ4K8˨w P;L-%'58&⻻ĕ7MWگb^9hv?AAdY/"HC|k[K!On%"G@v)ITDQT֒eR.yKXG.8~dYu3m=TQR4N#+ӑʼgbre9pz8j_Ǭ 5*t%ԠQ'=WU2H2Y*ܹ#q\*hAPq|-.g~T9mM:?`hn@%gV}\RFJ[Jݾ[*$~iE~^"nߋXMjOpzdA]S\V2P9&cMLU+C}}DrE I>aD8AbF Qj.ZC"~=6L<0gѓG*9O?Ag B߿(T.*7$) c͹E`Q)yUB֬rIlHl` ;~|Lr5w1N72׺U+7V,BM3uZ ; x9Ȑơ_c#Fuӂ;BI}#?-Nh̏6P>iX6%q9r&'p 4 >nBSP(ܤf0#b{-4CoT)ٻqdعN>iSmPtT1aX1_r|}6ݽH2fVd-)GCS3UKg-QDHTtq@!ctjv, jHH/8*Ž97٫B@w4)B4 YFi遪 |䡉 M \r+kȐ<?kB ڭ(~]^x- *,R;6XCV#=^=[ b!8Ijpm H`ZVE 3В28O0u0*DjZ' Έvk@B "ƷxKK:q_?@՝ .Wpk܉T)\ ٪-eMkItq+g_ Afδ 8}X%Լ߬vܵ*{sJ-V o7`Nfw!-3,n0x/Ss[:"W{T4[%Ls$!Q?کUK?są3)ҁ]=@p vWӌ3 }1bx7E&$H4y,E0l?W }i4:ӷBِši.yz+X:b+8'“Ѹ|}I|Bܗ/x2b50&vN[cPy˰HwBEAiE('j8=Ql`<7ԢgH5[{:~ܸGbd>qv%W|!#>\hWg_[K_HeAD*e(@yxf;iW"GGA2job}F+e,yRYveupۥOh)YF +nx}@gD_(Wiva r8DˈG@EqQ@ A)^Q^tص<AFM~BC_}ntbΎ8TBAAWOKW{&n}xpv,ݍ?cp p6wzѥ<_p5LUM2n>-UQ"MMPr?$#O NCn";{cɠv߀ )B.{ $}x:M%${Vl2X/$j@1?wCmG.=H236lkfe>iCjd۴c^nTJɫZK`;qiא#wF+!]Hz L3J4+Z(VcB2>kwﰥHi3&^6hR*r'|ej!I< B vU KأoV} xYsАp9@bѤ;ip˔7wLԌU9znݵQ:BM~0cUT֭?ļsA.r <҉y#: =}Ll C`ݖSQmsH9z!I-Ҡg'm=;QR+S![_+#[{OjT| I_j UR4>h/i!NM<#6T{$o#%= uأ*vrҫǒ!__[ 0 mVuZA%'N)\vCh-GisxxVMu}EzɄxG \ B0GK9(4WJd4| tnt~ ǝ(fIȠ٬:s%|ڃrĺ@LB7.B,Fsz:jK $מPcebCu>c6Zdztts|ު0^Y2؆WꊌCpR{zjֈ/4okZRc@FJ20dA|go\ }v,僶Y,ęg۝H؋J; S8Cz&V-洁yLWQ jI.[4ur,}C8,bn7Y/81;!sb5]U[9̠C6+o&ʔ1q$M=^c+n?q;׭)p3G{6ߞQexHQ"ʣ o7V`+oG.¸ʚ ,L iaY?b*Y 1nb×eZ_?FqEb\vn| N8Q<DOkSdTto/Ktgڳ,!剠US;Im a iN3ar)Q[aP=v2(AN S5K lGH֝evKVy ct;IC#OL^?qhv,~l?L{~~B%t50)3okF#abZCa!3;0QEMT g'}ig5(py2H\<ÐDP,aiIN=h~͌oDo(::7b]f((`%5N%\~/.-Oj99ȑRr2ɯG$$E;\n)mKX}?!zMUifMcVQS\O"HkieߔYYvyL1?p~بԫ.¦&qϫ/on4u;2,Z Ah6ŭq$Dh"ASKq@hIR) wqGLdQBn[_< <: ,H߅8yhyzttnΚĢԓ}^sl}KSG!g3ݺ$R6ҟvv3-Cgg9վEᵷtwjvzMOԵi C+*qT||kDՁZi 2ǰ`IÔ.m,'elPjƆùMwBU?S^'\MQj{Е\ǐIَ)?AL`OBR>>"gfxEwfW.>VY7U0?3ɸ7;ii c#|I5p1$z}jAaЎxn 쒍#1# J +1T=cG`ŊU#T:!>uR ѾY㇝)<ήPf+z:ߡr)&##d<,R[-.Rd>J /S7fAIBđx޿۰ 7 d jj1 OQ'g5։/!6JTРOb/=m̕{V 'Hs%.,g>hږ'~ڜNcw:E]QT% <7թ*۹{&ӐA c^3ɳSGm"$Є \Wp q $2vSP%^%]BU4 qԕ^vQ,wdF7FNg.Xz;A/eq8>d{=0 cg m9zEe~} P v7}#[c Oa$#A`c)LE)28Y?g>4UGpN}S`t7J sw)$ŇWb 1-*#D;-B%NiZT)N X䝍 ^# # .fS3ijWJBM c~abULM`uqTK*ij0Ku 5 p,ó\uW٭^c͍W_ #_&x *{b&9q\<$l5RQ݂G!ˇE?1N^D;q?<% A\r:ڼ:O6@nXKS]/g.*UdXͥ(?H!}O{z\MEO4_)3H໙5"^c2l @:CBg yCZLfq&d)}iAiZ!* =z&RϜ}ZTƕ6Ri8b@$2 p?3ՉDLr>@(*%q)MwZWMw眛;|GjZX\A&duSZy149R@Ħ/Mw Ǡ>?7x! (uO=ov\|OH}8"`RaATw"e.fn u癇h I-9&`GbdJB K{Mw ` !ʪ@x8$(5j]X,7hb(a"+2GQ̤q=(ۭE^!N4QkZCZBLD1$4M/ Tnq!#ҩ pmrɇwˠx. s쨃|#W!3z;-G @)ӿj24$t5]^Jb|ȱ&m㿠jtxVaf~q2?5E Sazbr}Q UR] ھ샓7s7i”5y ıDzJD #9THh]t:st.&G4c%[+g8JF.܄f{>U$1G< qj(1$x7KZf7b2vK;m1?42N|U]8h)a2.".W=wfmP{*Y0Td?m$S՜'H.o>:[<,X̥i _r'y:عe8.gV[:d4DTxa1*/GRv}[*K78f=k}O|*LNDwnyaâN"fs&`@KYY`ARGUJ4N.]4V5RPXsiCWsm5˟0oƥ&ȣudeF31apaΔGh m/Zf;gva[۰|LؼQTťX.ZEy6KUcub!N?^vHj9WUmmd@0l+g}6j1B͢s lwYJ5Լzo4*L(N[rOV\niJm >~>R@ZOqge<^ôMnd\5OPP Un7o1<2Ro c [ i}ZS<(_nҵTP:Q,bOtYS*v$x2)EO4R.`$|,,C,YU Xq~K{͉߲>\[OX3+(U;ehW^bAjI5R!͹)h*G1WA!Z$S4n>Kx014`%@D,`A[߅8!$0Kgy/1{FI׉v8@J 9ꀓ406fd[0_a3` ȉo׳Ec0T;#&FGQq5Pc]^$|Bjogq^P%}.f-1B賊ғAZgf[$J^~3zָwB?Úb]c9냷BcnU<^7^o]BA 鮻$qiY fɪLw5# e=N^ez66CIw̄Vd&Na_"u1H|m+ crt؁Ge5.h({rHo0u6b\QcVKgUOH[a錬'0)i̬aehi2BEPZ#roykuӏL kq൬&`ZNw(=3hw"gMIwƳ-Rcb.lۛ^?b":׹=2yc2e=ĕ+T8VmC ɡŔ#d'0> \wZT',Sbg-(J|~|g4hL=(_TY2K`IsNm$y}Z4T :}Wյ gEg[SW(TI9ekq`Yhx'nwPN'm@Raos#i?6]cOܗGr4SގjrؽmVf릫rc­/eVdJH;/QjܮkaLryl݊o(f&(2@M4< 3͉ vJMTժ TĈqGLb OuTa`< ~yࠞ 9ȺPǧGwqq~hYb`+bAL]2R|4tu ~|S ~*$e NlZ$z+|MHn :~GjՂr2}L/XFQbo E^`"Gͯ/HE͉U5ts^3**T&cD1uS&cQdG]TeB"\(a=,mP-_* ]캃u䳢rhJϼs>R,p]fjuZChڈ'}ۼl80=X}{M-gⶼoZU#_,S\AWRꢌWBb@a̹6$:*F-|EsH}\J>ͽF]](#.nǼO:G4UP$4v/&)b[רK$;[=hb8ʢg{P ė}7nXqK3: vKQ& jM"||`tTSMN#M3]n1?F9uDtg,Lۜ14'SFW|p[kTL?Hc<2ZԨ0)"$A\9:.w]Bvu/CC!HW=5 ߬~? iOYd(Aηjquh7xd*gEBXptTVWf=fe ζ-USRH]* pU(Se2ӾU\dfe&|1=k,*lɋal}0]-5?zڕcf,}g+injϸ%wbf#=Z 3PqGQ>:&CaN!4jq;Z0f#T\{ @!&pDIoYU2%l#.pՍiB%ˣļ{T]Kx_F\83)mͺE#Ӌ.{MH?pE$Ё+UIQn*^ Őҷ"(|ē8$ÖkImB2y(OJ}t Ur vF}R"}[{b8ipC oQM궽 x¯"EÚ`;Xth}ҫ{,r}75x_v6><(AA]R`TwE}kQ CԔYWxဧ3RÈzI$d:"p_d4+ *cJX%]6MGH 8GQ|YE[#i4d|ՃX$Z* G Cf6<&n%S{pe b {.kzo*b8 {O7曗ҵчrSʩ:҇T7R=53EI$51RЬ&0fkL2m2>Vʦ4 ad9H kn}Cqgc21_?Uj|Ypon^'l %䆞f@?44i J$k8k ܌q`b7B937MRxeWۙNۭ{;yۇmhNJ&Vk~bεM2m#87"ISyG@-fŔ3N?HFt}UL.Ix:N7}Zc,%@pGV3\$t4jOSMt-uf(i!qKEG;Vc!.62:lP&KKg8ƓXy  tKsشa(|u B&ED' ;q">_.i+|I"6Z'ajKFσA|HBml,KqL6Oc&y%gyʒڑ`Ã@5L,ő`h0xtI6tCٹڿ(Tht\%KDz~@zU6cp4R%'>#.ucjL:J>05s%vnJ9wjMC|XUDp:uQiK:xvdC#ڰH5,O0nH 냊F+[ b3Ѯ>lwkE*yivOmr h.j -CS;q6ufX%o)p@[.Wf>XQ-,-xݪ0%0!ajv4 KPTQ dV·J)y?a.|oeWRQ+ٞ@aob?X5$  S{MAF,8mOSC@P $JP Ki w 4\@nv؎3S]~FʢNs'8F5g#J ëDjh<ka}`O8̢5CUdkkYe";nYs1ĹGgh8l>LnUgK0;ݫFpt"t+prlbf̬Z~\C~idr?i/J$0`Eдȯ`?_zR#mt#* \F]d1-5{7 J Zo04ނm;p2J@uG{"=_:rB XqSU W1ZŤAg2T0+Ϧ~.E MI:_8cl %X%%AʤBՠXʦ?X䞃 0xKqC1` bf`Z+z14%D+5/\#:j!Z+l˪'NQFX,۶0$@LV"I58+RW?4,DҘPb%̭| "[M) ,vUD%$ߝӗ[T7 VaҘ!&\>ըf9OQ]dw铪'$2vLx*jntz̵eN]b'R:iBc)+Oh}bWS7(5 330;Td'!Swv(L )큸dc|;e y w1+UK_uGh{F~iR]xb^F=BWACſ2,P8BBƟ=?LjXߒ Aَ$ (#IaN49<U_]tE'&MȮʏ1M5m ATUs%pij{FkM&U6\n ,CXT v5yMjLH I_Ϥi#FfPp[gL.^E]jrO7=<- y&Z2&`pH,6Tqi ؾ uJ<+fh~Ugg^/+MlWz ۓq&s;Q7TX\}b^ zNu}t ~`XɁ#s{/70a@J"ch`S_bol-v+"JU~ktX2e= xx< mC8&TGt]](Wμd*&Iώ((ɇQ\1#d X~ɪ=L>+DqU1 ꓻNע>ޖn.-IH4^L =K9$Ǵ1wjNp,6hLS!R/\į-uz?fuRv,YW%΀ikɇf8cIV8u{UT=j3vuS:Jۣ/U3).eGD/gGQ4]|Ȍ9>| FwYxg/jmz!yUqٜ.5s|N>\L39B/e`u[v9HVv6t9OnH .3s OTgrgJElQ3d`H3/gv\n݊E9.!O \4Y$ ]in*R3 3Nɐ\5(ݳXE#nBWV/ΓL|k D~Q%%Bpg6ai<.DǪӨK*'tm DkH[ȔBʏwTNezp@:; N@ȷCob\s7>b,Hg4h0q h FSLJ ۭ'۵."J5W]KmR Y da:W;|xcwHC(IAt-cE ҉1O}f"qMZp,Jŷ!D V f_V}$,⺡$e ;H*ikFc^="4w,\ul`3@5Uxj$,#֜f65mƀ 2$.X7mAjy C'ԛv%"yl#`"=4{:gr} 7Cѝ؁JyNܽZ}TNQzO*ҦNArr\큌yԂ?KRz9F_^ӟN2(*sV[xsgwϮ$_R=r0?9](j{Q B? 1WS1 #+J2GnxV[cg)*N0XLB+FWlᱴ?nAv}]L;;d{/AuUJ1z cV޻k@Geg=ׂOmGIlOoo[>lELi}@-?#$+!:lq_ `B4ɨqD; " J =!q#DC`U>Εq?VV鮞LɜsrgH0):r?'Sڐ? P݋/8` cc]u]x3džv8]n97BzNQ*+ǽZJ2DOxݔ4.䤫G(IVzG}­FWVd.JF'Jɏ?!rgR+MZ}D 7PZ CvQ\FLĐ,;m*;q:p?A{:B[Q2VhJ\ c3bC^~Y߅FDZº&(x9=W'|-Thj$&G`t14CӨFDў}0!-Įl A@|}~qnkyPyž0tvO4X[H\Yz//Q"<*(s!^Q!$OS>1v۰yG%`jQ EGK\}j/wkF~Br<}A i.hPjncymUIƚwo4 7u$S#m|vknp.|' [/OXޑwhh"yZ5{P!޻;WB]H!qOwe6k-<Ǘ[7}ɭVaX> 4{Pr̞&̻d-K/ $bAזXeq.Qc nbs4oc}^)l-e 0.4e*EɹYTяt-wv*_wUrY"[Cs!!j/7?f̫ԐGױ%Hpr2|2꒥E5)S C(x`<;.fP cyOśɅCqͰG$tbǸtN|C(Y[LDR/ȥ.ٍO6!+Yh1|O[VOj@n(*/]?j}! MoyI8U/mdK1R& ѰF'oJGaJW.&-䔫p@pRY7;ݎ'FWf]3T[Z,6y ]M){^!=*%* t2yE;=O.1N ]Kg٠8ƻ85Z(1hRZEdQوigI&cmEuab皺{q7*[p&a* {:Q/!b8W1X9MR&_6Mo^!eaYǥ7EH}->'&ܬBQ;$\F1 (]:x%ÐfrRode ͈~ v}D'9O_/wdW-P\Z/ʓ{3E)E-#cڀy5jMh,.+f,L߰Gx{,J}#TފEbӐaO`,s!qЂט;ެ.{a"2M ;\=}zyWv*რTݽ3|n:/F[%$0%~I7}Nl1.2-J1a܂}*G].@' \"(ǸQ}=J^L]s@>qIM6g4МJ1 ' .'~$hz\qR݈zeu[Oh,nU}8~,Qu'ɽ `:v[sh<@u%cفf(ɳx"i.*ݨin>7kOOwjB hZjKRQTBweNno?Zuq]DͲDzt 74BdY~ڿ|KԱGtxR?SxmMEdSQi.L{[M輓I}s ebbM}Ohbm0eSgHh͂%aWgU e~&ج A!`iC׀d-h~:due4wxL[_G Rt _ yb$JlϣF~s Q%$C{BGqg;蹭ނqIhOc"p`Kn4 1{;)SbKA\l^f< ז)W7/"=44Fmx38Yj:S5sB4%zr$@SqظV\i˕ҿ#b;Q0XɪJE[]q7';f WOƎ%zd}q03$OQ/ X\yU\Tv+Cig],vC|??o6"z4>ٿ3'5o8du/O1@\9Ky%C%$nV qɪ4H%Y)rk)%LLB#q?Hd=2YrHk^ge~Ozޛzq6^~*2]_^=/uvTŠ[jVqw 'uvmFWP\[iCz8) 7W1TvQA[׀m`5 pcV#-1(R ]/λ e߄_n!|6W%cфmrF^VVnGQ2Jv8VMxZE] zW|c'jBat/,LPr_2?*tu:] ?ej?@0@ܳ#!Ny7WME6)ZE֝n7H鷆)c]A Uȵ>Pu 9W`ft)f&OA&Vs:,x٤UQTBl~=쳘Πj4|mjaPڦJa蠻L閤Ui'0?W gGH8:,Ta;M]7&3@3Gƛ*KԊ$.Zt׮AcFi\wYw, .8m@/綶P+ M'[, G.znLhqopiܿF>KN;RB d3;ZtXHS⬐$jxkqJfۗƏ܆f.tຩD5Y7~θ;/=! +^2GdYU"\S~,TF.*$[u&;TbqQ?\zusv>%{a)~؍E217t ߲Ij9 m?,8]{^=T:ru 6*Zen+A*2]f7!M7W/}GH?M 84x*E5 ۾"i╬ -o>]i`A3)>C1/iU,Bn c" N-GJ֝Çxb%?Fj>#La53zD `L|ڷFɻP,TmFAx{~݀Х_R=ap`L:>]JtF\xxm]rn;$NE7zȤc"zG>HE[e uE_KnZ W 8jMT3&[3pfB"5G{ 13Уzu݋˵k}!+T4{.O$aEj]؎FS-1Uй;iLt@]eSo6 &]0ˈ]X>ɀBrcԠlV h#JdU-m3򰢷;m8:n:&*/j|r=O9yaAI7we&n榒p=ÀQH?P}"2c5|PJSNnw.Wl!uJN^@7Brq%1 hs+^[uyc(:RgO{s(# -R܈xJ4f37.UTl@ڙ8)ƆvВSTʤ֫HiV]wl0MTzYAmeo4'ۺ;zcT)D99 e\|i%$~ِ^O@%F2Ju|%Lt^:f*"s4[R6qc7sp~ǔ";WTRW/eyإ.vӯNQrbˡBɹc0D$) %Y ]mle"ゆOsHJW{+bXMx=$tLTv6STqT/ۏᘙ ߝh,58GF5ZCFt.M+͜g@ݢSMDEpy.gٓYDfC#f]= ʞ L۹ˢlCyw"*\@/{qd!i:tᕮ!%a x|>6Pٽ^jگp&g PAsށŏp*R"@cu:r0(Y(ִee,BeEC`Q[Eą0%?R/]XNCí3_jU*̠3صuc옴tĴ؉ƪ-PL|kL34PSɵ)C<1jEsva:5/QɅy9dHss_;MJp{Y;!t( >Kˤux5C +)rlKZ.Vr3F 9A{AG ʖI+7r"p1W{'lA^I[aCJg/<,lܰaI}(;&dCm8e0[M0I .C<)^/P}@a=sz𿎻Leː@go$XSOeYug3US24)-@e(fm,.֪ȥ>՗~č "}-3/!k4>Gt5*ĦWDYg CVd<O8t^smog=]BR b?Qx&2p#ߋ qɜ'{c%jqdzuiOI]㩱C/"șoNe\*wlZߏ\5Q13i ^@(02~)C=ZY8%Q8"S?,̨ʇ't*%OU(;;= kbm\~V%ͻ%ɤqE 0WٮK逧<#M8'bѳA?J0B'_GV*.i擕K@Qbw#*22(@DWJN+WX;}?Y(o)*٠4?j{O],)t:6NXhbE S~Mm=qg>,mKN46(zF!s,&v7p^6Y ;y% vy8,Qt@ApB 4#&Jn)=X|^A/kg=(D.c>8IYɉAQdPڛ_-3}ِV]{/\gPg XVyC͌3 g ;1c]sהKs{MBhkt:JSn5Q>OtgBz0:&4cL_WSUOSG(ůđ4IykVw%[S"EEh⑃!x8/.SP.sшg'\,xkOڋ';d}VLQo-~i "IgE5R1QI!K4ʮF0{%Lc:Gӭ9acDhOg9lB/ve+:Sj#Ǧy M̀$oF3 ιv$ܘNjyɹ]􂧷`QsK>(ic#PlsWcf 3|G"۠#S;4KyFP$7"{.\Liz&X A2Gn*joߨKgwfǨٳE12ZRcgLA(=z@"O-_X9-쇙㻏u9%Zm~lzhV*QӒu tF7yu&OX8 eކ|􏩟$!8p_,5$N߁z9]rÁQZ}(glǾ+QBu,^q$z)3y*2q6fІB.Aqs9 \& } 'Zf}4vB.o_ΏE=+T mvYXsrf.ʷJG5`2c5`b IFQzNx)w'~qX&v΅fjB]P&dN`~Ј 8u5.],gK_ Ѣ;gkfwK-)E_KZr[ ֘Q.*.dţ "T? ÒpuTuPVc֩</V.&5o5|(W'f (˄}Ϲ[|QtUGP,v!̛@!T,}OR%{ڷ~S;$ìCH hSK@鐆Tk(qhg/|E"ay+GUmJw$ÜR 4nl$X*R IisIAx]0DhSޛFe>i-ga(%ݹx{ϻ[w-A?s*΀% f: 7+3nl&[r:3SǬ52%q~?f3ah5|PO9 `+ @|?q8gtm9o4y?}"-LJy:V>YE;h3=)vK#;'e@c^79+u%(4.ꄮ'S3̱KtAEQ05O]ٶ }}L#1H0J^q@n;pmn^%& ߇C%iz1_1ۥ rh0%GiƱ\we]MdnzR#(v-=9[L_(곓@@;ڣb\FB0`s'f ƅ>;JtܐE ד=(MكEv8-nh-,~X̰b 'o~Nh 4WQ&ω⩻Tum;S$6ݤ([?k%_xJjV 38.#?5n~ MiY P@}WNQjxZar]o۠-kR OⓣF!dQ98@34%j,l\pHO{IȠ[)mz%1fAB ѳ[AH qWLǥ-``wVft̹l>Xł⒖&+ V,Q޵bmwxX6ns2ˆ#d]?lJ,IЯW(GV^%AMAV qZ{HRsGsG0gtM9Jƣ0t#YCJm-WXNX e}<-v 0'Y%QlG[6gx>}e,SB!fPEK*e2P_z[ne'T_ոlKo\m/Qk> )VDkbΝ:7h\Iu&ӌ qDT*X]<=4M(L$ n>@ &UhЎ$KR"Z14H=q.a$ɴo:g#iKWV0KVsyjq,6f jV$DzŗS֥c Ao61`lZޚRkɾy.\#,^IYt4?Hm1~2:"^C$-_(qM+)ԋOkL%~=eZT ;j(Na*bCQ茙J$mrU)u:GSTk*D਑CTg`˛*3D}8uW%>P㈾+·&8( Ԅ%].Ӹ4IBLj-$6ϛ.P>M'9N 7{kј 2Dl`*$ᄰ|[j_BAvƙ1"7dVe1m2`X[#Y9-4b[fRK ozӽε5:^G{gIC23V:ҋ{d/MBg:jʱd3נ֑c3@b'QJ - &HҾJr:WQ'HE4&Ӄ PoA{쐁K %Do[YƉ_;;=(e5.O7'۶qh{V]Zl@HJuq p0̮Ϧ0;LhْZ}Z_|g.+l)o !j5V]hUb|5"TDé:ж<|wJI5fȒo ZC.Ey]jF9y^U9]-Cܹ~ 8jOUGE + 0V&Xs|!#nKwcDQ[Tj:E)RI^n jlhAz9o%믖EüǕӣR50'NHZfOCްVu2x$5@jﰃ&~ y.C4W\1jӌ(A(SP޻ XP-9o"ZX0"9Y\ -3iGYf8,@5GjT$aU4 %͍ƻ6SUD!Hꘑ+~3jt> 8_V g9I[~0<=f6ɡiq|$-z4wnF֥Aʼh6≠]GFW!S?T"f5 邳5o]׺7h=Hj]H^Q*sr9@53# ?9n$r(+޺i9TTF&wt;peoY, /Y.u=`uQ5Q+}WQf7H t"1P]i nQ̔!SRKI4Fxz`&gr&!-Tdc'Qdy D=EW3n^rtusl4_8-0!C:5MϼKEü}yP sc:KP 3=,ިG[lXCw;Vjv Q)`Ʌ"mu*P%GBSK.el{z[X~'i՗ 1"o޷ *CN <0&˱sAGsI)S|Ij =5n|pNuH͢A"Ǚ5c/. ϖ2r6Yfv1([QE:v !səԜ'X [ #?xۛ[1jyI#sN"SuyuTtI[oL-\*ᢘٙLg3#ǹO_b]z?V5=p&%ph93wFFceXUˆ>.J&_6}e` 2$޽͍St a\a~I50 gPn_>yX\?-GyHm+!辜MS Oւ3y жEKmny|@p>b."<0+ŻxLl)EYY!qRءkZZf԰7qkNj0̬s}uK dV &Aqf6_\D_v坉c/i-{2c~7XCQyxƑcwDnhICDSyg*b)K9)^rejOLN)Όsr٠X8p9 r:*!9A@0 *v6B+x@L8%W`6xBE;|R'1x\cCQnnȝ2{Sރ-ˎ-$^2u\Zl0_Jt/iʲ`:0. sa/o♠LJs/)C0_ ],>n?'m53pKܐj1ӻ0@7Sݝ|`_-ΝWCYee}BW}ŤN;5d:tF˨NweL;XY!!pQHM;3]la 3_N+.XOɭs{be)͸oE..ƥ/ZH]%s0b$7ҒȾUڵdɭjsi1df#gp&+vDRbo5h""2O'h/Ly?-'oTlnKG@ -?,V ygT~-"D?>F[[ZIIVz7 ^sڳ%>~/qT+ J]E)ʷ R[m]>֕<o~1HSG2۪-hh1?aȼpC_wẻpsB \#ꄤ`mJe^LPH?5ƠeM=$htGrPW[_Գ0F.ӵO+&̽=Uvd3QcLqs>_$wU#1RPת*U00~lėHGoRwa0~16OQ_oڵkj&p=DX]sR' B1Wbb-M;U&|x9/23 T{5ۨx*IQ%}QJ:8\z?Ͽ`_a 7DrW՜tClzI&(m7@5A67C@կCm*<6L 6Dr(Sk;tBHA/w;CĢP yRҖ;Ju;0 ֿ"\-0qn_jԂ1{c5Z&g8}Ņf/L0gagAD!g=չY+#Y $ix3gOXPMڷ5ePbۿpf_=ԏY$>)eZR? ``oԻ2/|6 P5@L8"- % ZJ\7AQأS&*b_ȃxE(S ͖y廘Yrq8e/YUmI,mr_+SQ,kJ*z)hPFϲrQ))ÔQU]8܈C[v9 W@` Y׀5>Fa0on)SXDof v3\hJW|WsUwn$oTeaYrPx@zgiζ,dq A_T|Bռuhʩ| eK˲7--[ /_eT)+W5 0j 6bFE-rţ6ix "߶@PW~y" [Rʞ~ C,POM@k顭rM-Z/S5zOH5H_MqDYFC %B M.}ؙXwnJwqmդC|HְpݲmilI:0nNʀRFߙ͓֓!t. 7c}O=`;fS$yӭ2MHÇdLTJ.,<{$4R6VaE\iL14O6a<~SUP0~NnUpJcCB~HMv0;@U_;*9u U^6t8H&W]4t mrragc3 p2C#{lo,z}]Qân `7 G@uTM9˜[} 8emB܍J\S ?AʳLT X"p59 '? e4 T|";3 01T mb XUOL,4h~q~IguИPfo\Pyq?u49nƍ᳧I$V#.Q>rtd!E`=МPzL>z}l Ih3Yiz7'DC]W|1) W(ȥ5 kyZ #zm[/_Ʒo;鏻vm|Ձ"YQ0*MdŭhYq ;*3*y@ "OU&vzCъ>eW')9c@CT(+% /g$SleۊS»G{'S'bTM=tKW0+/NôNPar`Єe;a~y%!\E5K`0nql5ÔMB0nY*Z$05>X\9vd&6ɂD/N',UZsb:/w6A xJXE͵Km#(2h LaJAN6i&h_@"8ᕏzMl:.I!Ϣfvv8'>ua9"{C_T:[ʻ']73Kw Lf$lƐ GLY Il%%;?vՓBz:DS><9D64/%--3/K9vz>b#Jz 1Aq7*!6L21 VIM ǹ>ۚQm-Vr-giAҰ=R+sN8{B=0=mǫd 3M(1[?p-xDYK^N }Gcp̔qB0z" bfd3YJH "Z~30 fXL.Ř.@TeBYn\ k ^.)"ur,?iYTyR^"ŇpNPFӼLcq#Aern"P~,S G.gx[e%˷v TQvugy[ʘyE%@gA{X8N:,NvH8jÇrutqYyhb}T#gG` TB@3bn 3:νVs0'tx2rƚcI(SJewow0{o y'*x={fi*CqR zUq 5* 99xM|}PYuEPZwԭl! Z\xۭR(E1ALr›Ox8PxkB6^ԿgA^>Xky^BB)erK/I8ih=aoSșap'.v>j }T3+sxzI( *N U_fCq,+'oK|+f,pLJ o ;0t+iaͰg⥊5c:[~郜a!^k20"]rQ_.`] gX7TĿy ~|L`/SMT KZӹN+ Zu/aҭ}Z1yj/B ʇMX Ó:G˩ۨ0Ō넽i2h &{kDVE@)U})SG2n aqx/,*?T xYq!fH0!9Yx/qPAڦ!ȋ_Z\'ɚ(L5ϸ###cgΧ&B34tfDariQzA^ h5*7VF:"t~ ʕWJAݚx^j\泮'P:D?vOf`d*E ?VK~p.ּp"@3\Q^g{e-wNfjR9] Rm9(lxc?@\O&5~ߠ Z4$]'zĤdl_AՃ?^2vyr:iWe|(wYjX@❛(Y,t(nq/pťP8O@;=^A>qqC?x(`VFAG+4&&ĕRNaX3k.]Gs:"P8OEr۫sQGK\.=UjgYǡG]\g&O`t޶UQ6+ڻ?*@Je~9BU׀M+ EF#WNJa%Loz,ŽSgkhaG\$zѴ}F& 辌)]3؅#VJp F6Bx )c&Zԑw'+]tSZJ jfL6bxZ};BLH~`zoO8pbkL"Bso~; zWW9V6O YnMql?]RvmVZ{$aUw)זj<;%l|ys FLCZhYp>v7A7ӟwt7XbYBz@sXh=Z%/Vi[ HsV.m}4'8%~}wQ >RFH(ka~%)y"2Fٚ~ x[2+X@;Ed4WR($(몂#Vrǻq4"Xۛ:UߘL_aPިCL tv&N`vXI5Tpȶ&E#{ĬDz =1}=U 0ҭCmOls:@kNzqT$UȦ~Ed#c9qͷśE]6W}.';8U18FTġ:+Gz*qNX}- "ٶl ~|@Ы16&vDC論"in,RM1Ѥ ",ؚy׽HԌvxu.Ǵ":3A4&g*vDVw|}k:3fyIIQKXR4†$bC0ӳ[vJ ~اA;)ր.JP_omp"] ̐LX,7N,Ѯa7?KjtCY}hv$gfjI$NeGD~5.>tk>%45.F`Q^J(咈s &Nwt}0 PYtŔ4tQ!x7rnyxֳ1,*P,~uϡK}.z쏗gϩmEkܯǧC q,k*wksS({$UUVr'i^v٪=_CPED&NSآS{ht[*B<wAA Kp_SFM3I' nQ"YQFf{⫏GL^K;0~)V.xb"8v >KW\! M\Ux񴣶D#!׶Glc7 ;i,NX:2-3l9(VWQF1[ˤ:!7v0KFL<fOB0*!Ha8S Z C)`h¸)ʑ<8[9&p349~a=QG6 bW8E#N1#7kl*E#4H5F$_π{ &uR$#BVq&J~fw؟+~0,ʯ:2QG[FA_AR<*"4$ ] C"&;RZbZ.cѴgډ>V VA"+X K LPؙAT\a AfgQԡ߷ЖC%V+VȈACH|]`h(}ɮgn*}[=E`!1S <D{B 6 VlM&<]fFĨ- VDpϳvaJ嚺c}8 L 2X 8JK#RA~QAҨ<{gA]Nl.9{DRXlPS%١6զt c|A(}@Zqo.1}w?rtke{zTc@/N۔qG U~/y&SVöu$ڝĠ3Ǫ"w7`L* \ ~1>J DūIdb]_#ݏDL22A) Ft6^'NBa³LI}V5o!tU=ڍ׭DˣLsH~/=[n_R#8tKs} l X2o BrB6*Z  %d'/`xP[4_W@)?szًc5Gk5hvŸRFM ;4}Եrqo&cR賐=74O OVCI7-J*UFSrѦV2="SMЕL0&bTֺx@px)Ydnp rzEO0ό mYTmJ hWDm𾴷.I߃κBK M3@\A8W@T4{o[:::ʌF' .l)K:J_O(T~:DnjY#W]ER}:pRф?yaM= _kwHDqG"|5&׃\ o ;7Ԅ@$I)tQ.mx$3>Yx~ӀrL튡ۘ^ eڣ#w&Ǫȝg)-%ϪXڷj붊a*^,viI$}Q&|@՝t.Xk-N<b^z_RT@ ?GNHqda .rNM̵_.$<&"i6}z#(9`$SasvhBMD;eF%V6hXk'j5!ucڧ5H7{hQXjoFәN#]KIMF;qRzrMbQ>j%w;E$[~bgwi)R*ȒE/f@JWF'܈ a*? ؛tx<Jo=uˊ`qPZ'0v=zQMmĴ^4Yœf(! 2Np XҞR^y"8{_vmTu~XI9[eyf<;el#k`G̑#A;M|qErI.htJ(ip7BQ%m}G$1})$tvzVpv 6wn)JEAO/hZ3zq\+0 iv e3Ƽ/77,m\tb @wZ!WGɲ,8kʱFuAhu<^&a[F"fPʫSTb5c^S#,/D'vF7k(ᦶwNӻ,0Rįp*DQ˨?;7 Dz]rH8"zֿ'i_.pZ#(7ŗ.QLyu9ըQ] ="짛 md6aA@LOd$ۍ6NwM҆?!dQMVuQzWpθaWXV&WױcBOAc`S@faqFZ]GDŽƇǜN_ۣ<n~ >[OiG9BDW(}kt P.XJUٺ krUWCEWZAn {`uwn@A)mwMQkduZb/pD\D NVl0c !EX*Wʓ$q~P '$}9/ 5ޔmhڿdqc Q]J;R,2p38V'@N!;Hz%>̪uf4*LV ⭑ȅ@;㦐j`@R/…*;֜\>D6b{jZV$^ɯ(_RaΏZDyH-=mjJm傪k"z.hod?~m1JvTI,;AI smLVBBc, gkW!&Rp؛W[8a.t(%_0^MpC2*9tm__qRt(ծ2;?ɣX?m0,ȗTtD kҜ B7sԕ™:"Υ>le:b-U( 4o)xc0˥W`lNEKYVZJ/$Eef4N|[v_2N'šbuͅz5.Fr''Ǖ쀸އ'g&O(>!-^rs7#ǠIOlWHRSSlgà_aL.s3zDbڋrwV'@\YHu&T5qi#2A{'n L0ftɟv>S㯩dϫӪ>Iʧ~SV! z_ Er;G4xFJE#˃;aySExg-V}a2 ߲ܳ.nSbO%vcHi ) QG)G{4_\&S]/Pq-DT_` pۻ(_$Uέn ,{+8Vĵ(yDfWmjBo(mG_y͉eQʇ z>Ƀ"L'Vz ? kע64}'10VIJ*/*rEY,n,]ǍDجbs8`֤N4pԻ,M셕Ȳiu8"Cm?ҖG֎)$$Bo9>We}?dRR 7i˞(%L5+v)D%tMmQ=wzZ%~tBʻBphSz1TN57sŶ*!=AXmaL ;P3ޘɚC@JYb={m2& 3\(o(u˞\rRE>kijLk|2ww9p@ -v8TeS֟2g/9V.0B5ONKX?Z.z~|D:'E^:) `VdSjv,c"Y3^h4C7%dP06\D&UdIOh2ָw6 "]T4Qfn?LQqUd>CY-Y[nz^20^jIOЍ~tw8GSB` e+0B&a l1]PZY^JuW&}W5r*|i1? 9B(I340jc$UĪ|!rW5<,)^Ono|˗V|3Aڈ}$|FS8r8֛Dx8Kpty_ *>ɤ}lTVBqwf{VA>d@P-牂m=K,gW,N|fuP;!9O/aʨ6B9tSF9 YWfp"3~RO<zmq\P,pdy7PcKQ߬$3qQ,j ]q*oPF"Otݕ;ǯ[9, nA8,,^m3@HPv5cWܭǺ!ēfnV͉>2^߈dxRuL.׈w[p"-F6T/A3[ϐ94'IuZk*\N>sqcW;|>xk OݧFd1gN eA9Tܠ84w*Q=G5mQY*Oʇx*COn뷚֙l=V^EYr{();&eEᶝ UmL` 8SLWJ\'q:s(u&h}^KH 22ceٕaN= ( sY%2}$ow|gF(D"/^; k%\`_qMF&`-+tsN<66L^2OkT :"Yltn oK(zS*R^rg _JbzQtM>H-4$w[O,kE(d)o"KER|f!4 -y*+1tǿ} l;$ k℟ 9wpmX,7 uD>U;WigTN[az7."ե^vp(QO:t *mX $wr͜╦/ 61Uu'_1ڏsVB(.-} 57e 4774ڤ$u5C?@d la@4;FP-,?IU +Tx|$lny19'c 1{ޑG СCs,SIV,o=L_YwAH0{,L 9"VD5gh=)_<)*d*(xB2tg"hU-תCZ˗v]zTU@: @aPkct}Bv_P|pND8 6-oet`{fQ0/O#_ps2 1IŌ4 !k5J5a5.jڑny }Y+ŝتmPN\ jJaÆQ ;|@oD_ ZQպaUK}M8PۛwH~L{l+b hІxWq-!k<fj$2>hqb` (؅^i]R)P3 itkyo[k7}dY.ݟ4@FU0ilXT\U-"jQRaEf44g1pNqӏrMX$h+=ȔR ^Lk C(,*60:o J-#<3 W6+x$Kpͮ8b.P@. @^yz~HO>qґ1# l9[\k2$0__ V-i@sXHoW$t 'a+Fw lt~߅G1%|Vrv>fe{wj5"%sٯ:&Y!FH68  ZRfMP.#t}9V>QT- 6ˮv\ +᳐Wy-W"ߣ"/R G0H{Mpȍ M"p5fnqMi\~Z8>su}`h)%`΅.B#֐79'MQ[0(|-.Z=Ek0xxOh<ZQk?V/XWpZޯn]HilfSNdXҤ0r\7|5 Mf*:9UlWk\%T^rSV$wjgڵ1h.3/<0qӣ 3gL~hh PkC5M{jǁ5ֵ.8RƥZP^8s>I)e{ *i7['K7H_aa9&#ȭ'ItuPЙZCr6 cӗXpA HJ#wnpD]NIZDtr^p5 b`+FN~\ GJ/`? 7T3JTw"}g%湘w?uxiE|mip^Cp8fQ~Vzfy*&lۅ&ڳ>X2Кѥ8yEe;K> ztHwtd"0dkaZm i, W2l|ozU6_q_,l] '20'$p@i*|0g/Ɩ9aʰv%$@ K۟jdtrY3)S‘pԣm'O:a;7 *Bz4gQeI᷻>~Ny31ݨ$/VK:s!i΅il[AEDZx|rB|'BYd1KwI9G Zq>=QӄPrJ.b$*"m}+HmhTۜ( &;O,x|Di=wr?6T zf/YH a2j䬟Z6I"KC^s]bS p+0%5Q QLg5҉_`"郻R7j#0弿kA4iR o5/ﵞ9q_ln =]!XfNa &Nq]u償`O>(RR 0Op'ߢn168$|n$d01 X9,"ﳛs)((.n26KWߘAbzGq"<.[Ga4n޹%A#2)myBrp~f!BA=l-$釖v XO =IiPbp(~^U`$Me]g%({`TV2P? e/Z)gֻJ791`h?ZK)hA١v^qxQÌUHF){L[{Cȸ2-A Y͇iqֶ;ƈϔIX t#T88+hAB}n yP4F!䧉&Mx `S} dNgvO9v#1\(A: +'|YNKRġB/@GG)WJ ړ]O4VnoK Ɛ2"R+Z+\JۡiɍcF)RK& vN_fG龄{; gg76LY n]+pR͓JڙwJ|9rRCj|5ɯiXvΧŷ쳽C|綿Рe\g< If MaFwMMM2ZG7gf9KT+Q&Bpgo\tKe2q5d~'σC!w,)/h|N j25XbpLVM@߯$*Ji306:BJ(AEM0X #A0vĜVs}Qsѥ_+@hF6VES1]t~˻#dr/-(XFɫCXNH @.pI&l#:09:oe<2*e3ʶТKIqYd4 D Ay^y4dy>'NqW^Jam/~^m7S%k*0<AK$ǵ#^].GKg𓲺KI]XS dV$Z4}))m/RVχ:ey:[N$Bo;;'_Amr52mv WZ"x! 9|wG\u:;b @ B¥oܙ4O|MT^ƞn[&0Ny}g\q˵̃Nn0p$Fc{Sg#.\:pS ~՝(V6 _#f#2j=sZpȽ?>َJa40(gMsևJ\Å%UЬaL[svlt#޴JKv?͉KWyoXi\c'u#IV Q'TNe #p 7S oV>3a2Z{OEuG3AB302./zUZeq|FJг aUD<ew}F(]*8_[}]7EX.T$ǫO*E9{}ԿPbĞe&96 ߥ^JQ&,,e$om VPB:>F\c#q=JUwC1/]\e[,#IdĚݥRe}sDʜ`xM.rPM}`k%MzhLQ2{ ﮦ;ڎҹ2.ǽh-~HDTcQvb8rNꜾ=Ri(KcGc$cNĮV^O-43KIU,egvh E, |W1cݚ5l.@ 7Y@fT}o@> iE௿R(1# $$XBY>@L+9J#ߔ[= h_;GsfӤ!*)0bU jgs%-]kz qh0vqgڄ})o,ud=O0,f+V $hTuW'oK鉀RSL3Ԣir6 1wE*^ Aņ5f7M: sФʌuu&vy36gUAVWE췳$FAZ`nn Ƴn< s `}0WPuϵM eBs}~6bH#%nPܞdoJA`Jd0džr.7Uy+DMiRMʓBYSy*݄OӬ+FK\ja$3 1N)mĭK:_gH]G离]*DK441&>_g]'S|T!Km|!Klvz:*eWҦv5FzXZvlT'2f:XX։2Bm|i60"-P9m][8obg)SF ?8'Z$ jJQ͈IߡX76IPz ݢf!5bjl+^3̚?1Xⰶc4k|! J絬%|ĕx٤==r6({ LYd K%\K985J=JG"W/F1Z(CV!rj^}gp|%M >+N~ʭЀ [ S#| (3A7SC\:v_Hkfp=Ng92Mr)YzNSI6)`gU6"O|!'[/Lx<';~3Tg]mt~R^ԥ) h=`[ ZK x.K)'UCᲂ#<\6ug81hda=`$Mwٷ[|4wX?B>=r+U*fܪtKYߐj@B ኷G̸@wC!.qpcM?x.H_O+22}O~qYJ"P:?jC0t3^M C'%ok)+޳Gm-VjS (E7d2HIMcz&WTbm^|n}fm"L1s}h]sfXtmM_EW9a1XhɃI-Ɏd2|ٿZaK'9d/{qQߏ$.W^qL SdV h@(m?+TFMϖ;lOeJ:JS+Ǟ!c&"5LaNcN҃G*;!TLXVAS5XTЈBG(w'ʕxsTӷBU}MŴHo,M!t3TAy IbEPX"~/%ifuXIτ#dad[7OƬvq:.JE)- 7aHRN0WTh+H&wh~|$,T*@VE2ɂNl҇g!qDk'o"'J7^Z!Ӱ,˖&T6ky)@ Jg!f*RȨ7Lfk8Z• )S.a^G. ~kvtZ !,y[<goILלDa$TJ(nŴQgyP+H۞('+F=Tm6)3V:w>&4)1ʼn@iehsC6(Dhus0a-AZEt[7ώHL#3FVZoXӉA}ńW&eR'7m޷vtA,m~N 5Ư!YTx]ÿyj/eդ-$ˢ|0|8o^yiˋv"*̝r|vV%Ŷ*}J1@˧)_:2zS}İiu"ߝQHx`B~!O,S uْ͋{pE)mbhAf>_+ >6xuD_*/ + i`ZF1-xlg=L3P/'%O1"(LϘ[ao:Zf\z@_!J6 \Qk{O_YD>%Q>*ŗۡν55ؤ.`dvӿM@wL<$dao45_(oF%d?W4v'(l~l? ")تW_@S,Z+_3h1C; Ԥÿ/P?l\."Ӆ~ko H\ &koÛQ -OOogJ1Ҹř E$ ¬URi 0Ee[Z  F51Q=TcU!E r*H5x5p9=%РfzE6Id,sJ;GT^MQTV&0wpr!!W@;0%[8$`$llm˞nmfʢKh7XˬRyl[b-F.w@ Ɖ(o<߲RG3;#N:1{!'1.o Ɲ=6˙C_iLqdi~{ =]yZgLDݵ_ՔcIw G?: e Xfʞ9Ӌd` Y@@Ilu$q珊,8-q7Tk}YW3֨["Č?ikM.qhB<6mnI_Zs|k1"wrv`z!./څLˑj^J{! V@vNecP8pYD.p" KCnCFF%S(#;[Km0t1ګ\4%_$҈E" 6hh\_ʕ(NW8QjҠl@F;/드LlGI&B&R"׼ZiJ$aS]x%Q(N{U:,emn>fyp-L^e'AB)J.|˻zwkqIRXhm|-@i'' |C3[z!1ѦR M+Lk1W^[._[ګgx,b(ք-ʥwUxt :qQ@g~pP1#@z!(@Ȭ{zWPMf_gs>N1fOϧ4)ug"Zj{eG{s* wl3=]W.Ffz ]k3 [OUG#5kL˃~s7DmgKfesH9]+]fUN zBXαo0 Fl"-/}tn w|l 0(ML٪r"C版^YYVXA/{#8S$BހCJRo0$i=oF3y.b7h\&!B>w/Z,S iYv1Gyn39](O+i"nb !k3Өt ƌQ!ۓIݘ)Ƭ3Hsk}$;o@ d_OȰ<҉>p/A.% !{vRKyJQӡ3]߀ Ѫh<9h} vV.nKm!43Aʧ,XT12&$T_H~6rogWŰ"E-K+|@5،F-Ym0S5Z}7ZJ37yVQ[̝}wP9JD33|;0 փ[hI7+[u,Kģ`iqq6+tӹ!.A8?*z:Da w-O@?l"N=3\JKwRYSTSY5PǬ.b'&*[{ܷ+4w%;oJՒO V|bL;[n ݙ/`4V ǝŖ ?haѫONc8'+Mɥ-Y+VCA X:i6+yMЪD ̤xv,e . *Sku]=r~DTOrNݮ1 )4N$E8Հ~*LeQKP1XU2)?DO}pݴ?2jûLV^q?C/Y!Ћ_n^t$:͝<VdEN۹`8Yũi[4UY0 C$zu؀mLn; '&d6<tk$1>L!xYGV)e>?LyD'b|1-"& UKgan%)# mרF1D!y~jjMBJAw{2x.$P #E,{ntwPdϡ.%n_=24b Z㡎LЏF}J+[k{ɝY{)oZ@}Y»2VCY U` (`Ɠ`쾆YN@ӌRS1rZKºIw㴵7ю<'LMfLPa"}ooM}V~}=@RN@jEhܶ ʏ7sw49{>SFYs聾AHѹ4^ȇP󅯣f6R(L3EԂ{jP&^JIfF3g^;A wQj] %[OyTDž0t,)~5ݙf -Nܳ!\?c tvC-^k NI8$-)W˔"(gbFA%Tg D4]}-Aw;Xɀ<_L jj>akyK*!n $˱}D%oNS!8Z Zd ؄KÂ>47{e x?J#Qr|]l7SJOfTS䓖g*EC.[ڤR ֓C9v}>]^:4SԌiր. RT[*+/B|b'y|hJdm]`S>ᜐ-!pQ|"+PD2/Bh#Rt\`G;ҫPi8"{}z)A(sliU1ώU0نۧW\ CjBEGO{[GUl o%Q1X{>&e"On޹?7|%1*HԼAD}>lav5+ )dգWq&~u"{z=?{}i*X*?@G%2}e[^~GFoZx‚pΑG p[diSӹR 8ǝA*]QESTJUʜkc%zWe^lyKn?Um^1p4Qčq]M6>Dufg$Z5k'ne>lBYA=|c! _ 1vw6泯: a5nAJoFGw6`-si[ t3kkc)Ku[4evϺ袰"I̊ c1Z̀(>9>gCU?OܬGBLL ʊ?ǁ@2Ty?aAAQ@PS;Ԑ h~/FW]u'Zz(y}Fx9L"s pa€0֫c:ZhXADӈ.0@ Q{c՝4f'~taո+{+kƁw|}XL5Pq*@@+T"4,7i8( yjǹO,w-Y׬* FLdX{Ky. 4(ݲ-"kc R^L¦Hn@ F+|>P?xG^1٬ 1#q*kuSDN #J۹b- F&j:hT{0](7bW5O+1%U,3蝞qmo5hy|>LL P RsՖ6*ghk?ukDƅClxIfÊlP!ejqnV{sлQ6ȳru. 4GGs>[ǧ*b> ٣_*y㮝 css X@IG]%[ l)cX(wdޕ%; z ZAvhTxrUZT.]ܛy{4sWwˊ7HDO5rz+*VWn M{n,#*Se-RrLPhޭb9_LB6eQYp7 v^B,y_HGls Yؒ86;0; i.AtRhU=-]0%ZW?c9Z8o#n5_1%r<=VPS&V$[ЁT$-y댁Hɟ{v Y,o0 a);V{s(`_(\̜ti1Ϋ(ia𴃋,/Y+~qZVQkۯOhJ&]rɃO=+́ /ysD(|Ҝ{ʏx0ܬ(k~ltRTEvrGX~%~r3֜'0aR^=2If.((*GHOra{|R~}2iqs~~Zd0џ%M:=KrPy0peFD2W&ի&~ i$?/>xYH؇1f\L딅?ì6xY#:l*x- ,+S˭Z.`l[aj9pϷs(re}z|ZNW,ei8#`넋,ٹdvT$wnP%OT~g}֐Kf"|u i:=Ot18ڶ8]9I4dG:S W[Ey)]R ZJڝc$1S(5>n'G{m>'BM9Ez8Dki%TvO+>[YC WEy?#CoK>4EvFp)KЦ-l} %ӯyq^;0@QT E4qx-[hU+z.aI5ZcWш^QeSG[sW-_9($OE .٭K:}ӡRh'dȷ|gO"p!y&.Z0I# X;A}~(9 vKxi !lc{ҧ/Z]9FJ$|f¼+UgA˗t mgbϧ^a0@Ȓ]ka@72e4?P` 8%KSwe!1Y{|q)[[Z ILDXqxtB?~&O̷]LF#{p1d_, i@*#&dž3 p,^ &{ :^)mrlq?N-#a;|" Rۼ]wȒ&18t;3 DAF\n,;J?>F> mejVCTf&ۺіI*ɇ/nl;o3^mu5<i )_%Rq0iãOENKSp g1)mК,>$_ͺ?8$ <+#Ax${\Tv6]K#)vc,Va|du6el[8,8VCKدF֎{55v)H*f|n("]JI?;:ea_0d5ۤĖTR=C`(lX'e&::ᙁИ/9P"e-; ٝ? D?)9Oe.ae:OެW`nwWmA[Fq̓ҡ)9$WaM /xE!hYEXFZ..6BE` 2rW߫pG S"mHCKBw c`t ~A!4"pxUNn8~Kq8`I QLՏ_jmi[rāc'!g@ͨk"Rl _ Fj)hKUl r >qtR5VP,q[kOU+l q3lA7c=7&~F"6suJe"qqbY+jboEQv]I{Q=YD EM%Z BSb:!9u4q2j9խ(tdWV.̽.M3a_w['>$\5HwEO]6ӁAJL`rOPxi?ۭf7 䒫w}VڟΪH ,ae[|m>,v8HrNO!l};JD^l@jpXZmx)ß\{oB]4 P[ 7E@\G]Գj!?woŜرwFc+y(~IrhDpstrLޣGO`n9L&/*´>˝㑪_Jߊˬi0-ՌZ]ԼV0WӬUF_eV?Q*'h+NZϫd2 2\pYCHSG~ZGV؂ (ym9|e%2}JcU 56QXe㢗gu^Iz㥬.X,<1dEr9zbk$sغ2h"QoN-Fdu)t%k+:7B}=/p1ɯPK@"@Lwz8%yb5/~P/8~Dc~13+wLkaaXަ\049y֙ ;~G߅HKmwx\,qrFYJ)\bJе"mO Q~q0!EwlMi&KJ{TY\č3Vi-4 _1T4mdB0GJF_ oتd¥}f,uv`gB*-Vj#e6&uSɇ%5)/ҁ2K*'z6ujYZם2E@88L<: f77Z" ƺS 9iڿθdnqbFTtNڍdTRX\ɞiSfI Q!PWV_v?Rϲ"nRs =|^~F"+ 񅶋持vJ@4OtrGHN^B1%5u e2⁹1/ZyK8G{\-̪yn`AhExv-+SEu*ۏrLKJ I-'EaWY#awlx gNahW'( W=nq3tOgn0hJ4J1 QN*SԳh!,}d0y߶7bT0vW:K^԰x0g WA"G(˒(5$;>X:.&A--R˄~O?e!Y#ZS6*h;leZ%YO|URnֵ Uc8݃p&KU0c9 BV8 ׇкr4u*WjȆc P!p2:fd%? x> ' h̞y"nrãGKmk#`e=_ 79Aàoi\Zp%/!\%^uxI ʖC =UOlam\^UF˝6 Λӌ XV=9&`:\Dskba̽ϚJza ȬTi x`x=yZl)#4V]+&[^>-qC H@^ E=0kԀ`P#t|!$+VH7MK~~[@H(msy37+"}.sE~ٚlc*riʣ-#c|2A|? zvUXt?$jzuq ˩$=P_wݡVz}8$2n;QxA}-~ФOU1 `p2dv! q ULYm ϫ=(1JsVw )OL?L(;QӲ1vͺ${\)@ jC :[<푱URJɁhW},k)4yOm758 4Xe uvoh@4}隶Oɀu5feZHWX>.rL nK`vlcfPu ;sX-rTe!)OWՀ)iZ\blX약e,7re۰޿!ۛ&n#eY04U3@8\b=v|NP:Ҵ-d+ %b)*Fxg1 KA9WGo*hQYy3-=/,Ȭq:.C>_K?[ѿ C:# >buW[ @r2:=V{ Ń_b>8Z:3>b.g\qc>H1{WeE#Q2}T3ДOҘs  mQ?vi$<w26nԝt l-b6~CL#ST|C"}hbd"/g(s?lYhO ^W<ؘ ;")fW  { ^Y3?(@?CCJݢ'z}SNzIMI؍UrBWPliSQmz`h |TefTx# U'#sA % _wi+H>Fnw=,$֋XJO Wl8c:o5JV"]h_+쫵9 \8=}i^ e6f<:ZPBra=Ctqk0W{ [|7xoB̵])h]ChIg+Jō<+3vd#h30+))nJ9^vX!dW לY} ZvnJ*~8oB#*UJK*j|Ho{$U@n]v?~>0 tȃAxx3Q' c;A"i늿7&}qi[(πM].c}mfe+߄/WgR+o&mo'`!eV#_D;d"IQB<-##~a-U/HZ) ^^Kκzi1E לIT#armiiQ/$k`aC kU2>AI2n^mKxtѡk|\Rp 3/d-j,M8ʑL}_H)` po#tzucܿq/W_W?a̓>/mA~hE eUSV=Ƿ;Q^*s1iaPZcT۳&S'{rr{4{)dq(6UrTop*96"bӻ'`gp u\K#hfRQ'Q! {YO.0pHظ=d)B"U}Y44J$K3 V'(/0mT |B?f U(Vr:'ֵ_EUS_ 3~񟎘^%/Gf7'"lFmxބ@ʝc}CVfAk&w k5N7p+ g:ұf%_/iPiXsvf#{sbLM&Sԡ$ܯt2%5K5_w%I?Y當rl)]#zBt1G=S̅GQ3hx%]l"W| _즼 bbXeÀK%w2=ޝ^V5&Gi@mr؟_ڣ H]ƘVrQ%֡yGi`<Ҫ=+<2a!N%w--E1i ThnCH&|Jsxza8z-H낉)}EA3lbH.5d4״WwXc*2r+J- :Z[IWD BH/mIIPjyA}ܗ,^/@nk}޼.g$EU;t$UbV*]m]b]D8rɞbR·3?iMx>-y' (1G&`6ڗv|bz8kH3qd$ӉF 9yLA_X"gO@jn _r65m9z2k- k^K" @p sTnZҤ,:mLT[َ&j93ҕ 9gG>YK0?D]{sR@PD#1(cS{wJ!#U]Fs ڪEِK6<5p`O8$dq6q*C-c iq^#@ƨR7EDIb,=gR $X͔wxOkq;-J5ƿdS;ďXB[ bz)lfr0gd I]̖9`!I-jz"֑?u>hxlvF4-k;\N:sO5ڶ[Gu1BJ傩 (. yb$㨹`Ĩź=zy!w'8Q]wҊLrI_H ]ݐ'WXȄwݡ7$3}]rcb&p6aO @RQZ҇ѹ0cī'[屢+xp]cv-)ȌTpl=CZڢ"8SX:?B7oAA^DI2P+VUqgԿ7YB['e3)SsVmU4g)oGbk]=I!i{$bнnGw)Cݸ347 }¥N_ÿtoq=1UwtqN˙Oj WtT@5ަzb' ngU\}Uv[aqm𫐎1R^a?́cŨU{tNچ2\KxQ)!˪#v;_xydzn4ˎ>En YV8 m9W<LUăv&o/vzijL6̵j@XiQFw| 6tc7֜ߐsf6n'U}8"XB\N}X=\Ǣ" RK> [E0[7:>֪1dk_bknxkq3B¢X=([IM=ے}xQ*zQNS ML=,VTۥfdohw]SIc'6,Oţ\mB*~>nqJ qN `{c"N՗|Eq)&3/ȭ*B#t[,Xᑅvա#:`{1 MM$:x΅;ү(/S :,WՌXTr$zE觚oN{wp,t˱5A%#1od3Fc=QiQ BKP<Yh_ E[eI} EϙK˨A<=s4^-8th,,zE cu8ܫ*Ol7[!#f)EPԁBR|z dѡ̢Ƙvh:Y8tl~SZ &1i ̀ VDlW|+O Iyo(.li?lE}n; 9eF| f\EM ֛ifw [(sVkm=tE`Kd((UC׫ =vP纡 .TNV9:nna:73.7Muxp-PmاRa ?$ S\/N%t'ݳT5 BKZ~q۔88@T %f9!QlG~8 5uW܉Mm3x1F}o^5N1g~2.Ysm)lތdGY;;_قP;^3J?i^(|' zS8T1ef_{R92,ӲՓXа e^˧~`3;J<<5 w&X!#TFLaO}k4pJXz @%ɢ[t1I߀j \&}/FUPDe\ "㶊++O_r q+'"f\oqk 0~DF" lqlaT\L.rnuKg؆szš|f37ot~اHC¾X+Cw!H/D|#FR[ZF]z |4W{\NN ӹ1$607?5W CVo9nqۯ;h`(Sw)a#^ϖEG3 1tUZ|/tsw0pC?4ȣxڱF},bMY VEJuɣ%\M(6bCv颙9EkeKvE+CSxo붓B4L|?v׆1Pwf ?mo:,_ 6Z?2~F{lu{ @|aLT.ܻj#msk5xGVޘOp*hg[;2Yu;eSq$Kxaطf#!7ơɼ 5CS \~ͺ(9b1t)f$HԛK m6M0 D`UCU'NVA9?j uKO8{{=w4W(5 e T/¿YY!7= 6BUSl'89=gxt)X~1(Nu^ r d;. MQ#&P{g;uѶ|.W6Z)2N=Ψ_aHhnRT?܀G2WA">ͨ m$ҦLla+` aiUfsfLG?4;φW;(AI}-ƤddY}tyFhHV}xQ٫7.)mV4f(e) =m|sZL5BgSBAd-v@!:VOϵA{B~^RvjKOFzخ] *XwdEj>0} #'RWDe@vNj=Tů1K1]XMHMKg2gIhݧJ5a(pm7Q3 ַ[C^aeR)'Őw,}4 W[pBRBZeײzwuQW3Kz` ۮ"p:Tb7]*@"J2BE9M 󷀿AM ^d zDsBeŜ66f%g Lz%LY#~è&m`ףf's!䅧l#e73f-CmVә=X#W؍lĦ FF 'HqXrlw1g'."ƭ8i|҉ J,"_1&I Lf7ɵn8xkigשl!{n-5_4])xc8+_d~g u; yUƫcB.k -󟨗]'8&w )_FރJ!:mOsS!ٙXl[xd_pT^z1'D|/aB<'K£&8ĮnRnn^p3X͎V"-WVH aX;KD|ygA һs?-njrM&C{N(G]_*-' dXco`O솵6="N/^I)u_!g%b.o$p]Ó=U7}A[b*> $^s*sQ_5)=!uHyJQx0~>ӥs{j[D5S.U#98 (NitCp$֚k䈡d܍<Ŭm)2HuR;BqNR֊43\Pr5 PPu4@*zg0rd,!mG/oo†)jfyv/:&9wXlVFZXG.4]W6 |͡?dU¶чؚ+ZM3$ ȖaY 8^ݬ5}:r̀BhGU`b;,Gy:]Zz -Ŀ-)?IyU: =h֢{*"a-`*,T{C 4)VK2Y p@(l3 G,]-P*|+1=ZOɊc1P2J{*\*uB_9Qz#ޏޑhn-Iyz뿶Ga7,;OUx|Ji0!> @{63sG*iS6UR k!^AE]>%4QVQת=8wIo/?'I L!5cJ- 7?tW*٬tOFB !гDs=/2c>\z2VSlPԕH^C$G Edp=obP=uT=*u*d o[_(.R֍mq]S~ WzwXٺ:tp[hy=%7x9/j㭻c Xxx$ta`ī/~+xQg_NK11wo!AHrh\Dg MgSw0Q#5ᢞGCmtNoM @HAB,*6Ց5Wa  ijZOI=A=S<Q8zr20zm1\|c2̝.p79Z7~:^<9|!1;`}]f*MHOv8ͿG'"769NSS,xȑتϥIgY:#mWN7c7o7a)y6z~/G 4siGu:߲xgeAOtr@ƑvgVN}HKX녶~PgnTr2is\&Z=lDhNO8|:R'YNV'zieƤv(i!qg8)zLÒ PaSԗ]a @m2 sda")xS!ݬ52`)5<$$cBhٴ!"cOނd!eT}ݺ2\CtWһ(S`՜nm*-aVpzGЏgN ]fdYqa'Dc*ޤAICN0 Rd3e[ba=_q?/ G0o裏`%KeRw3iDuA6ƀec݉Cjr'3%'ohIL̊ drBrM eXD㵅©Y:<|:ԟN9cF孾!aT\T!{LC,TZa3p J`,{",Js(&E?`.eceĢa) iB Dj(|4t0hjIe> =O a ;,A`^mcXp3HuXDp67f@Mb*ֈ)dQQ8 k< =!* O*1'€f桔fvЄE[nORJZdúzM %.U)OjHtl/{Z2h~v8:V;k#̛[ Й<=Cy .WrFV`nEeHTbx ŠWnK5.5tP]\Husl\=&5U".?[N mfmc'p^2z,:kS)cOETP8 >!|y=|Ε5Kt:2^ ڵXYtOƯMgVoEң>VHP|9򆲦nDxЅD%&!&ި -G(/Ź}uq_.0|FIvoF]&7tmuY{4#Ɓ 7~}0;컢I xDN`t9Ux a9{]bp_,lw{2 ZK*[O&+8/E}`Ffވg=2HRYVGQI'9%UErkAK|AezMe@\=,lm +ºldClVC[%QAWΒtn"u(i^7 'k0]4 w^4;:2V[UO"Scd*u;#i7*F %&ɸԭümJ)};O7Ml4BTE].^kvL-)XRSF*F^gnL*MO H$n0Al\fD~pZD0 yv*I ȥԠۂyMׁ/賡1P4mB2 n (>@\J@v?2paH:'r R/Z03MjuؖCn[?>('goT%\T ѷ8]Sߑ؈xГ;D`Hq=>NW]=hEpҐ4|tխ8'#N{huiBki֧#:4VSjUrh ħB*d{^b̩ S W(- 雳-Q[Hb1l6ܓ!<%QᔩD)A >4C Fp'r1G[0!*OW"жg!H ids'R|3OC61֍a{hΠ ֔{AF;46!,okuz"0Ǣ"E^J%ӔB^&rKwC}> X]'{ pT1" pWu %XԎb ؽٰ9ACdƞ$⏉n[x3> )T۲U~[;pd\YX!, 1Fa=c; "*#E]>H\1ɘ*n}_ :?;R_ Ց)z86{\2 B8R\vm ~%A{.娊\i϶BC(\C ;k vkPFf$V3<~]bG?Ҙ"twe఩Y6jZ֓S"_ B${`#6(,爥w۰2[/%ю!׊% >#S۟kV{yhI=)*@CHjS^ϸc6\$zGu3C?ݲ)NOc1kS[|.Wk OMX{|ƿ7'=73mVHӻoeXEǧPқG H&-i^]8"?E^[8nis׳xFVW[$(7]rYs2z)jڋʈrځx\V(|LnrX6dVT%'UǏ@QsS•$L+ǖ)q~eS1WAIAQBR6ܠXwɼXx5Yhj~SlDQk KC=Rw~2sK&8WjM1~df< GOh+\3NdsP$ w&hLSM0]Ro2~KapMEZ7G2vpg46k`( j;T(>V4A['?{wѿ`ı33"PKtr{޳2Ejb٨QN])_qj!.ܜJG߷h8Oqm,|ܧ~g DD}=0Zfi_>k#)_a`OzAfٚ(`l ^ʉ9Fq"-߻4t2 yVr- H1LHY) ;W0rr7}t"t;G{,8DrH7жb}nCYG3cgliqM(| ^̩y{f sXg5\05sn&ύ z~NG;JfG$E806b1!%< N{=eR 3>53we SP&qGIKFwܫf; B(']W' ̊ׯB CN ޷IGuۅ/˕`u!Qw+ɗp.1JpQLwO%V8אjWgsçQ䆚  Eom B̋f1$ťjω`/;5I%Oz騂"7i!* ^҉ppbPo˨T{ybQ@tEsqo\2Y*Qt0CISkL*}As[}TIa" .L]p ҥv>zG|bT%pG>ɩ{'5銮חkB wEBQ$nA9 a̅fe^Kou,W{[xB ߏqQ/nE %gftQyy4ǝo(qǶ̈́/*XޜtSٔaXܤlXuEhP+A=_*8ф:iiFLi% c`VNQjΊLS@qQ1ѿp{5Zu[)pS B€R1`e3;iב&ܝW9 gk> 's. LĆXDX+EN\Axa >@hm]!'\Z~RA0-Mvd٦CFz1rm c45zq$0ԍ1yW!]ϩ*"Q|xE\SxnӂQ!-, cx t>ѵr$U+A vGN6lOnlVs*=Th` pU#Ѽ@t??"ߏ%p^TX[L Y3P^VD%A :] )ͨmS/su`ycZV1]s.J3JCE/sK*"ݫP ?_c{9+,2:!X]DD*CC!hH-jcH 80Lu3 b݌gomi#(# 9{EPu[*Yt9 䚥k ϼas/`ZRd'sQf 7z6~Qrێ~#9x77].'lﵸޠd?^*_B#ϛg)${ *+Źh5, #HR{-b:'"f&HL3 >yf⃟ePV>`8!]iA>\jtrQ,I5;頀 iZb ﾪF%8b+> 16w"bf?$2Y)wZw|&9NZEȔ%灾SWƑ8{y -̹t/=UՓi9yj 쟇|?fz=Ism'݇d+3[=XC&P ?+VF.=EߩPanȢ4c[GpБ "ZA%QYG7Q[oFgh"g8`j4$,D#iL/{ݔOu҉>hf] ()y&}>/Bp넸anGDȓj|GDiOI4Vrm.=Ki &w|U:h"i& de4:Y;_3J88КR*C8x-]u8 8%zF /Nj?~\讦+d{MwEu%O^PN7]L]*uVPB{*xh0GsphtLnY*}3hԜgϹ]*%OX&CasVk6azu$Z0eP8p#l/y4dk?8WD~p/r&b_z]iVp#)fzӜ E8ܒ! ט̴!(*ѡ}|W :@>m3Tie B{׫j?UR28@i/ta"O \9@5 WFtbyIR~˩V2D! Šy B,g%`j"~~K]視"_VKMe+[];} 7nc؈~SMIh=Aq vj?!MغXt\vYO s` 3&Z?esE0".CG[ Q @J`Rw3sfY}>ƌ2!eut nk t8=y[[7e(8Q P~v@_#~EE epDlb;%N,\ Y'4pEBYJ7b}ed*xXDnd.k#r ٌԗ6/Ҭ'TqeFuM8e6Jyl=d~#-% t {qs~ʥKh5`.O6W:N(~q9.~ Op8L@9z~?Q$[,zٟ?ҫy[_˫`Ku?'?Nkn?BzsAJk_$AQ ^p"|ST0%B}bMC[[z36큖ҖɁ+GRJ(!^z'Mr{A I *P ~~ώ~pRױQF{]/b9EɊ=섮"{e}W!M! SD.82uHڏ[p}X?_(Ұ ?Xxs!p؟M_h ѧ3k=~Ş/W%gdǮF-#hh p#ǞL@{ qK{>f?܄W}- fؽ=j.Lχ-pg#B-G(ŋ/Z2fVq_KhzZ#1y?T;CpFS3.l|j,E4v eIWߔK6 nI֨i—sY|w_'>"/9p}vgc52raCCY#)1ʙlgaE{|Y2EiHF3ܟP%,1Rv)H C!pUǥG3Nc!G^9ԹOc9NdxC6( )DH/B8j+^ ,-W,OTN4ZdVf~^w!;+7+/#GWĽ%E6`yv著ķ *=I YϚ g:Gpn[K 7?aRPf۱w M<`&Q;\ !+j;'Ǭ x$4NfP%ZR8-TH1MC\r Uٮnrx u7;Bړ~i9W@č _1U5$،ȝ[X-,`weVÎ(R>c`"sG+E̘Ix&}123H?4N'!l0\Yj7@>ML *7\Jp=meb(?WՐs!)4 X8ĬFRl!|p-vDYLI.1sj.ff]|nD=y6 1R.IE =y (-Iv;3'f~HJlGȝ Bn+Flltm|gM-a]JRx~":h|.h4X8F~|t|!ٜ),>O<5t҅kkj_tP]D w'(,o( v]̌9ƭ0hqmywP/re j[n󄲌'sxi@vb:(6,cx(2Kl_9jհUJd=[ln56vRTeF]mLjot>[j,Z#I3k!MrhmD[:\\pui@M>ph/̬kw`CVN+F[q G)yۆB:QRG3yV_k1 u=JJ#KO L1"c՟y%`vф8oG/U^>;; 76k gk[X~NST+M 8,|s|L<ݟ ^ iN $]ɾTrI=-bjf /#y*%0mqC>1i0NбH&U@p(AI: 8QL2FhCLdF@3` tJ$)}xLI6 !` =!`TĂ,;-[Tᆀzx]CYdL0 ࣪WJw6@VO"؟j,F5{dVHy5"1̼uf}U&]d=l Y@ :nceh-322~ъf&&}cz-L9Q71e2TvA9Ӯ85f*0>SHCN$(Y[ Q$bǛ,h@5]9XO W^c. 1VL=d }5x-"\ؾޣ^6݌#b^kW\d-ԍ׽v1(jmNݑ;$.kBz bO1!֛ .NI Ɓo=r0qܪn=  ;wׅSZ gCd(`By+y@%\@M VMX'ovXvB[ Za4G R@"-ݝ i8 fHKʺ^3]}pPd+Hx0e]p_=TFCNG%Mc߲ lft՚;k 1#_*0#%X3~rXI`[Qkd =Q1å3-B?4QXC(A1ψFT5 $:iL&p*#H.C,M<`IFz =p?1vi:k~z4+NHY3Sm̐q C2;c=E?ȍYa5i;~Mpdk_PF-l~n-2) 4X+WFhՙkl1 U簽C4\50Tb9$f9UI7wOP1 o]Ι2"7@tb>&|Q)a +;Ҵ"&"?,_mdP&JA؏M=\!q'ڔ';hXɎ#aN~n#3f'% )z**KkЭ?x{{?>pZ4&4-'by6~Ԥ5ĢŖ)P,]SD z䣫ӿNŒ/>4m%sYk%oČ̂Om/-7emagUܺV/k)?6}5fՂuLKCw.H @bWV1as[`J8GfGew9NnU ?<`L|`ƪD_#00_E7-YL^򥯧/X.^ *[at×J/R8ȃ' Я`O(l>1Ps. "I\sp3AZV Ba#^S yb:[' cER~Sۣ[ʰJ]CSaڌqe@q!n+}QT}#D-!n>dR&r_mq#{ 񋦈oA}z ʂz)O昳▮~y[p8 ï 02EKK u貣>8!Af&b ~mcNAy*B]e|BfCv|iF "5`_9(>/EㆨG؂GRJUhr1dU N^qL9?5Ub bn qNn1 q:Am8^Φ#pPyJuvTvr߁#9(wX>R}xEפ#SzM>)[P$l\sbݥ3S{nΰy$_V{(]ϻw!I2/C]g|&V]rv-kp}3L+UQKN 4r"ٰN|wSd2DZpEuԔGhC aҊr:Mhcj\PU'鿅īO]+i-`\b U 64B ]@) Ԛ}Ic7Eva@:֠{2%)U;DTgjDgf>HEʉeXn\@u^)C yݥ[Sloߘ5IuUL@8dYT Wnl2#Qq&Bn10xW(;ulHc+d'*Ŧs!cLH'Lܦ'w5*8)J %0{d6-;Z%#2(PwUߔoy>dh쯤l2Ҳk f`K fJS{8 sO_`bh jpܾC#~{$5qpN#~ Wx/꼦Wr˰P8XCScFGu13D|P7&5 NK$H1dDoQ3ޠV5Ue\dE ΋#SSn&|iA|2)^d<΄FNWrvRz(G۳dz@XҀ'&>Zw*{ (`ZԗWkru=ad[{иZ9#fX7h@h_rY'ς8L{zz'QhYCVjd=y^/ %=Mr$ ͞5 0n}l5:RϜW6zl0e4h',O~'rL^ܸ09^P՚qx*j L$t|dZ2D(`54wT7l>!gRl!Nɑ+)b k'j!?1'_=0g-WLxjQr=͔*"D7ZI@swFy[f]8B/[%^sh閍DJgpLB=df VNQW1ĵYq*B()#ugE3bm=h[A40a'H mVeQVaN'L['ÌfӴms4KIZ#Eh0G,CTM7<^o uqn2@9EƷmjbmpkKϰb 55b72$C=VM$4%Ѳfc~pNx#g L"2lmdF;qmrɄہ0Tyywq 桋c.(6@IP5'Sy;I6U Vm{pt{~tw vY>j] RH Rd`}:aqP|5akKTC \1S~tw@8#n`Yp^/e$ hh,ۇ}/y_VHyaXaPA(2=tJ^=ZD-=nVn%f]dC);0%6<E&G[cie*G˥6È,ScM)9#6V%@GP޲Ets/]h}xyy#Ye;C1+{'"\֌qʘgB!Uә.Q#g|%3:Y6ƞF۔8`bī`§⧑UYIAm3?.z陵4!4F3s.;`Xk bz^?rШ~C(ǥ#9^Ev/0 FO"Sg1Pr̕jQ0@/9 s@:UiK'߄%=-ap[{)GiwwT9#jZ7t̜D@*M_|YCX&l}6zֵ=@zFFeh{~`tPտ(G|?T.|H9 3@ Z'Z>\[Qp:4DU]#%:&gxjl/c 9d:(tda5}L*ⱐ1+sScux(t?].YVhco&Xlaެ3l~6g4L3_R >%eTu+X>_(hWOri c|t!K_4J9 `*}sPW{e8t# HT[bY)}GN@GVUgTx;qB5/W/Kp(1Z'^[ ~u]{F웖~Br֭?~ͦ\, qntA!Ec3ߐ4+cg|wb[H2zra!vW$/#OG-\imt ._2}AlxH&X{bk1L&AߵRyDh#8SI8!{g$=<,~ӊ)ZNA/d-ḥ:녽DDaqHa;dKM~Gd\xB*ͅ9gZ|Wl~2cV"PY`( d7]R@, p хpO3wm0y1=#Yj芒ӵ`9k"8 >G\f#[0/UGJ7DyQυ!2J" -^J]ǿ#е4P,_o8HCFYRDۋq(mE@ e@b AXN"aq>Ǘ M(JhYΑ6H3\i)!EH+3V7Ϋn28gR'NâPq|I{p vO2Ñ' |GN,t2BtukxD8ܐc4VP)RfFi+f=15я&oi\RJ9@.i @}=&6/v=^\WƳo֜%*y9d"Q;ZſQ1rj[pejGʇ鏼ڦ".D* V_ eR 3S# c 9 :xC&;x;N7'Y*Zhj,ۣ" ^|? y*UXOVtsIYJPɻh.,$ыp{B:W@gQ<Y nI8\ z Q4FmVTDeJIެ]&oռXg Ebc}$_TD<"Us f:%-vټ&0{.?pV|8n͈]s4C5˳t fjl:UbId9E X T1= m59|@X;NxSMHkG,]K#Ѩ Kz+:՞ǕzL WT&jW=..ƃ}C5k7 ?OF\9栙5oBSGlՙ뽏!+@h3ֈ#(:9֒mᗳ u8YsӜn "Yp\6owwKmZh Zb);[ "Ϡ6wR Gn_PQW `&ӓԾE9h$ y|`l÷\lRfHŐ]99TTbpȾ2L"aC SN4G6$!v(JUVŘH8i\{)L7SyZ4/ Y[H'1Ys:̐9Ⱥ> tm'n^!iPww3/~EF3M=]gVI-#2-0F$mbNvE ns)@j AC:ZP3ޕS@ {`Զ.юy]b0 18"g. ,XNDg79EGTޞЃZi>4%HbyzG~ P8Y;ҟ>N[Z;A4(k{n񌜃|۰pJԆ1k[ IüUzWG~EۂHSڄSPg`1@)2,Ts S7sЭWV ٬_#bLV5ohہ##v1.5]WP7̗AAGh2{)4ixŝ+&CÕ'LvE܉=}bY8 ytim8}|jbeR!R  \5Y{&U;9mAE_'ǛOw30 sVX89Rmz1Jֱlzq+C̶^BƻPdULQ|ҫ_ۏztR]a&kg  ROv/.#}`jr4ޞ&7-^8L,?2(*WEV m$Qc>A|/JAtxwц$]ᓻj*IF JWօ?7{/+`ʞ^)nZ #nn{6F-T^0Un }N9(Ojh.v%&:L(+7ŏNТlNK%~.qV`؝a CJL5iڴO^\_hUB-^b1KTSsLюW&W ivl*3 |qoK}r*@K?lpݢX]zR J,:PnTbk"2z8W]K`v唖)>fV;.VЍ_XUĊw|.{iY&@峦b{_=mPܫgGDOkn7`3L2oō&xo~t/yZ5z”Sp̂L5C!eC8ZCY!+B(A qJ4eWa nMEu@vR^&Nȶ7 )^a\`0,>6&|,F >CEdtw_zzl#`!N{FRRbfE:؇\T'We8SNYn4Oj̲qЙD4"pߓzKQmMk]y{sE M Ns:׋Dfq|Jj%0}D`P[g-H߰T3/h&!qyPU檟Ot-tl(ʲA'GCcX:k[CLL-}[PgzP%k`zUk&poԺ.|t3ǀP`*b/kho2`ĹY IJ l;|s k@㟽~P'[XӞRe9Qvjׅ2^غ.> fe,{ؚ|>r&H3NILKdљw&5:Ɍۖ*D eè.[bv[pPlXrlJU;#u![,s`k'י( FUC mtQl~Ms9YN (pߐE'zQ:\7$xхa~Ya`3(o"!m(Qm>bpR~'G62s& 'Vᦌbxᣈ10ٱKa]~NKJ(L+>yl<,y M/3X t^F[-CO7y6"W2!be54vVlz^74 aN0FO us> z?vOgd#:@:$٫ⲥe7L-tbv2Na$7Rll6طjr}{?SCS-G>e_Y/"-KvC`Z|&qe$Vg>JډmHiD`WUyr;jh7h88kD1L}w$T Ө+wGps<]UE".m}qf4aԖΊ_]Ĩ^]Uz^RoA*q.3 f:H Vv}bo LSe#16aia$U9y5n_Ks NMǫɋϫ^&-I8;`'`146C7O7lb}E#b tXa;f~#3ⷪ!Wx!ܹ'5{Ey ͫB 5{m;KgIUaX2ǨoRZ0 v[ ;6H=3J^S)@niE)g aG郑!!,hnJ/ζt͌>Vxn2 `jq9)lm%2?Yk>[UQQl_|O@$H1XW}Nm\tؾ&7};`Q?Hhg] H" ^D3.'x } plJIcWX"4 ':A 24MF(J:M clM۪jX]U|b[# 7XYfk6Ԡߩ-xs,P6NM=_.PvB|L`&b?w8Ye  g*yMFÖ;!+W*%n/lՈyZʪB wG2N?~A])и`[AxM&2CAQ㥁U A U !< ܶ`$%CbE4YOQ^e22ЗǼc[¾+h.]TRjÈC| (tXAq~iKuZS!.&Z_U {d:hk(0k; D;za洞\(v͸VL#p4$( ~s:5ۥ*u t΀˜O9^l*WGμ== 2t/tHMkWi^FޫyBWbHe6ٝ E:܀;i^UhgO>h  4Ut!Dm sq?'j $8kH ڠїF% e2@D==L[4RJfIQTD)AlC߁͸o:iCp+._\6;ER g;E,&mбIUגL̋ :짯G;\|Ca"ν\,ȶP!V/ mDFؓ*:x}fKy`v| "cԥS;fY^0ch"OoNI΃f@ R1Oy 7* )YZ[p&3˯0^W0KdM6>pmX1`uSJ,Q9L!2>0nu&$ag( [m~m:rc)9McA_9g˴@T;5_mr0NƬQgB^✍oY%WZssNC= Q'r"K,&4!q9 )8Tכ=zGS88:?oć{![$XVv'W]kv)CaI[Mhᅸ#&ax})xSÅGk/jHc*m577:ao.>F_`ފVb]c;F ̀&k$Ҧ?؆j:⑌S%GK`oN !<I*uf;L'\Ub{3@E.@"^DƩ>%J&Hr-R0}3bgAqH-R\UOTV}Ӭ0)_ yMWzr34/r˱VBkh LN-(l ojc2y`"'BT,d WM/)/b'wha_OdmFwIHX`A|<4y)X{~\\ qA']gKÊ ڤ@ qP ޠ:Yσ;5IfjܶA*;N,dmG|ta^RU j5t=:l)R4"༾e+Τ-9I[IZiUhj,+O4B:]$O?._phfFjcob( o!ാ,̈]v@!\vFžsx:Vj6vq//^7]ʜv"Rr>'Z58.MI+R>Ugm'ʒyZOQ4k_MlS%Sl?JdAlz0_J|bb t,$03taظSLJ>B$q!JGxl'c` $4طS0jQ˓白N_DOL+C[lGf|Oxew "/Ve 3Tp-AsѶh"b>*:8b۔[XXNYMG hXArip89sQb4"%.`mc &H1cnVWnNStiuaVvk\gd3 e&/(e8J*2AkvspGëMl[=&X^z*m< q%uN8; §T lF8Ub<GXQT(%"?+լx$ԺcSS^OkTfƮcV!_gbۖp=`dd,5琁:t7w!~6wՌL=&{|!ղzw.q,`ۋJm ?O29&1gh #ӡ1R>7a.i1|m3ېpے tj ;!UT:.W +JLeQ Z:j .t:SZmU9a׫v%n(.b469)# FXt /w `+{W# ZI5GШ}zR_&I˞YiF&Jw6n&';,X9b)L<[gz\o.~S7K7/+KƎjIsD9*U"*g|bVK,6aBq:$Ѵ)G&]} $5uD} _:A<ʼ]hjN]^t;Bfo-+5~?t@D&h)){Ӗj_M4rn_ l}r6!`ey; /.&~؆T)b**Qͷ:_sgרŕ4 _ZƎL$_HԘ].KօgM:*̻4~nltN*/RH}bK?FCOTo|k=iof>ZPo]' kZʦL&_[Y~ӳ^ϴP*3yi=ak+o-pT 85WCpci7K~HtNkI>,CD\F)p2Ό<7Qӣ{r ~~h-}el0$VZ_2@&`Ȩ5 n7;K!Fpu2bى8O/P|d(k7`?2r~8m!` "@ȨëS4dl EÉ]L%"'nIqmVJMJcu13kZ~@ҔCj8+N"A>< wXyٵՃEyy$G=>ɮݪoF־Hp~|#V 2Z|AM,=߃i2J,.B4];鍯@F/Tw2-6[$ *y68_Nm@N2h5X[L_Vt0 .p* Kt'aHRC#A=bNoA0Ku0^RvOFN*? D3HB1 Vap Oe!,]A/6|$/y!Vȣ iW\GG?&>of)5>hHy1 n]ؖL 3wdΗ^] ɀ憝BMI5\ءA a#@KNv wO.mO˲:x~ZjF%dYШ1 8q?x\ uv|bw,ő:5v /VND<*i22)͎{s>bRip< Q9Btr] #Nwz:6Z%JN(-Sc}BRχ1ʁPU j]$xY04Rb/ *C<^lou .eaˢ쪆;2"**͹ȁpxr0G>9G*Yu#gXCSs S7qS\fd1MZjO/q[CJ\ԘAY^-ř+samjGq/3.]Ц~e4Tԉ^٠1<}1^ 8aø0ƣ0]ODb{xiPpBU?yEkDOB1#@9 40L$\S 4LڒGo/LNt[Ѧi:˨]tyȸt8dUIQ϶|b NGd7Po E֬CgK7hbr=m3_MubK[,۟dek ˬn 򳿇w$8&Q L 6> XJFHqpQM8ds/e\g\Ge\UԮnwwMWBmgQڛ0͌"wFs}27+# lchLg(Yx&DN(UP$3;f'+ /v`={,-hcT8خ[6u_YY瀱  ţ "Rcx(Ƙg$5"| {I"!'z*6^W{6Z9Sq8hZHDrFqxЉ-?a/C|-9 T|xYVgJ;j O FHY.,{m-`*ŸR dlMۧdgpEc[Sgoco`d+}zy`"±J *ڦzMiMǮ^q9dR}8'|.WPmZS|VnI+O6(wڬ,>{7yD ~!W;v=J,[3|3^ 64%.23\$Fπ{20ڂHH<پǘhT[gQyJe{{D :!y逅<Ok8N4`NJysHUs~mmѐDٳXo' ў<5"VM@{|5A97יũ# ŴdH!FԖd-y5k;+SG՗zҌAByg!m0#{dPirɪplm˘ #wT XjҨ':;kM-fHצsFzz`l.F߁? p)BI}#hYrfEl-}O|K2,`]$oz:c04}G^Ikuu -<jR0Rb|Lg1Wk ' wKs6!. .4V2 AV[Ngo(Ume;sJϳRyˆUo4@t.SV3z ɼmJC8[m""oﾹk쨦0c4zi \b-nK5nl( \4ܫ.;4|0?ECբT|bgbwdjT?k$?(?և_cgwx-822)370?-HcG\V(5&x8 4+(.g5.mzil=(]7%[ B翦`Y9`GCz[ȎJv]vf?g& #D IssIiJ_5`2eېaZui6KbԹQck"B &]sn .ZAUe7HX=~]g죴:E\s9槌jc:bF4nyTT3^@sĢת?@(҈[Օ:Ahd UAK ֭as>y*iUjGڢe{S| %I/TOj׳⻐H[8:& USlen-Ho= ygVzO:XUЏ4kM0=@u0H=*Twl\atgo 9?;vďf((ib1H4y䙲툈 }omj|@Fܻ_qm~@~Tya|Ckc0{,9}mԊhmѯl ЕUBvf8.\S+)x)nQ4 m#i+,97rBCp%X2G^qj1 ,|גYƄ)0K'ԥY'(ep`7?~Ͱb5Oqd=iz@pݟ.ٔI_۳~ W.a 7`MgD|oZ*WsOIXr1Y2ܓ+3\TRz8דbrE^&z#.r,xngђ2ُ\`ҍB?|x7c]P2BZ>-#00RPqm.JXbsv7sIDbm9:_ @ ?" G4ٮ1amO[f[ '}scaw֜"(O  kIXh%c7m\ +iz n4&I/ns2B$'-掶*1BH&8ų+ g3Y0TҤXC% [U^ f @\ׇ9aeW`X(8_Ѻza--s@vxҭ&i>5vd (OK;Ont$:م @҂3CcIA/rN.WC(~Ifm6D<\#;/ʑ*W;IZmԕ+2(Ѐng^Nު)g9"^i7#9Mj?@U@8(YhҴwB]iW u-КU[#ot] l)wC!Wj?{>GmwQ%tPeңf "HLmAOQ--@`h|&qN}[f 3j[ۮGyF-Rn5K}IKe^NXGJ/zdn@! r)DɬN˨i#~j;My Z>eYB ;ᔂ »s9r§5h"_ !wIr#.&q*+짥~7B<|4{;3S1]1m; tUKe+",]5sLNgЋ1v>P*u9MJA7=|E[f˘ʣ0''o9[2㷂$k|E"N/js[>7=lc/ 2.hՑP2Pߏ"Hp{I,>bi 2p͋DdDG} lWuS C6Rաk2_`?K=RjuM`CY{_{7r5`_DNvw2gUoX2ku?qHBIAN$7eK]c4"]^e]|)0(> O$ RXL~SwxeɡP+B+R:ABoTX/fP+b kaD{0po֩%S}wLOɯ9 a(7*l@8D*Mm0H*A5x2v5n.?+X*'GYtFd. ww?4;NOڞ%(BMyk4M@Xa DיZX#lJdlW;3ZAєο3%f3Ϊz,ra/w5rcjŎ8noy,YdϭjI;)4R{}Z\/&. f"G%0)=^)SU~83H =U5JSV_2zQ:~h"Γ k&_/_ ]O6-D.PXa\܁jJ*LQ꿶dq>7ĕc=3B]}{HDW8;x0 c³._^{.M˅VH'3l{5-zx2)-+A8oKtut&ΎƑ|="pv 0':)?d \NBёlN5k)8ܯ E/LQ5!ߑ,N7eJ܊0a.U|SpD}gncZTY1 ,Rr\qPS%N߮Xi 0G3Q!?,K|Ft)7MEh#E_ -^MY0I")r:9i vv624XL[Թ ^zN%☲M?G î!6 25kVcpͰQaΛڿLV0_$%!=vB) UX na JǨP8: ؛Lz27:Y=`Zi\Z֦{ORR ִ7! \}ČsijOD!FYikS. oIXУմLhL..ӫ5}Wt6(,J>b XD75aW\Q*ό/r<)Z훁pM}Ɔ܂g9P>Py]2=+b+fO'w49|aI7JFm:է(>}H+ pTY$|qDߡX|"b=$RɄVKRGڴl!0 :WR"@FimٓOC۰W RB!ZAoH@\vK>1'2VgfmrvSF2sC"Nkh:,OhL{o- 3 D{eWiېyJAA"u׆ X0͙c/{J2\/K鏃 ]'`_Okg;a PFiuW=9(.Qzgh؄|JjX/Ha3DnbA_z Q^I?w!nmCkWO~))@&b⯉E'Ve!0V?Z! A%Y'(ëvc"";baON͘"Zޙg7U%g> H[ _B<\VFP y~{A*=$n/rQe3vW s[]4l=O[FtF?uPb;(T J?V2R%9UpF4`Gj,y@X21/3/*[K~u,-4oo W=d w?Oa0ɞ? v=!(>;oPWI~s~ߓ!y(s߮pO¥私UX[۶W̘7GsxGOOuҲMnQ`eiKxK _6"N'X"tڋ1ITq?t7j9,Ax'ғBlf}in 8Q%e_g/=݀wef?o?huڨN..VVTwJiT_Ɲ?$ur`;ܤ⭼&Ҡ]iLӇw̪ ajQjix0P"nX$tņoQ<\[(I:R >;GCݩ[ fiW%!׈Q3o dًFK / C72xhVk v67Zҏ,;$b~:E]?1L7f:Pz}uPRTmޢ"bjW1.@wȗ B7YH+H%WÈm1ij  gNfi:fX)r"WQZgS_s/hX)u3 ޷dF($yЭ\w?5^"3_iƶ\$fAܜ1@:gga'pk~ro<8ށI#A|/ԉvHj|Y1ӱU:N޿VUJ\ʮm{ .;]2&%C|+UwZwAiGYXH1Mo'ؠBTr qQ4\,=]^{[Qm՛}FCЬjҖ\ _64wI}S^CiJDELM@fY ҿl+ tVNI(@)s83b 1]]볬,[g\RO=ZchyP`(Qk:fu=M?kg_6_R۴]U Y elA@M3.zr:)vSRO#ZPoyk<.k tCS\`-iֳظgwV bzm^mytfqp*ReJ>F ᜩ f_Ln^,W0G.T"u4ςc9(n-<@tT LNJVu؁ذo%y],=va],@Et ^ lF&Ʀv R˰h˰4ނ]"?wPzrǹyZT4@!Z~YHw0HsE!6*gUoT|:6\}Еl%RoϗYޫ4zA (B E(@9+wmq?Ӭ1熪_+ /-dy$O*HR!zvATk['k\ue50I^Y_{1x%ZQ;Emx)~?lw4v[Ul1:PL~_ԕM 8&OGwb4C$RXffr@7ӯ,pJbܣ%ӳr[[Ewa_M8RdT,ŃQUҎM9ےBA޸|'{JCǍ&'f<9A&Jo%l|Jȿ;$MHӫRKX ~FdoyO1RˇE8T #r3s]{eN ]L3FjUY<_a\~6!zì`@GZM~wvS;7D{"6wq`qWgUlFߓ^C6@݋4[(~?hV` = I>*!cԍ e_y0eze3Ѕur> #b-ᬯ_qxlo?2_ͳ,&յ` oʺ |)Izc!xo,Hga• 4 S@oXS(jgg\k ʹ zg/GIAs_s "6&(׋!ƀB^9JXP YcԎuhhZNXeφ \Uҳ^ccG% ci+S祯)70$pӀK1XƜǩ=2~#7kls.'Û6Bf:r%;`{@+ڃ0;ܗZ隱U7,§S^V# lHSsHŀU/^AeeE)¸$_Ϸk=ڟ1i` q@4O/8 9䗬xA  sD]Wj#Mn-1Pm LCbмu{XVG0y~٫wخR2 om`ܦdytj/rɟƎ1E[=!e%S2N<¹qjb${45IgHjz4euΞX[f lRAsvK}d,:kK10[-UsyvӺԈ1BUi՞I mʲIO*irUaL TbwC) `0\ožr̰0KG{*^, A # vw8'{1Nmx.v% * {q)KB[YA O,pκT oX%1QK!ih1hspiu)\>-a֔  ; XCv]lj^iXh}-5fEo폿Y:;!tbu%TvU{Op7pq_z8o heÓ@-FXUWuno(p$~"L[qZlr^zւԌ}lwKe]nUkD|GG[Od,̉,/̟ȅtΚW(&~>{ yل=LT-7 &Y3NG-qYd@d b ) ЎQǚBԸbλ2P!0p>UֶtqG@̑;Vt`֑,-i:U@ _ ] a66J[w愇NԶ; 5icӽGeDf@\u"rQ0Z z}n:QxNSS ȠҾ}}|zyn4n}p 抈kFuf)g2i=cMJ \Z ] ; :>(=8.QZ \khC<3#3+ܡA}ծ4.)xOKZ@*O +3q8AFp#숫j^n nRXr~M/JJu2f7~DtDL[s}F)`(H\zdy߱z.~&^#7Uj1AB"-t ԄQ ۋy3J*· E߁+%X1i;c%f<;0ZQ [}1I,j ,@8\2r+x33𨣋qgEQ)_rcjX#d.@HٛZBP}/3o0^ԜY/mDpV, r2M7#1.&Hlۆxx>xm06p#*^#S#`hSx `_w6>cG&DWX6JW;AA ap׷9#,H':T-@$N6o"MFe'w4( 0Ft;mލS9yI[H-Wjy3]}08/b[k@y0*qi sv!Ф5 # ئB%m,elR\jJ4e+4~BZ[dX2kb@a֗6P/f݈x5bUH"!k}֣&^rߤSq-OHM|~w)r6 m2B 6D*'D {;TwҊpo#^\Co21QG( 2Ȇvޗ[/ IλI_;Ny=' box"P2b]`Gmt+c{ M-SMHF'D"6;3J]@Ϩyۿ:ab{8s nr#|_2(/tr n1eHyD"t蛜;[!!UNr/ۏλc+C\}vohͮ'ޛe ro:+l˓wo XHD:>WϿIhP9%4p\kpY"\f ?$ ( N  m`~_ˇӞU;(?Ӫk٥hmSlO|A'Y ]pN FWCK'yN;71(/ wT /OC'ڄ$[iJ| K> u_8 U+zP>Ɉj&^\jxʈ 3^kry`ZrćrIMmFY $S {E?, goX/a)1-_K}_v>U`zx٩ h60 E=tpҨb|ĸ>[gBjj3d6ȑijOSR&+d()KcO0: M$hz+gdKeQXÆKx_*Tكsd6^3Scԣcu_ bN9WAU`ObeBOD;, O%Y`ܮ u)䦠ۆAZs|pd)r! :޼$s^Rש"$ü(f 8:FϴPPd^g(\q4"'X@-K4}i y2˖RcSFpy\GKf(ZSn=PR{9BF;#\ᄽЭ lU2>/M7kE)Kn4B&k,;u}15ȥ!(>T40ʒSX'>jE:YAJ;t 9"(ZUMb?xj9;2xuI6e@{NQƁ]b/PܬYkv `bpnUvqL'nAv;\yZ?]]Wq$s;n^|HM( N [CTܕ)vmSK sSa:PE] ';f^  h$2PFyPo049/f&;;S)BI-(8np?jB8A}v +K&%CW ma8%Z\܇̐:F!6uFiq4\H[ n3Ӯ/}laz+H`"|C-װ3@=$n!1UAcE*҇ OЌV) ߹ Nve[fou%zd2hhBbXF*\%7B0i1W(0vFJ8`t)kR>LlSW@M{0o,} ´Lb" _ $QQJ'c}ٵЕYH ,/z exda& n9jڲ<-/ gK Œ|V]i V)ѐU\~ķKCp:YT#!WWAgMqhCDhPرmZ^iUNŴQ/n>%e*{N2\8[8aJjG0.^;dH-Oof! ۻ`? }pJ7\v *>q'MOGz{̼=%a a6#hZFIsQda'6nXe}q-'JAHqb@9SIo3~P)0dnZU'TM:.6Դ?}&piֺ$0pWwud O"g5m5>D\SdoA R sxA}!**3 $zrR]`q>1.󊡆k/3[K,&ddQW:V5quEB:RW v<8U33)COxϰܨ61$Р:+kIsݰ{K'@ Ԇ?&i+gYDkl9VZEN4;r&ϫ˯;Pw)ˤX :`A un5#z-_.4Z7V:q#uqaQ6BQ[k`jQF-[Ml% |9GSx DP؟{Pk>< anSVިT$q5 :7lL.rSyD:@0#wֈעg89)leWT\۰Mš={w;1ipp/N Aۦ(K4!w ZvU [-!m wVBĿTEyؾa}@C|isc[qeʶjO|0YF MpY/!}P.w{62,/|U/p!1ۃĕS`I|Rtk6zȲ<#v@+FV<5Wִf`&Zd,e+B 0.^+e Rj#R+~&B_OqՆ{5Ô"6 X^}jc3_oha3N= wP Wz6%"\C>\nCi  .k1%T߈3( Yg0ޔ!N;q$cMi Q?Gz+Z8`tKy*߬qo[bA1,֥xi>2yOB,lH!޹ i{HyVj_o4;`W.U*XvJiĦyz6Sá!A78s@{X,\9(iV<=֚A$Uw~ ;馏c5-y1b6sDkae3RCGtdGTppQCX+bǢzڱa:\\,fjE~c>1*' 'MojZB4W,:vr`a-z8G3ԭBIL'46\Ӥ>״?q1V[[ ^'40) k^C3i9>Ax>gZ;}fqOz s 9k +Jm$# wV^~10#/ `Z =D1S8OBLjNRDtɖ蹆.wE=؜Oi`def4SŸ*OX^W(poo |5>hbѹ ( ZBC#i$y{TtJi7kCV)]B>$c[<<"`O ûZ}HUa^z-;vohpߟd C .#q > ņ=_sSl y ?+Rх<kaA̎̏t8XF[6h..\{VŌv1<o,R<==(S]TD )*ir7# v}s/Mo /`9y7 EbvtCS9L[y>m('2/zӏAJ?%^$kPԽ0OB'n&Iv ll L̂.[ yo݅^qf"<} ˜EmR2fMyv >>wUVS@0O T_e.'CK?5bt"c*2Ŝ4&`GR1ފgEA2:ٌ0O`4 <ޝP˳CUoZV\v٣P<9) q~p-JKFbF\XW#SfQ/ .pP)o1V+C4$û^f 2G >'ΤJ$;5eImd'H@&0#$鬵6CO.Xzm3ZG$b`&V/GG@yB: ;-4Fgjr8ЦFHבI.LkgcKAbFi+p7I0$qV7_e_oV\/US_V:<"4<#:ωluy7k q`.}alR\,YЋvjU4CϠRv&]'S14};s4zp=ϧqֹL*ڈ~aTV(qX|c?0+&-bz˻̡fnUW &:'gM~D}6㍼Mh',_aɂ4np]q7 Z ͚h Jݜ\!uԊFy6 BEQ?X-I&TYo+J`H02 sGS,'ƚ2hX ]SR=8Y${[5{yKbg}p(eB%Yٓ5Zz9E@'3o`\RV!m\>NH}p<k7E׾^CtA=n :^@+B׸3藷L_W5 ,YWUBbFϺD- ɛg*)>kyD+d@_0>+&Cobi9| p:2}f.l4B%@4EnXOa?qB p:I* w~3n5!OX`O˧M u߸&/?.Ukx^]hpMN Nw;Z`:#rЃ6ҏÀL(%&RnGa u.?i =d~1~d(}xYD<l85e,~2QƂmk~g;OX$ OSàWnUw#6.Ŭ.ۖ Y[~H\S2.Lusqk:>pd9TSK_Ի؎S6[RGF_#sfR)Mt hY2:?H e԰kcL͇2u 4h^S.]+)7P8m -΁8%rQٚZoR&MTTuc^D#SO`5;c.[Jd>:v431)_3ϙ@c*BJ>IvĨhXr))ҔC6n&ʛZ*ۺEdR[0lͪ.WUC[H8 8Ge1, k$-44[`bL_Bȑ%8QM¤iVkK9б u2rKHHs^ tu@GBӹ2Èpϛu^NMO!ieĔo2Gנ6'P7bKszAU?%5ZjYnǎ"iDenk4TR>H6ͱKY1_\12a V?8r@Iڮ-i߿M֡gWs:<sReijO5mY).x*OËT뱊,%~=Ixݭwϟ[ȉ!/qB{m#y+kNs_(hyz O8: rYlD\õ|@I)̝fC\5 4Pgo|eײo5# mS2qqX=/k8adzTxOѬic<=TV~FfXZ(}{-v|oh`]`y,Uf}fa@3.z SA$f+]kH>N"yC6ɴHG)aR"ʝrj8Õ5nJS3y~R-ԱE)&2$mC@B#^iy#9ݲYΑ=VȆ3/ a|Ur1 Q᫢¯ںݵ |^;-4+;Yؾ=`'eX$?p&L,MUK,>Uİ|6fmv!ai!X5M |]Ms`*?A88́XOeP_0J4 XYFb*7I|͌ʘzA~NjNZxsOVme?⢦&3)Nle߽JԴ  Sq#bx >FJyGNل֎pf"jh85M?{XI,^ آ̪Z?/d^Vdqǔ6x `W~F:3_xp6B ^Yd:&8Q993Sy*c@7|>n,AmZE mgKz`OA8\n#\s vēKw?ӹrA^p. FA-B'd}ͨkm85EԻӒEM#4c(U&?,uhry+L!@^ԑC,\-#]W.yP^? #]9k9[kJ)|MNڳW󖜲.i %>K`KbU-zj:YSUz;m9љr\weߝ le-`Ý ~ab-ƣh w ;EB!E%=t4D.;%PRe@ 04Vb|{2HR"qdN$GZ`N6ol;[I11,!m["7yTۓ~ Y]oG T$?OE?qk1ɟfc֎`ҧ!{$\# .(bSVp*l:Z 8$*l<3)u΃I%HCt5F/&X-iXR <@)ى!m ~uqgxguX4{U5v5ƹEҍ%BD|EYW>~-"26Q$鵘9kVptC~>Din☱/㱫3bD/w @%e:JPS)a(1?*/r/t8vLKxbYdKm*b䧼)5V 5yOs/aR! vntV3>f?lme={E8W/(^AVLA6g>>$j+'f;p$ִjo Py ZMPn dgGzcgT ~1wcň6WoGAD\RW<TiH9hEsugpQ(F# xQυBk,-׿nud|j/$kP:{ĺDoom+L=K^afŽlu R"Yc7E2^qFH5B5caa\JigE2 6WjkpK,JPLsIÅ3~ & ,:P@+i5Wn\P]+8aos9ׅc]k9q#M,u0n`IY~6Wh?02t4\JUs/.rt De}lkxN(oF|q/tKbz^a"[ऺ5A;BVh=fQTr$q%;0ua~cb_ˬ4׽e.aYE h-;KBqU7Ҷ]7rvQ ס0oFunh!ӭ .y9$=4V_3a]ŖuF%+:a6>Ab]tJA_t9? W9(.((sc=؄q۝,8, /?S<]v5" )Ca#cfSFOi}*Y;ݯ*0 hQFV;5`A=t"D~:W?-ݓg ZE𥘜 d)؎*B/\MR ͋IL#?]ΌX).\僛!:7kW,Oj'˺ω=4gS 2 qJb#IT-HNHj@uPI0Nf_3gkmrD4xtw5l1Aۉ7OC`(}n '˯*RfGOgט%au=]C1ySOy !pcbdNεiˈC-VILҢ2`MNj0/׷PeGI+ wwr+VfUm+F=({E Tw놱khďc :VqBR.#5:s B5k [!o—JV!658 c<9Ց1x& [F@p- erEecT0)549h8g*=?8[?4ܨKD\f( }9aj87Re^.EUjB"PMhMplɖ[#T(⠬i;ѠEC4֔ogNw Cwv!K ZЬQ; K돥n\k70$] Fڎ ]G6Y`Ceyi,˷DuմESrI'.n}crJp386`xBGL%:;9S'DC4%[#G=C%oerQAt4澼|k򖫔hA>kC#vQdlit6+6[!\Iλ4[V(^'p>TeN zi-XLGgD%mAS*KACC3nw7M\ 1vnw+{-cs|{~p=KZG셵(Z i}d-+ ~a'^_wZi^RY>%8fQ)5-Z>/L} lvh7fˤs8WDBx|yqPy"}1s @Iˌ"SVq#?Z̅^Mߨ베b \ަ9 JNqsiƲxX *JKMj<w-(a't)9ub&j3nSӓ?1pKڎU%9Zjezc[},A [MB[E꿇z%(=^c:)`#X#GR=7U (j;USJ^5K^`ǡ<1R>X@TRIjipQlcQ~9'$>SMpf~;`⾞ȅB:.U q!`fA6*Ȳt6 *Fp#Tk|mnc{+x*DUd6N!$=B;QMaU&zl20)&DPgvf27[#N^ҳN$z@"~4cT%<&Il~Owq=L{m66baO51ufr%Ce໅{#DbQ uQ!wL_o ߕFUevƦ:FLǧEB" f8^O u,{΁;cOuX8uF/!_3ːd>L.  zsezE* SEgqAWȻ SuUu:lCWm5Ӌ+[A*җ'P3[25YHnL+s3,`Sѱ"4QN?PqH|\C%CW,ײNzy) 1, {P4lm)/C߭< # @o㶿ZEƛpz2Ybܣc5|K?naֈշ'"F=lTZT̨REEYחkع% -b QDF]+_9n3₦5F<n'l"L! x"VODo:13cj`0yNL˹“NQ;0IΏUnO EC,/|<%>:i錗n/V7 ?!Y^:YnV@RV_^ ]Ba+,4&ȚJꗭ$04R bְ?t~~8isb"`g+ls!5P3MH>R&=T/{>Ƣ4owڦ 0^"qv?h&2$J6ZU7k6;AX1W&վrرC:Uj WOJ]S'vS?JvݟKFޜlȨ rW 'f$ H; J8!ugxWxqb>$A!d`4]i$*/j;E޸ecj\L,@kr? ܐZQN8꣠Eg6s}rc,PXW1?)3Yf#7RyMlOӠ4h׀+X8f#J]/C kp]~v3"ĨC #f+,h\"N%loR7M;iBsZx; v^sX&ߤ$4ڄCzcwg9WmJ|bv> 4;3v6$vԂ3:s F䚒1bwQOĽBh/{̪@/s &Xx2d/lpPY+۫IoQ{|XO7[M 6CzAcBA0iPhKwg*60 ZD1S@Jb {Q}p)MQ燾 ,7)ɌS<%)3Ht.w84 ^COÁB.1nu6na0geG":ybVTIM.AӿMm |n@ FWujg)>qޏeA+=eoY\vRTa֜{{8 I+ǛŏOXx i|R$~::p1:72)Qn_.Q1>1.~W>' d PNXil~X *x{!laC,zse-[G2A bR deQ!zX+?غ} ˜;,Na0ӆT+NHaB SnhNSyi`*4P?Ofs8z l>@+,_•_+?W%4.Q hMdžjG.w?)lPPY$o0Ȓ0?EFwy>"P(kO'b悄kлcs)\+ܩ̖ 0yrBwRCY#Emm,#$qS.?4vBL6pt$hw:úqaLWƌ\nSL8,Nm I@YX?htU&I[5 )vYzؒ3pn#ƤGغV%T ]wO1YJ)ihfEpO:>L۽oћ%όQJ~)=KezrMVY2@a ab۰ƿ=~U85zR$ͅhChD 8*,5ئ[ YIY\btEI7 p2h,˭NiN˂\OIͻOܾi+*9rC(ݼK6߽~3Ix5WXk&ϵdƞӻd;u1,M?-%Lޥ>I"h]3 m9umhW8#!W9Li\|Pn r@Y$`=+^x*kE;7m\mEw;Vg4vǚEb1qL-ׄ!* &FH4]ȹD]rC#`ޤ@C r՗ni PaŸdIxÊ8Jɿ@ѝkW6>If% g*n$έDL~Q;A@䎷VE$u"8˩'9]՜B=CH擘1'|o-z` Tx?#![:Cw*_,)ݩy %0KABH=Y4lj'Q>@z;qռ`Ay.yx nq#)Y'DuMRr>9e#>1aQפ`_OeC ˍ@cBQGSp6kgrʅԣ kSիtS:C:)R;;nV9YonB#g $!KߤQQM^Bl9Y1`[Si ޢȼ s܇u$8\ }_X=ѷ-fcJjֹ]/C+E&p@M2[5"\Hr#wK"S2}e0n'0 eb#P OaF# ըQH:[{q/TD$0'čWj))5Tf9ɤDTgV5&C89~(B%{)̍T#Ũ/WWg* ׻rkxJL  l9 n_i8et*%Hզw'eJ|&Fq*>@}gSRjASsF@FI*y2$#aL3cB^ҧĄ!oyn حyj(o-*1r=c}$Ї /Iy!r2c!=}XQ87i#0V!h -`jˌ\.ll~ƽ\H}anW}taUعY܉C|PŌx3,6lҁ3ҩtH´hz!fz]1E3qw<@y*&xZA * Uz^傑/|=DoB])e q~L 6ϵ2t 8\vboj5o3`7YjӤV ѣUFJAqͪHB%omSj=afEy:}evYFF* ЪgNۨx.ijAoVǒbĤt UiȰTn*eeSԛAEGGZ^Y`#TMߢj0AaBE|^G)*>cY)n0X:iHS6;-}VL.ȷكhY#up!V1C"L0H먡dx#7*^ԒzQF7x.y+/Iu75]ΰ:8_j~ ~]Ş`ԏ|EQ f؟JDxΖu2ޤ5͍,18k3|Vu*<:`&7_ltpkݣ>Rv=DZ啣jLC'+頍dI*K{2KOZ6HAPQ|~\ }7YKmSbkAo|~b|.U!ހ"e  Ey5AԘ2ڪ/ͯ,M)y49N\6P,õ!j4mvlێKXۈDs*r*#.LG64Py%ŷ騏JUXimJ]5`O5^#7vj&35-K <КYP ?4^[xd2<3yv5LZHo^nߙ TW?i,3J>`uuSQ_bJ)׫:@ܜ2 '{o`)gqzT*$Z~ȆksS]ûQ|hWV x>q.;EX@jgpZꎅܸs=X} M|~hٻ pj9}X;]k?s|e}${H̼ Q~e!zM$ -;E±7';Fjf&OK0k=GWZˉawㆸ@пc-:!ȑ:CL)0i b%a|\2+&4sFurSX&ch!~ᯚ L!lحۢm;%Tji!# |L{He*-(9"J04Jv|EbNasX?;i{ɲy?K߽!jr騲n{J"?ziBhhBł {2O {M}EY% TRb;,.,[r \CTv(Uf9v8Đ?X{!+kJ"#{To46$7RauK*~U~w_cbn)פjWeEBOXQoKK&Xn[@?+JaSPEE<Ј|%_ۂH. <[.()Š*]k.*wV,l}KlV9A;r9>9F^؊_{&HU斣HM ,8 w;- MXBće^&7`C]-hfw+ØݠNw$<7tj9 (7٥l  AܨF')d)*imr{,W2Um]X(|Z'm}TVXVGK` CI(Xy,MOśvQ4+v05 :$ j3[%zFQN|$."1U!Gk+55OZ̗|˺)y늘fLfz>*^_`-^N+RJ"G2݁I"|.B U 5].1h(4sN7_X%vsZ*JsE뀣}q.X}1N-`#5CR[IF<{4IcA,A9 0quF˸bwl6+"ՓKWaIR0!ׂ=>yx(Z>R6,NAVM\Lw3TpV> s]=_|+Ŀ 9^Bfl'Dӑ3Z*\;c|=w>J_Q8/di !Gj۱0αf{;n };ĖCNUwilcn}nY[jkjo4tȆ9v ;DO+PJbJlbkFm}%l5mAw`6Zkdx熃 sP8vr0d[U㘎v pX^ޟmMйZ2#zI[Ѻ QhsoگelR:B@zAgv|LK/ft޷$t<@!j`?>q kQL q(%)udZN)>jٵdBēOvm3mf̚`}*[R6Pz X2d2ε; wl`*}\ڙHMhswJ$9BуT7{ei:kxS&XGpk' pwH x~t`TT M1 h"ΦL8 YMh+"ēڣ)N7r/P4uB.)Z*hP |B/ze6(. сݹ܅DPV52ݓyW QWiz,a)X%iNi#b\K2fe"ҙ骵ȅ%#|?3ݴS+Zynhjh=E򞔇<$ۂu"SHfc }ͪ IoI>ke%ătCsb7.h]?=C{ @i#̌u(' DvY,ʞ2(m f`z/2`.a~S]G6_306h-鵣VDTŮ9q:IQSl6ӟ-Zr [Q >5Uz#nᎉh&YW'tl RI4;jd {O?D ^a)mr_IMʍZЀ `ѣSpj+k*S҇`ܴq4W*ǩC1K^]Q(#sre]` |K꺖GOcݣuZTCEHغ7!t,J⌕;'JEyn=;LfEQKST>~*<"NM잪*s6g5׵r>VQfԉ2fw*kֱG`W^rT30ԞϺҥ|mC*r=/1r [y 05ɭ<؋4Z]l u hHo;_I>~1M.dG+W~_I2Jol8[ZŠoY?6+3*|91l[&,;­JC0_*]q g ~Z\V JaE5}.brw&)CEzk{#-xˠ9??u͗xQ71}A:|/MR3z컒OFhCa$q[ƽǭlQ'!{M}:N!B30DxsN9# iFpY).FK8,7"~"'hR,W;}6ln#DuIZnKJ2]~ĈsyZ2t)Z`-}chHTPE"b]CtE}s̥˥܌RO<`Xfh! PX=_dИ.yrvRB0~*[OuRw;ٞ6 U*`9B$@搝\iwݨ g\ù k;X;%ޛS-RdĽ%pWKXV'ZDZPוbI.Zb_ nڑjC #1#iPIO? WD^[vƨpc7A${RGtT|qOm!6Ig5A쉟 9'[ LȀkKmGju k^@Vѽ(}\{I?ǒ"qtndDX(!Je$G}L}`iVաZ^D6 )2"8Kѧ 7#¼9()gK;LdAf(J/l^kc=<Lȥwaƙ(^K^*a{EYm5v 6"{F(y}o| S`=.HKe1eSggR/O-eZ`!q4heUO<X|*x ;f#>ڃ/|FU֓9_ѩXzvjKs,Fg;P*%F^ vOQV"zFE 1cQUmԼh#kyG}s |ᦝNn80"O3\^{Icf*>i_H;2\3Sٜh$ˆ+ЂXv"e_A4b ݵ"Æx;jJy($}<~74Q[cjY^뭣fq{7$ 'JRVﯩO'Vlɴ;\i eBrrU>; V<w %7Y?C$oF7v 1F\qs"+@o^'oMr"DOF%?ԊJ3+c=kŵv , kQfu5†QbNңBtgq5>3QT8cD; %FNdYYI Σ[6Ȟ|^iJjƘ*wnv. T7M4XD@-@Rv~AZtnK3㾷hn JiH3{5l"p'|ɻ@a k|[Q99kr<4 x+\)G%~7V;TQ 7wWxm7>0w, 0"R 9HT8g9đ%KgDGCK!p(R`޶3!39 $6ۯ 1ZK 3/dFu_ <㳉[3 b̗pem)9Y*8' 6&^nkNjVx` 񈊔mlM-e.i#5RfF#KY饱d{)DUw8ϊUlƃxޫۋnk`t9&cxej;f12~K̦şE5F/byDk2E0:F f< 1s_}ApahI52HJA0tUk0gّ^ ۊQ: ws?_1L-9@]9Wydױax(:V 0Ѯ\E:ؓy3~0TN/;`ڂ'B#a饠&N(Menr{e6.sDP}㗗l!M㬁]uU3.xƩkHn N%'M pbݚҀC$^7ŇJ=H JP\)}_܇6*dz ThN1֋63kY{E߀Ө{ 'na&S.i4Et6ϳگXI0^0;?o")wgǿFbEa%9!sOɑY2L==Ut 4?E0s*w2*  Jfks'lxAr.ChuD>% s~a&殭07njMضc$<`iATCȁrKQgh{qa=-23_3 ^od7}L>AΈˎiq!崭ҽIGk|=Nʤ>Ww¸0`OK\&d?g$b ([?/Аm9b[MMmHy1A\~' dsMjdj,In^lPC[yߊ+m=9}tB= L)5*xfXZV;`hPΑV?9?6*9qUynNS~L-JE.ts6^}Vzu0g7p$Βg^w:ZӺSL!Tj`Cw#!Fm NQ;!`8|<WWJI\#ѩ˧ Spqd*0^ph/=׳ dBvS[9hE~]Ԝ$aXxuiY` # c.<A>zwMR@8_wU[.!~갗cRVRĩ@}2~^qR򷐐ș:VK;Toy}fw::Fdʮlk;D' *+ģ&Ag6ˡ%gj!xrEQ[ܡ4jW'Cr:hzPlO|Ԭ?FxlV!M"SP6Əc"/.؏;A@=(&NZoUT .96&\#><8Q QG 1Ķ|%8'QJcJDŽb2d뉵$6M\p;yB4.Q?!),5\ޗChEvC<@aAPQM&p OÜH0!^dH&ruՌ>Fpv巛c&ۗ-$B.,V1zEVw"A6/& !*{K@2qE RQ83ɓC;<)#wm&-SFf'Z:'I5ĤX#.Cʾ#0x( ا=-.|^/z^85t`-#mʲ<Hy[`eh]*9P'BM_v $v枋F`lQܺ ɈbLmo.u]d[fTǡ^Tx8BtMyl7F 5g.Bڀco4f$TK.y^/蝡^~/zxN)]܁/65|d VE?q^r&+O9R߄֛+U!vطji\@~0T{7egF&262<3rlvpR? ; Mt!CՁ,fSATp[$mk=Wa@ \l(MPwXd|z*ce/`3,cx^rw"sd ?ImH[oǑl%3E[=Mg_N賁XDEV*-?Sy[d>'KğCb#ڲfMT'0Y_rjpPtRRx-'uR" +Q"YV3u5jJgkՀ(X1rғ/K7 Os%hn\zK$&m/] c~(̇/m S}ʅc_dGbZ@ \ IYKH6{Wult ';4g(.OKZy!qTr L|(xl_J]q EjK@O!cʓCk,\#HP.YF_qVN!*:ۍ hXڵQER(B[ 5C(ooxIKߧ-v)ǟkWTJ} Ñ\YY9YmhXTp-6q u!Zb ;<{*`Yi}UvI+>ouo~7?GiTʄN9r<O*A2>gJPv* ' ؔ0P] @+h' \Ճ!C$mj23q}Z}νD+٥a z]:6$61}EZZYMqgif#F ^1%1Itk6S _k$Ei&MYI{__s5}IHNn|he=Ѱb8i%6| ݽ5р?m{C(\XM8.F/[ IŖ% X{u0+*[iP#6c;F|>Y QS_KZDb`0cWCMm_pKԳFJܐY= y;zSs(3/Z7ɐ[_id6,SW@Kq0Hg#!'5w@L7^$K?5Sr㪻ۛY̧X|ʤ0|׹[i)ȋU{7k=; }.}൒ )JL,IʿkG^ܘ+ N`g9w ZQb ȿ}(B(V[=*bl6 Jc7A;ՃFDp*+ ;D WvPN KJi }?S?̃i) -OKQ|[/%|?mf-CY򼋑!`Bs@'CF9t/~P~ߟ!g72yEC\]H"0xT=V.QAd@4|[.e'vg(}/9`ߊ.^>_uJdǽr1;7kRP JQ9W-Ҙco{lDSDRͳؚo:dsbKN (md=6kϴ}eȩ}_(uK  St1yE)uפV|D> lTD;I"&c,s%VEESAexd[yK r>T^T|x>5 Eì^4ෙߨdb[8۵T2߫(?}f'k3B|۟-؀H._0m-y<ޤ]Q}ES43BYD0D{e0T3J8٫jtP^@~9}P_ˆS#l:5Ha>X-7bY.Rxu!ujg f0+PYѣuеޮX(@k"To2t &[l&KM-Du;y{ɶgAij7ONWO&%m}!ULQI6};tװ.$Y%'dȈ ?#Mc&ES@Z0HArY7I?srr030E Q˹%0Ff"Ooxd<$ ~D0I3Z_11Ujy _Ja{A)%W5Ҍu׬%|oX&M+t韘4 P3\v[<1O<UOK,G!N=Tٍ}u}r+[ FSHWx:,Ex^-,~&,_S&cbrEט+ܵ.qda ϱhEhZ{g叹傒VrkG6 ?Lo<ʦ`lh xFOhv1ذ3t:OyDU!y*eexMv. P`KVV/9^LTݣVk7 X ls"Yƪ0#&+,BB=@4yGYN~=xޓIrw*OL}.w51 @ИSA1Ti+|B߻P|$_dҠm,ư0vbtե2xEqWL*8%+Z"egФrdVEy<+0l7斌ߚ=1=maؗ1標GĪ FQ^̞C *:p,kQJBDŽPZ<[xg[hscP<;%+=, ~O2xW:1_f7;i1я5 46)) w}OYavڝ* %.d9uxTсQd$ ̠w{iSN$Wܻ?V/6m.`Y]d/V[rggzFT*I7&[>YMT+Q 7C2j\X8IAn(#e.v Zl.#B7툜J/^0Iozm 2gS}v >#YYT$zL"~VI!ϭ3A: yc~8b_LV 3gǼ.α׽P\@ƻuGls5e \FŃ ,Y*}%zSOeZU^^p# j="qA:~,[1gjBagƥ{]Zo rwԯ23;QZ"}j?{X8{M27 ֋1q"# 't>s&e l|mL03oژAeV8E>I턩=翝)[ mUn^UW[DGsbxxIA=VkKMNƿ@tLP=Ex6||~]ykO+hRC18xX8$mZ-;8JƱ b=mćScxޮgOn|2، ǝ׆ɂȣekcJ%kX!?N2p2]TE8ItZ>Y\Ѯ酝ɟ!OQ.&,Ь 1}s{@G[~XysGw*)4H`k n9 D̈́4p'!K1jN8;kE$&ЀQVkԎ} kٌ1mwAyӪ'No SLNMl(9@`f&l]wϢH5Q7uu"$L61Lؾ :N@ "éEt D, #͆G1eL?KjIŧG8EcEV`E{ qa/>z ujN_ܑSJHv&#V7fNejrrTk/\&v=ԯ=ќt.=d#2at9gwpP$]K&Ұ:inX6i'.جG/Yr'T+9OQo,Nxֽ!qݞ k)GKk=GQb ©9qۆ]e'E]g:2A7S5ddQɵ\aL(1vtUR`LmeEZ%ф9c9Ws'Zb([ 9Qj*}ǩ"j-‚K_+La=7#"w*Q\k9b94 +CP, EdSL+(YpÞsuA%.墁\WyqUI@rCh3uEA/JߙU%mUv0E倷pg?9+S%E#TQ3?Fv|97;m)u(nNVn~Dc`~F~J5j>}Hbk"(INȖSm$1 ,Kn=7ՒDSb/dX^ƕzf #6v&=]^ƨh%e֥]ӷ7 μaJ]aiDӈx'YsQ*6L.E%Krd2TLEӖIC \kh'Io|%|=s5_~x_7 I =KgLU{LRwD=y|~#qWx{.9]&w~+&^7Uօx<+Ffp[?u*l{./:2Vлx l"N{_ *cebE+Z.Wu{0fX=SLdLGbT)E ῎{-^wD~*70tks!tôg+ʂ ͠\Q *|T RT2D 6M Xs[kdv~VUZOoP{8m= S2HKށKq, Cfk-`4Nzߺ4DV]-Tmmѐ73x ҟ5I$ ,ڂg'Á>Rnfq<4F"Ƭ{9ɝE׺w"r(㠣BLO똘4V[Pj:Tߋ'W_#'PC_ <,A5u$9E&ls./>oK^:Uln"sIyycif߮?xޕ F.==Pډ)luIHX26hC*}upb4iUufc~pӎgXf&.DiKK6?J2DIi\ *50A7r>?0-\׸: B\τ"'F>g]*Z 2y8J⇱YK}xNy?nzs|VA_]7>Г%fiw>G?[tEڦE&Ba'1kU k={b $RsV](ZZRKzX|`LZ)m (}7e1/0sg|^sLLS2J]^ $ ,Ng3jfjs?ID ˕]2f zH%GϷ w6e̡:Aϻw)`JI/kڝY5~2Eènju4WFVǙ+ P1Lld.jϘ}J3La85@b"wƎfJAݿQ'+ټ{=m=/}\ŁfKՠ`;o[+Qy V Ңc]:THr;x9 r;A#A=PmfnYU%byD]'?\ug3c#k_kR?J \fKӅ&u9S&:4tDjW [p]B.@,4+9:$X^*eTJ}ZQ[(_]8ݻhi==VI Е8rT`yEr[qi1z7UԒy$|9pG8O3ZkϓU Lo"*^[^Tƍ}[b"=5o 3g&&@>(y&dx0#`B ?/h"R?w)ԥƜ{p0 n\,J3H(2BDFYrHٌӘnZwȀ瑑"k9tЗM{{Y^oۘȲ8Hy(3Cdƈ <ݽXO}v8XhNHC@-$7C{h[tƒHkgM~dJ2+"=Ka$Ǖr*c 9 Wv# 4g;egOV4&T{"lcˑ=Mn;n'ml]Ϊ8$) n^>(`ח" za߬:{":ʫ8<3i*焏q'7 il@bjyGA(l&J8C;B,}C2c3zpy#TF3͝bs {iіјj_Mb~E4#7kE4m(Rմ(dUStQ"xB"FdRnwe1:A:ݓSmT 4fhT@.8Cx#7Uu@KݍF]Q4vW333,&{9 n(6qXRctîJUAy^G3W _B?y5ܪLp&ۧ/٭]/bWH6 ͽA{n8sJSF6˫Mj4"PvPbrG(}+O+DYOך:G=$q"ᤋэX,<[8U [zݬ;C*\hʩ[v;I+t\$+F]@cVpAZiI0}~?+dbe`/Gx| * EVJQ:c Cඅ/>ԯӐi#Up@zub~ڐ(#Ą+e.ÆH>K dIO+oqqe̶wZɠP_Bibq3wKdxfc˃^}gfx ^h Afҁ;=>?K3ܿ/tj]0nԀe.ʜk*mF:Dp$ttik)ZĒ{;HcC\:`[l`,L`6-T4BvF!uz8_77Nb) >sb,O|NaF~xflߎ>wx}eA aRv:cYA)q$W*?y; r:T tl\b/}{\鱻-SMcYREA?[<| LJ*' J:QA>=ND*xZ60'R"h+@TMd&uYWf(,|OVBDA6ċ93SZ#$Ѫcka?]FYzNm]7; 򇳯mO^]$8Kj4i_jO, D12q4RW675=gXa#Vc׵%P;Pp9TuHXZ"h6 `}p,Nɞi\}nf/`jGkt>{^؄l8;Rdd4{ ԢgikIcHJ?>P_fo~c X] 1  bvZݜJIXؔ=TSE% 7Z8F։F~@Ѩo$7T3C#Е}𵮡KR+83KXSҧ\H5]5yȎfqtIu~F:js~Vݹj{ <Œ'D sa}upijWKy }mf֮X=V]Y|@;[.9ժ=*)l 'UFhN{5 ƚ*Q,<=~:kkܯ{w I-way]YH.[$=>&xv" SZt,@a\*=qgbr]:: 9tz&&缃VG%]K𛝕A3Pز+fR|4 9iMMG,dq,78bQ̞es&ٹU-U`H;F״Giom#ҥYFhTq\\{3ϴAijs%[%ǣe ]mʤo󲮪ms5Wx;(*. ǴFCeXsB!- g3.NT yaSu'1hfc˒G׳qa/Iv?:;&=?{Wem5 ^7ʐu;/n8ߐZe'W{a335p;j/$QJE}BIVVN%D ;wuqıx݇yEV.ӞGGVYT֒%Z3sy!}cn͙~sZ|u!+J|Tټ¦#q82+UUkU1^RdpQz-^L!N!1}Ҍ[$t54zJ6̡q<̌s^׋r;cI#Ӏ>)mиhg/Cfu:@'ED;xQĸHsx>PƐa7 {$ߺ&`9"`&VXOKm`bhBTd{+CF ?.$rECV߾xZx'es# :h$|w Ֆ4ɡ>R9Z@oA9/GoN;glh !]!ԵJ:{_6H~l:жI Kķ ),ofor=xTԏĒއbgZZn,ົ]PvLƀ~\@!x$Z1Wv`s$!a9eC~|߾1>qމক"f`- ^Aq7 PtwmE)Gx^ܟhw @'lK.ʙA։D®mYJt>ݡ&lh!J11(ckiv$:KRD&⶞(yT_/wCmH$`mrfN&Vœzu#*[#-UÖ "}*!.ZU$Hƥv'XCMR pn`t.s䴴'WtaIڻTDZ Kz@8v͏]VzQ孪3ۘX%q`}! i7zXJ%Fo_d[0,d zaއ;8qY?tJmx* 1;Fb@3)ഌ1NS8"]7#_[Q@8LA<Z 0ޫbbWlv.* qiڄ S%^wN|\9HtnxCʱ*Cux%%NoH'tJȋXZ=o`PcMbu*\VuwO'A*h9x sc>pd7LMVTGgp{Dau0J^־#pS5#| _x>#b qso:5F`1Y&6bKDr)z+tX``h=%2c >\SuyzB# '.\_!lfqWoK==7H}]gw ef O*v [?; ?>ݱu,γ3״53&|vrwo븈A^jWfI9 P=5cDmCQHCs$"%hIUҠc}Dқǯc rmR/~$}=:S6*~_DI&=7ۄ֍BR?Ꝭn؎+&b\,28ȱ&S+W$ys#uBBytvI8J-[Dnγ#t:y;&(+m}J0UpvA&R xܳMj~O_|.KüvL& }Nn6AP͛ =daQo^/%k#|I>!!#e r=3؎V5uKPtÀk}68*Qyb Ԛ[ҵ;L.g챌܅oSJN>b~Ҵ%F.$'1#KՀejHA#I(jjΑh,['Eĕd'fϏg}ÔYRKYfEuDo795xO]`` t[8b1+hMƉ@3kXUJ,??~֨_mԟLMj<,̶P.YV:xhV0Iey!cQ?+mk D݂Ֆ#4ԷZ9#x( 8>%ƞ\JR0&lm)g; M¤ڡAPDY3o\vtxOvNzS|n_Zb]0).Frھ;/jUo3g$]#C˔JTޟuT)T>k>RXHzv'>W`UkK .бz䟧F6/)3$4 9 P{4t>da#봫 A %baF/o Ɲ%Incp wB{ޕʑËDt{xf=>m(z2ˀw8=Q-׌r3Gz]S]6U1ӷR/Ö#WG~AVsŲ++BOJaq@+-+Re cI}P yd`/EYo3T/`\b/)?.iB 1B8nSR +r2h5!qIJ c%rDW?~ 3 9^MaZ_d~_Z'RR弊U>;G‚˟7C:[eUF_uQ&v% ƛTx$&G]\[uۉpja&o_dKpvBoQV' lQۍ'V^9BCAĹZ*[ۘyd |?f8 \(V1RNYA[o~!Gf*ӲvRC/ګ|-7ߵg&Yz_Dx/]6E('Ľ]Sgwr6$F>O9-Sm*K_|FbIbGWvUt5K>ūX9U>=~ށ74\+ܟm8".O   xG)CZ*' <ְiW?~Sx~7U }WvU lEJsS/:f7JR:hγK_-W{MGߑ [-^n+~.^b3y] S%|b\h#ʤ]0 JVl+GaVKw.Y3A50lb8Ϧck@mcRMN}'T6)U2 oV e ?ъǹRebR|$r>[#rdA97k~.'"~Fj{Wr/Pr|OTwq$p4_X$֐ Z!e0SƷݝQ߷(!ο-!{~%|m-Y*@]"%@TO)ѷ@Yz|<[E:ިup7LϟBѳW`li҄g1J&j]$!G)c_rcd~PY6EuE U|oQ.ɥ%lv֜mPc{ŋ&^>ieI2[OM02SwW_O62ug)TXt,;W'9Y(Z\2=0z8*,E]2kq: ~m)@o.[b ʍ?6/%E se*{Xj\-lՑxo@GjH<13gKը2&}>_~uNÐtټAf|]O,岾rW +"xg]BŴ&םx&Gш*,4Q .ZشFТFC忑`Y;1U($R~Od n0cY˥& [\./+`>5'"~6g%)cɃXSЌLT'dceєUrN˗gקFM2ct(qFa(i,)(?K&L\qzFXTiOU5gHCY¼B0"ng/7%]p.Q:Ӵf 4CW~2ewb͈1GѡE}.pY6h<_6 >w?9ޕ#Gmz-O/b#U <ð ؓ$1mdLZ*s@!o^yhs?YV1?'5}`djB0V(Ll ]Rgq*s}.k5㺕 sbΕ:MJCN`siE%K^+nogDuَԵRG&%6,އV2eQq ~' hTL4=cҪ^r:~"창iNH7F3aPPD^B~-zaڷWwZ Y깐-So*0h}UP&Am1B=WhzJ_)i,#׹8L',i66$Ls.2*^ 2b[0ᑊq LfknmZt~]P$)l~; ?y;j =tRPzTËL9xR$]_MIѽW sMn+%.6н -1YYVN˨Z+ҤԦҴ /o4 dMF?aJNQ u bRq '6Kv[ӥEyQ֪68M:>ȣ͊qn8.V_㐰y:.iMK 81.P{;C]iѨa_q%, 2;™Ƅ)/ KE_L( bgnE(0[57Wc|@ލSzlIۯ(op:o-!5Ԓ-{tP(4^cܫ;wqfاKjG\Ç2Evj_&,j-Kr&/D.cm&e}_!# T[sƯ,K-61?@N#QϛTZ{.K(N5a8z_jY4}U!4]&7ܟn2TSӡ4?/EU!kmBз5ZT>z,jp```A+TI`UYqllCCkD<> bWc.Z+f%l̜gԹ?Xg<EP'6^gg:uho(5P -T,e(ߪfϭ5JI8,?R!+'w{Q}e{"}3XhЀRUL]Q뜭 &Nm|&_Ϋ 61Ho4ߗVH*lsڞcQY.I\6!py$?ם:/qW''q3 gɇɗTcLCm2sX9}&A3OD:H.;7!ma@'uT:;2@* +'.3L7S^ubſ5 KQğ[ߍZ4X?L5XKԶW )fk.8#yq. 5FQ OmZ&H HN[CB߆*(%M9. *FX| ˰o/qW`yDiX$7@/5WJo9%&%\=0o F,nrHJ9ON_yxYFU}.5 +L8_>3|NLtݾ}u9oɬ-~5)I#Y4بò *x aP ]3?n#Y#t~>ǥY 7(+ /L;՟0oZ~}r3rPJXiY,@A2l#$W47T"#WN4gsMh^R $5o~T,KSqk} Y!хw'/e)!jy<'gYV +NhWm5iѤlRyi麱)( 6,OUIsޔ:&oK}JiM5/urB8q'R$JpN>8:z %DJ179i9 Wi5Q&l6S'>&DFMCHo8Z H jV(rqaW.~1#^ͳ!ef,S;8eSKEJ 1<qZbHM-"4)!8 ʢ@',Y椕4wz ڭhN$ړ<QYtMB'6+7SOT2}o"W xٰ k:"YXxXLYGa#?t wч=1s]:=wgνjS%aFiAHjP~8=,W3kFTvs1wtTCp1 fծ^ U /7#v*Z< F)C}Is~&Ш˚̧o zAb <vWh!`J aIu楩4X]<35[. ^QCW80&͕/M;7T4#lTb*N%b_o\\#/aT un={C| C m[z2D\fRHe.'j|vs׆ O#.@oco[uNeR0((W[EeC\|~P9͘οRH5(J6)"{J&m\_K>,R[i\&uM.w]$C?PGāRC|ʋ=k-X˪?Fp:w,q@žMU]N3ߠQDN™:y:w[ZZpYiAa).cDZIHjd diꮰ^?qvMn6: ^^ox+cj8bgy%S8#A]m+]~C5I lXnމ5e;J\hpH6:0 !GjiconLھJ0hF*tyÍ차s`̮zl"0i:lzڜC[1x(-v*6yg߁oui;Dt;C b-7\.$_0%[x N|59x|YᎹ'ǀjD#Ƥ>-ʚZV3ԷΪ+ТxO 2116H=S?}}dD$Z :&dCPd3(T*"/`haN6T&cawT 'lOUqTPVQ[P홪"vg^pAgpkK#Fy@JrZ}.T\G_2uW*Zȃôka8h\{yA1E{UvǢ+pӔȧe?5t E;d]?mh8L'E1!Nc& pFIn`e仄(a 6*,^t@N3ޥd?S^. {2ش+=VQka;NYQw-I!YƤ: P J`0"=e(aC%ekW$ i&k'5#2O/?듇j-Ffsʳ(@(||¿wZCEM4{(~jKn|K4QCLdb# ¥!*2"|*NQlxʨ:$Ti&E6U':.$7۳[-26rЃP/yF_M諧:x} $J[ǶWlTzYz`Y 5,tUaXP:<~$^s􎟞׀T||).[35ȇΛcsku]o"zYDw 7W2x}0_]k7Y[2!=4Z[46P%iZ#K#=Chn焺9_{hwƘ.^28K39s1[U'X"p #M<@;7~hcwox܊?\YU=`u׸P1 ?$06f%`櫯^ ,&ôM0ɁiFï+L~*8j=/g_&9=Bm*~%=btc;{gL ޷N$opfo+Un/4 &#MiTƗ8^6N|>+ND:H?6U@v 7[h"V*{]ך*e͔"S MD?"+XN-m]X=x@ĩh4Zl`BOv*$nhxⱒ Crty sU@M:L#"p3}m0}]ri$, U/EF,;* ۮ\cx 1hAF3OP*`=h,HY ΎW _CԞ`7A`8»"sLF!fН{R[@3_{k³]@vWiB-M&qS>,: Mk S>)f'2qnPtWXt.B*U]R-2 B9ԗbQኽCL '/`o Hϴ>Q1 9h%0c+Xl&ʩד5̀Q[?teXi@ fW. U.4k،EiY>\UBqaA_??(,]gBT ͣ}Z2T<9fZڒƀWﱜU_#R߭@{r g1yQ H/di͕;#u7yA)鞒ɣF~c-%9pC]vZ W& FBn]*z2OjVb;N#w |vf}ZoDB~ťl`hc8 C#sxhRV2'a:f*8A %K(h P3yf)'# ,%)rx &gldm3Mr<ܡ;7<OwLOxp률~m^A%΋'ȁ|(u|2f͋B8mE^~Ye8$n# QHEm'9l8a\+c ~SB'ƀ"1|B*(]d QMMg 9Ϟ\'9ztP#r9 +gns:zcOaix a;1i{M=n_>YGv‚6TQ=wJ,QK?@*ZWsᤝ^Q*Vh'VG(-ƝྡLީ |UnXDUYkzȁqD 6|;){JtjAd,`"_PJ <5Cn6ޟ\]اGOڽ f0q_M֔w0;.sdmXH耳o 1R1kvr@Gm9,' $,Dzu*̼V6 Κ|5Sare;>^GaĐXoR[@ ЖUƔ($atzRwA@cnS -rOb t=X$rNyºlOLYKKUz.Ua}SCѸ>ST><4'z:'e8db dz}"=o.6ba/iˊn0>[ cckLX>@8B;fw6\86btZa,G_ ͌h 0I_ YLc{S Ot.SjgqqT.\oa`4Wjޝ:I&aM6xQhEe膮y kd( U-"i28jRgN=Ҽ}Y9:W4j^ I*a-|ޠ]Wݤ;J""׾ !LjKjj#eB.G1sr`|z5,j_ YR ng T:j E:m]cY0 #qwU0jk,ֽb&7tQX?7Z`])PN }nxJmO/kdɐ`1>V7[JOw7gcmkhqલ8FG$GL0FX VWd9!>)0/ b)!IxmļTzVGh5#~u׎+t {T<9tӪ nN}s<'+յaz- 3=e5rԲ\p\GN2W! Y/\YV)*m3 )ꇈuTn*w-j2O@$6*#O q!mMPCJ]d{Bn̴Ud_Q)R-C%1ÐH=_n|ZDc:̓L3lwd{)Ot<mt㠥H CgNtT"1 KѐdLj%+gΤN=t60Yf*6QԼ%Fsǭ#aI/c )h3`!+eZtve[,`|*܎K;P_+wnV=XIZ 1$G8N g'ua6_Ng#彴{dG^+H\Vc$-^W05>;jݢE;PhV`s N閝P5j;ڝoEX[M5 \ ֤d<4Yʲv7sܑ/0ˋX ۏz0Bq2p<*nB.!py›!O1]sD*mٺKʼdkf#ѺN} 5@j2 iA,\e:[jf&@^ݮ;*X8Lt lB!0Sɔ;7X{9SɎwp/oR,bxCkGIFQv$%Hj2+R"]|>ɼ_4ydLL_6Fn bU,9!tu39<`GsXP ΉƉ %dvc*dXO eI1'֒huĒb5Pp#%u=XV*GMtGATnMZB{Vnv28úi?](RRz=)fR>dSE9-_ LJJiWp ,Mq}]ƒk Y^tE_Vkj?uMMW֫ @5&|7Zoޱh &.8"Q>~S Rku}郪s)E)ZMvr0;UN+gO^y&Vƃo{MU4j3r^)D2Fm_Đ~C\}I>|TaO: \@)V ԥr||/TPNj18ႵaŖcȱZs"f20<]?+&X|j#6.^)_%~6!CmoɎzT*zӾ #uQ7/cJ1 $nC+@ >%|rG p0$C$a2EH@nNH }Glz:R(j7E6'93h\ eH,5mDA@`P88JVXSn`_sk? !{=EUŀeLʂRHc-G1| ֓|݆FԪhm9'zOϬE$`*ˌm;ZClLy|lݞ Tf|Mᒧ{J9a<;MTo^<LMZtK*d5LԝQG&y{#&֙n}lԽ8$F[ hek{k6ɭWMd^È5]VͯէCY)ˉNql1;ttj[q ˙&ٻ$,˫T W?M*%MΆ܆5UnةL'1PHIÂ@qkϦ@L_F;±0D_^W>Bs yJD'Ƚjgq\W8hFGnh\C| [3-MP׀Qn耔ʁ2HURcvKt/ujG!ldyY&;Y$+t\ml@woK=U'lUɻtt͠Ih el?I7Qn/UT=5UQY1vn,ND[9]e2(չhGk=v 𹆲=gRL'rhvSV^U-~kǩ7$ + |_;Hceh0JZ*!WX>۟A/,x}$MὺT ].oFQl06]/4U~ff֝>…mh[<$jMmX S{-ɣIKr +䴙µsc^%9 ڞz6cǓDen, 1w8 P2 Д6o&!P#e0FO⏌Q寚Xge/q}wƕ YZ