kernel-7.2.3-300

* Wed Sep 02 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.2.3-0]
- Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao)
- ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki)
- ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki)
- page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847]
- media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart)
- media: i2c: cvs: Add NVL ACPI ID (Arun T)
- media: i2c: cvs: Add IPU8 PCI device ID (Arun T)
- random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262]
- Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes)
- crypto: af_alg - Stop after finding name in allowlist (Eric Biggers)
- crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers)
- crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers)
- crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap)
- crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers)
- crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers)
- Linux v7.2.3
Resolves: rhbz#2521546, rhbz#2521847, rhbz#2524262

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>

Patchlist.changelog

@@ -1,3 +1,45 @@
+https://gitlab.com/cki-project/kernel-ark/-/commit/e8406125b1518ccea6da3a6d24c083d1266e86c2
+ e8406125b1518ccea6da3a6d24c083d1266e86c2 Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/6a286cd1edf4510f39fa76e9e9c74578dd6d066a
+ 6a286cd1edf4510f39fa76e9e9c74578dd6d066a ACPI: scan: Do not combine resources that overlap completely
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/c83e3a20e2c864a3a262a68715b003e34cd83693
+ c83e3a20e2c864a3a262a68715b003e34cd83693 ACPI: scan: Avoid registering platform devices with resource overlaps
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/a3cf371d7ad3947bc73d6fb68226f2cb93b4e703
+ a3cf371d7ad3947bc73d6fb68226f2cb93b4e703 page_pool: keep frag_offset aligned for odd-sized requests
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/16fd65fad1784d16d1e38ca90bf672fe6dbd3703
+ 16fd65fad1784d16d1e38ca90bf672fe6dbd3703 media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg()
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/dd40a4985ebc29b4d1e12960b4e7cf715128722b
+ dd40a4985ebc29b4d1e12960b4e7cf715128722b media: i2c: cvs: Add NVL ACPI ID
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/2aafb1ce0a15a4453bcb2b6501e2b759c6558a7d
+ 2aafb1ce0a15a4453bcb2b6501e2b759c6558a7d media: i2c: cvs: Add IPU8 PCI device ID
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/2efed24569953e88ce1f9a6ed579a71bafece833
+ 2efed24569953e88ce1f9a6ed579a71bafece833 random: Drop the extrng module reference when import_ubuf() fails
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/e597dba8c0eb131768f5aa3498822d52c6cb356a
+ e597dba8c0eb131768f5aa3498822d52c6cb356a crypto: af_alg - Stop after finding name in allowlist
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/dfb9f20d58fe088049b7a4e5f7b0597fbe39a76d
+ dfb9f20d58fe088049b7a4e5f7b0597fbe39a76d crypto: af_alg - Replace 'bool privileged' with flags
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/9ce90cf073745eb142bfe1669e9b8f6625a763b6
+ 9ce90cf073745eb142bfe1669e9b8f6625a763b6 crypto: af_alg - Make cbc(paes) privileged-only
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/76bcc03f09041646f7bdcf3020b756b5bd8e09db
+ 76bcc03f09041646f7bdcf3020b756b5bd8e09db crypto: af_alg - clean up kernel-doc warnings
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/13d0095a68c6be26a179e14df996cab6be9ee9f1
+ 13d0095a68c6be26a179e14df996cab6be9ee9f1 crypto: af_alg - Allow additional ciphers for cryptsetup
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/e5a7d83cf810d0227ce161a6b2a94a1897f843ce
+ e5a7d83cf810d0227ce161a6b2a94a1897f843ce crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1
+
 https://gitlab.com/cki-project/kernel-ark/-/commit/d088d8766e390303a72e82a86d2970f17e6846df
  d088d8766e390303a72e82a86d2970f17e6846df redhat: Add DENYLIST.rhel to BPF selftests
 

kernel.changelog

@@ -1,3 +1,22 @@
+* Wed Sep 02 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.2.3-0]
+- Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao)
+- ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki)
+- ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki)
+- page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847]
+- media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart)
+- media: i2c: cvs: Add NVL ACPI ID (Arun T)
+- media: i2c: cvs: Add IPU8 PCI device ID (Arun T)
+- random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262]
+- Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes)
+- crypto: af_alg - Stop after finding name in allowlist (Eric Biggers)
+- crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers)
+- crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers)
+- crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap)
+- crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers)
+- crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers)
+- Linux v7.2.3
+Resolves: rhbz#2521546, rhbz#2521847, rhbz#2524262
+
 * Fri Aug 28 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.2.2-0]
 - Linux v7.2.2
 Resolves: 

kernel.spec

@@ -192,18 +192,18 @@ Summary: The Linux kernel
 #  the --with-release option overrides this setting.)
 %define debugbuildsenabled 1
 # define buildid .local
-%define specrpmversion 7.2.2
-%define specversion 7.2.2
+%define specrpmversion 7.2.3
+%define specversion 7.2.3
 %define patchversion 7.2
 %define pkgrelease 300
 %define kversion 7
-%define tarfile_release 7.2.2
+%define tarfile_release 7.2.3
 # This is needed to do merge window version magic
 %define patchlevel 2
 # This allows pkg_release to have configurable %%{?dist} tag
 %define specrelease 300%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 7.2.2
+%define kabiversion 7.2.3
 
 # If this variable is set to 1, a bpf selftests build failure will cause a
 # fatal kernel package build error
@@ -4964,6 +4964,24 @@ fi\
 #
 #
 %changelog
+* Wed Sep 02 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.2.3-0]
+- Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao)
+- ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki)
+- ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki)
+- page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847]
+- media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart)
+- media: i2c: cvs: Add NVL ACPI ID (Arun T)
+- media: i2c: cvs: Add IPU8 PCI device ID (Arun T)
+- random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262]
+- Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes)
+- crypto: af_alg - Stop after finding name in allowlist (Eric Biggers)
+- crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers)
+- crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers)
+- crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap)
+- crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers)
+- crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers)
+- Linux v7.2.3
+
 * Fri Aug 28 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.2.2-0]
 - Linux v7.2.2
 

patch-7.2-redhat.patch

@@ -1,3 +1,5 @@
+ Documentation/admin-guide/sysctl/crypto.rst        |  36 ++++++
+ Documentation/crypto/userspace-if.rst              |  13 ++-
  Makefile                                           |  30 +++++
  arch/arm/Kconfig                                   |   4 +-
  arch/arm64/Kconfig                                 |   2 +-
@@ -6,45 +8,133 @@
  arch/s390/kernel/ipl.c                             |   5 +
  arch/s390/kernel/setup.c                           |   4 +
  arch/x86/kernel/setup.c                            |  22 ++--
+ crypto/af_alg.c                                    |  76 +++++++++++-
  crypto/akcipher.c                                  |   3 +-
+ crypto/algif_aead.c                                |  11 ++
+ crypto/algif_hash.c                                |  24 ++++
+ crypto/algif_rng.c                                 |   9 ++
+ crypto/algif_skcipher.c                            |  27 ++++-
  crypto/dh.c                                        |  25 ++++
  crypto/seqiv.c                                     |  15 ++-
  crypto/sig.c                                       |   3 +-
  crypto/testmgr.c                                   |   6 +-
+ drivers/acpi/acpi_platform.c                       |  45 +++++++-
  drivers/acpi/apei/hest.c                           |   8 ++
  drivers/acpi/irq.c                                 |  17 ++-
  drivers/acpi/scan.c                                |   9 ++
  drivers/ata/libahci.c                              |  18 +++
+ drivers/bluetooth/btrtl.c                          |  13 ---
+ drivers/bluetooth/btusb.c                          |   8 ++
  drivers/char/ipmi/ipmi_dmi.c                       |  15 +++
  drivers/char/ipmi/ipmi_msghandler.c                |  16 ++-
- drivers/char/random.c                              | 126 ++++++++++++++++++++-
+ drivers/char/random.c                              | 128 ++++++++++++++++++++-
  drivers/firmware/efi/Makefile                      |   1 +
  drivers/firmware/efi/efi.c                         | 124 +++++++++++++++-----
  drivers/firmware/efi/libstub/fdt.c                 |   5 +
  drivers/firmware/efi/libstub/secureboot.c          |  14 ++-
- drivers/firmware/efi/secureboot.c                  |  38 +++++++
- drivers/hwtracing/coresight/coresight-etm4x-core.c |  19 ++++
+ drivers/firmware/efi/secureboot.c                  |  38 ++++++
+ drivers/hwtracing/coresight/coresight-etm4x-core.c |  19 +++
  drivers/iommu/iommu.c                              |  22 ++++
+ drivers/media/i2c/cvs/core.c                       |   3 +
+ drivers/media/i2c/cvs/icvs.h                       |   2 -
+ drivers/media/i2c/cvs/v4l2.c                       |  17 ++-
  drivers/pci/quirks.c                               |  24 ++++
  drivers/usb/core/hub.c                             |   7 ++
+ include/crypto/if_alg.h                            |  42 ++++---
  include/linux/crypto.h                             |   2 +
  include/linux/efi.h                                |  22 ++--
  include/linux/lsm_hook_defs.h                      |   1 +
  include/linux/random.h                             |  10 ++
  include/linux/security.h                           |   9 ++
  kernel/module/signing.c                            |   9 +-
+ net/core/page_pool.c                               |   3 +-
  scripts/Makefile.lib                               |   3 +
  scripts/tags.sh                                    |   2 +
  security/integrity/platform_certs/load_uefi.c      |   6 +-
  security/lockdown/Kconfig                          |  13 +++
  security/lockdown/lockdown.c                       |  11 ++
- tools/testing/selftests/bpf/DENYLIST.rhel          |  76 +++++++++++++
+ tools/testing/selftests/bpf/DENYLIST.rhel          |  76 ++++++++++++
  tools/testing/selftests/bpf/Makefile               |   2 +-
  tools/testing/selftests/bpf/prog_tests/ksyms_btf.c |  31 -----
- 43 files changed, 701 insertions(+), 106 deletions(-)
+ 58 files changed, 979 insertions(+), 159 deletions(-)
 
+diff --git a/Documentation/admin-guide/sysctl/crypto.rst b/Documentation/admin-guide/sysctl/crypto.rst
+index b707bd314a64..9a1bd53287f4 100644
+--- a/Documentation/admin-guide/sysctl/crypto.rst
++++ b/Documentation/admin-guide/sysctl/crypto.rst
+@@ -7,6 +7,42 @@ kernel configuration:
+ 
+ .. contents:: :local:
+ 
++.. _af_alg_restrict:
++
++af_alg_restrict
++===============
++
++Controls the level of restriction of AF_ALG.
++
++AF_ALG is a deprecated and rarely-used userspace interface that is a
++frequent source of vulnerabilities. It also unnecessarily exposes a
++large number of kernel implementation details. For more information
++about AF_ALG, see :ref:`Documentation/crypto/userspace-if.rst
++<crypto_userspace_interface>`.
++
++Starting in Linux v7.3, AF_ALG supports only a limited set of
++algorithms by default. This sysctl allows the system administrator to
++remove this restriction when needed for compatibility reasons, or to
++go further and disable AF_ALG entirely. The default value is 1.
++
++===  ==================================================================
++0    AF_ALG is unrestricted.
++
++1    AF_ALG is supported with a limited list of algorithms. The list
++     is designed for compatibility with known users such as iwd and
++     bluez that haven't yet been fixed to use userspace crypto code.
++
++     Specifically, there is an allowlist for unprivileged processes
++     and a somewhat longer allowlist for processes that hold
++     CAP_SYS_ADMIN or CAP_NET_ADMIN in the initial user namespace.
++
++     Attempts to bind() an AF_ALG socket with a disallowed algorithm
++     fail with ENOENT.
++
++2    AF_ALG is completely disabled. Attempts to create an AF_ALG
++     socket fail with EAFNOSUPPORT.
++===  ==================================================================
++
+ fips_enabled
+ ============
+ 
+diff --git a/Documentation/crypto/userspace-if.rst b/Documentation/crypto/userspace-if.rst
+index ab93300c8e04..d6194346e366 100644
+--- a/Documentation/crypto/userspace-if.rst
++++ b/Documentation/crypto/userspace-if.rst
+@@ -1,3 +1,5 @@
++.. _crypto_userspace_interface:
++
+ User Space Interface
+ ====================
+ 
+@@ -12,9 +14,14 @@ AF_ALG is insecure and is deprecated. Originally added to the kernel in 2010,
+ most kernel developers now consider it to be a mistake. Support for hardware
+ accelerators, which was the original purpose of AF_ALG, has been removed.
+ 
+-AF_ALG continues to be supported only for backwards compatibility. On systems
+-where no programs using AF_ALG remain, the support for it should be disabled by
+-disabling ``CONFIG_CRYPTO_USER_API_*``.
++AF_ALG continues to be supported only for backwards compatibility.
++
++Starting in Linux v7.3, the set of algorithms supported by AF_ALG is limited by
++default. See :ref:`/proc/sys/crypto/af_alg_restrict <af_alg_restrict>`.
++
++On systems where no programs using AF_ALG remain, the support for it should be
++disabled entirely by setting ``/proc/sys/crypto/af_alg_restrict`` to 2 or by
++disabling ``CONFIG_CRYPTO_USER_API_*`` in the kernel configuration.
+ 
+ Deprecation
+ -----------
 diff --git a/Makefile b/Makefile
-index ee964fb0c056..a579dc02a0fe 100644
+index 150b1c1d7bed..de832cf47e7b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -358,6 +358,17 @@ ifneq ($(filter install,$(MAKECMDGOALS)),)
@@ -273,6 +363,140 @@ index 46882ce79c3a..9c73814c31e0 100644
  
  	reserve_initrd();
  
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index cce000e8590e..ab84c4488a15 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -8,6 +8,7 @@
+  */
+ 
+ #include <linux/atomic.h>
++#include <linux/capability.h>
+ #include <crypto/if_alg.h>
+ #include <linux/crypto.h>
+ #include <linux/init.h>
+@@ -22,10 +23,28 @@
+ #include <linux/sched/signal.h>
+ #include <linux/security.h>
+ #include <linux/string.h>
++#include <linux/sysctl.h>
++#include <linux/user_namespace.h>
+ #include <keys/user-type.h>
+ #include <keys/trusted-type.h>
+ #include <keys/encrypted-type.h>
+ 
++static int af_alg_restrict = 1;
++
++static const struct ctl_table af_alg_table[] = {
++	{
++		.procname       = "af_alg_restrict",
++		.data           = &af_alg_restrict,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1		= SYSCTL_ZERO,
++		.extra2		= SYSCTL_TWO,
++	},
++};
++
++static struct ctl_table_header *af_alg_header;
++
+ struct alg_type_list {
+ 	const struct af_alg_type *type;
+ 	struct list_head list;
+@@ -110,6 +129,43 @@ int af_alg_unregister_type(const struct af_alg_type *type)
+ }
+ EXPORT_SYMBOL_GPL(af_alg_unregister_type);
+ 
++static bool af_alg_capable(void)
++{
++	return ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN) ||
++	       capable(CAP_SYS_ADMIN);
++}
++
++int af_alg_check_restriction(const char *name,
++			     const struct af_alg_allowlist_entry allowlist[])
++{
++	int level = READ_ONCE(af_alg_restrict);
++
++	if (level == 0)
++		return 0;
++	if (level == 1) {
++		for (const struct af_alg_allowlist_entry *ent = allowlist;
++		     ent->name; ent++) {
++			if (strcmp(name, ent->name) == 0) {
++				if ((ent->flags & AF_ALG_UNPRIVILEGED) ||
++				    af_alg_capable())
++					return 0;
++				/* List contains at most one entry per name. */
++				break;
++			}
++		}
++	}
++	/*
++	 * Use -ENOENT (the error code for "algorithm not found") instead of
++	 * -EACCES or -EPERM, for the highest chance of correctly triggering
++	 * fallback code paths in userspace programs.
++	 *
++	 * Don't log a warning, since it would be noisy.  iwd tries to bind a
++	 * bunch of algorithms that it never uses.
++	 */
++	return -ENOENT;
++}
++EXPORT_SYMBOL_GPL(af_alg_check_restriction);
++
+ static void alg_do_release(const struct af_alg_type *type, void *private)
+ {
+ 	if (!type)
+@@ -506,6 +562,9 @@ static int alg_create(struct net *net, struct socket *sock, int protocol,
+ 	struct sock *sk;
+ 	int err;
+ 
++	if (READ_ONCE(af_alg_restrict) == 2)
++		return -EAFNOSUPPORT;
++
+ 	if (sock->type != SOCK_SEQPACKET)
+ 		return -ESOCKTNOSUPPORT;
+ 	if (protocol != 0)
+@@ -1222,27 +1281,32 @@ EXPORT_SYMBOL_GPL(af_alg_get_rsgl);
+ 
+ static int __init af_alg_init(void)
+ {
+-	int err = proto_register(&alg_proto, 0);
++	int err;
++
++	af_alg_header = register_sysctl("crypto", af_alg_table);
+ 
++	err = proto_register(&alg_proto, 0);
+ 	if (err)
+-		goto out;
++		goto out_unregister_sysctl;
+ 
+ 	err = sock_register(&alg_family);
+-	if (err != 0)
++	if (err)
+ 		goto out_unregister_proto;
+ 
+-out:
+-	return err;
++	return 0;
+ 
+ out_unregister_proto:
+ 	proto_unregister(&alg_proto);
+-	goto out;
++out_unregister_sysctl:
++	unregister_sysctl_table(af_alg_header);
++	return err;
+ }
+ 
+ static void __exit af_alg_exit(void)
+ {
+ 	sock_unregister(PF_ALG);
+ 	proto_unregister(&alg_proto);
++	unregister_sysctl_table(af_alg_header);
+ }
+ 
+ module_init(af_alg_init);
 diff --git a/crypto/akcipher.c b/crypto/akcipher.c
 index 630bb19738be..8da7eedce31e 100644
 --- a/crypto/akcipher.c
@@ -287,6 +511,151 @@ index 630bb19738be..8da7eedce31e 100644
  	if (!alg->set_priv_key)
  		alg->set_priv_key = akcipher_default_set_key;
  
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index 787aac8aeb24..5574e2d70539 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -34,6 +34,11 @@
+ #include <linux/net.h>
+ #include <net/sock.h>
+ 
++static const struct af_alg_allowlist_entry aead_allowlist[] = {
++	{ "ccm(aes)" }, /* bluez */
++	{},
++};
++
+ static inline bool aead_sufficient_data(struct sock *sk)
+ {
+ 	struct alg_sock *ask = alg_sk(sk);
+@@ -344,6 +349,12 @@ static struct proto_ops algif_aead_ops_nokey = {
+ 
+ static void *aead_bind(const char *name)
+ {
++	int err;
++
++	err = af_alg_check_restriction(name, aead_allowlist);
++	if (err)
++		return ERR_PTR(err);
++
+ 	return crypto_alloc_aead(name, 0, AF_ALG_CRYPTOAPI_MASK);
+ }
+ 
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index 5452ad6c1506..6e8b5fb82a7f 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -16,6 +16,24 @@
+ #include <linux/net.h>
+ #include <net/sock.h>
+ 
++static const struct af_alg_allowlist_entry hash_allowlist[] = {
++	{ "cmac(aes)" }, /* iwd, bluez */
++	{ "hmac(md5)" }, /* iwd */
++	{ "hmac(sha1)" }, /* iwd */
++	{ "hmac(sha224)" }, /* iwd */
++	{ "hmac(sha256)" }, /* iwd */
++	{ "hmac(sha384)" }, /* iwd */
++	{ "hmac(sha512)" }, /* iwd, sha512hmac */
++	{ "md4" }, /* iwd */
++	{ "md5" }, /* iwd */
++	{ "sha1", AF_ALG_UNPRIVILEGED }, /* iwd, iproute2 < 7.0 */
++	{ "sha224" }, /* iwd */
++	{ "sha256" }, /* iwd */
++	{ "sha384" }, /* iwd */
++	{ "sha512" }, /* iwd */
++	{},
++};
++
+ struct hash_ctx {
+ 	struct af_alg_sgl sgl;
+ 
+@@ -382,6 +400,12 @@ static struct proto_ops algif_hash_ops_nokey = {
+ 
+ static void *hash_bind(const char *name)
+ {
++	int err;
++
++	err = af_alg_check_restriction(name, hash_allowlist);
++	if (err)
++		return ERR_PTR(err);
++
+ 	return crypto_alloc_ahash(name, 0, AF_ALG_CRYPTOAPI_MASK);
+ }
+ 
+diff --git a/crypto/algif_rng.c b/crypto/algif_rng.c
+index 4dfe7899f8fa..bd522915d56d 100644
+--- a/crypto/algif_rng.c
++++ b/crypto/algif_rng.c
+@@ -50,6 +50,10 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
+ MODULE_DESCRIPTION("User-space interface for random number generators");
+ 
++static const struct af_alg_allowlist_entry rng_allowlist[] = {
++	{},
++};
++
+ struct rng_ctx {
+ #define MAXSIZE 128
+ 	unsigned int len;
+@@ -201,6 +205,11 @@ static void *rng_bind(const char *name)
+ {
+ 	struct rng_parent_ctx *pctx;
+ 	struct crypto_rng *rng;
++	int err;
++
++	err = af_alg_check_restriction(name, rng_allowlist);
++	if (err)
++		return ERR_PTR(err);
+ 
+ 	pctx = kzalloc_obj(*pctx);
+ 	if (!pctx)
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 035fed7db81f..d469a3ec1491 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -35,6 +35,24 @@
+ #include <linux/string.h>
+ #include <net/sock.h>
+ 
++static const struct af_alg_allowlist_entry skcipher_allowlist[] = {
++	{ "adiantum(xchacha12,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
++	{ "adiantum(xchacha20,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
++	{ "cbc(aes)" }, /* iwd */
++	{ "cbc(des)" }, /* iwd */
++	{ "cbc(des3_ede)" }, /* iwd */
++	{ "cbc(paes)" }, /* caam and others */
++	{ "ctr(aes)" }, /* iwd */
++	{ "ecb(aes)" }, /* iwd, bluez */
++	{ "ecb(des)" }, /* iwd */
++	{ "hctr2(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
++	{ "xts(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup benchmark */
++	{ "xts(camellia)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
++	{ "xts(serpent)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
++	{ "xts(twofish)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
++	{},
++};
++
+ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,
+ 			    size_t size)
+ {
+@@ -310,12 +328,13 @@ static struct proto_ops algif_skcipher_ops_nokey = {
+ 
+ static void *skcipher_bind(const char *name)
+ {
+-	u32 mask = AF_ALG_CRYPTOAPI_MASK;
++	int err;
+ 
+-	if (strcmp(name, "cbc(paes)") == 0)
+-		mask = 0;
++	err = af_alg_check_restriction(name, skcipher_allowlist);
++	if (err)
++		return ERR_PTR(err);
+ 
+-	return crypto_alloc_skcipher(name, 0, mask);
++	return crypto_alloc_skcipher(name, 0, AF_ALG_CRYPTOAPI_MASK);
+ }
+ 
+ static void skcipher_release(void *private)
 diff --git a/crypto/dh.c b/crypto/dh.c
 index 7ad4768716c8..01ccc24db074 100644
 --- a/crypto/dh.c
@@ -411,6 +780,78 @@ index 4958211fbfa9..ee6d34885696 100644
  		.suite = {
  			.kpp = __VECS(ecdh_p384_tv_template)
  		}
+diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
+index a09636a4168e..e3c77a65f61c 100644
+--- a/drivers/acpi/acpi_platform.c
++++ b/drivers/acpi/acpi_platform.c
+@@ -12,6 +12,7 @@
+ #include <linux/bits.h>
+ #include <linux/device.h>
+ #include <linux/err.h>
++#include <linux/ioport.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/dma-mapping.h>
+@@ -71,6 +72,42 @@ static struct notifier_block acpi_platform_notifier = {
+ 	.notifier_call = acpi_platform_device_remove_notify,
+ };
+ 
++static unsigned int acpi_platform_adjust_resources(struct acpi_device *adev,
++						   struct resource *new_res,
++						   struct resource *resources,
++						   unsigned int count)
++{
++	unsigned int i;
++
++	if (!(new_res->flags & (IORESOURCE_IO | IORESOURCE_MEM)))
++		return count;
++
++	for (i = 0; i < count; ) {
++		struct resource *res = &resources[i];
++
++		/*
++		 * Look for overlaps of resources of the same type that would
++		 * cause resource insertion to fail down the road.
++		 */
++		if (__resource_contains_unbound(res, new_res) ||
++		    __resource_contains_unbound(new_res, res) ||
++		    resource_type(new_res) != resource_type(res) ||
++		    !resource_union(new_res, res, new_res)) {
++			i++;
++			continue;
++		}
++
++		dev_info(&adev->dev, "%pR expanded due to overlap\n", new_res);
++		/*
++		 * Eliminate the previously processed resource that overlapped
++		 * with the new one because it is not necessary any more.
++		 */
++		memmove(res, res + 1, (--count - i) * sizeof(*res));
++	}
++
++	return count;
++}
++
+ static void acpi_platform_fill_resource(struct acpi_device *adev,
+ 	const struct resource *src, struct resource *dest)
+ {
+@@ -151,10 +188,14 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev,
+ 				return ERR_PTR(-ENOMEM);
+ 			}
+ 			count = 0;
+-			list_for_each_entry(rentry, &resource_list, node)
++			list_for_each_entry(rentry, &resource_list, node) {
++				count = acpi_platform_adjust_resources(adev,
++								       rentry->res,
++								       resources,
++								       count);
+ 				acpi_platform_fill_resource(adev, rentry->res,
+ 							    &resources[count++]);
+-
++			}
+ 			acpi_dev_free_resource_list(&resource_list);
+ 		}
+ 	}
 diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
 index 20d757687e3d..90a13f20f052 100644
 --- a/drivers/acpi/apei/hest.c
@@ -522,6 +963,63 @@ index 6d72eb017b49..0a6701eb8d37 100644
  	/* wait for engine to stop. This could be as long as 500 msec */
  	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
  				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 7f54d2d2d13a..03fa9409e3ee 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
+ 	if (!btrtl_dev->ic_info)
+ 		return;
+ 
+-	switch (btrtl_dev->project_id) {
+-	case CHIP_ID_8761B:
+-		/* RTL8761B/BU reports HCI version 5.1 but does not support
+-		 * the LE Extended Scan commands (Opcode 0x2042), causing
+-		 * repeated -EBUSY failures when BlueZ attempts extended
+-		 * scanning while a connection is active.
+-		 */
+-		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
+-		break;
+-	default:
+-		break;
+-	}
+-
+ 	switch (btrtl_dev->ic_info->lmp_subver) {
+ 	case RTL_ROM_LMP_8703B:
+ 		/* 8723CS reports two pages for local ext features,
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 184e95c1625e..adee77ebd9aa 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
+ #define BTUSB_ACTIONS_SEMI		BIT(27)
+ #define BTUSB_BARROT			BIT(28)
++#define BTUSB_BROKEN_EXT_SCAN		BIT(29)
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -615,6 +616,10 @@ static const struct usb_device_id quirks_table[] = {
+ 	{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
++	/* Realtek 8761BU Bluetooth devices */
++	{ USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
++						     BTUSB_BROKEN_EXT_SCAN },
++
+ 	/* Realtek Bluetooth devices */
+ 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
+ 	  .driver_info = BTUSB_REALTEK },
+@@ -4366,6 +4371,9 @@ static int btusb_probe(struct usb_interface *intf,
+ 	if (id->driver_info & BTUSB_INVALID_LE_STATES)
+ 		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
+ 
++	if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
++		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
++
+ 	if (id->driver_info & BTUSB_DIGIANSWER) {
+ 		data->cmdreq_type = USB_TYPE_VENDOR;
+ 		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
 diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
 index 505e32911c34..26f7ee0ccf40 100644
 --- a/drivers/char/ipmi/ipmi_dmi.c
@@ -584,7 +1082,7 @@ index ab4c85f3d6fe..92de1165f6ef 100644
  	rv = ipmi_register_driver();
  	mutex_unlock(&ipmi_interfaces_mutex);
 diff --git a/drivers/char/random.c b/drivers/char/random.c
-index b4da1fb976c1..1e112e2b405b 100644
+index b4da1fb976c1..7ff4dd4d9836 100644
 --- a/drivers/char/random.c
 +++ b/drivers/char/random.c
 @@ -51,9 +51,11 @@
@@ -659,7 +1157,7 @@ index b4da1fb976c1..1e112e2b405b 100644
  
  	if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE))
  		return -EINVAL;
-@@ -1392,6 +1417,21 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags
+@@ -1392,6 +1417,23 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags
  	if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM))
  		return -EINVAL;
  
@@ -671,8 +1169,10 @@ index b4da1fb976c1..1e112e2b405b 100644
 +
 +	if (rng) {
 +		ret = import_ubuf(ITER_DEST, ubuf, len, &iter);
-+		if (unlikely(ret))
++		if (unlikely(ret)) {
++			module_put(rng->owner);
 +			return ret;
++		}
 +		ret = rng->extrng_read_iter(&iter, !!(flags & GRND_RANDOM));
 +		module_put(rng->owner);
 +		return ret;
@@ -681,7 +1181,7 @@ index b4da1fb976c1..1e112e2b405b 100644
  	if (!crng_ready() && !(flags & GRND_INSECURE)) {
  		if (flags & GRND_NONBLOCK)
  			return -EAGAIN;
-@@ -1412,6 +1452,12 @@ static __poll_t random_poll(struct file *file, poll_table *wait)
+@@ -1412,6 +1454,12 @@ static __poll_t random_poll(struct file *file, poll_table *wait)
  	return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM;
  }
  
@@ -694,7 +1194,7 @@ index b4da1fb976c1..1e112e2b405b 100644
  static ssize_t write_pool_user(struct iov_iter *iter)
  {
  	u8 block[BLAKE2S_BLOCK_SIZE];
-@@ -1552,7 +1598,58 @@ static int random_fasync(int fd, struct file *filp, int on)
+@@ -1552,7 +1600,58 @@ static int random_fasync(int fd, struct file *filp, int on)
  	return fasync_helper(fd, filp, on, &fasync);
  }
  
@@ -753,7 +1253,7 @@ index b4da1fb976c1..1e112e2b405b 100644
  	.read_iter = random_read_iter,
  	.write_iter = random_write_iter,
  	.poll = random_poll,
-@@ -1565,6 +1662,7 @@ const struct file_operations random_fops = {
+@@ -1565,6 +1664,7 @@ const struct file_operations random_fops = {
  };
  
  const struct file_operations urandom_fops = {
@@ -761,7 +1261,7 @@ index b4da1fb976c1..1e112e2b405b 100644
  	.read_iter = urandom_read_iter,
  	.write_iter = random_write_iter,
  	.unlocked_ioctl = random_ioctl,
-@@ -1575,6 +1673,32 @@ const struct file_operations urandom_fops = {
+@@ -1575,6 +1675,32 @@ const struct file_operations urandom_fops = {
  	.splice_write = iter_file_splice_write,
  };
  
@@ -1138,6 +1638,118 @@ index e8f13dcebbde..dd7014ca962c 100644
  /**
   * iommu_setup_default_domain - Set the default_domain for the group
   * @group: Group to change
+diff --git a/drivers/media/i2c/cvs/core.c b/drivers/media/i2c/cvs/core.c
+index fe9e59ac311c..d4a3b9c3bab1 100644
+--- a/drivers/media/i2c/cvs/core.c
++++ b/drivers/media/i2c/cvs/core.c
+@@ -31,6 +31,7 @@
+ 
+ #define PCI_DEVICE_ID_INTEL_IPU7		0x645d	/* MTL / LNL */
+ #define PCI_DEVICE_ID_INTEL_IPU7P5		0xb05d	/* ARL / PTL */
++#define PCI_DEVICE_ID_INTEL_IPU8		0xd719	/* NVL */
+ 
+ /*
+  * IPU7 PCI device IDs not covered by ipu6_pci_tbl in ipu6-pci-table.h.
+@@ -39,6 +40,7 @@
+ static const struct pci_device_id icvs_ipu7_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IPU7) },
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IPU7P5) },
++	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IPU8) },
+ 	{ }
+ };
+ 
+@@ -962,6 +964,7 @@ static const struct acpi_device_id intel_cvs_acpi_match[] = {
+ 	{ "INTC10DE" }, /* LNL */
+ 	{ "INTC10E0" }, /* ARL */
+ 	{ "INTC10E1" }, /* PTL */
++	{ "INTC10FA" }, /* NVL */
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(acpi, intel_cvs_acpi_match);
+diff --git a/drivers/media/i2c/cvs/icvs.h b/drivers/media/i2c/cvs/icvs.h
+index cfa8ef5d975c..17beb0920dd2 100644
+--- a/drivers/media/i2c/cvs/icvs.h
++++ b/drivers/media/i2c/cvs/icvs.h
+@@ -432,7 +432,6 @@ enum icvs_state {
+  * @freq_ctrl: (future) frequency control pointer
+  * @pads: Local media pads (sink/source)
+  * @nr_of_lanes: Active CSI-2 lane count
+- * @link_freq: Current link frequency (Hz)
+  * @ipu_link: PM runtime device link (IPU consumer, CVS supplier)
+  * @res: Resource capability (light/full)
+  * @caps: Reported device protocol capabilities
+@@ -458,7 +457,6 @@ struct icvs {
+ 	struct v4l2_ctrl *freq_ctrl;
+ 	struct media_pad pads[ICVS_CSI_NUM_PADS];
+ 	u32 nr_of_lanes;
+-	u64 link_freq;
+ 	struct device_link *ipu_link;
+ 	enum icvs_resources res;
+ 	struct icvs_dev_capabilities caps;
+diff --git a/drivers/media/i2c/cvs/v4l2.c b/drivers/media/i2c/cvs/v4l2.c
+index 3a1ec0059ef7..9fadca7a3bee 100644
+--- a/drivers/media/i2c/cvs/v4l2.c
++++ b/drivers/media/i2c/cvs/v4l2.c
+@@ -46,6 +46,7 @@ static const struct v4l2_mbus_framefmt cvs_csi_format_mbus_default = {
+ /**
+  * csi_set_link_cfg - Program default CSI-2 link parameters
+  * @ctx: CVS device context
++ * @link_freq: Link frequency (Hz)
+  *
+  * Populates a HOST_SET_MIPI_CONFIG command using current lane count and
+  * link frequency, then submits it to the device.
+@@ -53,12 +54,12 @@ static const struct v4l2_mbus_framefmt cvs_csi_format_mbus_default = {
+  *
+  * Return: 0 on success or negative errno.
+  */
+-static int csi_set_link_cfg(struct icvs *ctx)
++static int csi_set_link_cfg(struct icvs *ctx, u64 link_freq)
+ {
+ 	struct icvs_cmd cmd = {
+ 		.cmd_id = cpu_to_be16(ICVS_HOST_SET_MIPI_CONFIG),
+ 		.param.conf.nr_of_lanes = ctx->nr_of_lanes,
+-		.param.conf.link_freq = ctx->link_freq,
++		.param.conf.link_freq = link_freq,
+ 	};
+ 	size_t cmd_size = sizeof(cmd.cmd_id) + sizeof(cmd.param.conf);
+ 
+@@ -91,7 +92,7 @@ static int cvs_csi_enable_streams(struct v4l2_subdev *sd,
+ 	struct v4l2_subdev *remote_sd =
+ 			    media_entity_to_v4l2_subdev(ctx->remote->entity);
+ 	struct device *dev = cvs_dev(ctx);
+-	s64 freq;
++	s64 link_freq;
+ 	int ret;
+ 
+ 	/* cvs_set_link_owner(ICVS_CSI_LINK_HOST) */
+@@ -99,15 +100,14 @@ static int cvs_csi_enable_streams(struct v4l2_subdev *sd,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	freq = v4l2_get_link_freq(ctx->remote, 0, 0);
+-	if (freq < 0) {
+-		ret = freq;
++	link_freq = v4l2_get_link_freq(ctx->remote, 0, 0);
++	if (link_freq < 0) {
++		ret = link_freq;
+ 		goto err_rpm_put;
+ 	}
+-	ctx->link_freq = freq;
+ 
+ 	if (ctx->i2c_client) {
+-		ret = csi_set_link_cfg(ctx);
++		ret = csi_set_link_cfg(ctx, link_freq);
+ 		if (ret < 0)
+ 			goto err_rpm_put_sync;
+ 	}
+@@ -345,7 +345,6 @@ static int cvs_csi_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad,
+ 	if (freq < 0)
+ 		return -EINVAL;
+ 
+-	ctx->link_freq = freq;
+ 	cfg->link_freq = freq;
+ 
+ 	return 0;
 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
 index b09f27f7846f..b54fe538511a 100644
 --- a/drivers/pci/quirks.c
@@ -1174,10 +1786,10 @@ index b09f27f7846f..b54fe538511a 100644
   * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
   * class code.  Fix it.
 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index d92bf887739d..039fd5620282 100644
+index 068c7bea3102..cecfac2b0bdc 100644
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5902,6 +5902,13 @@ static void hub_event(struct work_struct *work)
+@@ -5907,6 +5907,13 @@ static void hub_event(struct work_struct *work)
  			(u16) hub->change_bits[0],
  			(u16) hub->event_bits[0]);
  
@@ -1191,6 +1803,108 @@ index d92bf887739d..039fd5620282 100644
  	/* Lock the device, then check to see if we were
  	 * disconnected while waiting for the lock to succeed. */
  	usb_lock_device(hdev);
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index 7643ba954125..0d51428c1da4 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -8,6 +8,7 @@
+ #ifndef _CRYPTO_IF_ALG_H
+ #define _CRYPTO_IF_ALG_H
+ 
++#include <linux/bits.h>
+ #include <linux/compiler.h>
+ #include <linux/completion.h>
+ #include <linux/if_alg.h>
+@@ -121,7 +122,7 @@ struct af_alg_async_req {
+  * @iv:			IV for cipher operation
+  * @state:		Existing state for continuing operation
+  * @aead_assoclen:	Length of AAD for AEAD cipher operations
+- * @completion:		Work queue for synchronous operation
++ * @wait:		For waiting for completion of async crypto ops
+  * @used:		TX bytes sent to kernel. This variable is used to
+  *			ensure that user space cannot cause the kernel
+  *			to allocate too much memory in sendmsg operation.
+@@ -161,9 +162,20 @@ struct af_alg_ctx {
+ 	unsigned int inflight;
+ };
+ 
++/* Flags for af_alg_allowlist_entry::flags: */
++#define AF_ALG_UNPRIVILEGED BIT(0) /* Unprivileged use is allowed */
++
++struct af_alg_allowlist_entry {
++	const char *name;
++	u32 flags;
++};
++
+ int af_alg_register_type(const struct af_alg_type *type);
+ int af_alg_unregister_type(const struct af_alg_type *type);
+ 
++int af_alg_check_restriction(const char *name,
++			     const struct af_alg_allowlist_entry allowlist[]);
++
+ int af_alg_release(struct socket *sock);
+ void af_alg_release_parent(struct sock *sk);
+ int af_alg_accept(struct sock *sk, struct socket *newsock,
+@@ -177,10 +189,11 @@ static inline struct alg_sock *alg_sk(struct sock *sk)
+ }
+ 
+ /**
+- * Size of available buffer for sending data from user space to kernel.
++ * af_alg_sndbuf - Size of available buffer for sending data from user space to kernel.
+  *
+- * @sk socket of connection to user space
+- * @return number of bytes still available
++ * @sk: socket of connection to user space
++ *
++ * Returns: number of bytes still available
+  */
+ static inline int af_alg_sndbuf(struct sock *sk)
+ {
+@@ -192,10 +205,11 @@ static inline int af_alg_sndbuf(struct sock *sk)
+ }
+ 
+ /**
+- * Can the send buffer still be written to?
++ * af_alg_writable - Can the send buffer still be written to?
++ *
++ * @sk: socket of connection to user space
+  *
+- * @sk socket of connection to user space
+- * @return true => writable, false => not writable
++ * Returns: true => writable, false => not writable
+  */
+ static inline bool af_alg_writable(struct sock *sk)
+ {
+@@ -203,10 +217,11 @@ static inline bool af_alg_writable(struct sock *sk)
+ }
+ 
+ /**
+- * Size of available buffer used by kernel for the RX user space operation.
++ * af_alg_rcvbuf - Size of available buffer used by kernel for the RX user space operation.
+  *
+- * @sk socket of connection to user space
+- * @return number of bytes still available
++ * @sk: socket of connection to user space
++ *
++ * Returns: number of bytes still available
+  */
+ static inline int af_alg_rcvbuf(struct sock *sk)
+ {
+@@ -218,10 +233,11 @@ static inline int af_alg_rcvbuf(struct sock *sk)
+ }
+ 
+ /**
+- * Can the RX buffer still be written to?
++ * af_alg_readable - Can the RX buffer still be read from?
++ *
++ * @sk: socket of connection to user space
+  *
+- * @sk socket of connection to user space
+- * @return true => writable, false => not writable
++ * Returns: true => readable, false => not readable
+  */
+ static inline bool af_alg_readable(struct sock *sk)
+ {
 diff --git a/include/linux/crypto.h b/include/linux/crypto.h
 index b7c97f1c47c9..0a484f45b24a 100644
 --- a/include/linux/crypto.h
@@ -1353,6 +2067,20 @@ index 590ba29c85ab..02153d857531 100644
  }
  
  int module_sig_check(struct load_info *info, int flags)
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 21dc4a9c8714..c8331e9cf5d9 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -1063,7 +1063,8 @@ netmem_ref page_pool_alloc_frag_netmem(struct page_pool *pool,
+ 	if (WARN_ON(size > max_size))
+ 		return 0;
+ 
+-	size = ALIGN(size, dma_get_cache_alignment());
++	size = ALIGN(size, max_t(unsigned int, dma_get_cache_alignment(),
++				 __alignof__(struct skb_shared_info)));
+ 	*offset = pool->frag_offset;
+ 
+ 	if (netmem && *offset + size > max_size) {
 diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
 index 0a4fdd8bd975..dcb12dad419f 100644
 --- a/scripts/Makefile.lib

sources

@@ -1,3 +1,3 @@
-SHA512 (linux-7.2.2.tar.xz) = 68317db0b38d12cc18fcfea9ff403172076ba347fcc8e09cd754c96a6f399848af11cdf2e4a1d66fae332c4f34a0e47f3c90adc91b8f20a9800a5c0497ceedb0
-SHA512 (kernel-abi-stablelists-7.2.2.tar.xz) = e90bf77d9ab78a91f1e98dfd19ccfcb3dac1c74735a79061d953b9db513be208f382f4f0761d70d12b150b6ca41e25140ee6b8cb4e2c96f8798e57ede1c155ad
-SHA512 (kernel-kabi-dw-7.2.2.tar.xz) = 12791da7c3fd756fab70a70fbd91b27fb7aa7fd6b46f59e3cd883fee0d1c36dbf2fba861088e60bf7519641c94bfedf11dbea51a60e490ade095219140ea569a
+SHA512 (linux-7.2.3.tar.xz) = 26f55349766553ede454e96253bd86280db21a11a1d1d3c1671b49e4afbaf4964cd976a8f9e983f1ab79a964159da3e4e57f210ce98ebbcc631f15afd4c1c18e
+SHA512 (kernel-abi-stablelists-7.2.3.tar.xz) = fcfcc48b32e1ec45b74ebcd1a0fd05f107d2fdba7a55bc6bbdff164e9fea30a0817282f0d2b8e7757cb9d711eb24c5f05356d324f2806b849d0874c09c192a03
+SHA512 (kernel-kabi-dw-7.2.3.tar.xz) = 3aa66a108e53cafc7de7316e68c79ec31fb522a69f85412cd4ae8768b1eb41ee39b268dafde8038fb89cc95e8c909a75fb5f62ead38ea5de3d6832cf0967ee54