36,308 commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	4922049993	This is the 5.10.163 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPCczkACgkQONu9yGCS aT4tnRAAsW8h/ohmhP+O2lQ9Ekw6s9VB6KB4aJzLhQXqIZlrzk2DP3CiLxQ7DkFc AcHwFYq+sERo8O7dK6pbCW0zNvLUpbK2wJhwMHujJfSUFboXX85NR6u90U67pBKS p+yVkDSx8LNc7c676xQ7ey5rO1K2fQQ266gexjI9WOkjIFOfplVkZ7tkvt51VwAD mNvOQsZdCE6xs+T3t9YMOtAx3wW8vl1wW3QDWCHznQwOJiMEjfNEOUY/+xELnnWz DVONWPHTFNKQHZwIuVUFZdNuORq5WXoIaMZdaEFkhuOtRMnQ9l+wi8iMxX8zkgBn Ji/dPu3GdAZsJU4/rXHkY2AeZV1oJc3NLYmevoRZirTqMQCqyM+blif7Rf34kBi7 6jlGPWOjyMNe58shfHmjWTl/u4pMDoYOnm5XO+1oL+2Xg8QWCucqAlfPFB3uMh6n aL4ymzo5QRy1+tx8v7o1NOjnGWydvYn3O4fwJVkYTFaJZZr9EI7gpTmEBw/gwfuf 4TH6BC++Ai/8vgKUhpdnWuTrjomWalPTcPBgQYG4gD7ak2TM1rmgMaCl/THUe36R zPC8m2sIXKeI4zGi8TeqTgaRvFSKJnuEmVo5OPkG98fZkjekCzWHp0q1+PG2Ecy8 Mu2/AOnwb1aSfOJh2Qajoke/Wed0U6qszop8C/jPRh8D1uTmRbI= =sOTj -----END PGP SIGNATURE----- Merge 5.10.163 into android12-5.10-lts Changes in 5.10.163 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static soc: qcom: llcc: make irq truly optional soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix syscall entry in !AUDUT_SYSCALL case PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file docs: fault-injection: fix non-working usage of negative values debugfs: fix error when writing negative value to atomic_t debugfs file ocfs2: ocfs2_mount_volume does cleanup job before return error ocfs2: rewrite error handling of ocfs2_fill_super ocfs2: fix memory leak in ocfs2_mount_volume() rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled clocksource/drivers/sh_cmt: Access registers according to spec futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Improve path in rpm_idle() when no callback PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() pata_ipx4xx_cf: Fix unsigned comparison with less than zero media: coda: jpeg: Add check for kmalloc media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev media: exynos4-is: don't rely on the v4l2_async_subdev internals can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Fix fall-through warnings for Clang ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: switch to drm_bridge_connector drm/msm/hdmi: drop unused GPIO support bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() wifi: ath10k: Fix return value in ath10k_pci_init() mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: fix an invalid memory access caused by incorrect use of list iterator ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx: replace osc_hdmi with dummy pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). net: hsr: generate supervision frame without HSR/PRP tag hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled clk: socfpga: clk-pll: Remove unused variable 'rc' clk: socfpga: use clk_hw_register for a5/c5 clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - delete unneeded variable initialization crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix normal discard process RDMA/siw: Fix immediate work request flush to completion queue RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Fix spurious fwnode_handle_put in error path serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: optional SETUP/SET_REPORT mode usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info RDMA/siw: Fix pointer cast warning iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Enable breakpoints on 8xx powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() kbuild: remove unneeded mkdir for external modules_install kbuild: unify modules(_install) for in-tree and external modules kbuild: refactor single builds of *.ko powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control NFSD: Remove spurious cb_setup_err tracepoint nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() nfc: pn533: Clear nfc_target before being used r6040: Fix kmemleak in probe and remove net: switch to storing KCOV handle directly in sk_buff net: add inline function skb_csum_is_sctp net: igc: use skb_csum_is_sctp instead of protocol check net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key skbuff: Account for tail adjustment during pull operations mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw reiserfs: Add missing calls to reiserfs_security_free() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable gcov: add support for checksum field ovl: fix use inode directly in rcu-walk mode media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug pwm: tegra: Fix 32 bit build usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init cifs: fix oops during encryption nvme-pci: fix doorbell buffer value endianness nvme-pci: fix mempool alloc size nvme-pci: fix page size checks ata: ahci: Fix PCS quirk application for suspend nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition nvmet: don't defer passthrough commands with trivial effects to the workqueue objtool: Fix SEGFAULT powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtas: avoid scheduling in rtas_os_term() HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: plantronics: Additional PIDs for double volume key presses quirk pstore/zone: Use GFP_ATOMIC to allocate zone buffer hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount binfmt: Fix error return code in load_elf_fdpic_binary() ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ALSA: line6: correct midi status byte when receiving data from podxt ALSA: line6: fix stack overflow in line6_midi_transmit pnode: terminate at peers of source md: fix a crash in mempool_free mm, compaction: fix fast_isolate_around() to stay within boundaries f2fs: should put a page when checking the summary info mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING tpm: acpi: Call acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails kcsan: Instrument memcpy/memset/memmove with newer Clang ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow() wifi: rtlwifi: remove always-true condition pointed out by GCC 12 wifi: rtlwifi: 8192de: correct checking of IQK reload torture: Exclude "NOHZ tick-stop error" from fatal errors rcu: Prevent lockdep-RCU splats on lock acquisition/release net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO net/af_packet: make sure to pull mac header media: stv0288: use explicitly signed char soc: qcom: Select REMAP_MMIO for LLCC driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them jbd2: use the correct print format arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength selftests: Use optional USERCFLAGS and USERLDFLAGS PM/devfreq: governor: Add a private governor_data for governor cpufreq: Init completion before kobject_init_and_add() ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: resume even if in FAIL mode dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' perf/core: Call LSM hook after copying perf_event_attr KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails x86/microcode/intel: Do not retry microcode reloading on the APs ftrace/x86: Add back ftrace_expected for ftrace bug reports x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK tracing/hist: Fix wrong return value in parse_action_params() tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line staging: media: tegra-video: fix chan->mipi value on error ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options rtc: ds1347: fix value written to century register md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk wifi: wilc1000: sdio: fix module autoloading ASoC: jz4740-i2s: Handle independent FIFO flush bits ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path crypto: n2 - add missing hash statesize driver core: Fix bus_type.match() error handling in __driver_attach() iommu/amd: Fix ivrs_acpihid cmdline parsing code remoteproc: core: Do pm_relax when in RPROC_OFFLINE state parisc: led: Fix potential null-ptr-deref in start_task() device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor drm/i915/dsi: fix VBT send packet port selection for dual link DSI drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() ext4: silence the warning when evicting inode with dioread_nolock ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: check and assert if marking an no_delete evicting inode dirty ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: avoid BUG_ON when creating xattrs ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area drm/amdgpu: handle polaris10/11 overlap asics (v2) drm/amdgpu: make display pinning more flexible (v2) ARM: renumber bits related to _TIF_WORK_MASK perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure perf/x86/intel/uncore: Clear attr_update properly btrfs: replace strncpy() with strscpy() x86/mce: Get rid of msr_ops x86/MCE/AMD: Clear DFR errors found in THR handler media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data x86/kprobes: Convert to insn_decode() x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK staging: media: tegra-video: fix device_node use after free ravb: Fix "failed to switch device to config mode" message during unbind riscv/stacktrace: Fix stack output without ra on the stack top riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument ext4: goto right label 'failed_mount3a' ext4: correct inconsistent error msg in nojournal mode mm/highmem: Lift memcpy_[to|from]_page to core ext4: use memcpy_to_page() in pagecache_write() fs: ext4: initialize fsdata in pagecache_write() ext4: move functions in super.c ext4: simplify ext4 error translation ext4: fix various seppling typos ext4: fix leaking uninitialized memory in fast-commit journal ext4: use kmemdup() to replace kmalloc + memcpy mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused ext4: remove EA inode entry from mbcache on inode eviction ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption SUNRPC: ensure the matching upcall is in-flight upon downcall bpf: pull before calling skb_postpull_rcsum() drm/panfrost: Fix GEM handle creation ref-counting vmxnet3: correctly report csum_level for encapsulated packet veth: Fix race with AF_XDP exposing old or uninitialized descriptors nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure nfc: Fix potential resource leaks vhost/vsock: Fix error handling in vhost_vsock_init() vringh: fix range used in iotlb_translate() vhost: fix range used in translate_desc() net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path net/mlx5: Avoid recovery in probe flows net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default net/mlx5e: Fix hw mtu initializing at XDP SQ allocation net: amd-xgbe: add missed tasklet_kill net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe RDMA/mlx5: Fix validation of max_rd_atomic caps for DC drm/meson: Reduce the FIFO lines held when AFBC is not used filelock: new helper: vfs_inode_has_locks ceph: switch to vfs_inode_has_locks() to fix file lock bug gpio: sifive: Fix refcount leak in sifive_gpio_probe net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop netfilter: ipset: fix hash:net,port,net hang with /0 subnet netfilter: ipset: Rework long task execution when adding/deleting entries perf tools: Fix resources leak in perf_data__open_dir() drivers/net/bonding/bond_3ad: return when there's no aggregator usb: rndis_host: Secure rndis_query check against int overflow drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet nvme: fix multipath crash caused by flush request when blktrace is enabled x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB riscv: uaccess: fix type of 0 variable on error in get_user() drm/i915/gvt: fix gvt debugfs destroy drm/i915/gvt: fix vgpu debugfs clean in remove ext4: don't allow journal inode to have encrypt flag selftests: set the BUILD variable to absolute path hfs/hfsplus: use WARN_ON for sanity check hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling mbcache: Avoid nesting of cache->c_list_lock under bit locks efi: random: combine bootloader provided RNG seed with RNG protocol output io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() parisc: Align parisc MADV_XXX constants with all other architectures ext4: disable fast-commit of encrypted dir operations ext4: don't set up encryption key during jbd2 transaction fsl_lpuart: Don't enable interrupts too early serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way" mptcp: mark ops structures as ro_after_init mptcp: remove MPTCP 'ifdef' in TCP SYN cookies mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 net: sched: disallow noqueue for qdisc classes net/ulp: prevent ULP without clone op from entering the LISTEN status ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 Linux 5.10.163 Change-Id: I9026971760be8484f1e1fa607f9f91243cc87785 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-06 12:30:05 +00:00
Greg Kroah-Hartman	8596b99884	Merge 5.10.162 into android12-5.10-lts ... Changes in 5.10.162 kernel: provide create_io_thread() helper iov_iter: add helper to save iov_iter state saner calling conventions for unlazy_child() fs: add support for LOOKUP_CACHED fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* Make sure nd->path.mnt and nd->path.dentry are always valid pointers fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED tools headers UAPI: Sync openat2.h with the kernel sources net: provide __sys_shutdown_sock() that takes a socket net: add accept helper not installing fd signal: Add task_sigpending() helper fs: make do_renameat2() take struct filename file: Rename __close_fd_get_file close_fd_get_file fs: provide locked helper variant of close_fd_get_file() entry: Add support for TIF_NOTIFY_SIGNAL task_work: Use TIF_NOTIFY_SIGNAL if available x86: Wire up TIF_NOTIFY_SIGNAL arc: add support for TIF_NOTIFY_SIGNAL arm64: add support for TIF_NOTIFY_SIGNAL m68k: add support for TIF_NOTIFY_SIGNAL nios32: add support for TIF_NOTIFY_SIGNAL parisc: add support for TIF_NOTIFY_SIGNAL powerpc: add support for TIF_NOTIFY_SIGNAL mips: add support for TIF_NOTIFY_SIGNAL s390: add support for TIF_NOTIFY_SIGNAL um: add support for TIF_NOTIFY_SIGNAL sh: add support for TIF_NOTIFY_SIGNAL openrisc: add support for TIF_NOTIFY_SIGNAL csky: add support for TIF_NOTIFY_SIGNAL hexagon: add support for TIF_NOTIFY_SIGNAL microblaze: add support for TIF_NOTIFY_SIGNAL arm: add support for TIF_NOTIFY_SIGNAL xtensa: add support for TIF_NOTIFY_SIGNAL alpha: add support for TIF_NOTIFY_SIGNAL c6x: add support for TIF_NOTIFY_SIGNAL h8300: add support for TIF_NOTIFY_SIGNAL ia64: add support for TIF_NOTIFY_SIGNAL nds32: add support for TIF_NOTIFY_SIGNAL riscv: add support for TIF_NOTIFY_SIGNAL sparc: add support for TIF_NOTIFY_SIGNAL ia64: don't call handle_signal() unless there's actually a signal queued ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling alpha: fix TIF_NOTIFY_SIGNAL handling task_work: remove legacy TWA_SIGNAL path kernel: remove checking for TIF_NOTIFY_SIGNAL coredump: Limit what can interrupt coredumps kernel: allow fork with TIF_NOTIFY_SIGNAL pending entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() x86/process: setup io_threads more like normal user space threads kernel: stop masking signals in create_io_thread() kernel: don't call do_exit() for PF_IO_WORKER threads task_work: add helper for more targeted task_work canceling io_uring: import 5.15-stable io_uring signal: kill JOBCTL_TASK_WORK task_work: unconditionally run task_work from get_signal() net: remove cmsg restriction from io_uring based send/recvmsg calls Revert "proc: don't allow async path resolution of /proc/thread-self components" Revert "proc: don't allow async path resolution of /proc/self components" eventpoll: add EPOLL_URING_WAKE poll wakeup flag eventfd: provide a eventfd_signal_mask() helper io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups Linux 5.10.162 Change-Id: I50a7b8bc8d38fac612113281b218cf5323b0af5e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 16:13:18 +00:00
Greg Kroah-Hartman	d0782c9411	Merge tag 'android12-5.10.160_r00' into android12-5.10 ... This is the merge of the upstream LTS release of 5.10.160 into the android12-5.10 branch. It contains the following commits: 003c389455 Merge 5.10.160 into android12-5.10-lts a2428a8dcb Linux 5.10.160 54c15f67cb ASoC: ops: Correct bounds check for second channel on SX controls 74b139c63f nvme-pci: clear the prp2 field when not used 77ebf88e00 ASoC: cs42l51: Correct PGA Volume minimum value 4db1d19b74 can: mcba_usb: Fix termination command argument 683837f2f6 can: sja1000: fix size of OCR_MODE_MASK define 434b523671 pinctrl: meditatek: Startup with the IRQs disabled 5cb4abb0ca libbpf: Use page size as max_entries when probing ring buffer map 50b5f6d4d9 ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() 344739dc56 ASoC: fsl_micfil: explicitly clear CHnF flags a49c1a7307 ASoC: fsl_micfil: explicitly clear software reset bit 75454b4bbf io_uring: add missing item types for splice request 17f386e6b7 fuse: always revalidate if exclusive create eb6313c129 nfp: fix use-after-free in area_cache_get() 965d93fb39 vfs: fix copy_file_range() averts filesystem freeze protection ed96733949 vfs: fix copy_file_range() regression in cross-fs copies 970862a96c x86/smpboot: Move rcu_cpu_starting() earlier 32e45c58a0 Merge "Merge 5.10.159 into android12-5.10-lts" into android12-5.10-lts d31626cbea ANDROID: usb: gadget: uvc: remove duplicate code in unbind 01ef2d0b53 Merge 5.10.159 into android12-5.10-lts 931578be69 Linux 5.10.159 4fd6f84e0a can: esd_usb: Allow REC and TEC to return to zero cf0e423106 macsec: add missing attribute validation for offload 6b03e41767 net: mvneta: Fix an out of bounds check 8208d7e56b ipv6: avoid use-after-free in ip6_fragment() 3d59adad12 net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() a00444e25b xen/netback: fix build warning 87277bdf2c ethernet: aeroflex: fix potential skb leak in greth_init_rings() cc668fddde tipc: call tipc_lxc_xmit without holding node_read_lock 4be43e46c3 net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() 8e3f9ac009 ipv4: Fix incorrect route flushing when table ID 0 is used 5211e5ff9d ipv4: Fix incorrect route flushing when source address is deleted 36e248269a tipc: Fix potential OOB in tipc_link_proto_rcv() 93aaa4bb72 net: hisilicon: Fix potential use-after-free in hix5hd2_rx() 296a50aa8b net: hisilicon: Fix potential use-after-free in hisi_femac_rx() 8d1aed7a11 net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq a5cfbc1995 ip_gre: do not report erspan version on GRE interface 696e34d54c net: stmmac: fix "snps,axi-config" node property parsing ca26f45083 nvme initialize core quirks before calling nvme_init_subsystem 27eb2d7a1b NFC: nci: Bounds check struct nfc_target arrays a2506b19d7 i40e: Disallow ip4 and ip6 l4_4_bytes 8329b65e34 i40e: Fix for VF MAC address 0 215f3ac53b i40e: Fix not setting default xps_cpus after reset 146ebee8fc net: mvneta: Prevent out of bounds read in mvneta_config_rss() e6860c889f xen-netfront: Fix NULL sring after live migration 3d3b30718a net: encx24j600: Fix invalid logic in reading of MISTAT register 51ba1820e7 net: encx24j600: Add parentheses to fix precedence 42c319635c mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 4c693330ce selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload bccda3ad07 net: dsa: ksz: Check return value e7b9504581 Bluetooth: Fix not cleanup led when bt_init fails 1717354d77 Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() 80c69b31aa vmxnet3: correctly report encapsulated LRO packet 575a6266f6 af_unix: Get user_ns from in_skb in unix_diag_get_exact(). 6c788c0a25 drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 de918d9738 igb: Allocate MSI-X vector when testing 6595c9208d e1000e: Fix TX dispatch condition 5ee6413d3d gpio: amd8111: Fix PCI device reference count leak b9aca69a6c drm/bridge: ti-sn65dsi86: Fix output polarity setting bug b46e8c50c3 netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark 0a8e66e375 ca8210: Fix crash by zero initializing data 27c71825ff ieee802154: cc2520: Fix error return code in cc2520_hw_init() a0418d0a6b netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one cb283cca1d rtc: mc146818-lib: fix signedness bug in mc146818_get_time() 5c432383b6 rtc: mc146818-lib: fix locking in mc146818_set_time 5e26531d81 rtc: cmos: Disable irq around direct invocation of cmos_interrupt() fccee93eb2 mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page c42221efb1 can: af_can: fix NULL pointer dereference in can_rcv_filter bc03f809da HID: core: fix shift-out-of-bounds in hid_report_raw_event 959a23a4d1 HID: hid-lg4ff: Add check for empty lbuf 4dde75945a HID: usbhid: Add ALWAYS_POLL quirk for some mice 11e95d85c3 drm/shmem-helper: Avoid vm_open error paths 6a4da05acd drm/shmem-helper: Remove errant put in error path 007f561f59 drm/vmwgfx: Don't use screen objects when SEV is active 3cb78c3925 KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field 549b46f813 Bluetooth: Fix crash when replugging CSR fake controllers 380d183e99 Bluetooth: btusb: Add debug message for CSR controllers f1cf856123 mm/gup: fix gup_pud_range() for dax f1f7f36cf6 memcg: fix possible use-after-free in memcg_write_event_control() 32f01f0306 media: v4l2-dv-timings.c: fix too strict blanking sanity checks 043b2bc96c Revert "ARM: dts: imx7: Fix NAND controller size-cells" abfb8ae69b media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() 83632fc414 xen/netback: don't call kfree_skb() with interrupts disabled 3eecd2bc10 xen/netback: do some code cleanup 49e07c0768 xen/netback: Ensure protocol headers don't fall in the non-linear area db44a9443e rtc: mc146818: Reduce spinlock section in mc146818_set_time() 17293d630f rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ acfd8ef683 rtc: cmos: avoid UIP when reading alarm time 949bae0282 rtc: cmos: avoid UIP when writing alarm time 33ac73a41a rtc: mc146818-lib: extract mc146818_avoid_UIP 8bb5fe5830 rtc: mc146818-lib: fix RTC presence check 775d4661f1 rtc: Check return value from mc146818_get_time() b9a5c470e0 rtc: mc146818-lib: change return values of mc146818_get_time() 94eaf9966e rtc: cmos: remove stale REVISIT comments f5b51f8550 rtc: mc146818: Dont test for bit 0-5 in Register D 3736972360 rtc: mc146818: Detect and handle broken RTCs 7c7075c88d rtc: mc146818: Prevent reading garbage 7f445ca2e0 mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths 4a1cdb49d0 mm/khugepaged: fix GUP-fast interaction by sending IPI cdfd3739b2 mm/khugepaged: take the right locks for page table retraction 1c0eec6a1d net: usb: qmi_wwan: add u-blox 0x1342 composition a8c5ffb4df 9p/xen: check logical size for buffer size ec36ebae36 usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer d9b53caf01 fbcon: Use kzalloc() in fbcon_prepare_logo() 8b130c770d regulator: twl6030: fix get status of twl6032 regulators f6f45e5383 ASoC: soc-pcm: Add NULL check in BE reparenting 688a45aff2 btrfs: send: avoid unaligned encoded writes when attempting to clone range 15c42ab8d4 ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event d38e021416 regulator: slg51000: Wait after asserting CS pin 1331bcfcac 9p/fd: Use P9_HDRSZ for header size 96b43f36a5 ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 ddf58f5939 ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register dbd78abd69 ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation bb1866cf1e ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels b1f40a0cdf ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name 5f9474d07b arm64: dts: rockchip: fix ir-receiver node names 060d58924a ARM: dts: rockchip: fix ir-receiver node names 3e0c466771 arm: dts: rockchip: fix node name for hym8563 rtc 3ada63a876 arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series 202ee06349 Revert "mmc: sdhci: Fix voltage switch delay" 0b0939466f ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION 5ab4c6b843 Merge 5.10.158 into android12-5.10-lts 592346d5dc Linux 5.10.158 cc1b4718cc ipc/sem: Fix dangling sem_array access in semtimedop race d072a10c81 v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails 9ba389863a proc: proc_skip_spaces() shouldn't think it is working on C strings 4aa32aaef6 proc: avoid integer type confusion in get_proc_long 5f2f775605 block: unhash blkdev part inode when the part is deleted a82869ac52 Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() 4e0d6c687c char: tpm: Protect tpm_pm_suspend with locks 5a6f935ef3 Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" f075cf139f ACPI: HMAT: Fix initiator registration for single-initiator systems f3b76b4d38 ACPI: HMAT: remove unnecessary variable initialization 63e72417a1 i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set df76136598 i2c: npcm7xx: Fix error handling in npcm_i2c_init() 7462cd2443 x86/pm: Add enumeration check before spec MSRs save/restore setup 5e3d4a68e2 x86/tsx: Add a feature bit for TSX control MSR support b7f7a0402e Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" 481f9ed8eb ipv4: Fix route deletion when nexthop info is not specified 0b5394229e ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference 4919503426 selftests: net: fix nexthop warning cleanup double ip typo 7ca14c5f24 selftests: net: add delete nexthop route warning test f09ac62f0e Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled 19d91d3798 parisc: Increase FRAME_WARN to 2048 bytes on parisc fcf20da099 xtensa: increase size of gcc stack frame check a1877001ed parisc: Increase size of gcc stack frame check a5c65cd56a iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() 10ed7655a1 iommu/vt-d: Fix PCI device refcount leak in has_external_pci() 302edce1dd pinctrl: single: Fix potential division by zero b50c964189 ASoC: ops: Fix bounds check for _sx controls a2efc46524 io_uring: don't hold uring_lock when calling io_run_task_work* be111ebd88 tracing: Free buffers when a used dynamic event is removed 648b92e576 drm/i915: Never return 0 if not all requests retired 8649c023c4 drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame 940b774069 mmc: sdhci: Fix voltage switch delay ed19662453 mmc: sdhci-sprd: Fix no reset data and command after voltage switch ef767907e7 mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check 46ee041cd6 mmc: core: Fix ambiguous TRIM and DISCARD arg b79be962b5 mmc: mmc_test: Fix removal of debugfs file d4fc344c0d net: stmmac: Set MAC's flow control register to reflect current settings 549e24409a pinctrl: intel: Save and restore pins in "direct IRQ" mode 471fb7b735 x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 e858917ab7 nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() 6ddf788400 tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" c099d12c55 error-injection: Add prompt for function error injection 26b6f927bb riscv: vdso: fix section overlapping under some conditions 2b1d8f27e2 net/mlx5: DR, Fix uninitialized var warning c40db1e5f3 hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() f06e0cd01e hwmon: (coretemp) Check for null before removing sysfs attrs d93522d04f net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed 176ee6c673 sctp: fix memory leak in sctp_stream_outq_migrate() 1c38c88acc packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE 5f442e1d40 net: tun: Fix use-after-free in tun_detach() 5fa0fc5876 afs: Fix fileserver probe RTT handling 7ca81a161e net: hsr: Fix potential use-after-free a1ba595e35 tipc: re-fetch skb cb after tipc_msg_validate 4621bdfff5 dsa: lan9303: Correct stat name 45752af024 net: ethernet: nixge: fix NULL dereference e01c154237 net/9p: Fix a potential socket leak in p9_socket_open b080d4668f net: net_netdev: Fix error handling in ntb_netdev_init_module() fe6bc99c27 net: phy: fix null-ptr-deref while probe() failed 0184ede0ec wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration e2ed90fd3a wifi: cfg80211: don't allow multi-BSSID in S1G 9e6b79a3cd wifi: cfg80211: fix buffer overflow in elem comparison 6922948c2e aquantia: Do not purge addresses when setting the number of rings fa59d49a49 qlcnic: fix sleep-in-atomic-context bugs caused by msleep d753f554f2 can: cc770: cc770_isa_probe(): add missing free_cc770dev() e74746bf04 can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() 0d2f9d95d9 net/mlx5e: Fix use-after-free when reverting termination table 2cb84ff349 net/mlx5: Fix uninitialized variable bug in outlen_write() b775f37d94 e100: Fix possible use after free in e100_xmit_prepare 086f656e44 e100: switch from 'pci_' to 'dma_' API 971c55f076 iavf: Fix error handling in iavf_init_module() d389a4c698 iavf: remove redundant ret variable fd4960ea53 fm10k: Fix error handling in fm10k_init_module() dd425cec79 i40e: Fix error handling in i40e_init_module() f166c62cad ixgbevf: Fix resource leak in ixgbevf_init_module() 8f7047f418 of: property: decrement node refcount in of_fwnode_get_reference_args() be006212bd bpf: Do not copy spin lock field from user in bpf_selem_alloc 90907cd4d1 hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails 7649bba263 hwmon: (i5500_temp) fix missing pci_disable_device() dddfc03f04 hwmon: (ina3221) Fix shunt sum critical calculation 984fcd3ec1 hwmon: (ltc2947) fix temperature scaling 8a549ab672 libbpf: Handle size overflow for ringbuf mmap cc140c729c ARM: at91: rm9200: fix usb device clock id 592724b14d scripts/faddr2line: Fix regression in name resolution on ppc64le 353c3aaaf3 bpf, perf: Use subprog name when reporting subprog ksymbol d48f6a5784 iio: light: rpr0521: add missing Kconfig dependencies 5eb114f55b iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw b1756af172 iio: health: afe4403: Fix oob read in afe4403_read_raw 01d7c41eac btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() d3f5be8246 drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" 00570fafc2 drm/amdgpu: update drm_display_info correctly when the edid is read 44b204730b drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code 1faf21bdd1 btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker 6050872f9f spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock 7b020665d4 btrfs: free btrfs_path before copying inodes to userspace d5b7a34379 btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino f3226d86f8 Revert "xfrm: fix "disable_policy" on ipv4 early demux" 982d7f3eb8 Merge 5.10.157 into android12-5.10-lts 37d3df60cb ANDROID: CRC ABI fixups in ip.h and ipv6.h f4245f0538 Linux 5.10.157 4801672fb0 fuse: lock inode unconditionally in fuse_fallocate() 86f0082fb9 drm/i915: fix TLB invalidation for Gen12 video and compute engines feb97cf45e drm/amdgpu: always register an MMU notifier for userptr 596b7d55d7 drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN c86c1a7037 btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() 1581830c0e btrfs: free btrfs_path before copying subvol info to userspace 0bdb8f7ef8 btrfs: free btrfs_path before copying fspath to userspace 24a37ba2cb btrfs: free btrfs_path before copying root refs to userspace b56d6e5585 genirq: Take the proposed affinity at face value if force==true 9d90a2b98e irqchip/gic-v3: Always trust the managed affinity provided by the core code e0d2c59ee9 genirq: Always limit the affinity to online CPUs f8f80d532f genirq/msi: Shutdown managed interrupts with unsatifiable affinities 3eb6b89a4e wifi: wilc1000: validate number of channels 5a068535c0 wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute 905f886eae wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute 7c6535fb4d wifi: wilc1000: validate pairwise and authentication suite offsets 64b7f9a7dd dm integrity: clear the journal on suspend d306f73079 dm integrity: flush the journal on suspend 79d9a11679 gpu: host1x: Avoid trying to use GART on Tegra20 a7f30b5b8d net: usb: qmi_wwan: add Telit 0x103a composition 7e8eaa939e tcp: configurable source port perturb table size 0acc008cf9 platform/x86: hp-wmi: Ignore Smart Experience App event 0964b77bab zonefs: fix zone report size in __zonefs_io_error() a5937dae66 platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) 52fb7bcea0 platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() 4fa717ba2d xen/platform-pci: add missing free_irq() in error path f45a5a6c9f xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too 9bbb587472 Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] 4ea4316dff Input: soc_button_array - add use_low_level_irq module parameter c1620e996d Input: goodix - try resetting the controller when no config is set f4db050958 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() 7c3e39ccf5 ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 36e0b97619 Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode ae9e0cc973 binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 017de84253 binder: Address corner cases in deferred copy and fixup 2e3c27f241 binder: fix pointer cast warning c9d3f25a7f binder: defer copies of pre-patched txn data 5204296fc7 binder: read pre-translated fds from sender buffer 23e9d815fa binder: avoid potential data leakage when copying txn 22870431cd x86/ioremap: Fix page aligned size calculation in __ioremap_caller() 3fdeacf087 KVM: x86: remove exit_int_info warning in svm_handle_exit 7e5cb13091 KVM: x86: nSVM: leave nested mode on vCPU free d925dd3e44 mm: vmscan: fix extreme overreclaim and swap floods a4a62a23fa gcov: clang: fix the buffer overflow issue e7f21d10e9 nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty f06b7e6a77 usb: dwc3: gadget: Clear ep descriptor last cff7523ab8 usb: dwc3: gadget: Return -ESHUTDOWN on ep disable a32635528d usb: dwc3: gadget: conditionally remove requests ca3a08e9d9 ceph: fix NULL pointer dereference for req->r_session 00c004c070 ceph: Use kcalloc for allocating multiple elements 69263bf781 ceph: fix possible NULL pointer dereference for req->r_session 8e137ace53 ceph: put the requests/sessions when it fails to alloc memory 38993788f4 ceph: fix off by one bugs in unsafe_request_wait() 8a31ae7f77 ceph: flush the mdlog before waiting on unsafe reqs 78b2f546f7 ceph: flush mdlog before umounting d94ba7b3b7 ceph: make iterate_sessions a global symbol 9ac038d3c2 ceph: make ceph_create_session_msg a global symbol 8382cdf0ab usb: cdns3: Add support for DRD CDNSP 57112da86b mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI b5d770977b mmc: sdhci-brcmstb: Enable Clock Gating to save power 049194538c mmc: sdhci-brcmstb: Re-organize flags fbe955be26 nios2: add FORCE for vmlinuz.gz c0a9c9973d init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash 456e895fd0 iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails fa9efcbfbf iio: light: apds9960: fix wrong register for gesture gain bd1b8041c2 arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency 86ba9c8595 ext4: fix use-after-free in ext4_ext_shift_extents 350e98a08a usb: dwc3: exynos: Fix remove() function d21d26e65b lib/vdso: use "grep -E" instead of "egrep" c0cf8bc259 net: enetc: preserve TX ring priority across reconfiguration de4dd4f9b3 net: enetc: cache accesses to &priv->si->hw 1f080b8caa net: enetc: manage ENETC_F_QBV in priv->active_offloads only when enabled 1d840c5d67 s390/crashdump: fix TOD programmable field size 11052f1188 net: thunderx: Fix the ACPI memory leak b034fe2a08 nfc: st-nci: fix memory leaks in EVT_TRANSACTION e14583073f nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION 9cc863d523 arcnet: fix potential memory leak in com20020_probe() 4d2be0cf27 net: arcnet: Fix RESET flag handling e61b00374a s390/dasd: fix no record found for raw_track_access aeebb07499 ipv4: Fix error return code in fib_table_insert() c0af4d005a dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). b8e494240e netfilter: flowtable_offload: add missing locking af9de5cdcb dma-buf: fix racing conflict of dma_heap_add() c40b76dfa7 bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() f81e9c0510 regulator: twl6030: re-add TWL6032_SUBCLASS 32b944b9c4 NFC: nci: fix memory leak in nci_rx_data_packet() 68a7aec3f4 net: sched: allow act_ct to be built without NF_NAT 8e2664e12b sfc: fix potential memleak in __ef100_hard_start_xmit() 6b638a16ea xfrm: Fix ignored return value in xfrm6_init() c7788361a6 tipc: check skb_linearize() return value in tipc_disc_rcv() 4058e3b74a tipc: add an extra conn_get in tipc_conn_alloc e87a077d09 tipc: set con sock in tipc_conn_alloc 891daa95b0 net/mlx5: Fix handling of entry refcount when command is not issued to FW e06ff9f8fe net/mlx5: Fix FW tracer timestamp calculation 5689eba90a netfilter: ipset: regression in ip_set_hash_ip.c e62e62ea91 netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 8dca384970 Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() 909186cf34 Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() f42802e14a macsec: Fix invalid error code set 72be055615 nfp: add port from netdev validation for EEPROM access ce41e03cac nfp: fill splittable of devlink_port_attrs correctly 0b553ded34 net: pch_gbe: fix pci device refcount leak while module exiting 2c59ef9ab6 net/qla3xxx: fix potential memleak in ql3xxx_send() a24d5f6c8b net/mlx4: Check retval of mlx4_bitmap_init da86a63479 net: ethernet: mtk_eth_soc: fix error handling in mtk_open() 756534f7cf ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties 290a71ff72 ARM: mxs: fix memory leak in mxs_machine_init() 5c97af75f5 netfilter: conntrack: Fix data-races around ct mark 459332f8db 9p/fd: fix issue of list_del corruption in p9_fd_cancel() 26bb8f6aaa net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() 398a860a44 nfc/nci: fix race with opening and closing 3535c632e6 rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] 23c03ee0ee rxrpc: Use refcount_t rather than atomic_t bddde342c6 rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc a2d5dba2fc net: liquidio: simplify if expression 8124a02e17 ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl b547bf71fa tee: optee: fix possible memory leak in optee_register_device() b76c5a99f4 bus: sunxi-rsb: Support atomic transfers 0c059b7d2a regulator: core: fix UAF in destroy_regulator() fcb2d28636 spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() 0b6441abfa regulator: core: fix kobject release warning and memory leak in regulator_register() 26d3d3ffa8 scsi: storvsc: Fix handling of srb_status and capacity change events c34db0d6b8 ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() 4f6c7344ab ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove 164a5b50d1 ASoC: hdac_hda: fix hda pcm buffer overflow issue 7cfb4b8579 ARM: dts: am335x-pcm-953: Define fixed regulators in root node b7000254c1 af_key: Fix send_acquire race with pfkey_register 51969d679b xfrm: replay: Fix ESN wrap around for GSO 497653f6d2 xfrm: fix "disable_policy" on ipv4 early demux 836bbdfcf8 MIPS: pic32: treat port as signed integer c0bb600f07 RISC-V: vdso: Do not add missing symbols to version section in linker script 81cc6d8400 arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. fa5f2c72d3 block, bfq: fix null pointer dereference in bfq_bio_bfqg() d29bde8689 drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) f7ce6fb04e scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC 2574903ee2 scsi: ibmvfc: Avoid path failures during live migration 7fc62181c1 platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 f54a11b6bf Revert "net: macsec: report real_dev features when HW offloading is enabled" f4b8c0710a selftests/bpf: Add verifier test for release_reference() 361a165098 spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run 2c1ca23555 wifi: mac80211: Fix ack frame idr leak when mesh has no route 8d39913158 wifi: airo: do not assign -1 to unsigned char 8552e6048e audit: fix undefined behavior in bit shift for AUDIT_BIT 1c9eb641d1 riscv: dts: sifive unleashed: Add PWM controlled LEDs 92ae6facd1 wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support 2fcc593b50 wifi: mac80211: fix memory free error when registering wiphy fail 044bc6d3c2 ceph: avoid putting the realm twice when decoding snaps fails d43219bb33 ceph: do not update snapshot context when there is no new snapshot 49c71b6814 iio: pressure: ms5611: fixed value compensation bug 879139bc7a iio: ms5611: Simplify IO callback parameters 80c825e1e3 nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro f4066fb910 nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH 4f0cea018e drm/display: Don't assume dual mode adaptors support i2c sub-addressing 347f1793b5 bridge: switchdev: Fix memory leaks when changing VLAN protocol 89a7f155e6 bridge: switchdev: Notify about VLAN protocol changes f5cbd86ebf ata: libata-core: do not issue non-internal commands once EH is pending 4034d06a4d ata: libata-scsi: simplify __ata_scsi_queuecmd() 03aabcb88a scsi: scsi_transport_sas: Fix error handling in sas_phy_add() d9b90a99f3 Merge 5.10.156 into android12-5.10-lts 25af5a11f1 Merge 5.10.155 into android12-5.10-lts e5d2cd6ad8 ANDROID: abi preservation for fscrypt change in 5.10.154 5bc3ece380 Revert "serial: 8250: Let drivers request full 16550A feature probing" f466ca1247 Merge 5.10.154 into android12-5.10-lts 6d46ef50b1 Linux 5.10.156 7be134eb69 Revert "net: broadcom: Fix BCMGENET Kconfig" 957732a09c ntfs: check overflow when iterating ATTR_RECORDs 6322dda483 ntfs: fix out-of-bounds read in ntfs_attr_find() b825bfbbaa ntfs: fix use-after-free in ntfs_attr_find() 294ef12dcc mm: fs: initialize fsdata passed to write_begin/write_end interface a8e2fc8f7b 9p/trans_fd: always use O_NONBLOCK read/write a5da76df46 gfs2: Switch from strlcpy to strscpy 5fa30be7ba gfs2: Check sb_bsize_shift after reading superblock f14858bc77 9p: trans_fd/p9_conn_cancel: drop client lock earlier 4154b6afa2 kcm: close race conditions on sk_receive_queue 7deb7a9d33 kcm: avoid potential race in kcm_tx_work 35309be06b tcp: cdg: allow tcp_cdg_release() to be called multiple times e929ec98c0 macvlan: enforce a consistent minimal mtu 95ebea5a15 uapi/linux/stddef.h: Add include guards 3f25add5ec Input: i8042 - fix leaking of platform device on module removal 7d606ae1ab kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case 89ece5ff7d scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() 75205f1b47 scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() 6e9334436d net: use struct_group to copy ip/ipv6 header addresses 9fd7bdaffe stddef: Introduce struct_group() helper macro 47c3bdd955 usbnet: smsc95xx: Fix deadlock on runtime resume 8208c266fe ring-buffer: Include dropped pages in counting dirty patches 36b5095b07 net: fix a concurrency bug in l2tp_tunnel_register() 023435a095 nvme: ensure subsystem reset is single threaded b9a5ecf241 nvme: restrict management ioctls to admin 5e2f14d772 perf/x86/intel/pt: Fix sampling using single range output 62634b43d3 misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() c1eb46a65b docs: update mediator contact information in CoC doc 4423866d31 mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() 440653a180 mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout 8e70b14131 mmc: core: properly select voltage range without power cycle 05b0f6624d firmware: coreboot: Register bus in module init deda86a0d8 iommu/vt-d: Set SRE bit only when hardware has SRS cap d2c7d8f58e scsi: zfcp: Fix double free of FSF request when qdio send fails db744288af maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault() 24cc679abb Input: iforce - invert valid length check when fetching device IDs 5f4611fe01 serial: 8250_lpss: Configure DMA also w/o DMA filter 8679087e93 serial: 8250: Flush DMA Rx on RLSI a5eaad87bf serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs f59f5a269c dm ioctl: fix misbehavior if list_versions races with module loading 67a75a9480 iio: pressure: ms5611: changed hardcoded SPI speed to value limited d95b85c508 iio: adc: mp2629: fix potential array out of bound access 46b8bc62c5 iio: adc: mp2629: fix wrong comparison of channel 8dddf2699d iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() 85d2a8b287 iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() 85cc1a2fd8 usb: typec: mux: Enter safe mode only when pins need to be reconfigured efaab05520 usb: chipidea: fix deadlock in ci_otg_del_timer 143ba5c2d2 usb: add NO_LPM quirk for Realforce 87U Keyboard 249cef723f USB: serial: option: add Fibocom FM160 0x0111 composition 5c44c60358 USB: serial: option: add u-blox LARA-L6 modem 0e88a3cfa6 USB: serial: option: add u-blox LARA-R6 00B modem de707957d9 USB: serial: option: remove old LARA-R6 PID 878227a3dd USB: serial: option: add Sierra Wireless EM9191 25c652811d USB: bcma: Make GPIO explicitly optional eb3af3ea5b speakup: fix a segfault caused by switching consoles 8cbaf4ed53 slimbus: stream: correct presence rate frequencies 15155f7c0e Revert "usb: dwc3: disable USB core PHY management" 100d1e53bb ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 c7dcc89482 ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro a80369c8ca ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() 28a54854a9 tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() bb70fcae41 tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() 315b149f08 tracing: Fix wild-memory-access in register_synth_event() 65ba7e7c24 tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() 5d4cc7bc1a tracing/ring-buffer: Have polling block on watermark 5fdebbeca5 ring_buffer: Do not deactivate non-existant pages 6a14828cad ftrace: Fix null pointer dereference in ftrace_add_mod() 6ed60c60ec ftrace: Optimize the allocation for mcount entries 9569eed79b ftrace: Fix the possible incorrect kernel message 5fc19c8313 cifs: add check for returning value of SMB2_set_info_init 0aeb0de528 net: thunderbolt: Fix error handling in tbnet_init() e13ef43813 cifs: Fix wrong return value checking when GETFLAGS 9f00da9c86 net/x25: Fix skb leak in x25_lapb_receive_frame() 94822d2331 net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in ag71xx_open() 3aeb13bc3d cifs: add check for returning value of SMB2_close_init c24013273e platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized 9ed51414ae drbd: use after free in drbd_create_device() 6b23a4b252 net: ena: Fix error handling in ena_init() 2d5a495501 net: ionic: Fix error handling in ionic_init_module() bb9924a6ed xen/pcpu: fix possible memory leak in register_pcpu() d6a561bd4c bnxt_en: Remove debugfs when pci_register_driver failed 389738f5db net: caif: fix double disconnect client in chnl_net_open() fb5ee1560b net: macvlan: Use built-in RCU list checking 709aa1f73d mISDN: fix misuse of put_device() in mISDN_register_device() 417f2d2edf net: liquidio: release resources when liquidio driver open failed 4cba73f2d6 net: hinic: Fix error handling in hinic_module_init() 083a2c9ef8 mISDN: fix possible memory leak in mISDN_dsp_element_register() 6b23993d5b net: bgmac: Drop free_netdev() from bgmac_enet_remove() 1f6a73b25d bpf: Initialize same number of free nodes for each pcpu_freelist ef2ac07ab8 ata: libata-transport: fix error handling in ata_tdev_add() 7377a14598 ata: libata-transport: fix error handling in ata_tlink_add() b5362dc163 ata: libata-transport: fix error handling in ata_tport_add() ac471468f7 ata: libata-transport: fix double ata_host_put() in ata_tport_add() ac4f404c25 arm64: dts: imx8mn: Fix NAND controller size-cells 30ece7dbee arm64: dts: imx8mm: Fix NAND controller size-cells f68a9efd78 ARM: dts: imx7: Fix NAND controller size-cells 1d160dfb3f drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() c47a823ea1 drm/drv: Fix potential memory leak in drm_dev_init() c776a49d09 drm/panel: simple: set bpc field for logic technologies displays 777430aa4d pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map bce3e6fe8b parport_pc: Avoid FIFO port location truncation a4b5423f88 siox: fix possible memory leak in siox_device_add() 0679f571d3 arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro 58636b5ff3 block: sed-opal: kmalloc the cmd/resp buffers e27458b18b sctp: clear out_curr if all frag chunks of current msg are pruned 0b4c259b63 sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent 7360e7c29d ASoC: soc-utils: Remove __exit for snd_soc_util_exit() e60f37a1d3 bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() b8fe1a5aa7 tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send 0a3160f4ff serial: imx: Add missing .thaw_noirq hook 7e1f908e65 serial: 8250: omap: Flush PM QOS work on remove d833cba201 serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() b0b6ea651e serial: 8250_omap: remove wait loop from Errata i202 workaround f14c312c21 serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() 85cdbf04b4 serial: 8250: Remove serial_rs485 sanitization from em485 f5dedad405 ASoC: tas2764: Fix set_tdm_slot in case of single slot 9e82d78fbe ASoC: tas2770: Fix set_tdm_slot in case of single slot 8d21554ec7 ASoC: core: Fix use-after-free in snd_soc_exit() 38ca9bd336 spi: stm32: Print summary 'callbacks suppressed' message a180da5564 drm/amdgpu: disable BACO on special BEIGE_GOBY card f3adf0adf3 drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid cards b0faeff69a drm/amd/pm: Read BIF STRAP also for BACO check 6958556285 drm/amd/pm: support power source switch on Sienna Cichlid 7daab001a6 mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA 65ac4d1807 spi: intel: Use correct mask for flash and protected regions 23793518a7 mtd: spi-nor: intel-spi: Disable write protection only if asked a326fffdc7 ALSA: hda/realtek: fix speakers and micmute on HP 855 G8 24839d027c ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route" bd48793240 Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm ce75e90859 btrfs: remove pointless and double ulist frees in error paths of qgroup tests 16743c4bf3 drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid df2747f295 i2c: i801: add lis3lv02d's I2C address for Vostro 5568 959cb0fd69 i2c: tegra: Allocate DMA memory for DMA engine 6cb657722e NFSv4: Retry LOCK on OLD_STATEID during delegation return f0187227e2 drm/amd/display: Remove wrong pipe control lock bb3edbd092 ASoC: rt1308-sdw: add the default value of some registers b1619f0307 selftests/intel_pstate: fix build for ARCH=x86_64 fdf6807606 selftests/futex: fix build for clang c1f0defecb ASoC: codecs: jz4725b: fix capture selector naming aeb7e8bc0d ASoC: codecs: jz4725b: use right control for Capture Volume c87945c173 ASoC: codecs: jz4725b: fix reported volume for Master ctl 9aae00961a ASoC: codecs: jz4725b: add missed Line In power control bit 0b4d650f90 spi: intel: Fix the offset to get the 64K erase opcode 6910e7279f ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK c7432616f6 ASoC: mt6660: Keep the pm_runtime enables before component stuff in mt6660_i2c_probe a47606064c ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe" f8f254c8b5 ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe" c73aa2cc41 ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe" 673a7341bd Merge 5.10.153 into android12-5.10-lts 27b36ba7c2 Merge 5.10.152 into android12-5.10-lts bf759deb0f Merge 5.10.151 into android12-5.10-lts 6b31c548a1 ANDROID: fix up struct sk_buf ABI breakage bd66e91ad2 ANDROID: fix up CRC issue with struct tcp_sock 3905cfd1d6 Revert "serial: 8250: Toggle IER bits on only after irq has been set up" 41217963b1 Linux 5.10.155 0f544353fe io_uring: kill goto error handling in io_sqpoll_wait_sq() 154d744fbe x86/cpu: Restore AMD's DE_CFG MSR after resume e7294b01de mmc: sdhci-esdhc-imx: Convert the driver to DT-only 534762e261 net: tun: call napi_schedule_prep() to ensure we own a napi 367bc0fa98 dmaengine: at_hdmac: Check return code of dma_async_device_register 85f97c97ef dmaengine: at_hdmac: Fix impossible condition f53a233eaa dmaengine: at_hdmac: Don't allow CPU to reorder channel enable f451285522 dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors 6be4ab08c8 dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware a35dd5dd98 dmaengine: at_hdmac: Fix concurrency over the active list 0f603bf553 dmaengine: at_hdmac: Free the memset buf without holding the chan lock 7f07cecc74 dmaengine: at_hdmac: Fix concurrency over descriptor 1582cc3b48 dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all() 9b69060a72 dmaengine: at_hdmac: Protect atchan->status with the channel lock ee35682261 dmaengine: at_hdmac: Do not call the complete callback on device_terminate_all 7078e935b4 dmaengine: at_hdmac: Fix premature completion of desc in issue_pending ad4cbe8e9c dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending 24f9e93e50 dmaengine: at_hdmac: Don't start transactions at tx_submit level 4b51cce72a dmaengine: at_hdmac: Fix at_lli struct definition d37dfb9357 cert host tools: Stop complaining about deprecated OpenSSL functions f8e0edeaa0 can: j1939: j1939_send_one(): fix missing CAN header initialization 0b692d41ee mm/memremap.c: map FS_DAX device memory as decrypted 03f9582a6a udf: Fix a slab-out-of-bounds write bug in udf_find_entry() 4ea3aa3b98 mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI 9c0accfa5a btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() 8fa0c22ef8 platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi b5ee579fcb drm/i915/dmabuf: fix sg_table handling in map_dma_buf 4feedde548 nilfs2: fix use-after-free bug of ns_writer on remount 1d4ff73062 nilfs2: fix deadlock in nilfs_count_free_blocks() 344ddbd688 ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure 516f9f2300 vmlinux.lds.h: Fix placement of '.data..decrypted' section f6896fb69d ALSA: usb-audio: Add DSD support for Accuphase DAC-60 2032c2d32b ALSA: usb-audio: Add quirk entry for M-Audio Micro a414a6d6ef ALSA: hda/realtek: Add Positivo C6300 model quirk 3a79f9568d ALSA: hda: fix potential memleak in 'add_widget_node' 380d64168d ALSA: hda/ca0132: add quirk for EVGA Z390 DARK 181cfff57b ALSA: hda/hdmi - enable runtime pm for more AMD display audio ea6787e482 mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI 0a8d4531a0 mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI 3f558930ad mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI b55e64d0a3 mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI 4631cb0406 MIPS: jump_label: Fix compat branch range check 475fd3991a arm64: efi: Fix handling of misaligned runtime regions and drop warning 94ab8f88fe riscv: fix reserved memory setup 0cf9cb0614 riscv: Separate memory init from paging init d7716240bc riscv: Enable CMA support ecf78af514 riscv: vdso: fix build with llvm e56d18a976 riscv: process: fix kernel info leakage 956e0216a1 net: macvlan: fix memory leaks of macvlan_common_newlink 59ec132386 ethernet: tundra: free irq when alloc ring failed in tsi108_open() dd7beaec8b net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() 56d3b5531b ethernet: s2io: disable napi when start nic failed in s2io_card_up() 05b2228434 net: atlantic: macsec: clear encryption keys from the stack 1a4e495edf net: phy: mscc: macsec: clear encryption keys when freeing a flow 4ad684ba02 cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open() 38aa7ed8c2 net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() fd52dd2d6e net: cpsw: disable napi in cpsw_ndo_open() 3b27e20601 net/mlx5e: E-Switch, Fix comparing termination table instance eb6fa0ac2a net/mlx5: Allow async trigger completion execution on single CPU systems bdd282bba7 net: nixge: disable napi when enable interrupts failed in nixge_open() 5333cf1b7f net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init() cf4853880e perf stat: Fix printing os->prefix in CSV metrics output 3a4a3c3b1f drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() 0b7ee3d50f dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() 6e2ffae69d dmaengine: pxa_dma: use platform_get_irq_optional f31dd15858 tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header fbb4e8e6dc net: broadcom: Fix BCMGENET Kconfig cb6d639bb1 net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable() d68fa77ee3 can: af_can: fix NULL pointer dereference in can_rx_register() a033b86c7f ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 02f8dfee75 tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent f3aa8a7d95 drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() bcb3bb1069 hamradio: fix issue of dev reference count leakage in bpq_device_event() bc4591a86b net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() 2bf8b1c111 KVM: s390: pv: don't allow userspace to set the clock under PV a60cc64db7 KVM: s390x: fix SCK locking fcbd2b3368 capabilities: fix undefined behavior in bit shift for CAP_TO_MASK 8aae24b0ed net: fman: Unregister ethernet device on removal e2c5ee3b62 bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer 38147073c9 bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() 3401f96402 net: tun: Fix memory leaks of napi_get_frags adaa0f180d macsec: clear encryption keys from the stack after setting up offload 9dc7503bae macsec: fix detection of RXSCs when toggling offloading 7f4456f011 macsec: fix secy->n_rx_sc accounting 3b05d9073a macsec: delete new rxsc when offload fails 50868de7dc net: gso: fix panic on frag_list with mixed head alloc types cedd4f01f6 bpf: Fix wrong reg type conversion in release_reference() 9069db2579 bpf: Add helper macro bpf_for_each_reg_in_vstate 95b6ec7337 bpf: Support for pointers beyond pkt_end. 8597b59e3d HID: hyperv: fix possible memory leak in mousevsc_probe() 8c80b2fca4 bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE cc21dc48a7 bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues e1e1218032 wifi: cfg80211: fix memory leak in query_regdb_file() 914cb94e73 wifi: cfg80211: silence a sparse RCU warning 72ea2fc299 phy: stm32: fix an error code in probe 925bf1ba76 hwspinlock: qcom: correct MMIO max register for newer SoCs 76eba54f0d fuse: fix readdir cache race 7bcea6c5c9 ANDROID: gki_defconfig: remove CONFIG_INIT_STACK_ALL_ZERO=y d2bc3376cd Revert "serial: 8250: Fix restoring termios speed after suspend" 0b500f5b16 Merge 5.10.150 into android12-5.10-lts f5b40c0eb9 Linux 5.10.154 bf506e366d ipc: remove memcg accounting for sops objects in do_semtimedop() c6678c8f4f wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() a6c57adec5 drm/i915/sdvo: Setup DDC fully before output init b86830cc95 drm/i915/sdvo: Filter out invalid outputs more sensibly 9f3b867808 drm/rockchip: dsi: Force synchronous probe 23f1fc7ce5 ext4,f2fs: fix readahead of verity data e5cef906cb KVM: x86: emulator: update the emulation mode after CR0 write ce9261accc KVM: x86: emulator: introduce emulator_recalc_and_set_mode c8a2fd7a71 KVM: x86: emulator: em_sysexit should update ctxt->mode e0c7410378 KVM: x86: Mask off reserved bits in CPUID.80000001H 9302ebc1c2 KVM: x86: Mask off reserved bits in CPUID.80000008H cc40c5f3e9 KVM: x86: Mask off reserved bits in CPUID.8000001AH bd64a88f36 KVM: x86: Mask off reserved bits in CPUID.80000006H 156451a67b ext4: fix BUG_ON() when directory entry has invalid rec_len 5370b965b7 ext4: fix warning in 'ext4_da_release_space' c9598cf629 parisc: Avoid printing the hardware path twice 98f836e80d parisc: Export iosapic_serial_irq() symbol for serial port driver 814af9a32b parisc: Make 8250_gsc driver dependend on CONFIG_PARISC 29d106d086 perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] 98f6e7c337 perf/x86/intel: Fix pebs event constraints for ICL 3be2d66822 efi: random: Use 'ACPI reclaim' memory for random seed 83294f7c77 efi: random: reduce seed size to 32 bytes f8e8cda869 fuse: add file_modified() to fallocate cdf01c807e capabilities: fix potential memleak on error path from vfs_getxattr_alloc() ff32d8a099 tracing/histogram: Update document for KEYS_MAX size 533bfacbac tools/nolibc/string: Fix memcmp() implementation f100a02748 kprobe: reverse kp->flags when arm_kprobe failed bef08acbe5 tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() 2bf33b5ea4 tcp/udp: Make early_demux back namespacified. ea5f2fd464 ftrace: Fix use-after-free for dynamic ftrace_ops 06de93a47c btrfs: fix type of parameter generation in btrfs_get_dentry e33ce54cef coresight: cti: Fix hang in cti_disable_hw() 015ac18be7 binder: fix UAF of alloc->vma in race with munmap() 836686e1a0 memcg: enable accounting of ipc resources e4e4b24b42 mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times 818c36b988 tcp/udp: Fix memory leak in ipv6_renew_options(). 29997a6fa6 fscrypt: fix keyring memory leak on mount failure 391cceee6d fscrypt: stop using keyrings subsystem for fscrypt_master_key 092401142b fscrypt: simplify master key locking 54c13d3520 ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices a0e2577cf3 block, bfq: protect 'bfqd->queued' by 'bfqd->lock' 26ca2ac091 Bluetooth: L2CAP: Fix attempting to access uninitialized memory 6b6f94fb9a Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM bfd5e62f9a i2c: piix4: Fix adapter not be removed in piix4_remove() fc3e2fa0a5 arm64: dts: juno: Add thermal critical trip points b743ecf29c firmware: arm_scmi: Make Rx chan_setup fail on memory errors 29e8e9bfc2 firmware: arm_scmi: Suppress the driver's bind attributes d7b1e2cbe0 ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset 160d8904b2 efi/tpm: Pass correct address to memblock_reserve c40b4d604b i2c: xiic: Add platform module alias 5bf8c7798b drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case 496eb203d0 HID: saitek: add madcatz variant of MMO7 mouse device ID ff06067b70 scsi: core: Restrict legal sdev_state transitions via sysfs 9edf20e5a1 ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() be6e22f546 media: meson: vdec: fix possible refcount leak in vdec_probe() c5fd54a65c media: dvb-frontends/drxk: initialize err to 0 7fdc58d8c2 media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE 1609231f86 media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE c46759e370 media: rkisp1: Zero v4l2_subdev_format fields in when validating links 3144ce5574 media: rkisp1: Initialize color space on resizer sink and source pads 6b24d9c2ac s390/boot: add secure boot trailer efc6420d65 xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices 37bb57908d mtd: parsers: bcm47xxpart: Fix halfblock reads 85e458369c mtd: parsers: bcm47xxpart: print correct offset on read error ec54104feb fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards f8c86d7829 video/fbdev/stifb: Implement the stifb_fillrect() function e975d7aeca mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake afeae13b8a mmc: sdhci-pci: Avoid comma separated statements a06721767c mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus 59400c9b0d drm/msm/hdmi: fix IRQ lifetime 8225bdaec5 drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag 5dbb47ee89 ipv6: fix WARNING in ip6_route_net_exit_late() 1c89642e7f net, neigh: Fix null-ptr-deref in neigh_table_clear() 634f066d02 net: mdio: fix undefined behavior in bit shift for __mdiobus_register d9ec6e2fbd Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() cb1c012099 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu 0a0dead4ad btrfs: fix ulist leaks in error paths of qgroup self tests 61e0612811 btrfs: fix inode list leak during backref walking at find_parent_nodes() a52e24c7fc btrfs: fix inode list leak during backref walking at resolve_indirect_refs() 81204283ea isdn: mISDN: netjet: fix wrong check of device registration e77d213843 mISDN: fix possible memory leak in mISDN_register_device() f06186e527 rose: Fix NULL pointer dereference in rose_send_frame() 2c8d81bdb2 ipvs: fix WARNING in ip_vs_app_net_cleanup() 931f56d59c ipvs: fix WARNING in __ip_vs_cleanup_batch() d69328cdb9 ipvs: use explicitly signed chars b2d7a92aff netfilter: nf_tables: release flow rule object from commit path 3583826b44 net: tun: fix bugs for oversize packet when napi frags enabled 5960b9081b net: sched: Fix use after free in red_enqueue() 24f9c41435 ata: pata_legacy: fix pdc20230_set_piomode() c85ee1c3cb net: fec: fix improper use of NETDEV_TX_BUSY 52438e734c nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() 0acfcd2aed nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() 9ae2c9a91f nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() eecea068bf NFC: nxp-nci: remove unnecessary labels e8c11ee2d0 nfc: fdp: Fix potential memory leak in fdp_nci_send() 31b83d6990 nfc: fdp: drop ftrace-like debugging messages 4e1e4485b2 RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() d360e875c0 RDMA/core: Fix null-ptr-deref in ib_core_cleanup() 37a098fc9b net: dsa: Fix possible memory leaks in dsa_loop_init() 45aea4fbf6 nfs4: Fix kmemleak when allocate slot failed f0f1c74fa6 NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot 10c554d722 NFSv4.1: Handle RECLAIM_COMPLETE trunking errors 4813dd737d NFSv4: Fix a potential state reclaim deadlock 7c4260f8f1 IB/hfi1: Correctly move list in sc_disable() 87ac93c8dd RDMA/cma: Use output interface for net_dev check 4dbb739eb2 KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER bb584caee8 KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter() 9faacf442d KVM: x86: Protect the unused bits in MSR exiting flags 5bdbccc79c x86/topology: Fix duplicated core ID within a package 6c31fc028a x86/topology: Fix multiple packages shown on a single-package system f5ad52da14 x86/topology: Set cpu_die_id only if DIE_TYPE found 570fa3bcd2 KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1) e5d7c6786b KVM: x86: Trace re-injected exceptions 8364786152 KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02 523e1dd9f8 KVM: nVMX: Pull KVM L0's desired controls directly from vmcs01 028fcabd8a serial: ar933x: Deassert Transmit Enable on ->rs485_config() e6da7808c9 serial: 8250: Let drivers request full 16550A feature probing 95aa34f721 Linux 5.10.153 26a2b9c468 serial: Deassert Transmit Enable on probe in driver-specific way 4a230f65d6 serial: core: move RS485 configuration tasks from drivers into core eb69c07eca can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive d5924531dd arm64/kexec: Test page size support with new TGRAN range values c911f03f8d arm64/mm: Fix __enable_mmu() for new TGRAN range values d523384766 scsi: sd: Revert "scsi: sd: Remove a local variable" 52a43b8200 arm64: Add AMPERE1 to the Spectre-BHB affected list 9889ca7efa net: enetc: survive memory pressure without crashing fdba224ab0 net/mlx5: Fix crash during sync firmware reset bbcc06933f net/mlx5: Fix possible use-after-free in async command interface 16376ba5cf net/mlx5e: Do not increment ESN when updating IPsec ESN state 0d88359092 nh: fix scope used to find saddr when adding non gw nh 3519b5ddac net: ehea: fix possible memory leak in ehea_register_port() 79631daa5a openvswitch: switch from WARN to pr_warn 00d6f33f67 ALSA: aoa: Fix I2S device accounting ce6fd1c382 ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() 97262705c0 net: fec: limit register access on i.MX6UL df67a8e625 PM: domains: Fix handling of unavailable/disabled idle states 1f262d8088 net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() 6170b4579f i40e: Fix flow-type by setting GL_HASH_INSET registers 9abae363af i40e: Fix VF hang when reset is triggered on another VF 23d5599058 i40e: Fix ethtool rx-flow-hash setting for X722 44affe7ede ipv6: ensure sane device mtu in tunnels 905f05c0ab media: vivid: set num_in/outputs to 0 if not supported b6c7446d0a media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' 683015ae16 media: v4l2-dv-timings: add sanity checks for blanking values 147b8f1892 media: vivid: dev->bitmap_cap wasn't freed in all cases 1cf51d5158 media: vivid: s_fbuf: add more sanity checks 3221c2701d PM: hibernate: Allow hybrid sleep to work with s2idle 0eb19ecbd0 can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path 6b2d07fc0b can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path 1634d5d39c tcp: fix indefinite deferral of RTO with SACK reneging 4f23cb2be5 tcp: fix a signed-integer-overflow bug in tcp_add_backlog() 49713d7c38 tcp: minor optimization in tcp_add_backlog() aab883bd60 net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY c3edc6e808 net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed e2a28807b1 kcm: annotate data-races around kcm->rx_wait c325f92d8d kcm: annotate data-races around kcm->rx_psock af7879529e atlantic: fix deadlock at aq_nic_stop d7ccd49c4d amd-xgbe: add the bit rate quirk for Molex cables 17350734fd amd-xgbe: fix the SFP compliance codes check for DAC cables b55d6ea965 x86/unwind/orc: Fix unreliable stack dump with gcov 0ce1ef3353 net: hinic: fix the issue of double release MBOX callback of VF 6603843c80 net: hinic: fix the issue of CMDQ memory leaks bb01910763 net: hinic: fix memory leak when reading function table ce605b68db net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg() 62f0a08e82 net: netsec: fix error handling in netsec_register_mdio() 32a3d4660b tipc: fix a null-ptr-deref in tipc_topsrv_accept fb94152aae perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap() bfce730886 ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() 2663b16c76 ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile a527557299 arc: iounmap() arg is volatile 648ac633e7 ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile 6571f6ca8a drm/msm: Fix return type of mdp4_lvds_connector_mode_valid 4953a989b7 media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation 9d00384270 net: ieee802154: fix error return code in dgram_bind() 568e3812b1 mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages 935a8b6202 mm/memory: add non-anonymous page check in the copy_present_page() 49db6cb814 xen/gntdev: Prevent leaking grants a3f2cc11d6 Xen/gntdev: don't ignore kernel unmapping error 467230b9ef s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() fe187c801a s390/futex: add missing EX_TABLE entry to __futex_atomic_op() 449070996c perf auxtrace: Fix address filter symbol name match for modules 6f72a3977b kernfs: fix use-after-free in __kernfs_remove 0bcd1ab3e8 counter: microchip-tcb-capture: Handle Signal1 read and Synapse 8bf037279b mmc: core: Fix kernel panic when remove non-standard SDIO card 5684808b26 mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO b686ffc0ac drm/msm/dp: fix IRQ lifetime 08c7375fa2 drm/msm/hdmi: fix memory corruption with too many bridges 21c4679af0 drm/msm/dsi: fix memory corruption with too many bridges 44a86d96fa scsi: qla2xxx: Use transport-defined speed mask for supported_speeds c368f751da mac802154: Fix LQI recording 9ba2990f4e exec: Copy oldsighand->action under spin-lock 7062153004 fs/binfmt_elf: Fix memory leak in load_elf_binary() d9ddfeb01f fbdev: smscufx: Fix several use-after-free bugs f19f1a75d3 iio: temperature: ltc2983: allocate iio channels once af236da855 iio: light: tsl2583: Fix module unloading 90ff5bef2b tools: iio: iio_utils: fix digit calculation 678d2cc204 xhci: Remove device endpoints from bandwidth list when freeing the device 3b250824b6 xhci: Add quirk to reset host back to default state at shutdown 63c7df3c81 mtd: rawnand: marvell: Use correct logic for nand-keep-config 228101fc83 usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller 2bc4f99ee2 usb: bdc: change state when port disconnected e440957f9c usb: dwc3: gadget: Don't set IMI for no_interrupt fb074d622c usb: dwc3: gadget: Stop processing more requests on IMI c29fcef579 USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM 4cc7a360ec ALSA: rme9652: use explicitly signed char 8959092300 ALSA: au88x0: use explicitly signed char 2bf5b16315 ALSA: Use del_timer_sync() before freeing timer ca1034bff8 can: kvaser_usb: Fix possible completions during init_completion 370be31cde can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() 7d51b4c67c Linux 5.10.152 43d5109296 udp: Update reuse->has_conns under reuseport_lock. a50ed2d287 mm: /proc/pid/smaps_rollup: fix no vma's null-deref 31b1570677 blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() e2f9b62ead mmc: core: Add SD card quirk for broken discard 3a260e9844 Makefile.debug: re-enable debug info for .S files 6ab2287b26 x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB 67dafece56 ACPI: video: Force backlight native for more TongFang devices dcaf631320 hv_netvsc: Fix race between VF offering and VF association message from host da54c5f4b5 perf/x86/intel/pt: Relax address filter validation 79c3482fbe riscv: topology: fix default topology reporting a6e770733d arm64: topology: move store_cpu_topology() to shared code cb1024d8a4 arm64: dts: qcom: sc7180-trogdor: Fixup modem memory region f687e2111b fcntl: fix potential deadlocks for &fown_struct.lock b1efc19644 fcntl: make F_GETOWN(EX) return 0 on dead owner task ca4c498382 perf: Skip and warn on unknown format 'configN' attrs dea47fefa6 perf pmu: Validate raw event with sysfs exported format bits 86e995f964 riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb 0e4c06ae7c riscv: Add machine name to kernel boot log and stack dump output 7fba4a389d mmc: sdhci-tegra: Use actual clock rate for SW tuning correction 3c6a888e35 xen/gntdev: Accommodate VMA splitting 5232411f37 xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests ea82edad0a tracing: Do not free snapshot if tracer is on cmdline bd6af07e79 tracing: Simplify conditional compilation code in tracing_set_tracer() 4e3a15ca24 dmaengine: mxs: use platform_driver_register 1da5d24970 dmaengine: mxs-dma: Remove the unused .id_table 1414e9bf3c drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() d74196bb27 iommu/vt-d: Clean up si_domain in the init_dmars() error path ef11e8ec00 iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() 35c92435be net: phy: dp83822: disable MDI crossover status change interrupt 7aa3d623c1 net: sched: fix race condition in qdisc_graft() 2974f3b330 net: hns: fix possible memory leak in hnae_ae_register() 3032e316e0 sfc: include vport_id in filter spec hash and equal() ded86c4191 net: sched: sfb: fix null pointer access issue when sfb_init() fails 305aa36b62 net: sched: delete duplicate cleanup of backlog and qlen ae48bee283 net: sched: cake: fix null pointer access issue when cake_init() fails 2008ad08a2 nvme-hwmon: kmalloc the NVME SMART log buffer 770b7e3a2c nvme-hwmon: consistently ignore errors from nvme_hwmon_init 67106ac272 nvme-hwmon: Return error code when registration fails bc17f727b0 nvme-hwmon: rework to avoid devm allocation 191d71c635 ionic: catch NULL pointer issue on reconfig ff7ba76675 net: hsr: avoid possible NULL deref in skb_clone() 7286f87551 cifs: Fix xid leak in cifs_ses_add_channel() 2d08311aa3 cifs: Fix xid leak in cifs_flock() bf49d4fe4a cifs: Fix xid leak in cifs_copy_file_range() 05cc22c008 net: phy: dp83867: Extend RX strap quirk for SGMII mode 118f412bed net/atm: fix proc_mpc_write incorrect return value c8310a99e7 sfc: Change VF mac via PF as first preference if available. 39d10f0dfb HID: magicmouse: Do not set BTN_MOUSE on double report ed5baf3d0a i40e: Fix DMA mappings leak e558e14893 tipc: fix an information leak in tipc_topsrv_kern_subscr 1f4ed95ce6 tipc: Fix recognition of trial period fc8c6b8bb2 ACPI: extlog: Handle multiple records 57e157749a btrfs: fix processing of delayed tree block refs during backref walking 590929ef69 btrfs: fix processing of delayed data refs during backref walking cc841a8a70 r8152: add PID for the Lenovo OneLink+ Dock 51b96ecaed arm64: errata: Remove AES hwcap for COMPAT tasks 910ba49b33 blk-wbt: call rq_qos_add() after wb_normal is initialized 392536023d block: wbt: Remove unnecessary invoking of wbt_update_limits in wbt_init ab6aaa8210 media: venus: dec: Handle the case where find_format fails bce5808fc9 media: mceusb: set timeout to at least timeout provided 6d725672ce KVM: arm64: vgic: Fix exit condition in scan_its_table() 34db701dc6 kvm: Add support for arch compat vm ioctls e55feb31df cpufreq: qcom: fix memory leak in error path 303d0f7614 ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS 6a2aadcb01 ata: ahci-imx: Fix MODULE_ALIAS d9f0159da0 hwmon/coretemp: Handle large core ID value 0fb04676c4 x86/microcode/AMD: Apply the patch early on every logical thread 6dcf1f0802 i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter 794ded0bc4 cpufreq: qcom: fix writes in read-only memory region 2723875e9d selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() 0d65f040fd ocfs2: fix BUG when iput after ocfs2_mknod fails b838dcfda1 ocfs2: clear dinode links count in case of error c34d1b22fe Linux 5.10.151 ecad331211 kbuild: Add skip_encoding_btf_enum64 option to pahole c5006abb80 kbuild: Unify options for BTF generation for vmlinux and modules f5f413cb3e kbuild: skip per-CPU BTF generation for pahole v1.18-v1.21 06481cd9f7 kbuild: Quote OBJCOPY var to avoid a pahole call break the build bbaea0f1cd bpf: Generate BTF_KIND_FLOAT when linking vmlinux a10a57a224 Linux 5.10.150 243c8f42ba Revert "drm/amdgpu: make sure to init common IP before gmc" 8026d58b49 gcov: support GCC 12.1 and newer compilers cbf2c43b36 f2fs: fix wrong condition to trigger background checkpoint correctly 7b19858803 thermal: intel_powerclamp: Use first online CPU as control_cpu f039b43cba inet: fully convert sk->sk_rx_dst to RCU rules 67de22cb0b ext4: continue to expand file system when the target size doesn't reach 357db159e9 Revert "drm/amdgpu: use dirty framebuffer helper" 98ab15bfdc Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega" 791489a5c5 net/ieee802154: don't warn zero-sized raw_sendmsg() a96336a5f2 Revert "net/ieee802154: reject zero-sized raw_sendmsg()" dc54ff9fc4 net: ieee802154: return -EINVAL for unknown addr type 45c3396675 mm: hugetlb: fix UAF in hugetlb_handle_userfault c378c479c5 io_uring/af_unix: defer registered files gc to io_uring release 67cbc8865a io_uring: correct pinned_vm accounting 904f881b57 arm64: topology: fix possible overflow in amu_fie_setup() b5dc2f2578 perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc 9b4e849777 clk: bcm2835: Make peripheral PLLC critical b8bbae3236 usb: idmouse: fix an uninit-value in idmouse_open d5bb45f47b nvmet-tcp: add bounds check on Transfer Tag b79da0080d nvme: copy firmware_rev on each init e6cc39db24 staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() 3a5a34ed9d Revert "usb: storage: Add quirk for Samsung Fit flash" acf0006f2b usb: musb: Fix musb_gadget.c rxstate overflow bug 91271a3e77 usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() 782b3e71c9 md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d dbcca76435 HID: roccat: Fix use-after-free in roccat_read() f00c049ede soundwire: intel: fix error handling on dai registration issues f04a673d4a soundwire: cadence: Don't overwrite msg->buf during write commands c263516c2c bcache: fix set_at_max_writeback_rate() for multiple attached devices fcad2ac863 ata: libahci_platform: Sanity check the DT child nodes number 19c010ae44 blk-throttle: prevent overflow while calculating wait time 1b3cebeca9 staging: vt6655: fix potential memory leak 89f305a714 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() b2700f98b3 nbd: Fix hung when signal interrupts nbd_start_device_ioctl() 5942e5c63d scsi: 3w-9xxx: Avoid disabling device if failing to enable it 48727117bd usb: host: xhci-plat: suspend/resume clks for brcm c13d0d2f5a usb: host: xhci-plat: suspend and resume clocks 12d31182de clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate c2257c8a50 media: cx88: Fix a null-ptr-deref bug in buffer_prepare() d9e2585c3b clk: zynqmp: Fix stack-out-of-bounds in strncpy` 70f8b48d0b btrfs: scrub: try to fix super block errors 8f554dd23c arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply 451ce2521c kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT 017cabfb3f ARM: dts: imx6sx: add missing properties for sram 9d3ca48722 ARM: dts: imx6sll: add missing properties for sram 9735f2b62b ARM: dts: imx6sl: add missing properties for sram 2829b6ad30 ARM: dts: imx6qp: add missing properties for sram 0c3a0b3d5e ARM: dts: imx6dl: add missing properties for sram 2763a3b43a ARM: dts: imx6q: add missing properties for sram 82e0d91484 ARM: dts: imx7d-sdb: config the max pressure for tsc2046 166feb964f drm/amd/display: Remove interface for periodic interrupt 1 1bb6f4a8db drm/dp: Don't rewrite link config when setting phy test pattern bb91c06b0b mmc: sdhci-msm: add compatible string check for sdm670 8a427a2283 drm/meson: explicitly remove aggregate driver at module unload time 1c7d957c5d drm/amdgpu: fix initial connector audio value 69130888b2 ASoC: SOF: pci: Change DMI match info to support all Chrome platforms 54f2585e2d platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading a9d6a7c9b6 platform/chrome: cros_ec: Notify the PM of wake events during resume e29d20deaf drm: panel-orientation-quirks: Add quirk for Anbernic Win600 bfdb391d57 drm/vc4: vec: Fix timings for VEC modes b70f8abc1a drm: bridge: dw_hdmi: only trigger hotplug event on link change bbe2f6f903 udmabuf: Set ubuf->sg = NULL if the creation of sg table fails 0a4fddc95c drm/amd/display: fix overflow on MIN_I64 definition 3959e8faf8 gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() c28a8082b2 drm: Prevent drm_copy_field() to attempt copying a NULL pointer e7d7018003 drm: Use size_t type for len variable in drm_copy_field() 3339a51bcd drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() 484400d433 r8152: Rate limit overflow messages 0c108cf3ad Bluetooth: L2CAP: Fix user-after-free 65029aaedd net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory 4851303c85 wifi: rt2x00: correctly set BBP register 86 for MT7620 a016144479 wifi: rt2x00: set SoC wmac clock register 5aa0461d11 wifi: rt2x00: set VGC gain for both chains of MT7620 8d9c00979a wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 27ed98e8a9 wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 3d67986e72 can: bcm: check the result of can_send() in bcm_can_tx() 7b674dce41 Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times e25ca9af8a Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() b051d9bf98 regulator: core: Prevent integer underflow e01d96494a wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() be81c44242 xfrm: Update ipcomp_scratches with NULL when freed 9661724f62 wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() 0958e487e8 tcp: annotate data-race around tcp_md5sig_pool_populated 129ca0db95 openvswitch: Fix overreporting of drops in dropwatch 4398e8a7fd openvswitch: Fix double reporting of drops in dropwatch e3c9b94734 bpftool: Clear errno after libcap's checks 50e45034c5 wifi: brcmfmac: fix invalid address access when enabling SCAN log level bbacfcde5f NFSD: fix use-after-free on source server when doing inter-server copy 3de402a524 NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data 1f730d4ae6 x86/entry: Work around Clang __bdos() bug 513943bf87 thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash 708b9abe1b powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue b434edb0e9 MIPS: BCM47XX: Cast memcmp() of function to (void *) 6c61a37ea7 ACPI: video: Add Toshiba Satellite/Portege Z830 quirk 0dd025483f rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() 36d4ffbedf rcu: Back off upon fill_page_cache_func() allocation failure 278d8ba2b2 selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle b60aa21e2f f2fs: fix to account FS_CP_DATA_IO correctly 0b8230d44c f2fs: fix to avoid REQ_TIME and CP_TIME collision ecbd95958c f2fs: fix race condition on setting FI_NO_EXTENT flag 110146ce8f ACPI: APEI: do not add task_work to kernel thread to avoid memory leak dce07e87ee thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id 3a720eb890 crypto: cavium - prevent integer overflow loading firmware 7bfa7d6773 crypto: marvell/octeontx - prevent integer overflows cdd42eb468 kbuild: rpm-pkg: fix breakage when V=1 is used 6d1aef17e7 kbuild: remove the target in signal traps when interrupted 8d76dd5080 tracing: kprobe: Make gen test module work in arm and riscv c6512a6f0c tracing: kprobe: Fix kprobe event gen test module on exit 9e6ba62d41 iommu/iova: Fix module config properly 426d5bc089 crypto: qat - fix DMA transfer direction a43babc059 crypto: qat - use pre-allocated buffers in datapath a91af50850 crypto: qat - fix use of 'dma_map_single' 8a4ed09ed8 crypto: inside-secure - Change swab to swab32 d33935e666 crypto: ccp - Release dma channels before dmaengine unrgister a1354bdd19 crypto: akcipher - default implementation for setting a private key 2fee0dbfae iommu/omap: Fix buffer overflow in debugfs cfde58a8e4 cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset ab2485eb5d hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() d88b88514e crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr 25f1342473 crypto: sahara - don't sleep when in softirq 2d285164fb powerpc: Fix SPE Power ISA properties for e500v1 platforms 2bde4e1e4f powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 7ae8bed908 x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition 6315998170 powerpc/powernv: add missing of_node_put() in opal_export_attrs() 434db6d17b powerpc/pci_dn: Add missing of_node_put() 718e2d8023 powerpc/sysdev/fsl_msi: Add missing of_node_put() 592d283a65 powerpc/math_emu/efp: Include module.h 44c26ceffa mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg b1616599c9 clk: ast2600: BCLK comes from EPLL 6d01017247 clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe 9b65fd6513 clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration 9a6087a438 clk: baikal-t1: Add SATA internal ref clock buffer 5f143f3bc2 clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent 823fd52391 clk: baikal-t1: Fix invalid xGMAC PTP clock divider 2f19a1050e clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD 92f52770a7 spmi: pmic-arb: correct duplicate APID to PPID mapping logic a01c0c1600 dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() 1dd5148445 clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent 6e58f2469e mfd: sm501: Add check for platform_driver_register() 3469dd8e22 mfd: fsl-imx25: Fix check for platform_get_irq() errors b425e03c96 mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() f7b4388636 mfd: lp8788: Fix an error handling path in lp8788_probe() 08d4051803 mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() 28868b940b mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() 382a5fc49e fsi: core: Check error number after calling ida_simple_get ed8e6011b9 clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical 884a788f06 scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() a9e5176ead scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() 8f740c11d8 serial: 8250: Fix restoring termios speed after suspend ab5a3e7144 firmware: google: Test spinlock on panic path to avoid lockups 95ac62e854 staging: vt6655: fix some erroneous memory clean-up loops 878f987166 phy: qualcomm: call clk_disable_unprepare in the error handling 9a56ade124 tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown 572fb97fce serial: 8250: Toggle IER bits on only after irq has been set up 3fbfa5e3cc serial: 8250: Add an empty line and remove some useless {} 71ffe5111f drivers: serial: jsm: fix some leaks in probe 7efdd91d54 usb: gadget: function: fix dangling pnp_string in f_printer.c cc952e3bf6 xhci: Don't show warning for reinit on known broken suspend dac769dd7d IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers 360386e11c RDMA/cm: Use SLID in the work completion as the DLID in responder side a1263294b5 md/raid5: Ensure stripe_fill happens on non-read IO with journal 76694e9ce0 md: Replace snprintf with scnprintf 7bd5f3b4a8 mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() f5325f3202 ata: fix ata_id_has_dipm() f5a6fa1877 ata: fix ata_id_has_ncq_autosense() 3c34a91c8a ata: fix ata_id_has_devslp() fc61a0c820 ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() e3917c85f4 RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. 3a9d7d8dcf mtd: rawnand: fsl_elbc: Fix none ECC mode f87f720811 mtd: devices: docg3: check the return value of devm_ioremap() in the probe d06cc0e11d dyndbg: drop EXPORTed dynamic_debug_exec_queries 1d65985589 dyndbg: let query-modname override actual module name c0e206da44 dyndbg: fix module.dyndbg handling 5047bd3bd7 dyndbg: fix static_branch manipulation af12e209a9 dmaengine: hisilicon: Add multi-thread support for a DMA channel d3fd838536 dmaengine: hisilicon: Fix CQ head update d5065ca461 dmaengine: hisilicon: Disable channels when unregister hisi_dma f59861946f fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() 7ba19a60c7 misc: ocxl: fix possible refcount leak in afu_ioctl() cf3bb86edd RDMA/rxe: Fix the error caused by qp->sk cdce36a88d RDMA/rxe: Fix "kernel NULL pointer dereference" error 2630cc8832 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init 40aa0999a3 media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start() 551b87976a tty: xilinx_uartps: Fix the ignore_status 28cdf6c6fb media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop 1f683bff1a HSI: omap_ssi_port: Fix dma_map_sg error check 962f22e7f7 HSI: omap_ssi: Fix refcount leak in ssi_probe 70f0a0a27d clk: tegra20: Fix refcount leak in tegra20_clock_init c01bfd23cc clk: tegra: Fix refcount leak in tegra114_clock_init f487137a53 clk: tegra: Fix refcount leak in tegra210_clock_init 59e90c4d98 clk: sprd: Hold reference returned by of_get_parent() 57141b1dd6 clk: berlin: Add of_node_put() for of_get_parent() dc190b46c6 clk: qoriq: Hold reference returned by of_get_parent() baadc6f58f clk: oxnas: Hold reference returned by of_get_parent() b95f4f9054 clk: meson: Hold reference returned by of_get_parent() beec2f0255 usb: common: debug: Check non-standard control requests 9d965a22f6 usb: common: move function's kerneldoc next to its definition 20b63631a3 usb: common: add function to get interval expressed in us unit c1ef8c66a3 usb: common: Parse for USB SSP genXxY ffffb159e1 usb: ch9: Add USB 3.2 SSP attributes aa7aada4b7 iio: ABI: Fix wrong format of differential capacitance channel ABI. b9a0526cd0 iio: inkern: only release the device node when done with it 44ec4b04fc iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume 513c72d76d iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq d259b90f0c iio: adc: at91-sama5d2_adc: check return status for pressure and touch bc2b97e177 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX 5b9bb0cbd9 ARM: dts: exynos: fix polarity of VBUS GPIO of Origen 657de36c72 arm64: ftrace: fix module PLTs with mcount 40e966a404 ARM: Drop CMDLINE_* dependency on ATAGS 477dbf9d1b ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family 5bbd3dd7f9 soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA 09c35f1520 ia64: export memory_add_physaddr_to_nid to fix cxl build error e31c0e14cf ARM: dts: kirkwood: lsxl: remove first ethernet port df4f05b356 ARM: dts: kirkwood: lsxl: fix serial line 43faaedf3a ARM: dts: turris-omnia: Fix mpp26 pin name and comment d5c2051898 soc: qcom: smem_state: Add refcounting for the 'state->of_node' 39781c98ad soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() 1d312c12c9 memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() daaec4b3fe memory: of: Fix refcount leak bug in of_get_ddr_timings() fde46754d5 memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() 2c442b0c06 ALSA: hda/hdmi: Don't skip notification handling during PM operation f182de42d7 ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe 37e3e01c9a ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe fb23569699 ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe c1b269dda1 ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe 71704c2e1b mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() c940636d9c ALSA: dmaengine: increment buffer pointer atomically 4993c1511d ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() ef59819976 drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() 598d8f7d86 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx a9a60d6405 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API ad0b8ed172 mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() 1f340e1c1c drm/omap: dss: Fix refcount leak bugs cbe37857dd ALSA: hda: beep: Simplify keep-power-at-enable behavior f0fb0817eb ASoC: rsnd: Add check for rsnd_mod_power_on 877e92e9b1 drm/bridge: megachips: Fix a null pointer dereference bug c577b4e972 drm: fix drm_mipi_dbi build errors 804d8e59f3 platform/x86: msi-laptop: Fix resource cleanup c21c08fab7 platform/x86: msi-laptop: Fix old-ec check for backlight registering b77755f58e ASoC: tas2764: Fix mute/unmute 2e6b64df54 ASoC: tas2764: Drop conflicting set_bias_level power setting c2c6022e10 ASoC: tas2764: Allow mono streams 868fc93b61 platform/chrome: fix memory corruption in ioctl 84da5cdf43 platform/chrome: fix double-free in chromeos_laptop_prepare() 5e25bfcd12 drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node() ad06d6bed5 drm/dp_mst: fix drm_dp_dpcd_read return value checks 3f5889fd65 drm/bridge: parade-ps8640: Fix regulator supply order 45120fa5e5 drm/mipi-dsi: Detach devices when removing the host 050b650507 drm/bridge: Avoid uninitialized variable warning 7839f2b349 drm: bridge: adv7511: fix CEC power down control register offset 29f50bcf0f net: mvpp2: fix mvpp2 debugfs leak 6cb54f2162 once: add DO_ONCE_SLOW() for sleepable contexts 67cb80a9d2 net/ieee802154: reject zero-sized raw_sendmsg() 6cc0e2afc6 bnx2x: fix potential memory leak in bnx2x_tpa_stop() da349221c4 net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() d9e25dc053 spi: Ensure that sg_table won't be used after being freed 96a3ddb870 tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited f65955340e sctp: handle the error returned from sctp_auth_asoc_init_active_key 2a1d036320 mISDN: fix use-after-free bugs in l1oip timer handlers b4a5905fd2 vhost/vsock: Use kvmalloc/kvfree for larger packets. d2b5dc3a53 wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM 17196f2f98 spi: s3c64xx: Fix large transfers with DMA b284e1fe15 netfilter: nft_fib: Fix for rpath check with VRF devices b384e8fb16 Bluetooth: hci_core: Fix not handling link timeouts propertly 129f01116b i2c: mlxbf: support lock mechanism 534909fe3c spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe 9da61e7b59 spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe 1ef5798638 x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype 6ed7b05a35 x86/microcode/AMD: Track patch allocation size explicitly 07299e52e5 wifi: ath11k: fix number of VHT beamformee spatial streams d7cc0d51ff Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure ed403bcd97 bpf: Ensure correct locking around vulnerable function find_vpid() 2a1c29dc9b net: fs_enet: Fix wrong check in do_pd_setup 795954d751 wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask 226e6f2412 wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration 0a60ac7a0d bpf: btf: fix truncated last_member_type_id in btf_struct_resolve 8398a45d3d spi: meson-spicc: do not rely on busy flag in pow2 clk ops 351cf55595 wifi: rtl8xxxu: Fix skb misuse in TX queue selection 1e91179057 spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() 7b83d11d48 spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() 5576008305 selftests/xsk: Avoid use-after-free on ctx c823df0679 wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() ea1b6b5409 Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend 07194ccbb1 Bluetooth: btusb: fix excessive stack usage cdadf95435 Bluetooth: btusb: Fine-tune mt7663 mechanism. 294395caac x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register 029a1de92c spi: mt7621: Fix an error message in mt7621_spi_probe() 2afb93e4e4 bpftool: Fix a wrong type cast in btf_dumper_int 61905bbb61 wifi: mac80211: allow bw change during channel switch in mesh 7565207066 leds: lm3601x: Don't use mutex after it was destroyed 08faf07717 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() e060c4b9f3 nfsd: Fix a memory leak in an error handling path 730191a098 objtool: Preserve special st_shndx indexes in elf_update_symbol 84837738d4 ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE f1d6edeaa8 ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd() da2aecef86 MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create() 0c667858c0 MIPS: SGI-IP27: Free some unused memory 3598445698 sh: machvec: Use char[] for section boundaries 6e4be747f1 userfaultfd: open userfaultfds with O_RDONLY 28d9b39733 selinux: use "grep -E" instead of "egrep" d11e09953c smb3: must initialize two ACL struct fields to zero abd13b2100 drm/i915: Fix watermark calculations for gen12+ MC CCS modifier fd37286f39 drm/i915: Fix watermark calculations for gen12+ RC CCS modifier 5d6093c49c drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() 57f1a89a8e drm/nouveau/kms/nv140-: Disable interlacing d0febad83e staging: greybus: audio_helper: remove unused and wrong debugfs usage ceeb8d4a43 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS 83fe0b009b KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" 085ca1d33b KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility bda8120e5b media: cedrus: Set the platform driver data earlier dbdd3b1448 efi: libstub: drop pointless get_memory_map() call 68158654b5 thunderbolt: Explicitly enable lane adapter hotplug events at startup fc08f84381 tracing: Disable interrupt or preemption before acquiring arch_spinlock_t 0cf6c09daf ring-buffer: Fix race between reset page and reading page 588f02f8b9 ring-buffer: Add ring_buffer_wake_waiters() 586f02c500 ring-buffer: Check pending waiters when doing wake ups as well 6617e5132c ring-buffer: Have the shortest_full queue be the shortest not longest 4a3bbd40e4 ring-buffer: Allow splice to read previous partially read pages f2ca4609d0 ftrace: Properly unset FTRACE_HASH_FL_MOD 846f041203 livepatch: fix race between fork and KLP transition 2189756eab ext4: update 'state->fc_regions_size' after successful memory allocation 2cfb769d60 ext4: fix potential memory leak in ext4_fc_record_regions() c9ce7766dc ext4: fix potential memory leak in ext4_fc_record_modified_inode() d575fb52c4 ext4: fix miss release buffer head in ext4_fc_write_inode 74d2a398d2 ext4: place buffer head allocation before handle start fbb0e601bd ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate 0e1764ad71 ext4: don't increase iversion counter for ea_inodes 483831ad04 ext4: fix check for block being out of directory size ac66db1a43 ext4: make ext4_lazyinit_thread freezable f34ab95162 ext4: fix null-ptr-deref in ext4_write_info fb98cb61ef ext4: avoid crash when inline data creation follows DIO write e65506ff18 jbd2: add miss release buffer head in fc_do_one_pass() 1d4d16daec jbd2: fix potential use-after-free in jbd2_fc_wait_bufs 7a33dde572 jbd2: fix potential buffer head reference count leak eea3e455a3 jbd2: wake up journal waiters in FIFO order, not LIFO ba52e685d2 hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero bdcb1d7cf2 hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO d621a87064 hardening: Clarify Kconfig text for auto-var-init 4a8e8bf280 f2fs: fix to do sanity check on summary info 73fb4bd2c0 f2fs: fix to do sanity check on destination blkaddr during recovery 12014eaf1b f2fs: increase the limit for reserve_root 47b5ffe863 btrfs: fix race between quota enable and quota rescan ioctl e504729496 fbdev: smscufx: Fix use-after-free in ufx_ops_open() 9931bd05bb scsi: qedf: Populate sysfs attributes for vport 102c4b6e8c powerpc/boot: Explicitly disable usage of SPE instructions 7db60fd46e powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain 9119a92ad9 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge a3c08c0217 mm/mmap: undo ->mmap() when arch_validate_flags() fails 7d551b7d61 block: fix inflight statistics of part0 0a12979089 drm/udl: Restore display mode on resume f134f261d7 drm/virtio: Check whether transferred 2D BO is shmem 303436e301 nvme-pci: set min_align_mask before calculating max_hw_sectors 6a73e6edcb UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK 1a053f597f riscv: Pass -mno-relax only on lld < 15.0.0 d15dca1d46 riscv: Make VM_WRITE imply VM_READ d8c6f9b2e1 riscv: Allow PROT_WRITE-only mmap() a6dcc6cfa2 parisc: fbdev/stifb: Align graphics memory size to 4MB 2ce9fab94b RISC-V: Make port I/O string accessors actually work ffb571e123 regulator: qcom_rpm: Fix circular deferral regression 85909424a1 hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API 8ef0e1c0ae ASoC: wcd934x: fix order of Slimbus unprepare/disable 9b2c82af65 ASoC: wcd9335: fix order of Slimbus unprepare/disable 1c20d672e3 platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure 6b7ae4a904 quota: Check next/prev free block number after reading from quota file 5b1a56beb6 HID: multitouch: Add memory barriers bfe60d7641 fs: dlm: handle -EBUSY first in lock arg validation 0b2d8e4db4 fs: dlm: fix race between test_bit() and queue_work() 057d5838c7 mmc: sdhci-sprd: Fix minimum clock limit 448fffc1ae can: kvaser_usb_leaf: Fix CAN state after restart a3776e09b3 can: kvaser_usb_leaf: Fix TX queue out of sync after restart 0f8c88978d can: kvaser_usb_leaf: Fix overread with an invalid command 5d1cb7bfad can: kvaser_usb: Fix use of uninitialized completion b239a0993a usb: add quirks for Lenovo OneLink+ Dock afbbf305db iio: pressure: dps310: Reset chip after timeout 9daadd1d10 iio: pressure: dps310: Refactor startup procedure ae49d80400 iio: adc: ad7923: fix channel readings for some variants ea4dcd3d6a iio: ltc2497: Fix reading conversion results 30e1bd0d3e iio: dac: ad5593r: Fix i2c read protocol requirements 9312e04b6c cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message 64f23e5430 cifs: destage dirty pages before re-reading them for cache=none 50d3d89537 mtd: rawnand: atmel: Unmap streaming DMA mappings e8eb44eeee ALSA: hda/realtek: Add Intel Reference SSID to support headset keys 4491fbd0a7 ALSA: hda/realtek: Add quirk for ASUS GV601R laptop 4285d06d12 ALSA: hda/realtek: Correct pin configs for ASUS G533Z 768cd2cd1a ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 3e29645fba ALSA: usb-audio: Fix NULL dererence at error path bc1d16d282 ALSA: usb-audio: Fix potential memory leaks ef1658bc48 ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() 026fcb6336 ALSA: oss: Fix potential deadlock at unregistration Also update the .xml file to handle the few ABI changes in this merge that required an update due to private pointers changing types and ABI padding structures being used to preserve the ABI: Leaf changes summary: 4 artifacts changed (1 filtered out) Changed leaf types summary: 4 (1 filtered out) leaf types changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 'struct fscrypt_info at fscrypt_private.h:195:1' changed: type size hasn't changed there are data member changes: type 'key*' of 'fscrypt_info::ci_master_key' changed: pointer type changed from: 'key*' to: 'fscrypt_master_key*' 5197 impacted interfaces 'struct sk_buff at skbuff.h:717:1' changed: type size hasn't changed there are data member changes: data member u64 android_kabi_reserved1 at offset 1472 (in bits) became anonymous data member 'union {struct {__u8 scm_io_uring; __u8 android_kabi_reserved1_padding1; __u16 android_kabi_reserved1_padding2; __u32 android_kabi_reserved1_padding3;}; struct {u64 android_kabi_reserved1;}; union {};}' 5197 impacted interfaces 'struct super_block at fs.h:1450:1' changed: type size hasn't changed there are data member changes: type 'key*' of 'super_block::s_master_keys' changed: pointer type changed from: 'key*' to: 'fscrypt_keyring*' 5197 impacted interfaces 'struct tcp_sock at tcp.h:146:1' changed: type size hasn't changed one impacted interface Change-Id: I6f2a7b91e1df96bede8aafa944a04b3e08ed33a1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-21 12:06:54 +00:00
Peter Collingbourne	b10e8ec405	BACKPORT: printk: stop including cache.h from printk.h ... An inclusion of cache.h in printk.h was added in 2014 in commit c28aa1f0a8 ("printk/cache: mark printk_once test variable __read_mostly") in order to bring in the definition of __read_mostly. The usage of __read_mostly was later removed in commit 3ec25826ae ("printk: Tie printk_once / printk_deferred_once into .data.once for reset") which made the inclusion of cache.h unnecessary, so remove it. We have a small amount of code that depended on the inclusion of cache.h from printk.h; fix that code to include the appropriate header. This fixes a circular inclusion on arm64 (linux/printk.h -> linux/cache.h -> asm/cache.h -> linux/kasan-enabled.h -> linux/static_key.h -> linux/jump_label.h -> linux/bug.h -> asm/bug.h -> linux/printk.h) that would otherwise be introduced by the next patch. Build tested using {allyesconfig,defconfig} x {arm64,x86_64}. Link: https://linux-review.googlesource.com/id/I8fd51f72c9ef1f2d6afd3b2cbc875aa4792c1fba Link: https://lkml.kernel.org/r/20220427195820.1716975-1-pcc@google.com Signed-off-by: Peter Collingbourne <pcc@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: David Rientjes <rientjes@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Kees Cook <keescook@chromium.org> Cc: Pekka Enberg <penberg@kernel.org> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 265364138 (cherry picked from commit 534aa1dc97) [Zhenhua: Resolved minor compile issue in include/linux/debug_locks.h] Change-Id: I46182e781b64561a1ebd5405628a317d4f6cb789 Signed-off-by: Jaewon Kim <jaewon31.kim@samsung.com> Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>	2023-01-20 00:46:19 +00:00
Yang Jihong	52c0622e53	tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line ... commit c1ac03af6e upstream. print_trace_line may overflow seq_file buffer. If the event is not consumed, the while loop keeps peeking this event, causing a infinite loop. Link: https://lkml.kernel.org/r/20221129113009.182425-1-yangjihong1@huawei.com Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: stable@vger.kernel.org Fixes: 088b1e427d ("ftrace: pipe fixes") Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:33 +01:00
Zheng Yejian	b838b1b9ca	tracing/hist: Fix wrong return value in parse_action_params() ... commit 2cc6a52888 upstream. When number of synth fields is more than SYNTH_FIELDS_MAX, parse_action_params() should return -EINVAL. Link: https://lore.kernel.org/linux-trace-kernel/20221207034635.2253990-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Cc: stable@vger.kernel.org Fixes: c282a386a3 ("tracing: Add 'onmatch' hist trigger action support") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:33 +01:00
Namhyung Kim	e61eacf993	perf/core: Call LSM hook after copying perf_event_attr ... commit 0a041ebca4 upstream. It passes the attr struct to the security_perf_event_open() but it's not initialized yet. Fixes: da97e18458 ("perf_event: Add support for LSM and SELinux checks") Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20221220223140.4020470-1-namhyung@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:33 +01:00
Zheng Yejian	0cb31bd883	tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' ... commit 82470f7d90 upstream. When generate a synthetic event with many params and then create a trace action for it [1], kernel panic happened [2]. It is because that in trace_action_create() 'data->n_params' is up to SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx' keeps indices into array 'hist_data->var_refs' for each synthetic event param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX (current value is 16), so out-of-bound write happened when 'data->n_params' more than 16. In this case, 'data->match_data.event' is overwritten and eventually cause the panic. To solve the issue, adjust the length of 'data->var_ref_idx' to be SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write. [1] # cd /sys/kernel/tracing/ # echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\ int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;\ int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\ int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\ int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;\ int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\ int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\ int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;\ int v63" >> synthetic_events # echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="bash"' >> \ events/sched/sched_waking/trigger # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid)" >> events/sched/sched_switch/trigger [2] BUG: unable to handle page fault for address: ffff91c900000000 PGD 61001067 P4D 61001067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 322 Comm: bash Tainted: G W 6.1.0-rc8+ #229 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0 Call Trace: <TASK> __find_event_file+0x55/0x90 action_create+0x76c/0x1060 event_hist_trigger_parse+0x146d/0x2060 ? event_trigger_write+0x31/0xd0 trigger_process_regex+0xbb/0x110 event_trigger_write+0x6b/0xd0 vfs_write+0xc8/0x3e0 ? alloc_fd+0xc0/0x160 ? preempt_count_add+0x4d/0xa0 ? preempt_count_add+0x70/0xa0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1d1d0cf077 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 RSP: 002b:00007ffcebb0e568 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000143 RCX: 00007f1d1d0cf077 RDX: 0000000000000143 RSI: 00005639265aa7e0 RDI: 0000000000000001 RBP: 00005639265aa7e0 R08: 000000000000000a R09: 0000000000000142 R10: 000056392639c017 R11: 0000000000000246 R12: 0000000000000143 R13: 00007f1d1d1ae6a0 R14: 00007f1d1d1aa4a0 R15: 00007f1d1d1a98a0 </TASK> Modules linked in: CR2: ffff91c900000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0 Link: https://lore.kernel.org/linux-trace-kernel/20221207035143.2278781-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Cc: stable@vger.kernel.org Fixes: d380dcde9a ("tracing: Fix now invalid var_ref_vals assumption in trace action") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:32 +01:00
Paul E. McKenney	7c15d7ecce	rcu: Prevent lockdep-RCU splats on lock acquisition/release ... commit 4d60b475f8 upstream. The rcu_cpu_starting() and rcu_report_dead() functions transition the current CPU between online and offline state from an RCU perspective. Unfortunately, this means that the rcu_cpu_starting() function's lock acquisition and the rcu_report_dead() function's lock releases happen while the CPU is offline from an RCU perspective, which can result in lockdep-RCU splats about using RCU from an offline CPU. And this situation can also result in too-short grace periods, especially in guest OSes that are subject to vCPU preemption. This commit therefore uses sequence-count-like synchronization to forgive use of RCU while RCU thinks a CPU is offline across the full extent of the rcu_cpu_starting() and rcu_report_dead() function's lock acquisitions and releases. One approach would have been to use the actual sequence-count primitives provided by the Linux kernel. Unfortunately, the resulting code looks completely broken and wrong, and is likely to result in patches that break RCU in an attempt to address this appearance of broken wrongness. Plus there is no net savings in lines of code, given the additional explicit memory barriers required. Therefore, this sequence count is instead implemented by a new ->ofl_seq field in the rcu_node structure. If this counter's value is an odd number, RCU forgives RCU read-side critical sections on other CPUs covered by the same rcu_node structure, even if those CPUs are offline from an RCU perspective. In addition, if a given leaf rcu_node structure's ->ofl_seq counter value is an odd number, rcu_gp_init() delays starting the grace period until that counter value changes. [ paulmck: Apply Peter Zijlstra feedback. ] Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:29 +01:00
Marco Elver	7b3631a2e1	kcsan: Instrument memcpy/memset/memmove with newer Clang ... commit 7c201739be upstream. With Clang version 16+, -fsanitize=thread will turn memcpy/memset/memmove calls in instrumented functions into __tsan_memcpy/__tsan_memset/__tsan_memmove calls respectively. Add these functions to the core KCSAN runtime, so that we (a) catch data races with mem* functions, and (b) won't run into linker errors with such newer compilers. Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Marco Elver <elver@google.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org> [ elver@google.com: adjust check_access() call for v5.15 and earlier. ] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:28 +01:00
Rickard x Andersson	f24474d12e	gcov: add support for checksum field ... commit e96b95c2b7 upstream. In GCC version 12.1 a checksum field was added. This patch fixes a kernel crash occurring during boot when using gcov-kernel with GCC version 12.2. The crash occurred on a system running on i.MX6SX. Link: https://lkml.kernel.org/r/20221220102318.3418501-1-rickaran@axis.com Fixes: 977ef30a7d ("gcov: support GCC 12.1 and newer compilers") Signed-off-by: Rickard x Andersson <rickaran@axis.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Tested-by: Peter Oberparleiter <oberpar@linux.ibm.com> Reviewed-by: Martin Liska <mliska@suse.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-14 10:16:24 +01:00
Stanislav Fomichev	329a766355	bpf: Prevent decl_tag from being referenced in func_proto arg ... [ Upstream commit f17472d459 ] Syzkaller managed to hit another decl_tag issue: btf_func_proto_check kernel/bpf/btf.c:4506 [inline] btf_check_all_types kernel/bpf/btf.c:4734 [inline] btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763 btf_parse kernel/bpf/btf.c:5042 [inline] btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709 bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342 __sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034 __do_sys_bpf kernel/bpf/syscall.c:5093 [inline] __se_sys_bpf kernel/bpf/syscall.c:5091 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 This seems similar to commit ea68376c8b ("bpf: prevent decl_tag from being referenced in func_proto") but for the argument. Reported-by: syzbot+8dd0551dda6020944c5d@syzkaller.appspotmail.com Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20221123035422.872531-2-sdf@google.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:16:18 +01:00
Zheng Yejian	6edd0cdee5	acct: fix potential integer overflow in encode_comp_t() ... [ Upstream commit c5f31c655b ] The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. Link: https://lkml.kernel.org/r/20210515140631.369106-3-zhengyejian1@huawei.com Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Cc: Hanjun Guo <guohanjun@huawei.com> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Zhang Jinhao <zhangjinhao2@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:16:14 +01:00
Zqiang	5a52380b81	rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() ... [ Upstream commit ceb1c8c9b8 ] Running rcutorture with non-zero fqs_duration module parameter in a kernel built with CONFIG_PREEMPTION=y results in the following splat: BUG: using __this_cpu_read() in preemptible [00000000] code: rcu_torture_fqs/398 caller is __this_cpu_preempt_check+0x13/0x20 CPU: 3 PID: 398 Comm: rcu_torture_fqs Not tainted 6.0.0-rc1-yoctodev-standard+ Call Trace: <TASK> dump_stack_lvl+0x5b/0x86 dump_stack+0x10/0x16 check_preemption_disabled+0xe5/0xf0 __this_cpu_preempt_check+0x13/0x20 rcu_force_quiescent_state.part.0+0x1c/0x170 rcu_force_quiescent_state+0x1e/0x30 rcu_torture_fqs+0xca/0x160 ? rcu_torture_boost+0x430/0x430 kthread+0x192/0x1d0 ? kthread_complete_and_exit+0x30/0x30 ret_from_fork+0x22/0x30 </TASK> The problem is that rcu_force_quiescent_state() uses __this_cpu_read() in preemptible code instead of the proper raw_cpu_read(). This commit therefore changes __this_cpu_read() to raw_cpu_read(). Signed-off-by: Zqiang <qiang1.zhang@intel.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:16:13 +01:00
Zheng Yejian	962f869b36	tracing/hist: Fix issue of losting command info in error_log ... [ Upstream commit 608c6ed333 ] When input some constructed invalid 'trigger' command, command info in 'error_log' are lost [1]. The root cause is that there is a path that event_hist_trigger_parse() is recursely called once and 'last_cmd' which save origin command is cleared, then later calling of hist_err() will no longer record origin command info: event_hist_trigger_parse() { last_cmd_set() // <1> 'last_cmd' save origin command here at first create_actions() { onmatch_create() { action_create() { trace_action_create() { trace_action_create_field_var() { create_field_var_hist() { event_hist_trigger_parse() { // <2> recursely called once hist_err_clear() // <3> 'last_cmd' is cleared here } hist_err() // <4> No longer find origin command!!! Since 'glob' is empty string while running into the recurse call, we can trickly check it and bypass the call of hist_err_clear() to solve it. [1] # cd /sys/kernel/tracing # echo "my_synth_event int v1; int v2; int v3;" >> synthetic_events # echo 'hist:keys=pid' >> events/sched/sched_waking/trigger # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid1)" >> events/sched/sched_switch/trigger # cat error_log [ 8.405018] hist:sched:sched_switch: error: Couldn't find synthetic event Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.816902] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.816902] hist:sched:sched_switch: error: Couldn't parse field variable Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.999880] : error: Couldn't find field Command: ^ [ 8.999880] : error: Couldn't parse field variable Command: ^ [ 8.999880] : error: Couldn't find field Command: ^ [ 8.999880] : error: Couldn't create histogram for field Command: ^ Link: https://lore.kernel.org/linux-trace-kernel/20221207135326.3483216-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Fixes: f404da6e1d ("tracing: Add 'last error' error facility for hist triggers") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:16:01 +01:00
Barry Song	50aaa6b174	genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() ... [ Upstream commit cbe16f35be ] Many drivers don't want interrupts enabled automatically via request_irq(). So they are handling this issue by either way of the below two: (1) irq_set_status_flags(irq, IRQ_NOAUTOEN); request_irq(dev, irq...); (2) request_irq(dev, irq...); disable_irq(irq); The code in the second way is silly and unsafe. In the small time gap between request_irq() and disable_irq(), interrupts can still come. The code in the first way is safe though it's subobtimal. Add a new IRQF_NO_AUTOEN flag which can be handed in by drivers to request_irq() and request_nmi(). It prevents the automatic enabling of the requested interrupt/nmi in the same safe way as #1 above. With that the various usage sites of #1 and #2 above can be simplified and corrected. Signed-off-by: Barry Song <song.bao.hua@hisilicon.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: dmitry.torokhov@gmail.com Link: https://lore.kernel.org/r/20210302224916.13980-2-song.bao.hua@hisilicon.com Stable-dep-of: 99c05e4283 ("iio: adis: add '__adis_enable_irq()' implementation") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:58 +01:00
Daniel Jordan	7ccfc2bb58	padata: Fix list iterator in padata_do_serial() ... [ Upstream commit 57ddfecc72 ] list_for_each_entry_reverse() assumes that the iterated list is nonempty and that every list_head is embedded in the same type, but its use in padata_do_serial() breaks both rules. This doesn't cause any issues now because padata_priv and padata_list happen to have their list fields at the same offset, but we really shouldn't be relying on that. Fixes: bfde23ce20 ("padata: unbind parallel jobs from specific CPUs") Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:51 +01:00
Daniel Jordan	8e0681dd4e	padata: Always leave BHs disabled when running ->parallel() ... [ Upstream commit 34c3a47d20 ] A deadlock can happen when an overloaded system runs ->parallel() in the context of the current task: padata_do_parallel ->parallel() pcrypt_aead_enc/dec padata_do_serial spin_lock(&reorder->lock) // BHs still enabled <interrupt> ... __do_softirq ... padata_do_serial spin_lock(&reorder->lock) It's a bug for BHs to be on in _do_serial as Steffen points out, so ensure they're off in the "current task" case like they are in padata_parallel_worker to avoid this situation. Reported-by: syzbot+bc05445bc14148d51915@syzkaller.appspotmail.com Fixes: 4611ce2246 ("padata: allocate work structures for parallel jobs from a pool") Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com> Acked-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:50 +01:00
Yang Jihong	782d0444ea	blktrace: Fix output non-blktrace event when blk_classic option enabled ... [ Upstream commit f596da3efa ] When the blk_classic option is enabled, non-blktrace events must be filtered out. Otherwise, events of other types are output in the blktrace classic format, which is unexpected. The problem can be triggered in the following ways: # echo 1 > /sys/kernel/debug/tracing/options/blk_classic # echo 1 > /sys/kernel/debug/tracing/events/enable # echo blk > /sys/kernel/debug/tracing/current_tracer # cat /sys/kernel/debug/tracing/trace_pipe Fixes: c71a896154 ("blktrace: add ftrace plugin") Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Link: https://lore.kernel.org/r/20221122040410.85113-1-yangjihong1@huawei.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:41 +01:00
Andrii Nakryiko	e1989d808b	bpf: propagate precision across all frames, not just the last one ... [ Upstream commit 529409ea92 ] When equivalent completed state is found and it has additional precision restrictions, BPF verifier propagates precision to currently-being-verified state chain (i.e., including parent states) so that if some of the states in the chain are not yet completed, necessary precision restrictions are enforced. Unfortunately, right now this happens only for the last frame (deepest active subprogram's frame), not all the frames. This can lead to incorrect matching of states due to missing precision marker. Currently this doesn't seem possible as BPF verifier forces everything to precise when validated BPF program has any subprograms. But with the next patch lifting this restriction, this becomes problematic. In fact, without this fix, we'll start getting failure in one of the existing test_verifier test cases: #906/p precise: cross frame pruning FAIL Unexpected success to load! verification time 48 usec stack depth 0+0 processed 26 insns (limit 1000000) max_states_per_insn 3 total_states 17 peak_states 17 mark_read 8 This patch adds precision propagation across all frames. Fixes: a3ce685dd0 ("bpf: fix precision tracking") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/r/20221104163649.121784-3-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:27 +01:00
Martin KaFai Lau	cdd73a5ed0	bpf: Check the other end of slot_type for STACK_SPILL ... [ Upstream commit 27113c59b6 ] Every 8 bytes of the stack is tracked by a bpf_stack_state. Within each bpf_stack_state, there is a 'u8 slot_type[8]' to track the type of each byte. Verifier tests slot_type[0] == STACK_SPILL to decide if the spilled reg state is saved. Verifier currently only saves the reg state if the whole 8 bytes are spilled to the stack, so checking the slot_type[7] is the same as checking slot_type[0]. The later patch will allow verifier to save the bounded scalar reg also for <8 bytes spill. There is a llvm patch [1] to ensure the <8 bytes spill will be 8-byte aligned, so checking slot_type[7] instead of slot_type[0] is required. While at it, this patch refactors the slot_type[0] == STACK_SPILL test into a new function is_spilled_reg() and change the slot_type[0] check to slot_type[7] check in there also. [1] https://reviews.llvm.org/D109073 Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210922004934.624194-1-kafai@fb.com Stable-dep-of: 529409ea92 ("bpf: propagate precision across all frames, not just the last one") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:27 +01:00
Andrii Nakryiko	42b2b7382a	bpf: propagate precision in ALU/ALU64 operations ... [ Upstream commit a3b666bfa9 ] When processing ALU/ALU64 operations (apart from BPF_MOV, which is handled correctly already; and BPF_NEG and BPF_END are special and don't have source register), if destination register is already marked precise, this causes problem with potentially missing precision tracking for the source register. E.g., when we have r1 >>= r5 and r1 is marked precise, but r5 isn't, this will lead to r5 staying as imprecise. This is due to the precision backtracking logic stopping early when it sees r1 is already marked precise. If r1 wasn't precise, we'd keep backtracking and would add r5 to the set of registers that need to be marked precise. So there is a discrepancy here which can lead to invalid and incompatible states matched due to lack of precision marking on r5. If r1 wasn't precise, precision backtracking would correctly mark both r1 and r5 as precise. This is simple to fix, though. During the forward instruction simulation pass, for arithmetic operations of `scalar <op>= scalar` form (where <op> is ALU or ALU64 operations), if destination register is already precise, mark source register as precise. This applies only when both involved registers are SCALARs. `ptr += scalar` and `scalar += ptr` cases are already handled correctly. This does have (negative) effect on some selftest programs and few Cilium programs. ~/baseline-tmp-results.csv are veristat results with this patch, while ~/baseline-results.csv is without it. See post scriptum for instructions on how to make Cilium programs testable with veristat. Correctness has a price. $ ./veristat -C -e file,prog,insns,states ~/baseline-results.csv ~/baseline-tmp-results.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) ----------------------- -------------------- --------------- --------------- ------------------ ---------------- ---------------- ------------------- bpf_cubic.bpf.linked1.o bpf_cubic_cong_avoid 997 1700 +703 (+70.51%) 62 90 +28 (+45.16%) test_l4lb.bpf.linked1.o balancer_ingress 4559 5469 +910 (+19.96%) 118 126 +8 (+6.78%) ----------------------- -------------------- --------------- --------------- ------------------ ---------------- ---------------- ------------------- $ ./veristat -C -e file,prog,verdict,insns,states ~/baseline-results-cilium.csv ~/baseline-tmp-results-cilium.csv | grep -v '+0' File Program Total insns (A) Total insns (B) Total insns (DIFF) Total states (A) Total states (B) Total states (DIFF) ------------- ------------------------------ --------------- --------------- ------------------ ---------------- ---------------- ------------------- bpf_host.o tail_nodeport_nat_ingress_ipv6 4448 5261 +813 (+18.28%) 234 247 +13 (+5.56%) bpf_host.o tail_nodeport_nat_ipv6_egress 3396 3446 +50 (+1.47%) 201 203 +2 (+1.00%) bpf_lxc.o tail_nodeport_nat_ingress_ipv6 4448 5261 +813 (+18.28%) 234 247 +13 (+5.56%) bpf_overlay.o tail_nodeport_nat_ingress_ipv6 4448 5261 +813 (+18.28%) 234 247 +13 (+5.56%) bpf_xdp.o tail_lb_ipv4 71736 73442 +1706 (+2.38%) 4295 4370 +75 (+1.75%) ------------- ------------------------------ --------------- --------------- ------------------ ---------------- ---------------- ------------------- P.S. To make Cilium ([0]) programs libbpf-compatible and thus veristat-loadable, apply changes from topmost commit in [1], which does minimal changes to Cilium source code, mostly around SEC() annotations and BPF map definitions. [0] https://github.com/cilium/cilium/ [1] https://github.com/anakryiko/cilium/commits/libbpf-friendliness Fixes: b5dc0163d8 ("bpf: precise scalar_value tracking") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/r/20221104163649.121784-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:27 +01:00
Kumar Kartikeya Dwivedi	72e8d9c731	bpf: Fix slot type check in check_stack_write_var_off ... [ Upstream commit f5e477a861 ] For the case where allow_ptr_leaks is false, code is checking whether slot type is STACK_INVALID and STACK_SPILL and rejecting other cases. This is a consequence of incorrectly checking for register type instead of the slot type (NOT_INIT and SCALAR_VALUE respectively). Fix the check. Fixes: 01f810ace9 ("bpf: Allow variable-offset stack access") Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20221103191013.1236066-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:27 +01:00
Gavrilov Ilia	93cdd12636	relay: fix type mismatch when allocating memory in relay_create_buf() ... [ Upstream commit 4d8586e046 ] The 'padding' field of the 'rchan_buf' structure is an array of 'size_t' elements, but the memory is allocated for an array of 'size_t *' elements. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@infotecs.ru Fixes: b86ff981a8 ("[PATCH] relay: migrate from relayfs to a generic relay API") Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: wuchi <wuchi.zero@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:22 +01:00
Phil Auld	270700e7df	cpu/hotplug: Make target_store() a nop when target == state ... [ Upstream commit 64ea6e44f8 ] Writing the current state back in hotplug/target calls cpu_down() which will set cpu dying even when it isn't and then nothing will ever clear it. A stress test that reads values and writes them back for all cpu device files in sysfs will trigger the BUG() in select_fallback_rq once all cpus are marked as dying. kernel/cpu.c::target_store() ... if (st->state < target) ret = cpu_up(dev->id, target); else ret = cpu_down(dev->id, target); cpu_down() -> cpu_set_state() bool bringup = st->state < target; ... if (cpu_dying(cpu) != !bringup) set_cpu_dying(cpu, !bringup); Fix this by letting state==target fall through in the target_store() conditional. Also make sure st->target == target in that case. Fixes: 757c989b99 ("cpu/hotplug: Make target state writeable") Signed-off-by: Phil Auld <pauld@redhat.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Valentin Schneider <vschneid@redhat.com> Link: https://lore.kernel.org/r/20221117162329.3164999-2-pauld@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:20 +01:00
Alexey Izbyshev	fc89b8853a	futex: Resend potentially swallowed owner death notification ... [ Upstream commit 90d7588967 ] Commit ca16d5bee5 ("futex: Prevent robust futex exit race") addressed two cases when tasks waiting on a robust non-PI futex remained blocked despite the futex not being owned anymore: * if the owner died after writing zero to the futex word, but before waking up a waiter * if a task waiting on the futex was woken up, but died before updating the futex word (effectively swallowing the notification without acting on it) In the second case, the task could be woken up either by the previous owner (after the futex word was reset to zero) or by the kernel (after the OWNER_DIED bit was set and the TID part of the futex word was reset to zero) if the previous owner died without the resetting the futex. Because the referenced commit wakes up a potential waiter only if the whole futex word is zero, the latter subcase remains unaddressed. Fix this by looking only at the TID part of the futex when deciding whether a wake up is needed. Fixes: ca16d5bee5 ("futex: Prevent robust futex exit race") Signed-off-by: Alexey Izbyshev <izbyshev@ispras.ru> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/20221111215439.248185-1-izbyshev@ispras.ru Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:20 +01:00
Peter Zijlstra	4750cac4df	futex: Move to kernel/futex/ ... [ Upstream commit 77e52ae354 ] In preparation for splitup.. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Suggested-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: André Almeida <andrealmeid@collabora.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@collabora.com> Link: https://lore.kernel.org/r/20210923171111.300673-2-andrealmeid@collabora.com Stable-dep-of: 90d7588967 ("futex: Resend potentially swallowed owner death notification") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:20 +01:00
Yang Yingliang	9346517ed2	genirq/irqdesc: Don't try to remove non-existing sysfs files ... [ Upstream commit 9049e1ca41 ] Fault injection tests trigger warnings like this: kernfs: can not remove 'chip_name', no directory WARNING: CPU: 0 PID: 253 at fs/kernfs/dir.c:1616 kernfs_remove_by_name_ns+0xce/0xe0 RIP: 0010:kernfs_remove_by_name_ns+0xce/0xe0 Call Trace: <TASK> remove_files.isra.1+0x3f/0xb0 sysfs_remove_group+0x68/0xe0 sysfs_remove_groups+0x41/0x70 __kobject_del+0x45/0xc0 kobject_del+0x29/0x40 free_desc+0x42/0x70 irq_free_descs+0x5e/0x90 The reason is that the interrupt descriptor sysfs handling does not roll back on a failing kobject_add() during allocation. If the descriptor is freed later on, kobject_del() is invoked with a not added kobject resulting in the above warnings. A proper rollback in case of a kobject_add() failure would be the straight forward solution. But this is not possible due to the way how interrupt descriptor sysfs handling works. Interrupt descriptors are allocated before sysfs becomes available. So the sysfs files for the early allocated descriptors are added later in the boot process. At this point there can be nothing useful done about a failing kobject_add(). For consistency the interrupt descriptor allocation always treats kobject_add() failures as non-critical and just emits a warning. To solve this problem, keep track in the interrupt descriptor whether kobject_add() was successful or not and make the invocation of kobject_del() conditional on that. [ tglx: Massage changelog, comments and use a state bit. ] Fixes: ecb3f394c5 ("genirq: Expose interrupt information through sysfs") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20221128151612.1786122-1-yangyingliang@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:18 +01:00
Chen Zhongjin	60a7a0aa9d	perf: Fix possible memleak in pmu_dev_alloc() ... [ Upstream commit e8d7a90c08 ] In pmu_dev_alloc(), when dev_set_name() failed, it will goto free_dev and call put_device(pmu->dev) to release it. However pmu->dev->release is assigned after this, which makes warning and memleak. Call dev_set_name() after pmu->dev->release = pmu_dev_release to fix it. Device '(null)' does not have a release() function... WARNING: CPU: 2 PID: 441 at drivers/base/core.c:2332 device_release+0x1b9/0x240 ... Call Trace: <TASK> kobject_put+0x17f/0x460 put_device+0x20/0x30 pmu_dev_alloc+0x152/0x400 perf_pmu_register+0x96b/0xee0 ... kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) unreferenced object 0xffff888014759000 (size 2048): comm "modprobe", pid 441, jiffies 4294931444 (age 38.332s) backtrace: [<0000000005aed3b4>] kmalloc_trace+0x27/0x110 [<000000006b38f9b8>] pmu_dev_alloc+0x50/0x400 [<00000000735f17be>] perf_pmu_register+0x96b/0xee0 [<00000000e38477f1>] 0xffffffffc0ad8603 [<000000004e162216>] do_one_initcall+0xd0/0x4e0 ... Fixes: abe4340057 ("perf: Sysfs enumeration") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20221111103653.91058-1-chenzhongjin@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:16 +01:00
xiongxin	9e760e0cf2	PM: hibernate: Fix mistake in kerneldoc comment ... [ Upstream commit 6e5d7300cb ] The actual maximum image size formula in hibernate_preallocate_memory() is as follows: max_size = (count - (size + PAGES_FOR_IO)) / 2 - 2 * DIV_ROUND_UP(reserved_size, PAGE_SIZE); but the one in the kerneldoc comment of the function is different and incorrect. Fixes: ddeb648708 ("PM / Hibernate: Add sysfs knob to control size of memory for drivers") Signed-off-by: xiongxin <xiongxin@kylinos.cn> [ rjw: Subject and changelog rewrite ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:15 +01:00
Qais Yousef	2ff4014417	sched/uclamp: Fix relationship between uclamp and migration margin ... [ Upstream commit 48d5e9daa8 ] fits_capacity() verifies that a util is within 20% margin of the capacity of a CPU, which is an attempt to speed up upmigration. But when uclamp is used, this 20% margin is problematic because for example if a task is boosted to 1024, then it will not fit on any CPU according to fits_capacity() logic. Or if a task is boosted to capacity_orig_of(medium_cpu). The task will end up on big instead on the desired medium CPU. Similar corner cases exist for uclamp and usage of capacity_of(). Slightest irq pressure on biggest CPU for example will make a 1024 boosted task look like it can't fit. What we really want is for uclamp comparisons to ignore the migration margin and capacity pressure, yet retain them for when checking the _actual_ util signal. For example, task p: p->util_avg = 300 p->uclamp[UCLAMP_MIN] = 1024 Will fit a big CPU. But p->util_avg = 900 p->uclamp[UCLAMP_MIN] = 1024 will not, this should trigger overutilized state because the big CPU is now *actually* being saturated. Similar reasoning applies to capping tasks with UCLAMP_MAX. For example: p->util_avg = 1024 p->uclamp[UCLAMP_MAX] = capacity_orig_of(medium_cpu) Should fit the task on medium cpus without triggering overutilized state. Inlined comments expand more on desired behavior in more scenarios. Introduce new util_fits_cpu() function which encapsulates the new logic. The new function is not used anywhere yet, but will be used to update various users of fits_capacity() in later patches. Fixes: af24bde8df ("sched/uclamp: Add uclamp support to energy_compute()") Signed-off-by: Qais Yousef <qais.yousef@arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/20220804143609.515789-2-qais.yousef@arm.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:15 +01:00
Vincent Donnefort	ca9ef12bf7	sched/fair: Cleanup task_util and capacity type ... [ Upstream commit ef8df9798d ] task_util and capacity are comparable unsigned long values. There is no need for an intermidiate implicit signed cast. Signed-off-by: Vincent Donnefort <vincent.donnefort@arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20211207095755.859972-1-vincent.donnefort@arm.com Stable-dep-of: 48d5e9daa8 ("sched/uclamp: Fix relationship between uclamp and migration margin") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-14 10:15:15 +01:00
Jens Axboe	6ef2b4728a	task_work: unconditionally run task_work from get_signal() ... [ Upstream commit 35d0b389f3 ] Song reported a boot regression in a kvm image with 5.11-rc, and bisected it down to the below patch. Debugging this issue, turns out that the boot stalled when a task is waiting on a pipe being released. As we no longer run task_work from get_signal() unless it's queued with TWA_SIGNAL, the task goes idle without running the task_work. This prevents ->release() from being called on the pipe, which another boot task is waiting on. For now, re-instate the unconditional task_work run from get_signal(). For 5.12, we'll collapse TWA_RESUME and TWA_SIGNAL, as it no longer makes sense to have a distinction between the two. This will turn task_work notification into a simple boolean, whether to notify or not. Fixes: 98b89b649f ("signal: kill JOBCTL_TASK_WORK") Reported-by: Song Liu <songliubraving@fb.com> Tested-by: John Stultz <john.stultz@linaro.org> Tested-by: Douglas Anderson <dianders@chromium.org> Tested-by: Sedat Dilek <sedat.dilek@gmail.com> # LLVM/Clang version 11.0.1 Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:23 +01:00
Jens Axboe	c91ab04781	signal: kill JOBCTL_TASK_WORK ... [ Upstream commit 98b89b649f ] It's no longer used, get rid of it. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:23 +01:00
Jens Axboe	788d082426	io_uring: import 5.15-stable io_uring ... No upstream commit exists. This imports the io_uring codebase from 5.15.85, wholesale. Changes from that code base: - Drop IOCB_ALLOC_CACHE, we don't have that in 5.10. - Drop MKDIRAT/SYMLINKAT/LINKAT. Would require further VFS backports, and we don't support these in 5.10 to begin with. - sock_from_file() old style calling convention. - Use compat_get_bitmap() only for CONFIG_COMPAT=y Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:23 +01:00
Jens Axboe	ed30050329	task_work: add helper for more targeted task_work canceling ... [ Upstream commit c7aab1a7c5 ] The only exported helper we have right now is task_work_cancel(), which cancels any task_work from a given task where func matches the queued work item. This is a bit too coarse for some use cases. Add a task_work_cancel_match() that allows to more specifically target individual work items outside of purely the callback function used. task_work_cancel() can be trivially implemented on top of that, hence do so. Reviewed-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:23 +01:00
Jens Axboe	831cb78a2a	kernel: don't call do_exit() for PF_IO_WORKER threads ... [ Upstream commit 10442994ba ] Right now we're never calling get_signal() from PF_IO_WORKER threads, but in preparation for doing so, don't handle a fatal signal for them. The workers have state they need to cleanup when exiting, so just return instead of calling do_exit() on their behalf. The threads themselves will detect a fatal signal and do proper shutdown. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:23 +01:00
Jens Axboe	9ded44b69c	kernel: stop masking signals in create_io_thread() ... [ Upstream commit b16b3855d8 ] This is racy - move the blocking into when the task is created and we're marking it as PF_IO_WORKER anyway. The IO threads are now prepared to handle signals like SIGSTOP as well, so clear that from the mask to allow proper stopping of IO threads. Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Reported-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:23 +01:00
Seth Forshee	000de389ad	entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set ... [ Upstream commit 3e684903a8 ] A livepatch transition may stall indefinitely when a kvm vCPU is heavily loaded. To the host, the vCPU task is a user thread which is spending a very long time in the ioctl(KVM_RUN) syscall. During livepatch transition, set_notify_signal() will be called on such tasks to interrupt the syscall so that the task can be transitioned. This interrupts guest execution, but when xfer_to_guest_mode_work() sees that TIF_NOTIFY_SIGNAL is set but not TIF_SIGPENDING it concludes that an exit to user mode is unnecessary, and guest execution is resumed without transitioning the task for the livepatch. This handling of TIF_NOTIFY_SIGNAL is incorrect, as set_notify_signal() is expected to break tasks out of interruptible kernel loops and cause them to return to userspace. Change xfer_to_guest_mode_work() to handle TIF_NOTIFY_SIGNAL the same as TIF_SIGPENDING, signaling to the vCPU run loop that an exit to userpsace is needed. Any pending task_work will be run when get_signal() is called from exit_to_user_mode_loop(), so there is no longer any need to run task work from xfer_to_guest_mode_work(). Suggested-by: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Petr Mladek <pmladek@suse.com> Signed-off-by: Seth Forshee <sforshee@digitalocean.com> Message-Id: <20220504180840.2907296-1-sforshee@digitalocean.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:22 +01:00
Jens Axboe	0f735cf52b	kernel: allow fork with TIF_NOTIFY_SIGNAL pending ... [ Upstream commit 66ae0d1e2d ] fork() fails if signal_pending() is true, but there are two conditions that can lead to that: 1) An actual signal is pending. We want fork to fail for that one, like we always have. 2) TIF_NOTIFY_SIGNAL is pending, because the task has pending task_work. We don't need to make it fail for that case. Allow fork() to proceed if just task_work is pending, by changing the signal_pending() check to task_sigpending(). Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:22 +01:00
Jens Axboe	90a2c3821b	kernel: remove checking for TIF_NOTIFY_SIGNAL ... [ Upstream commit e296dc4996 ] It's available everywhere now, no need to check or add dummy defines. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:22 +01:00
Jens Axboe	61bdeb142e	task_work: remove legacy TWA_SIGNAL path ... [ Upstream commit 03941ccfda ] All archs now support TIF_NOTIFY_SIGNAL. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:22 +01:00
Jens Axboe	eb42e7b304	task_work: Use TIF_NOTIFY_SIGNAL if available ... [ Upstream commit 114518eb64 ] If the arch supports TIF_NOTIFY_SIGNAL, then use that for TWA_SIGNAL as it's more efficient than using the signal delivery method. This is especially true on threaded applications, where ->sighand is shared across threads, but it's also lighter weight on non-shared cases. io_uring is a heavy consumer of TWA_SIGNAL based task_work. A test with threads shows a nice improvement running an io_uring based echo server. stock kernel: 0.01% <= 0.1 milliseconds 95.86% <= 0.2 milliseconds 98.27% <= 0.3 milliseconds 99.71% <= 0.4 milliseconds 100.00% <= 0.5 milliseconds 100.00% <= 0.6 milliseconds 100.00% <= 0.7 milliseconds 100.00% <= 0.8 milliseconds 100.00% <= 0.9 milliseconds 100.00% <= 1.0 milliseconds 100.00% <= 1.1 milliseconds 100.00% <= 2 milliseconds 100.00% <= 3 milliseconds 100.00% <= 3 milliseconds 1378930.00 requests per second ~1600% CPU 1.38M requests/second, and all 16 CPUs are maxed out. patched kernel: 0.01% <= 0.1 milliseconds 98.24% <= 0.2 milliseconds 99.47% <= 0.3 milliseconds 99.99% <= 0.4 milliseconds 100.00% <= 0.5 milliseconds 100.00% <= 0.6 milliseconds 100.00% <= 0.7 milliseconds 100.00% <= 0.8 milliseconds 100.00% <= 0.9 milliseconds 100.00% <= 1.2 milliseconds 1666111.38 requests per second ~1450% CPU 1.67M requests/second, and we're no longer just hammering on the sighand lock. The original reporter states: "For 5.7.15 my benchmark achieves 1.6M qps and system cpu is at ~80%. for 5.7.16 or later it achieves only 1M qps and the system cpu is is at ~100%" with the only difference there being that TWA_SIGNAL is used unconditionally in 5.7.16, since it's required to be able to handle the inability to run task_work if the application is waiting in the kernel already on an event that needs task_work run to be satisfied. Also see commit 0ba9c9edcd. Reported-by: Roman Gershman <romger@amazon.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Link: https://lore.kernel.org/r/20201026203230.386348-5-axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:18 +01:00
Jens Axboe	3c295bd2dd	entry: Add support for TIF_NOTIFY_SIGNAL ... [ Upstream commit 12db8b6900 ] Add TIF_NOTIFY_SIGNAL handling in the generic entry code, which if set, will return true if signal_pending() is used in a wait loop. That causes an exit of the loop so that notify_signal tracehooks can be run. If the wait loop is currently inside a system call, the system call is restarted once task_work has been processed. In preparation for only having arch_do_signal() handle syscall restarts if _TIF_SIGPENDING isn't set, rename it to arch_do_signal_or_restart(). Pass in a boolean that tells the architecture specific signal handler if it should attempt to get a signal, or just process a potential syscall restart. For !CONFIG_GENERIC_ENTRY archs, add the TIF_NOTIFY_SIGNAL handling to get_signal(). This is done to minimize the needed architecture changes to support this feature. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Link: https://lore.kernel.org/r/20201026203230.386348-3-axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:18 +01:00
Jens Axboe	52cfde6bbf	signal: Add task_sigpending() helper ... [ Upstream commit 5c251e9dc0 ] This is in preparation for maintaining signal_pending() as the decider of whether or not a schedule() loop should be broken, or continue sleeping. This is different than the core signal use cases, which really need to know whether an actual signal is pending or not. task_sigpending() returns non-zero if TIF_SIGPENDING is set. Only core kernel use cases should care about the distinction between the two, make sure those use the task_sigpending() helper. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Link: https://lore.kernel.org/r/20201026203230.386348-2-axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:17 +01:00
Jens Axboe	1500fed008	kernel: provide create_io_thread() helper ... [ Upstream commit cc440e8738 ] Provide a generic helper for setting up an io_uring worker. Returns a task_struct so that the caller can do whatever setup is needed, then call wake_up_new_task() to kick it into gear. Add a kernel_clone_args member, io_thread, which tells copy_process() to mark the task with PF_IO_WORKER. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:16 +01:00
Suren Baghdasaryan	f677efbea1	Revert "Revert "ANDROID: vendor_hooks:vendor hook for mmput"" ... This reverts commit 501063ce66. Reason for revert: The vendor hook is actually needed by a partner Bug: 238821038 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I1c19add348792967975369a10ec9cb41fa268236	2022-12-24 12:34:20 -08:00
Greg Kroah-Hartman	01ef2d0b53	This is the 5.10.159 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOZpiwACgkQONu9yGCS aT6whRAArWRCd5yEvuYtdCIPQh70Yz3vhHKkeqKU3AzAOYxYB+UbmRf8i6Cgv5S7 b0Mmla4vV1w+tRZcwdPHXoNrwxQ+r6b89mywResfp+FLAti/Ak1wMNR1l0FGQTeM z2dIeuhNtVIatvpBw7E1KKGXpSRYfJuzbkT3npKRmWqv1hmcwcqkQ9uZSkFCf3dO YETpGjOk6Z8/Ml4z6gEWy54+W3nLf3X8G0i1CfDwxkxcCf4fqIgNCaGaT26Q+Yv1 GDKtAzmF/FfxwwIdwxx+Y/Iq3+ccEf2WTRQEDWb8K62TBbNjR+q1+Y3IJCfrBj+H 6sVfnyQm9fTQd7gKLy3gipJxphS4sAZ+OcwY+gMfRQBBHSmccHOC9MhQFgd+wN39 vBnCG0g6x+9J/DESPOXwrTDnWuGW1Grv7avYlJo2L4WTUFsAuDrtGdCRJ+Bwd9PH VVD6eSmXQdrFe9ttf8CQUERlWmNkAmFvT135Hf+qclNsvp7PbtCX2rjgo27NxVbo mdOkLLNXBwMNcHjhWhN7MDzoEw7gUqvWWC6vdRgQicrLJphrcV82+C0QIW3A/Uft tp/HEsHhGCX6mTXN0x9faz9WMXrfI+j6rUs0UoSVBfP+rwtCqweX5qgz5eUj2jjJ v+edcnh/2t4dVwK2dbsniw8y19tI/VHfyfMJiGSY18LsLlMrHiw= =QY26 -----END PGP SIGNATURE----- Merge 5.10.159 into android12-5.10-lts Changes in 5.10.159 arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series arm: dts: rockchip: fix node name for hym8563 rtc ARM: dts: rockchip: fix ir-receiver node names arm64: dts: rockchip: fix ir-receiver node names ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 9p/fd: Use P9_HDRSZ for header size regulator: slg51000: Wait after asserting CS pin ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event btrfs: send: avoid unaligned encoded writes when attempting to clone range ASoC: soc-pcm: Add NULL check in BE reparenting regulator: twl6030: fix get status of twl6032 regulators fbcon: Use kzalloc() in fbcon_prepare_logo() usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer 9p/xen: check logical size for buffer size net: usb: qmi_wwan: add u-blox 0x1342 composition mm/khugepaged: take the right locks for page table retraction mm/khugepaged: fix GUP-fast interaction by sending IPI mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths rtc: mc146818: Prevent reading garbage rtc: mc146818: Detect and handle broken RTCs rtc: mc146818: Dont test for bit 0-5 in Register D rtc: cmos: remove stale REVISIT comments rtc: mc146818-lib: change return values of mc146818_get_time() rtc: Check return value from mc146818_get_time() rtc: mc146818-lib: fix RTC presence check rtc: mc146818-lib: extract mc146818_avoid_UIP rtc: cmos: avoid UIP when writing alarm time rtc: cmos: avoid UIP when reading alarm time rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ rtc: mc146818: Reduce spinlock section in mc146818_set_time() xen/netback: Ensure protocol headers don't fall in the non-linear area xen/netback: do some code cleanup xen/netback: don't call kfree_skb() with interrupts disabled media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() Revert "ARM: dts: imx7: Fix NAND controller size-cells" media: v4l2-dv-timings.c: fix too strict blanking sanity checks memcg: fix possible use-after-free in memcg_write_event_control() mm/gup: fix gup_pud_range() for dax Bluetooth: btusb: Add debug message for CSR controllers Bluetooth: Fix crash when replugging CSR fake controllers KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field drm/vmwgfx: Don't use screen objects when SEV is active drm/shmem-helper: Remove errant put in error path drm/shmem-helper: Avoid vm_open error paths HID: usbhid: Add ALWAYS_POLL quirk for some mice HID: hid-lg4ff: Add check for empty lbuf HID: core: fix shift-out-of-bounds in hid_report_raw_event can: af_can: fix NULL pointer dereference in can_rcv_filter mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page rtc: cmos: Disable irq around direct invocation of cmos_interrupt() rtc: mc146818-lib: fix locking in mc146818_set_time rtc: mc146818-lib: fix signedness bug in mc146818_get_time() netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one ieee802154: cc2520: Fix error return code in cc2520_hw_init() ca8210: Fix crash by zero initializing data netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark drm/bridge: ti-sn65dsi86: Fix output polarity setting bug gpio: amd8111: Fix PCI device reference count leak e1000e: Fix TX dispatch condition igb: Allocate MSI-X vector when testing drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 af_unix: Get user_ns from in_skb in unix_diag_get_exact(). vmxnet3: correctly report encapsulated LRO packet Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() Bluetooth: Fix not cleanup led when bt_init fails net: dsa: ksz: Check return value selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() net: encx24j600: Add parentheses to fix precedence net: encx24j600: Fix invalid logic in reading of MISTAT register xen-netfront: Fix NULL sring after live migration net: mvneta: Prevent out of bounds read in mvneta_config_rss() i40e: Fix not setting default xps_cpus after reset i40e: Fix for VF MAC address 0 i40e: Disallow ip4 and ip6 l4_4_bytes NFC: nci: Bounds check struct nfc_target arrays nvme initialize core quirks before calling nvme_init_subsystem net: stmmac: fix "snps,axi-config" node property parsing ip_gre: do not report erspan version on GRE interface net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq net: hisilicon: Fix potential use-after-free in hisi_femac_rx() net: hisilicon: Fix potential use-after-free in hix5hd2_rx() tipc: Fix potential OOB in tipc_link_proto_rcv() ipv4: Fix incorrect route flushing when source address is deleted ipv4: Fix incorrect route flushing when table ID 0 is used net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() tipc: call tipc_lxc_xmit without holding node_read_lock ethernet: aeroflex: fix potential skb leak in greth_init_rings() xen/netback: fix build warning net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() ipv6: avoid use-after-free in ip6_fragment() net: mvneta: Fix an out of bounds check macsec: add missing attribute validation for offload can: esd_usb: Allow REC and TEC to return to zero Linux 5.10.159 Change-Id: I3ec26473c358ffda0ea8a8dd91ee265f58739029 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-12-14 13:11:31 +01:00
Tejun Heo	f1f7f36cf6	memcg: fix possible use-after-free in memcg_write_event_control() ... commit 4a7ba45b1a upstream. memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type. Link: https://lkml.kernel.org/r/Y5FRm/cfcKPGzWwl@slm.duckdns.org Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft") Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Jann Horn <jannh@google.com> Acked-by: Roman Gushchin <roman.gushchin@linux.dev> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Shakeel Butt <shakeelb@google.com> Cc: <stable@vger.kernel.org> [3.14+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-14 11:31:57 +01:00
Greg Kroah-Hartman	5ab4c6b843	This is the 5.10.158 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmORvAIACgkQONu9yGCS aT6OMhAAkxn/BD0mYER+XMJK+z5KIgusOh2TbHJGIkHUmj1u6Fse8VfR1xAjTk5q y3J0uX5Bung1FIsA8iVF7no1D4ungqsyXUt6cclO8X3dVQAV8ikNDRTu2FFLiywY 4QxJ/h1Nhl+6lb1lqHT+iSEuMAjlUr6DtAq4hb9Xxgbn9hOghTMzg4dZYjXI3cr4 Bxk/tunrp8Rc5ad/I9Gwba0ar23cFDLYNxT6VKn+FBJ2jcj/74ULjwPvT3SyAm2U hONKAQQZNtGPmGsUXkjdjhz7VaceNlLp0bA92AqCvNEmbnJzjb21qAklfdNAvEGH yP4GOdxDvmwzPxkxpZfa0I3OYpfxAwT2bG6mVSl7+Ok8LNIiKvvD+TlL0p+nqoe1 LogxV309xqpN+D3EgUnX03lLkJDfWfrZyhEIPgEuRdW7OjixqYOs0hWLmkF0QCi6 vLYRSPnsoxragShq8HrdC/QlLmLCckMy8i7bcCiwpSwcsL/1vVUnb05O6iaFoIc4 56nTifRT5p3nJlnjQhCyPVbxmF8CRlhsRwbOsA+0pklkTQx5qHaYMFLuXsd7nSFG +le0Kuc+xTMdP/ABgs2s3UdZFh3Zevovt4gaOnYjC6EDbmoeG6DNTTzIbNEwa1vw D6+Zrw3HePytwJcUNRHthXuTUN2V68YvsXu7zVhKU8mlyj+UXpE= =Zr7b -----END PGP SIGNATURE----- Merge 5.10.158 into android12-5.10-lts Changes in 5.10.158 btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino btrfs: free btrfs_path before copying inodes to userspace spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code drm/amdgpu: update drm_display_info correctly when the edid is read drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() iio: health: afe4403: Fix oob read in afe4403_read_raw iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw iio: light: rpr0521: add missing Kconfig dependencies bpf, perf: Use subprog name when reporting subprog ksymbol scripts/faddr2line: Fix regression in name resolution on ppc64le ARM: at91: rm9200: fix usb device clock id libbpf: Handle size overflow for ringbuf mmap hwmon: (ltc2947) fix temperature scaling hwmon: (ina3221) Fix shunt sum critical calculation hwmon: (i5500_temp) fix missing pci_disable_device() hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails bpf: Do not copy spin lock field from user in bpf_selem_alloc of: property: decrement node refcount in of_fwnode_get_reference_args() ixgbevf: Fix resource leak in ixgbevf_init_module() i40e: Fix error handling in i40e_init_module() fm10k: Fix error handling in fm10k_init_module() iavf: remove redundant ret variable iavf: Fix error handling in iavf_init_module() e100: switch from 'pci_' to 'dma_' API e100: Fix possible use after free in e100_xmit_prepare net/mlx5: Fix uninitialized variable bug in outlen_write() net/mlx5e: Fix use-after-free when reverting termination table can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() can: cc770: cc770_isa_probe(): add missing free_cc770dev() qlcnic: fix sleep-in-atomic-context bugs caused by msleep aquantia: Do not purge addresses when setting the number of rings wifi: cfg80211: fix buffer overflow in elem comparison wifi: cfg80211: don't allow multi-BSSID in S1G wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration net: phy: fix null-ptr-deref while probe() failed net: net_netdev: Fix error handling in ntb_netdev_init_module() net/9p: Fix a potential socket leak in p9_socket_open net: ethernet: nixge: fix NULL dereference dsa: lan9303: Correct stat name tipc: re-fetch skb cb after tipc_msg_validate net: hsr: Fix potential use-after-free afs: Fix fileserver probe RTT handling net: tun: Fix use-after-free in tun_detach() packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE sctp: fix memory leak in sctp_stream_outq_migrate() net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed hwmon: (coretemp) Check for null before removing sysfs attrs hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() net/mlx5: DR, Fix uninitialized var warning riscv: vdso: fix section overlapping under some conditions error-injection: Add prompt for function error injection tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 pinctrl: intel: Save and restore pins in "direct IRQ" mode net: stmmac: Set MAC's flow control register to reflect current settings mmc: mmc_test: Fix removal of debugfs file mmc: core: Fix ambiguous TRIM and DISCARD arg mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check mmc: sdhci-sprd: Fix no reset data and command after voltage switch mmc: sdhci: Fix voltage switch delay drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame drm/i915: Never return 0 if not all requests retired tracing: Free buffers when a used dynamic event is removed io_uring: don't hold uring_lock when calling io_run_task_work* ASoC: ops: Fix bounds check for _sx controls pinctrl: single: Fix potential division by zero iommu/vt-d: Fix PCI device refcount leak in has_external_pci() iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() parisc: Increase size of gcc stack frame check xtensa: increase size of gcc stack frame check parisc: Increase FRAME_WARN to 2048 bytes on parisc Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled selftests: net: add delete nexthop route warning test selftests: net: fix nexthop warning cleanup double ip typo ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference ipv4: Fix route deletion when nexthop info is not specified Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" x86/tsx: Add a feature bit for TSX control MSR support x86/pm: Add enumeration check before spec MSRs save/restore setup i2c: npcm7xx: Fix error handling in npcm_i2c_init() i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set ACPI: HMAT: remove unnecessary variable initialization ACPI: HMAT: Fix initiator registration for single-initiator systems Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" char: tpm: Protect tpm_pm_suspend with locks Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() block: unhash blkdev part inode when the part is deleted proc: avoid integer type confusion in get_proc_long proc: proc_skip_spaces() shouldn't think it is working on C strings v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails ipc/sem: Fix dangling sem_array access in semtimedop race Linux 5.10.158 Change-Id: I8db196fa535e260ed31965b52ed53ef0b6bd526b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-12-08 16:39:44 +00:00