A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity
978,481 commits 10 branches 0 tags 2.1 GiB
Commit graph

978,481 commits

This branch
This branch
All branches
Author SHA1 Message Date
Lokesh Gidra
56ccf7d575 Revert "BACKPORT: FROMGIT: userfaultfd/selftests: reinitialize test context in each test" 
This reverts commit 2ed6377e515707a52d123b735d861a7b8305eceb
as an updated version of the patch-set will be merged later.

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 187930641
Change-Id: I239e3f80e27d7e86dc9911cc3dd5640fc2d9bf94
 2025-05-18 08:08:42 +00:00
Lokesh Gidra
542ffaa634 Revert "BACKPORT: FROMGIT: userfaultfd/selftests: exercise minor fault handling shmem support" 
This reverts commit 44f2dcd54e168d03c32ef4730596783bff3180f7.
as an updated version of the patch-set will be merged later.

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug 187930641
Change-Id: Iec5f001d559609b4b3a2239a2b92cd46778437ca
 2025-05-18 08:08:42 +00:00
Lokesh Gidra
41c5a99009 Revert "FROMLIST: userfaultfd/shmem: fix minor fault page leak" 
This reverts commit 33a50fd21ddb04629ba4a262f3cdcdc2f43ee578
as an updated version of the patch-set will be merged later.

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 187930641
Change-Id: Ie6fe2a611d4cbb3bd103c62a90b84e6ba4e89af1
 2025-05-18 08:08:42 +00:00
Shaohua Li
d28487ec26 BACKPORT: userfaultfd: wp: add helper for writeprotect check 
Patch series "userfaultfd: write protection support", v6.

Overview
========

The uffd-wp work was initialized by Shaohua Li [1], and later continued by
Andrea [2].  This series is based upon Andrea's latest userfaultfd tree,
and it is a continuous works from both Shaohua and Andrea.  Many of the
follow up ideas come from Andrea too.

Besides the old MISSING register mode of userfaultfd, the new uffd-wp
support provides another alternative register mode called
UFFDIO_REGISTER_MODE_WP that can be used to listen to not only missing
page faults but also write protection page faults, or even they can be
registered together.  At the same time, the new feature also provides a
new userfaultfd ioctl called UFFDIO_WRITEPROTECT which allows the
userspace to write protect a range or memory or fixup write permission of
faulted pages.

Please refer to the document patch "userfaultfd: wp:
UFFDIO_REGISTER_MODE_WP documentation update" for more information on the
new interface and what it can do.

The major workflow of an uffd-wp program should be:

  1. Register a memory region with WP mode using UFFDIO_REGISTER_MODE_WP

  2. Write protect part of the whole registered region using
     UFFDIO_WRITEPROTECT, passing in UFFDIO_WRITEPROTECT_MODE_WP to
     show that we want to write protect the range.

  3. Start a working thread that modifies the protected pages,
     meanwhile listening to UFFD messages.

  4. When a write is detected upon the protected range, page fault
     happens, a UFFD message will be generated and reported to the
     page fault handling thread

  5. The page fault handler thread resolves the page fault using the
     new UFFDIO_WRITEPROTECT ioctl, but this time passing in
     !UFFDIO_WRITEPROTECT_MODE_WP instead showing that we want to
     recover the write permission.  Before this operation, the fault
     handler thread can do anything it wants, e.g., dumps the page to
     a persistent storage.

  6. The worker thread will continue running with the correctly
     applied write permission from step 5.

Currently there are already two projects that are based on this new
userfaultfd feature.

QEMU Live Snapshot: The project provides a way to allow the QEMU
                    hypervisor to take snapshot of VMs without
                    stopping the VM [3].

LLNL umap library:  The project provides a mmap-like interface and
                    "allow to have an application specific buffer of
                    pages cached from a large file, i.e. out-of-core
                    execution using memory map" [4][5].

Before posting the patchset, this series was smoke tested against QEMU
live snapshot and the LLNL umap library (by doing parallel quicksort using
128 sorting threads + 80 uffd servicing threads).  My sincere thanks to
Marty Mcfadden and Denis Plotnikov for the help along the way.

TODO
====

- hugetlbfs/shmem support
- performance
- more architectures
- cooperate with mprotect()-allowed processes (???)
- ...

References
==========

[1] https://lwn.net/Articles/666187/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/andrea/aa.git/log/?h=userfault
[3] https://github.com/denis-plotnikov/qemu/commits/background-snapshot-kvm
[4] https://github.com/LLNL/umap
[5] https://llnl-umap.readthedocs.io/en/develop/
[6] https://git.kernel.org/pub/scm/linux/kernel/git/andrea/aa.git/commit/?h=userfault&id=b245ecf6cf59156966f3da6e6b674f6695a5ffa5
[7] https://lkml.org/lkml/2018/11/21/370
[8] https://lkml.org/lkml/2018/12/30/64

This patch (of 19):

Add helper for writeprotect check. Will use it later.

Bug: 254441685
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Bobby Powers <bobbypowers@gmail.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Denis Plotnikov <dplotnikov@virtuozzo.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Martin Cracauer <cracauer@cons.org>
Cc: Marty McFadden <mcfadden8@llnl.gov>
Cc: Maya Gokhale <gokhale2@llnl.gov>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Link: http://lkml.kernel.org/r/20200220163112.11409-2-peterx@redhat.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 1df319e0b4dee11436fe2ab1a0d536d3fad7cfef)
[Lee: Dependency for Fixes: commit 6ce64428d6202 ("mm/userfaultfd: fix memory corruption due to writeprotect"))
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I0c09235bb2e3ac9abd7aa5d5ba1cdba19d2afbb7
 2025-05-18 08:08:42 +00:00
Dmitry Safonov
50873dd8ff UPSTREAM: mm/mremap: don't account pages in vma_to_resize() 
All this vm_unacct_memory(charged) dance seems to complicate the life
without a good reason.  Furthermore, it seems not always done right on
error-pathes in mremap_to().  And worse than that: this `charged'
difference is sometimes double-accounted for growing MREMAP_DONTUNMAP
mremap()s in move_vma():

	if (security_vm_enough_memory_mm(mm, new_len >> PAGE_SHIFT))

Let's not do this.  Account memory in mremap() fast-path for growing
VMAs or in move_vma() for actually moving things.  The same simpler way
as it's done by vm_stat_account(), but with a difference to call
security_vm_enough_memory_mm() before copying/adjusting VMA.

Originally noticed by Chen Wandun:
https://lkml.kernel.org/r/20210717101942.120607-1-chenwandun@huawei.com

Link: https://lkml.kernel.org/r/20210721131320.522061-1-dima@arista.com
Fixes: e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
Signed-off-by: Dmitry Safonov <dima@arista.com>
Acked-by: Brian Geffon <bgeffon@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chen Wandun <chenwandun@huawei.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yongjun <weiyongjun1@huawei.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit fdbef61491359947753c13581098878e8d038286)
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Id0833f3e84c4a6119e2ec069afff5122cb0c6b35
 2025-05-18 08:08:42 +00:00
Brian Geffon
2af548dd44 BACKPORT: FROMLIST: Revert "mremap: don't allow MREMAP_DONTUNMAP on special_mappings and aio" 
This reverts commit cd544fd1dc9293c6702fab6effa63dac1cc67e99.

As discussed in [1] this commit was a no-op because the mapping type was
checked in vma_to_resize before move_vma is ever called. This meant that
vm_ops->mremap() would never be called on such mappings. Furthermore,
we've since expanded support of MREMAP_DONTUNMAP to non-anonymous
mappings, and these special mappings are still protected by the existing
check of !VM_DONTEXPAND and !VM_PFNMAP which will result in a -EINVAL.

1. https://lkml.org/lkml/2020/12/28/2340

Signed-off-by: Brian Geffon <bgeffon@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Link: https://lore.kernel.org/patchwork/patch/1401226/
Conflicts: include/linux/mm.h
(Resolved minor conflict with manual rebase)
Bug: 160737021
Bug: 169683130
Change-Id: I97d29e6a54cee07ba69d6bb880778ee1fea8ff7c
 2025-05-18 08:08:42 +00:00
Brian Geffon
7629defaa9 FROMLIST: mm: Extend MREMAP_DONTUNMAP to non-anonymous mappings 
Currently MREMAP_DONTUNMAP only accepts private anonymous mappings.
This restriction was placed initially for simplicity and not because
there exists a technical reason to do so.

This change will widen the support to include any mappings which are not
VM_DONTEXPAND or VM_PFNMAP. The primary use case is to support
MREMAP_DONTUNMAP on mappings which may have been created from a memfd.
This change will result in mremap(MREMAP_DONTUNMAP) returning -EINVAL
if VM_DONTEXPAND or VM_PFNMAP mappings are specified.

Lokesh Gidra who works on the Android JVM, provided an explanation of how
such a feature will improve Android JVM garbage collection:
"Android is developing a new garbage collector (GC), based on userfaultfd.
The garbage collector will use userfaultfd (uffd) on the java heap during
compaction. On accessing any uncompacted page, the application threads will
find it missing, at which point the thread will create the compacted page
and then use UFFDIO_COPY ioctl to get it mapped and then resume execution.
Before starting this compaction, in a stop-the-world pause the heap will be
mremap(MREMAP_DONTUNMAP) so that the java heap is ready to receive
UFFD_EVENT_PAGEFAULT events after resuming execution.

To speedup mremap operations, pagetable movement was optimized by moving
PUD entries instead of PTE entries [1]. It was necessary as mremap of even
modest sized memory ranges also took several milliseconds, and stopping the
application for that long isn't acceptable in response-time sensitive
cases.

With UFFDIO_CONTINUE feature [2], it will be even more efficient to
implement this GC, particularly the 'non-moveable' portions of the heap.
It will also help in reducing the need to copy (UFFDIO_COPY) the pages.
However, for this to work, the java heap has to be on a 'shared' vma.
Currently MREMAP_DONTUNMAP only supports private anonymous mappings, this
patch will enable using UFFDIO_CONTINUE for the new userfaultfd-based heap
compaction."

[1] https://lore.kernel.org/linux-mm/20201215030730.NC3CU98e4%25akpm@linux-foundation.org/
[2] https://lore.kernel.org/linux-mm/20210302000133.272579-1-axelrasmussen@google.com/

Signed-off-by: Brian Geffon <bgeffon@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Tested-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Link: https://lore.kernel.org/patchwork/patch/1401224/
Bug: 160737021
Bug: 169683130
Change-Id: Ic4f023dff404d7b0e35adbe92c7a12536aa0f70d
 2025-05-18 08:08:42 +00:00
Dmitry Safonov
13575f869d UPSTREAM: mremap: don't allow MREMAP_DONTUNMAP on special_mappings and aio 
As kernel expect to see only one of such mappings, any further operations
on the VMA-copy may be unexpected by the kernel.  Maybe it's being on the
safe side, but there doesn't seem to be any expected use-case for this, so
restrict it now.

Link: https://lkml.kernel.org/r/20201013013416.390574-4-dima@arista.com
Fixes: commit e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
Signed-off-by: Dmitry Safonov <dima@arista.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit cd544fd1dc9293c6702fab6effa63dac1cc67e99)

Bug: 176847609
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I9fc569e41bd7fc07c2a168c96d83eda0396c2305
 2025-05-18 08:08:42 +00:00
Dmitry Safonov
958bc1f599 BACKPORT: mm/mremap: for MREMAP_DONTUNMAP check security_vm_enough_memory_mm() 
Currently memory is accounted post-mremap() with MREMAP_DONTUNMAP, which
may break overcommit policy.  So, check if there's enough memory before
doing actual VMA copy.

Don't unset VM_ACCOUNT on MREMAP_DONTUNMAP.  By semantics, such mremap()
is actually a memory allocation.  That also simplifies the error-path a
little.

Also, as it's memory allocation on success don't reset hiwater_vm value.

Link: https://lkml.kernel.org/r/20201013013416.390574-3-dima@arista.com
Fixes: commit e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
Signed-off-by: Dmitry Safonov <dima@arista.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit ad8ee77ea9db1f74fe79c285e3546375efa75608)

[Kalesh Singh: Resolve conflicts in mm/mremap.c]
Bug: 176847609
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: If8e8bf5a18d16ed6b40af22a685951698e6f444c
 2025-05-18 08:08:42 +00:00
Arnaldo Carvalho de Melo
9274b888a1 UPSTREAM: tools headers UAPI: Sync linux/mman.h with the kernel 
To get the changes in:

  e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")

Add that to 'perf trace's mremap 'flags' decoder.

This silences this perf build warning:

  Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h'
  diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.h

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Brian Geffon <bgeffon@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
(cherry picked from commit f60b3878f47311a61fe2d4c5ef77c52e31554c52)

Bug: 176847609
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: Iab7117411cf9c4c32356da2b3de598a0df299a7c
 2025-05-18 08:08:42 +00:00
Brian Geffon
33293c4df9 UPSTREAM: userfaultfd: fix remap event with MREMAP_DONTUNMAP 
A user is not required to set a new address when using MREMAP_DONTUNMAP
as it can be used without MREMAP_FIXED.  When doing so the remap event
will use new_addr which may not have been set and we didn't propagate it
back other then in the return value of remap_to.

Because ret is always the new address it's probably more correct to use
it rather than new_addr on the remap_event_complete call, and it
resolves this bug.

Fixes: e346b3813067d4b ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Brian Geffon <bgeffon@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: "Michael S . Tsirkin" <mst@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Sonny Rao <sonnyrao@google.com>
Cc: Joel Fernandes <joel@joelfernandes.org>
Link: http://lkml.kernel.org/r/20200506172158.218366-1-bgeffon@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit d1564926066115fb47ca06b2b9d23ed506ca9608)

Bug: 176847609
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I7a20139ee14a2c9124b74310d7c0324c11009087
 2025-05-18 08:08:42 +00:00
Brian Geffon
f1934d352a UPSTREAM: mm: Fix MREMAP_DONTUNMAP accounting on VMA merge 
When remapping a mapping where a portion of a VMA is remapped
into another portion of the VMA it can cause the VMA to become
split. During the copy_vma operation the VMA can actually
be remerged if it's an anonymous VMA whose pages have not yet
been faulted. This isn't normally a problem because at the end
of the remap the original portion is unmapped causing it to
become split again.

However, MREMAP_DONTUNMAP leaves that original portion in place which
means that the VMA which was split and then remerged is not actually
split at the end of the mremap. This patch fixes a bug where
we don't detect that the VMAs got remerged and we end up
putting back VM_ACCOUNT on the next mapping which is completely
unreleated. When that next mapping is unmapped it results in
incorrectly unaccounting for the memory which was never accounted,
and eventually we will underflow on the memory comittment.

There is also another issue which is similar, we're currently
accouting for the number of pages in the new_vma but that's wrong.
We need to account for the length of the remap operation as that's
all that is being added. If there was a mapping already at that
location its comittment would have been adjusted as part of
the munmap at the start of the mremap.

A really simple repro can be seen in:
https://gist.github.com/bgaff/e101ce99da7d9a8c60acc641d07f312c

Fixes: e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Brian Geffon <bgeffon@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit dadbd85f2afc8ccd1dd1f0131781c740c91edd96)

Bug: 176847609
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I823b63d110825c306dab6929fca9408f8bf79ff0
 2025-05-18 08:08:42 +00:00
Brian Geffon
a3967e5ebe UPSTREAM: mm/mremap: add MREMAP_DONTUNMAP to mremap() 
When remapping an anonymous, private mapping, if MREMAP_DONTUNMAP is set,
the source mapping will not be removed.  The remap operation will be
performed as it would have been normally by moving over the page tables to
the new mapping.  The old vma will have any locked flags cleared, have no
pagetables, and any userfaultfds that were watching that range will
continue watching it.

For a mapping that is shared or not anonymous, MREMAP_DONTUNMAP will cause
the mremap() call to fail.  Because MREMAP_DONTUNMAP always results in
moving a VMA you MUST use the MREMAP_MAYMOVE flag, it's not possible to
resize a VMA while also moving with MREMAP_DONTUNMAP so old_len must
always be equal to the new_len otherwise it will return -EINVAL.

We hope to use this in Chrome OS where with userfaultfd we could write an
anonymous mapping to disk without having to STOP the process or worry
about VMA permission changes.

This feature also has a use case in Android, Lokesh Gidra has said that
"As part of using userfaultfd for GC, We'll have to move the physical
pages of the java heap to a separate location.  For this purpose mremap
will be used.  Without the MREMAP_DONTUNMAP flag, when I mremap the java
heap, its virtual mapping will be removed as well.  Therefore, we'll
require performing mmap immediately after.  This is not only time
consuming but also opens a time window where a native thread may call mmap
and reserve the java heap's address range for its own usage.  This flag
solves the problem."

[bgeffon@google.com: v6]
  Link: http://lkml.kernel.org/r/20200218173221.237674-1-bgeffon@google.com
[bgeffon@google.com: v7]
  Link: http://lkml.kernel.org/r/20200221174248.244748-1-bgeffon@google.com
Signed-off-by: Brian Geffon <bgeffon@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: "Michael S . Tsirkin" <mst@redhat.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Deacon <will@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Sonny Rao <sonnyrao@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Jesse Barnes <jsbarnes@google.com>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Link: http://lkml.kernel.org/r/20200207201856.46070-1-bgeffon@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit e346b3813067d4b17383f975f197a9aa28a3b077)

Bug: 176847609
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I8474cd9f032de02fa1764c49c63d368ac15346da
 2025-05-18 08:08:42 +00:00
Orson Zhai
91e49e5534 ANDROID: userfaultfd: Fix untag pointer in userfaultfd_continue() 
Fixes e71e2ace5721 ("userfaultfd: do not untag user pointers").

Above patch is ported from upstream into LTS branch then merged into
android12-5.4. The original patch was going to fix all untag user
pointers.

The change to userfaultfd_continue() was cut off when being merged into
LTS because the routine does not exist in LTS.

But specially the routine has been cherry-picked into android12-5.4 with
commit b69f713e60d0 ("BACKPORT: FROMGIT: userfaultfd: add
UFFDIO_CONTINUE ioctl") by Lokesh Gidra <lokeshgidra@google.com> long
ago.

So add back the missing part of fixing here.

Fixes: e71e2ace5721 ("userfaultfd: do not untag user pointers")
Change-Id: I32da80c2e9517356daadf566a433e056f6bef08c
Signed-off-by: Orson Zhai <orson.zhai@unisoc.com>
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
3c4f4023a8 FROMLIST: userfaultfd/shmem: fix minor fault page leak 
This fix is analogous to Peter Xu's fix for hugetlb [0]. If we don't
put_page() after getting the page out of the page cache, we leak the
reference.

The fix can be verified by checking /proc/meminfo and running the
userfaultfd selftest in shmem mode. Without the fix, we see MemFree /
MemAvailable steadily decreasing with each run of the test. With the
fix, memory is correctly freed after the test program exits.

Fixes: 00da60b9d0a0 ("userfaultfd: support minor fault handling for shmem")
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Peter Xu <peterx@redhat.com>

Link: https://lore.kernel.org/patchwork/patch/1400686/
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I599f1434e24fce6e31d0d73c7f9c4714e9875b63
 2025-05-18 08:08:42 +00:00
Peter Xu
baf24c949a BACKPORT: FROMLIST: userfaultfd/hugetlbfs: Fix minor fault page leak 
When uffd-minor enabled, we need to put the page cache before handling the
userfault in hugetlb_no_page(), otherwise the page refcount got leaked.

This can be reproduced by running userfaultfd selftest with hugetlb_shared
mode, then cat /proc/meminfo.

Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: f2bf15fb0969 ("userfaultfd: add minor fault registration mode")
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>

Link: https://lore.kernel.org/patchwork/patch/1400632/
Conflicts: mm/hugetlb.c
(manual rebase)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Iac0ebd6738af8b6212c5a6303e4ee2f482bb5841
 2025-05-18 08:08:42 +00:00
Peter Xu
30cd89e371 BACKPORT: FROMGIT: userfaultfd/selftests: drop VERIFY check in locking_thread 
It tries to check against all zeros and looped for quite a few times.
However after that we'll verify the same page with count_verify, while
count_verify can never be zero.  So it means if it's a zero page we'll
detect it anyways with below code.

There's yet another place we conditionally check the fault flag - just do
it unconditionally.

Link: https://lkml.kernel.org/r/20210310004511.51996-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
(cherry picked from commit 9c42d387952986b4159ce304a14771a0534469b3
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1392478/

Conflicts: tools/testing/selftests/vm/userfaultfd.c
(Manual rebase)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Iee4e4fa10db0b2a01cb4804087275d2714e477b4
 2025-05-18 08:08:42 +00:00
Peter Xu
88407480bb FROMGIT: userfaultfd/selftests: remove the time() check on delayed uffd 
There seems to have no guarantee that time() will return the same for the
two calls even if there's no delay, e.g.  when a fault is accidentally
crossing the changing of a second.  Meanwhile, this message is also not
helping that much since delay could happen with a lot of reasons, e.g.,
schedule latency of resolving thread.  It may not mean an issue with uffd.

Neither do I see this error triggered either in the past runs.  Even if it
triggers, it'll be drown in all the rest of test logs.  Remove it.

Link: https://lkml.kernel.org/r/20210310004511.51996-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 9c08bd6a7410e916a8d38e932d913bb240219745
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1392477/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I09b7b75425115653ee6082e7f1846984fba197fe
 2025-05-18 08:08:42 +00:00
Peter Xu
c21e5dd2d6 FROMGIT: userfaultfd/selftests: use user mode only 
Patch series "userfaultfd/selftests: A few cleanups".

I wanted to cleanup userfaultfd.c fault handling for a long time.  If it's
not cleaned, when the new code grows the file it'll also grow the size
that needs to be cleaned...  This is my attempt to cleanup the userfaultfd
selftest on fault handling, to use an err() macro instead of either
fprintf() or perror() then another exit() call.

The huge cleanup is done in the last patch.  The first 4 patches are some
other standalone cleanups for the same file, so I put them together.

This patch (of 5):

Userfaultfd selftest does not need to handle kernel initiated fault.  Set
user mode so it can be run even if unprivileged_userfaultfd=0 (which is
the default).

Link: https://lkml.kernel.org/r/20210310004511.51996-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit eaf221e6a1916d2471309800e4534bdc0698af33
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1392475/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Ie3f0708b3c1a25ea66e4e0795e4ea54ca938c7a1
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
3325f0ceaf BACKPORT: FROMGIT: userfaultfd/selftests: exercise minor fault handling shmem support 
Enable test_uffdio_minor for test_type == TEST_SHMEM, and modify the test
slightly to pass in / check for the right feature flags.

Link: https://lkml.kernel.org/r/20210302000133.272579-6-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wang Qing <wangqing@vivo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 01d5af3a0bc027d51d729cefe3105c7054182df7
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388148/

Conflicts: tools/testing/selftests/vm/userfaultfd.c
(Manual rebase)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I545c6b7058f59fe5bc21d2dd37202209253f1a92
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
9302deed1a BACKPORT: FROMGIT: userfaultfd/selftests: reinitialize test context in each test 
Currently, the context (fds, mmap-ed areas, etc.) are global.  Each test
mutates this state in some way, in some cases really "clobbering it"
(e.g., the events test mremap-ing area_dst over the top of area_src, or
the minor faults tests overwriting the count_verify values in the test
areas).  We run the tests in a particular order, each test is careful to
make the right assumptions about its starting state, etc.

But, this is fragile.  It's better for a test's success or failure to not
depend on what some other prior test case did to the global state.

To that end, clear and reinitialize the test context at the start of each
test case, so whatever prior test cases did doesn't affect future tests.

This is particularly relevant to this series because the events test's
mremap of area_dst screws up assumptions the minor fault test was relying
on.  This wasn't a problem for hugetlb, as we don't mremap in that case.

Link: https://lkml.kernel.org/r/20210302000133.272579-5-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wang Qing <wangqing@vivo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 0108aac75e6d6852e8bba20d5b94e29bf8dc9335
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388145/

Conflicts: tools/testing/selftests/vm/userfaultfd.c
(Manual rebase)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Icf57513cad6f6580114bc5452bfadc5e528434ed
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
7e738f2d9a FROMGIT: userfaultfd/selftests: create alias mappings in the shmem test 
Previously, we just allocated two shm areas: area_src and area_dst.  With
this commit, change this so we also allocate area_src_alias, and
area_dst_alias.

area_*_alias and area_* (respectively) point to the same underlying
physical pages, but are different VMAs.  In a future commit in this
series, we'll leverage this setup to exercise minor fault handling support
for shmem, just like we do in the hugetlb_shared test.

Link: https://lkml.kernel.org/r/20210302000133.272579-4-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wang Qing <wangqing@vivo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 8bc5e62208bcb9427ea6eed94ff1b152598da6f8
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388149/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I1605dba2d5f0e35bfd57bd9110bb54e950faab19
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
195eef95ec FROMGIT: userfaultfd/selftests: use memfd_create for shmem test type 
This is a preparatory commit.  In the future, we want to be able to setup
alias mappings for area_src and area_dst in the shmem test, like we do in
the hugetlb_shared test.  With a VMA obtained via mmap(MAP_ANONYMOUS |
MAP_SHARED), it isn't clear how to do this.

So, mmap() with an fd, so we can create alias mappings.  Use memfd_create
instead of actually passing in a tmpfs path like hugetlb does, since it's
more convenient / simpler to run, and works just as well.

Future commits will:

1. Setup the alias mappings.
2. Extend our tests to actually take advantage of this, to test new
   userfaultfd behavior being introduced in this series.

Also, a small fix in the area we're changing: when the hugetlb setup fails
in main(), pass in the right argv[] so we actually print out the hugetlb
file path.

Link: https://lkml.kernel.org/r/20210302000133.272579-3-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wang Qing <wangqing@vivo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit de45daecde2d4793e9021b102e168a4cb656dd03
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388147/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I63ac39245d4090e275238efa75bcdbd40fcc7879
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
1999a272c6 BACKPORT: FROMGIT: userfaultfd: support minor fault handling for shmem 
Patch series "userfaultfd: support minor fault handling for shmem", v2.

Overview
========

See my original series [1] for a detailed overview of minor fault handling
in general.  The feature in this series works exactly like the hugetblfs
version (from userspace's perspective).

I'm sending this as a separate series because:

- The original minor fault handling series has a full set of R-Bs, and seems
  close to being merged. So, it seems reasonable to start looking at this next
  step, which extends the basic functionality.

- shmem is different enough that this series may require some additional work
  before it's ready, and I don't want to delay the original series
  unnecessarily by bundling them together.

Use Case
========

In some cases it is useful to have VM memory backed by tmpfs instead of
hugetlbfs.  So, this feature will be used to support the same VM live
migration use case described in my original series.

Additionally, Android folks (Lokesh Gidra <lokeshgidra@google.com>) hope
to optimize the Android Runtime garbage collector using this feature:

"The plan is to use userfaultfd for concurrently compacting the heap.
With this feature, the heap can be shared-mapped at another location where
the GC-thread(s) could continue the compaction operation without the need
to invoke userfault ioctl(UFFDIO_COPY) each time.  OTOH, if and when Java
threads get faults on the heap, UFFDIO_CONTINUE can be used to resume
execution.  Furthermore, this feature enables updating references in the
'non-moving' portion of the heap efficiently.  Without this feature,
uneccessary page copying (ioctl(UFFDIO_COPY)) would be required."

[1] https://lore.kernel.org/linux-fsdevel/20210301222728.176417-1-axelrasmussen@google.com/T/#t

This patch (of 5):

Modify the userfaultfd register API to allow registering shmem VMAs in
minor mode.  Modify the shmem mcopy implementation to support
UFFDIO_CONTINUE in order to resolve such faults.

Combine the shmem mcopy handler functions into a single
shmem_mcopy_atomic_pte, which takes a mode parameter.  This matches how
the hugetlbfs implementation is structured, and lets us remove a good
chunk of boilerplate.

Link: https://lkml.kernel.org/r/20210302000133.272579-1-axelrasmussen@google.com
Link: https://lkml.kernel.org/r/20210302000133.272579-2-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wang Qing <wangqing@vivo.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oliver Upton <oupton@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 4cc6e15679966aa49afc5b114c3c83ba0ac39b05
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388146/

Conflicts: include/linux/shmem_fs.h
	mm/shmem.c
	mm/userfaultfd.c
(1. write-protect related conflicts, rebased manually
2. Enclose shmem_mcopy_atomic_pte() with CONFIG_USERFAULTFD to avoid
compile errors when USERFAULTFD is not enabled.)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Idcd822b2a124a089121b9ad8c65061f6979126ec
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
05004f0991 BACKPORT: FROMGIT: userfaultfd/selftests: add test exercising minor fault handling 
Fix a dormant bug in userfaultfd_events_test(), where we did `return
faulting_process(0)` instead of `exit(faulting_process(0))`.  This caused
the forked process to keep running, trying to execute any further test
cases after the events test in parallel with the "real" process.

Add a simple test case which exercises minor faults. In short, it does
the following:

1. "Sets up" an area (area_dst) and a second shared mapping to the same
   underlying pages (area_dst_alias).

2. Register one of these areas with userfaultfd, in minor fault mode.

3. Start a second thread to handle any minor faults.

4. Populate the underlying pages with the non-UFFD-registered side of
   the mapping. Basically, memset() each page with some arbitrary
   contents.

5. Then, using the UFFD-registered mapping, read all of the page
   contents, asserting that the contents match expectations (we expect
   the minor fault handling thread can modify the page contents before
   resolving the fault).

The minor fault handling thread, upon receiving an event, flips all the
bits (~) in that page, just to prove that it can modify it in some
arbitrary way.  Then it issues a UFFDIO_CONTINUE ioctl, to setup the
mapping and resolve the fault.  The reading thread should wake up and see
this modification.

Currently the minor fault test is only enabled in hugetlb_shared mode, as
this is the only configuration the kernel feature supports.

Link: https://lkml.kernel.org/r/20210301222728.176417-7-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 823e78ae969c4ae9500cac5a84ee5b923634be4d
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388135/

Conflicts: tools/testing/selftests/vm/userfaultfd.c
(Removed write-protect related test and removed uffd_stats usage)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I93a845d45436d835a4fd5de0dfd8a2c54fa15550
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
e896f54b5e BACKPORT: FROMGIT: userfaultfd: update documentation to describe minor fault handling 
Reword / reorganize things a little bit into "lists", so new features /
modes / ioctls can sort of just be appended.

Describe how UFFDIO_REGISTER_MODE_MINOR and UFFDIO_CONTINUE can be used to
intercept and resolve minor faults.  Make it clear that COPY and ZEROPAGE
are used for MISSING faults, whereas CONTINUE is used for MINOR faults.

Link: https://lkml.kernel.org/r/20210301222728.176417-6-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit d08ba026886f0161e2bdd3dbd75c4da0fc62a284
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388137/

Conflicts: Documentation/admin-guide/mm/userfaultfd.rst
(Manual rebase by removing text related to write-protect feature)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Ib59504247d38034e4c86f692dd63f2b3706fe554
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
5d62f07fff BACKPORT: FROMGIT: userfaultfd: add UFFDIO_CONTINUE ioctl 
This ioctl is how userspace ought to resolve "minor" userfaults. The
idea is, userspace is notified that a minor fault has occurred. It might
change the contents of the page using its second non-UFFD mapping, or
not. Then, it calls UFFDIO_CONTINUE to tell the kernel "I have ensured
the page contents are correct, carry on setting up the mapping".

Note that it doesn't make much sense to use UFFDIO_{COPY,ZEROPAGE} for
MINOR registered VMAs. ZEROPAGE maps the VMA to the zero page; but in
the minor fault case, we already have some pre-existing underlying page.
Likewise, UFFDIO_COPY isn't useful if we have a second non-UFFD mapping.
We'd just use memcpy() or similar instead.

It turns out hugetlb_mcopy_atomic_pte() already does very close to what
we want, if an existing page is provided via `struct page **pagep`. We
already special-case the behavior a bit for the UFFDIO_ZEROPAGE case, so
just extend that design: add an enum for the three modes of operation,
and make the small adjustments needed for the MCOPY_ATOMIC_CONTINUE
case. (Basically, look up the existing page, and avoid adding the
existing page to the page cache or calling set_page_huge_active() on
it.)

Link: https://lkml.kernel.org/r/20210301222728.176417-5-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 14ea86439abaf3423cd9b6712ed5ce8451d2d181
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388136/

Conflicts: fs/userfaultfd.c
	include/linux/hugetlb.h
	include/linux/userfaultfd_k.h
	include/uapi/linux/userfaultfd.h
	mm/hugetlb.c
	mm/userfaultfd.c
(1. 8f251a3d5ce3bdea73bd045ed35db64f32e0d0d9 is not cherry-picked yet so
    switched SetHPageMigratable() to set_active_huge_page() in
    mm/hugetlb.c,
2. Other files conflicts due to lack of write-protect userfaultfd
support. Manually rebased accordingly
3. Included linux/mm.h in linux/userfaultfd_k.h for definitions of
VM_UFFD_*)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I45b62959dcb1d343154cb831113a26e47e77c8af
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
0bea3b8d35 BACKPORT: FROMGIT: userfaultfd: hugetlbfs: only compile UFFD helpers if config enabled 
For background, mm/userfaultfd.c provides a general mcopy_atomic
implementation.  But some types of memory (i.e., hugetlb and shmem) need a
slightly different implementation, so they provide their own helpers for
this.  In other words, userfaultfd is the only caller of these functions.

This patch achieves two things:

1. Don't spend time compiling code which will end up never being
   referenced anyway (a small build time optimization).

2. In patches later in this series, we extend the signature of these
   helpers with UFFD-specific state (a mode enumeration).  Once this
   happens, we *have to* either not compile the helpers, or
   unconditionally define the UFFD-only state (which seems messier to me).
   This includes the declarations in the headers, as otherwise they'd
   yield warnings about implicitly defining the type of those arguments.

Link: https://lkml.kernel.org/r/20210301222728.176417-4-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 0e6e243e1d9a252c047c4cb1b032cfb31caf87ea
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388133/

Conflicts: include/linux/hugetlb.h
(Manual rebase, required as 1f9dccb25b8fb48778149a002bb25d4ac2899633
isn't CP'ed)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I765cff74cde5fb4ce8141fb95e41848890ced961
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
84c481c854 FROMGIT: userfaultfd: disable huge PMD sharing for MINOR registered VMAs 
As the comment says: for the MINOR fault use case, although the page might
be present and populated in the other (non-UFFD-registered) half of the
mapping, it may be out of date, and we explicitly want userspace to get a
minor fault so it can check and potentially update the page's contents.

Huge PMD sharing would prevent these faults from occurring for suitably
aligned areas, so disable it upon UFFD registration.

Link: https://lkml.kernel.org/r/20210301222728.176417-3-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 19fbec4445b6a690253c1785dfd376ede2cdb9d9
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388134/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I257024f980f43cf8b06b5421ee3278115d1b1540
 2025-05-18 08:08:42 +00:00
Axel Rasmussen
59e978522d BACKPORT: FROMGIT: userfaultfd: add minor fault registration mode 
Patch series "userfaultfd: add minor fault handling", v9.

Overview
========

This series adds a new userfaultfd feature, UFFD_FEATURE_MINOR_HUGETLBFS.
When enabled (via the UFFDIO_API ioctl), this feature means that any
hugetlbfs VMAs registered with UFFDIO_REGISTER_MODE_MISSING will *also*
get events for "minor" faults.  By "minor" fault, I mean the following
situation:

Let there exist two mappings (i.e., VMAs) to the same page(s) (shared
memory).  One of the mappings is registered with userfaultfd (in minor
mode), and the other is not.  Via the non-UFFD mapping, the underlying
pages have already been allocated & filled with some contents.  The UFFD
mapping has not yet been faulted in; when it is touched for the first
time, this results in what I'm calling a "minor" fault.  As a concrete
example, when working with hugetlbfs, we have huge_pte_none(), but
find_lock_page() finds an existing page.

We also add a new ioctl to resolve such faults: UFFDIO_CONTINUE.  The idea
is, userspace resolves the fault by either a) doing nothing if the
contents are already correct, or b) updating the underlying contents using
the second, non-UFFD mapping (via memcpy/memset or similar, or something
fancier like RDMA, or etc...).  In either case, userspace issues
UFFDIO_CONTINUE to tell the kernel "I have ensured the page contents are
correct, carry on setting up the mapping".

Use Case
========

Consider the use case of VM live migration (e.g. under QEMU/KVM):

1. While a VM is still running, we copy the contents of its memory to a
   target machine. The pages are populated on the target by writing to the
   non-UFFD mapping, using the setup described above. The VM is still running
   (and therefore its memory is likely changing), so this may be repeated
   several times, until we decide the target is "up to date enough".

2. We pause the VM on the source, and start executing on the target machine.
   During this gap, the VM's user(s) will *see* a pause, so it is desirable to
   minimize this window.

3. Between the last time any page was copied from the source to the target, and
   when the VM was paused, the contents of that page may have changed - and
   therefore the copy we have on the target machine is out of date. Although we
   can keep track of which pages are out of date, for VMs with large amounts of
   memory, it is "slow" to transfer this information to the target machine. We
   want to resume execution before such a transfer would complete.

4. So, the guest begins executing on the target machine. The first time it
   touches its memory (via the UFFD-registered mapping), userspace wants to
   intercept this fault. Userspace checks whether or not the page is up to date,
   and if not, copies the updated page from the source machine, via the non-UFFD
   mapping. Finally, whether a copy was performed or not, userspace issues a
   UFFDIO_CONTINUE ioctl to tell the kernel "I have ensured the page contents
   are correct, carry on setting up the mapping".

We don't have to do all of the final updates on-demand. The userfaultfd manager
can, in the background, also copy over updated pages once it receives the map of
which pages are up-to-date or not.

Interaction with Existing APIs
==============================

Because this is a feature, a registered VMA could potentially receive both
missing and minor faults.  I spent some time thinking through how the
existing API interacts with the new feature:

UFFDIO_CONTINUE cannot be used to resolve non-minor faults, as it does not
allocate a new page.  If UFFDIO_CONTINUE is used on a non-minor fault:

- For non-shared memory or shmem, -EINVAL is returned.
- For hugetlb, -EFAULT is returned.

UFFDIO_COPY and UFFDIO_ZEROPAGE cannot be used to resolve minor faults.
Without modifications, the existing codepath assumes a new page needs to
be allocated.  This is okay, since userspace must have a second
non-UFFD-registered mapping anyway, thus there isn't much reason to want
to use these in any case (just memcpy or memset or similar).

- If UFFDIO_COPY is used on a minor fault, -EEXIST is returned.
- If UFFDIO_ZEROPAGE is used on a minor fault, -EEXIST is returned (or -EINVAL
  in the case of hugetlb, as UFFDIO_ZEROPAGE is unsupported in any case).
- UFFDIO_WRITEPROTECT simply doesn't work with shared memory, and returns
  -ENOENT in that case (regardless of the kind of fault).

Future Work
===========

This series only supports hugetlbfs.  I have a second series in flight to
support shmem as well, extending the functionality.  This series is more
mature than the shmem support at this point, and the functionality works
fully on hugetlbfs, so this series can be merged first and then shmem
support will follow.

This patch (of 6):

This feature allows userspace to intercept "minor" faults.  By "minor"
faults, I mean the following situation:

Let there exist two mappings (i.e., VMAs) to the same page(s).  One of the
mappings is registered with userfaultfd (in minor mode), and the other is
not.  Via the non-UFFD mapping, the underlying pages have already been
allocated & filled with some contents.  The UFFD mapping has not yet been
faulted in; when it is touched for the first time, this results in what
I'm calling a "minor" fault.  As a concrete example, when working with
hugetlbfs, we have huge_pte_none(), but find_lock_page() finds an existing
page.

This commit adds the new registration mode, and sets the relevant flag on
the VMAs being registered.  In the hugetlb fault path, if we find that we
have huge_pte_none(), but find_lock_page() does indeed find an existing
page, then we have a "minor" fault, and if the VMA has the userfaultfd
registration flag, we call into userfaultfd to handle it.

This is implemented as a new registration mode, instead of an API feature.
This is because the alternative implementation has significant drawbacks
[1].

However, doing it this was requires we allocate a VM_* flag for the new
registration mode.  On 32-bit systems, there are no unused bits, so this
feature is only supported on architectures with
CONFIG_ARCH_USES_HIGH_VMA_FLAGS.  When attempting to register a VMA in
MINOR mode on 32-bit architectures, we return -EINVAL.

[1] https://lore.kernel.org/patchwork/patch/1380226/

Link: https://lkml.kernel.org/r/20210301222728.176417-1-axelrasmussen@google.com
Link: https://lkml.kernel.org/r/20210301222728.176417-2-axelrasmussen@google.com
Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Steven Price <steven.price@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 82a150ec394f6b944e26786b907fc0deab5b2064
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1388132/

Conflicts: arch/x86/Kconfig
	fs/userfaultfd.c
	include/linux/userfaultfd_k.h
	include/uapi/linux/userfaultfd.h
	init/Kconfig
	mm/hugetlb.c
(Lack of userfaultfd write-protect support in 5.4 lead to all conflicts.
Resolved by carefully rebasing such that write-protect related code
doesn't get added)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I43b37272d531341439ceaa03213d0e2415e04688
 2025-05-18 08:08:42 +00:00
Peter Xu
5f1b26c2cd BACKPORT: FROMGIT: hugetlb/userfaultfd: unshare all pmds for hugetlbfs when register wp 
Huge pmd sharing for hugetlbfs is racy with userfaultfd-wp because
userfaultfd-wp is always based on pgtable entries, so they cannot be
shared.

Walk the hugetlb range and unshare all such mappings if there is, right
before UFFDIO_REGISTER will succeed and return to userspace.

This will pair with want_pmd_share() in hugetlb code so that huge pmd
sharing is completely disabled for userfaultfd-wp registered range.

Link: https://lkml.kernel.org/r/20210218231206.15524-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 267bda5c9993856b86f91a998df632b29cf517e2
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1382208/
Conflicts:
	mm/hugetlb.c

(CONFIG_CMA not CP'ed in this kernel. Manual rebase)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I99d541ce45aaf924fa912f00dafa4caefe307755
 2025-05-18 08:08:42 +00:00
Peter Xu
abc495fa9d FROMGIT: mm/hugetlb: move flush_hugetlb_tlb_range() into hugetlb.h 
Prepare for it to be called outside of mm/hugetlb.c.

Link: https://lkml.kernel.org/r/20210218231204.15474-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 04297c667b3972097535638e3dab5a66f11ca1df
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1382206/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I9bf21fe479548d44a8b611ed832b2f1af7667f4c
 2025-05-18 08:08:42 +00:00
Peter Xu
245a106b01 FROMGIT: mm/hugetlb: fix build with !ARCH_WANT_HUGE_PMD_SHARE 
want_pmd_share() is undefined with !ARCH_WANT_HUGE_PMD_SHARE since it's
put by accident into a "#ifdef ARCH_WANT_HUGE_PMD_SHARE" block.  Moving it
out won't work either since vma_shareable() is only defined within the
block.  Define it for !ARCH_WANT_HUGE_PMD_SHARE instead.

Link: https://lkml.kernel.org/r/20210310185359.88297-1-peterx@redhat.com
Fixes: 5b109cc1cdcc ("hugetlb/userfaultfd: forbid huge pmd sharing when uffd enabled")
Signed-off-by: Peter Xu <peterx@redhat.com>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 5038f9dd8bbde13ff16435011bb3b0981acc5c1c
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1393174/

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Id716afd43bff303f7eda2c4f70f18d9ea727c698
 2025-05-18 08:08:42 +00:00
Peter Xu
a7279b3385 BACKPORT: FROMGIT: hugetlb/userfaultfd: forbid huge pmd sharing when uffd enabled 
Huge pmd sharing could bring problem to userfaultfd.  The thing is that
userfaultfd is running its logic based on the special bits on page table
entries, however the huge pmd sharing could potentially share page table
entries for different address ranges.  That could cause issues on either:

  - When sharing huge pmd page tables for an uffd write protected range, the
    newly mapped huge pmd range will also be write protected unexpectedly, or,

  - When we try to write protect a range of huge pmd shared range, we'll first
    do huge_pmd_unshare() in hugetlb_change_protection(), however that also
    means the UFFDIO_WRITEPROTECT could be silently skipped for the shared
    region, which could lead to data loss.

Since at it, a few other things are done altogether:

  - Move want_pmd_share() from mm/hugetlb.c into linux/hugetlb.h, because
    that's definitely something that arch code would like to use too

  - ARM64 currently directly check against CONFIG_ARCH_WANT_HUGE_PMD_SHARE when
    trying to share huge pmd.  Switch to the want_pmd_share() helper.

Since at it, move vma_shareable() from huge_pmd_share() into want_pmd_share().

Link: https://lkml.kernel.org/r/20210218231202.15426-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit ab6a0d00a63f92f1f0d220274fa989eb75c09f2b
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1382207/
Conflicts:
	include/linux/hugetlb.h
	mm/hugetlb.c

(Manual rebase)

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Ie2dff7ab31600cae78914e3278be61516844394e
 2025-05-18 08:08:42 +00:00
Peter Xu
c775249492 BACKPORT: FROMGIT: hugetlb: pass vma into huge_pte_alloc() and huge_pmd_share() 
Patch series "hugetlb: Disable huge pmd unshare for uffd-wp", v4.

This series tries to disable huge pmd unshare of hugetlbfs backed memory
for uffd-wp.  Although uffd-wp of hugetlbfs is still during rfc stage, the
idea of this series may be needed for multiple tasks (Axel's uffd minor
fault series, and Mike's soft dirty series), so I picked it out from the
larger series.

This patch (of 4):

It is a preparation work to be able to behave differently in the per
architecture huge_pte_alloc() according to different VMA attributes.

Pass it deeper into huge_pmd_share() so that we can avoid the find_vma() call.

Link: https://lkml.kernel.org/r/20210218230633.15028-1-peterx@redhat.com
Link: https://lkml.kernel.org/r/20210218230633.15028-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Suggested-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Adam Ruprecht <ruprecht@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Cannon Matthews <cannonmatthews@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Chinwen Chang <chinwen.chang@mediatek.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Dr . David Alan Gilbert" <dgilbert@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Michal Koutn" <mkoutny@suse.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oliver Upton <oupton@google.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Shawn Anastasio <shawn@anastas.io>
Cc: Steven Price <steven.price@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit b92dc1bfd52ecf338c024815a7c1d44e37a507a1
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Link: https://lore.kernel.org/patchwork/patch/1382205/

Conflicts:
	arch/sparc/mm/hugetlbpage.c
	mm/hugetlb.c
	mm/userfaultfd.c

(1. manual rebase,
 2. c0d0381ade79885c04a04c303284b040616b116e wasn't CP'ed. Rebased by
 appropriately updating huge_pte_alloc(),
 3. manual rebase)

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I50db4e27f2951a5ee01b0dfa22c1ece34e79f881
 2025-05-18 08:08:42 +00:00
John Hubbard
346a6836ed UPSTREAM: selftests/vm/.gitignore: add mremap_dontunmap 
Add mremap_dontunmap to .gitignore.

Fixes: 0c28759ee3c9 ("selftests: add MREMAP_DONTUNMAP selftest")
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Brian Geffon <bgeffon@google.com>
Link: http://lkml.kernel.org/r/20200517002509.362401-2-jhubbard@nvidia.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 98097701cc0bec06e4bc183cceaf6dfa06a69e10)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Iadb72ad4ffec5d0203214a632b612ff3266695c0
 2025-05-18 08:08:42 +00:00
Brian Geffon
c16d9b8365 FROMLIST: selftests: Add a MREMAP_DONTUNMAP selftest for shmem 
This test extends the current mremap tests to validate that
the MREMAP_DONTUNMAP operation can be performed on shmem mappings.

Signed-off-by: Brian Geffon <bgeffon@google.com>

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Link: https://lore.kernel.org/patchwork/patch/1401225/
Bug: 160737021
Bug: 169683130
Change-Id: Ib357e58526af739cf8df49fc9604372996a9a6b3
 2025-05-18 08:08:42 +00:00
Brian Geffon
7d28c28500 UPSTREAM: selftests: add MREMAP_DONTUNMAP selftest 
Add a few simple self tests for the new flag MREMAP_DONTUNMAP, they are
simple smoke tests which also demonstrate the behavior.

[akpm@linux-foundation.org: convert eight-spaces to hard tabs]
[bgeffon@google.com: v7]
  Link: http://lkml.kernel.org/r/20200221174248.244748-2-bgeffon@google.com
[akpm@linux-foundation.org: coding style fixes]
Signed-off-by: Brian Geffon <bgeffon@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: "Michael S . Tsirkin" <mst@redhat.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Deacon <will@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Sonny Rao <sonnyrao@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Jesse Barnes <jsbarnes@google.com>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: "Kirill A . Shutemov" <kirill@shutemov.name>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Link: http://lkml.kernel.org/r/20200218173221.237674-2-bgeffon@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 0c28759ee3c91fa8ae14d7672b781b979be274e1)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I3380f66b882cc24b7c4b5b29923f929722e7c22a
 2025-05-18 08:08:42 +00:00
Alexander Winkowski
5b40652054
 		qcedev: Fix excessive logging on DRM playback 
Change-Id: Idb0224d5213a57b9f0925fe89a1a5c816e3967b2
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
 2025-05-18 11:08:08 +03:00
Shashikala Katthi
20e2af2352
 		usb: dwc3: gadget: Fix break condition in gadget state 
Add break condition in gadget state of dwc3_gadget_run_stop_util.

Change-Id: I644ae558558616819a7369d8163a68a74c2bb3fd
Signed-off-by: Shashikala Katthi <quic_skatthi@quicinc.com>
 2025-05-18 11:07:00 +03:00
Alexander Winkowski
9f07178ded
 		Revert "usb: dwc3: Increase DWC3 controller halt timeout" 
This reverts commit 935e842f98.

Reason for revert: dwc3_gadget_run_stop() is called from atomic context,
it's wrong to use usleep_range() there.

Change-Id: I5e25f2c1c9de0bba4b28157b6d42ef62f6706dfc
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
 2025-05-18 11:05:37 +03:00
Michael Bestas
6544d65e83
 		Revert "Revert "Revert "8250: add support for ASIX devices with a FIFO bug""" 
This reverts commit eea11c5180.

Reason for revert: Build is broken without it,
we don't care about GKI ABI.

Change-Id: I3d7be0324682d01b14863438d8383df16679ef38
 2025-05-18 11:04:18 +03:00
Michael Bestas
bbcf9da13a Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2025-05-01

* tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: net_sched: Prevent creation of classes with TC_H_ROOT
  Linux 5.4.292
  jfs: add index corruption check to DT_GETPAGE()
  jfs: fix slab-out-of-bounds read in ea_get()
  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
  ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
  x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
  x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
  ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
  can: flexcan: only change CAN state when link up in system PM
  arcnet: Add NULL check in com20020pci_probe()
  net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
  ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
  vsock: avoid timeout during connect() if the socket is closing
  net_sched: skbprio: Remove overly strict queue assertions
  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  ntb: intel: Fix using link status DB's
  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
  spufs: fix a leak in spufs_create_context()
  spufs: fix a leak on spufs_new_file() failure
  hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
  can: statistics: use atomic access in hot path
  locking/semaphore: Use wake_q to wake up processes outside lock critical section
  sched/deadline: Use online cpus for validating runtime
  affs: don't write overlarge OFS data block size fields
  affs: generate OFS sequence numbers starting at 1
  wifi: iwlwifi: fw: allocate chained SG tables for dump
  sched/smt: Always inline sched_smt_active()
  octeontx2-af: Fix mbox INTR handler when num VFs > 64
  ring-buffer: Fix bytes_dropped calculation issue
  objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  fs/procfs: fix the comment above proc_pid_wchan()
  perf python: Check if there is space to copy all the event
  perf python: Decrement the refcount of just created event on failure
  perf python: Fixup description of sample.id event member
  ocfs2: validate l_tree_depth to avoid out-of-bounds access
  kexec: initialize ELF lowest address to ULONG_MAX
  perf units: Fix insufficient array space
  iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
  coresight: catu: Fix number of pages while using 64k pages
  isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
  x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
  mfd: sm501: Switch to BIT() to mitigate integer overflows
  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  power: supply: max77693: Fix wrong conversion of charge input threshold value
  x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
  clk: amlogic: g12a: fix mmc A peripheral clock
  clk: amlogic: gxbb: drop non existing 32k clock parent
  clk: amlogic: g12b: fix cluster A parent data
  IB/mad: Check available slots before posting receive WRs
  clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
  pinctrl: renesas: rza2: Fix missing of_node_put() call
  lib: 842: Improve error handling in sw842_compress()
  bpf: Use preempt_count() directly in bpf_send_signal_common()
  clk: amlogic: gxbb: drop incorrect flag on 32k clock
  fbdev: sm501fb: Add some geometry checks.
  mdacon: rework dependency list
  fbdev: au1100fb: Move a variable assignment behind a null pointer check
  PCI: pciehp: Don't enable HPIE when resuming in poll mode
  PCI: Remove stray put_device() in pci_register_host_bridge()
  PCI/portdrv: Only disable pciehp interrupts early when needed
  PCI/ASPM: Fix link state exit during switch upstream function removal
  drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
  ALSA: hda/realtek: Always honor no_shutup_pins
  perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
  lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
  PM: sleep: Fix handling devices with direct_complete set on errors
  thermal: int340x: Add NULL check for adev
  EDAC/ie31200: Fix the error path order of ie31200_init()
  EDAC/ie31200: Fix the DIMM size mask for several SoCs
  EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
  selinux: Chain up tool resolving errors in install_policy.sh
  x86/platform: Only allow CONFIG_EISA for 32-bit
  x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
  cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
  x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
  serial: 8250_dma: terminate correct DMA in tx_dma_flush()
  memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
  net: usb: usbnet: restore usb%d name exception for local mac addresses
  net: usb: qmi_wwan: add Telit Cinterion FE990B composition
  net: usb: qmi_wwan: add Telit Cinterion FN990B composition
  tty: serial: 8250: Add some more device IDs
  counter: stm32-lptimer-cnt: fix error handling when enabling
  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  ARM: Remove address checking for MMUless devices
  ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
  ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
  atm: Fix NULL pointer dereference
  HID: hid-plantronics: Add mic mute mapping and generalize quirks
  ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
  drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
  batman-adv: Ignore own maximum aggregation size during RX
  ARM: shmobile: smp: Enforce shmobile_smp_* alignment
  mmc: atmel-mci: Add missing clk_disable_unprepare()
  drm/v3d: Don't run jobs that have errors flagged in its fence
  i2c: omap: fix IRQ storms
  net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
  net: atm: fix use after free in lec_send()
  ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
  ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
  Bluetooth: Fix error code in chan_alloc_skb_cb()
  RDMA/hns: Fix wrong value of max_sge_rd
  RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
  xfrm_output: Force software GSO only in tunnel mode
  firmware: imx-scu: fix OF node leak in .probe()
  i2c: sis630: Fix an error handling path in sis630_probe()
  i2c: ali15x3: Fix an error handling path in ali15x3_probe()
  i2c: ali1535: Fix an error handling path in ali1535_probe()
  ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
  drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
  qlcnic: fix memory leak issues in qlcnic_sriov_common.c
  drm/amd/display: Assign normalized_pix_clk when color depth = 14
  drm/atomic: Filter out redundant DPMS calls
  x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
  USB: serial: option: match on interface class for Telit FN990B
  USB: serial: option: fix Telit Cinterion FE990A name
  USB: serial: option: add Telit Cinterion FE990B compositions
  USB: serial: ftdi_sio: add support for Altera USB Blaster 3
  block: fix 'kmem_cache of name 'bio-108' already exists'
  drm/nouveau: Do not override forced connector status
  x86/irq: Define trace events conditionally
  fuse: don't truncate cached, mutated symlink
  nvme: only allow entering LIVE from CONNECTING state
  sctp: Fix undefined behavior in left shift operation
  nvmet-rdma: recheck queue state is LIVE in state lock in recv done
  ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
  s390/cio: Fix CHPID "configure" attribute caching
  HID: ignore non-functional sensor in HP 5MP Camera
  HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
  ACPI: resource: IRQ override for Eluktronics MECH-17
  scsi: qla1280: Fix kernel oops when debug level > 2
  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  powercap: call put_device() on an error path in powercap_register_control_type()
  hrtimers: Mark is_migration_base() with __always_inline
  nvme-fc: go straight to connecting state when initializing
  net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
  netfilter: nft_exthdr: fix offset with ipv4_find_option()
  net_sched: Prevent creation of classes with TC_H_ROOT
  ipvs: prevent integer overflow in do_ip_vs_get_ctl()
  netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
  Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
  drivers/hv: Replace binary semaphore with mutex
  netpoll: hold rcu read lock in __netpoll_send_skb()
  netpoll: netpoll_send_skb() returns transmit status
  netpoll: move netpoll_send_skb() out of line
  netpoll: remove dev argument from netpoll_send_skb_on_dev()
  netpoll: Fix use correct return type for ndo_start_xmit()
  pinctrl: bcm281xx: Fix incorrect regmap max_registers value
  sctp: sysctl: auth_enable: avoid using current->nsproxy
  sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
  Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
  Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
  sched/isolation: Prevent boot crash when the boot CPU is nohz_full
  clockevents/drivers/i8253: Fix stop sequence for timer 0
  vlan: fix memory leak in vlan_newlink()
  Revert "tasklet: Introduce new initialization API"
  Revert "net: usb: rtl8150: use new tasklet API"
  Revert "net: usb: rtl8150: enable basic endpoint checking"
  Revert "usb: xhci: Add timeout argument in address_device USB HCD callback"
  Revert "usb: xhci: Fix NULL pointer dereference on certain command aborts"
  Linux 5.4.291
  eeprom: digsy_mtc: Make GPIO lookup table match the device
  slimbus: messaging: Free transaction ID in delayed interrupt scenario
  intel_th: pci: Add Panther Lake-P/U support
  intel_th: pci: Add Panther Lake-H support
  intel_th: pci: Add Arrow Lake support
  Squashfs: check the inode number is not the invalid value of zero
  xhci: pci: Fix indentation in the PCI device ID definitions
  usb: gadget: Check bmAttributes only if configuration is valid
  usb: gadget: Fix setting self-powered state on suspend
  usb: gadget: Set self-powered based on MaxPower and bmAttributes
  usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
  usb: typec: ucsi: increase timeout for PPM reset operations
  usb: atm: cxacru: fix a flaw in existing endpoint checks
  usb: renesas_usbhs: Flush the notify_hotplug_work
  usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
  usb: renesas_usbhs: Use devm_usb_get_phy()
  usb: renesas_usbhs: Call clk_put()
  Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
  gpio: rcar: Fix missing of_node_put() call
  net: ipv6: fix missing dst ref drop in ila lwtunnel
  net: ipv6: fix dst ref loop in ila lwtunnel
  net-timestamp: support TCP GSO case for a few missing flags
  vlan: enforce underlying device type
  ppp: Fix KMSAN uninit-value warning with bpf
  be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
  drm/sched: Fix preprocessor guard
  hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
  llc: do not use skb_get() before dev_queue_xmit()
  hwmon: (ad7314) Validate leading zero bits and return error
  hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
  hwmon: (pmbus) Initialise page count in pmbus_identify()
  caif_virtio: fix wrong pointer check in cfv_probe()
  net: gso: fix ownership in __udp_gso_segment
  HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
  HID: google: fix unused variable warning under !CONFIG_ACPI
  wifi: iwlwifi: limit printed string from FW file
  mm/page_alloc: fix uninitialized variable
  rapidio: fix an API misues when rio_add_net() fails
  rapidio: add check for rio_add_net() in rio_scan_alloc_net()
  wifi: nl80211: reject cooked mode if it is set along with other flags
  wifi: cfg80211: regulatory: improve invalid hints checking
  x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
  x86/cpu: Validate CPUID leaf 0x2 EDX output
  x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
  platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
  drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
  ALSA: hda/realtek: update ALC222 depop optimize
  ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
  HID: appleir: Fix potential NULL dereference at raw event handle
  Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
  drm/amdgpu: disable BAR resize on Dell G5 SE
  drm/amdgpu: Check extended configuration space register when system uses large bar
  drm/amdgpu: skip BAR resizing if the bios already did it
  acct: perform last write from workqueue
  kernel/acct.c: use dedicated helper to access rlimit values
  kernel/acct.c: use #elif instead of #end and #elif
  drop_monitor: fix incorrect initialization order
  pfifo_tail_enqueue: Drop new packet when sch->limit == 0
  sched/core: Prevent rescheduling when interrupts are disabled
  phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
  phy: tegra: xusb: reset VBUS & ID OVERRIDE
  usbnet: gl620a: fix endpoint checking in genelink_bind()
  perf/core: Fix low freq setting via IOC_PERIOD
  ftrace: Avoid potential division by zero in function_stat_show()
  x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
  net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
  ipvs: Always clear ipvs_property flag in skb_scrub_packet()
  ASoC: es8328: fix route from DAC to output
  net: cadence: macb: Synchronize stats calculations
  net: loopback: Avoid sending IP packets without an Ethernet header
  sunrpc: suppress warnings for unused procfs functions
  batman-adv: Drop unmanaged ELP metric worker
  batman-adv: Ignore neighbor throughput metrics in error case
  acct: block access to kernel internal filesystems
  ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
  nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
  tee: optee: Fix supplicant wait loop
  power: supply: da9150-fg: fix potential overflow
  flow_dissector: Fix port range key handling in BPF conversion
  flow_dissector: Fix handling of mixed port and port-range keys
  net: extract port range fields from fl_flow_key
  geneve: Suppress list corruption splat in geneve_destroy_tunnels().
  gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
  geneve: Fix use-after-free in geneve_find_dev().
  powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
  ALSA: hda/realtek: Fixup ALC225 depop procedure
  ALSA: hda/realtek - Add type for ALC287
  powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
  powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
  USB: gadget: f_midi: f_midi_complete to call queue_work
  usb/gadget: f_midi: Replace tasklet with work
  usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API
  usb: dwc3: Fix timeout issue during controller enter/exit from halt state
  usb: dwc3: Increase DWC3 controller halt timeout
  memcg: fix soft lockup in the OOM process
  mm: update mark_victim tracepoints fields
  crypto: testmgr - some more fixes to RSA test vectors
  crypto: testmgr - populate RSA CRT parameters in RSA test vectors
  crypto: testmgr - fix version number of RSA tests
  crypto: testmgr - Fix wrong test case of RSA
  crypto: testmgr - fix wrong key length for pkcs1pad
  driver core: bus: Fix double free in driver API bus_register()
  scsi: storvsc: Set correct data length for sending SCSI command without payload
  vlan: move dev_put into vlan_dev_uninit
  vlan: introduce vlan_dev_free_egress_priority
  ima: Fix use-after-free on a dentry's dname.name
  pps: Fix a use-after-free
  btrfs: avoid monopolizing a core when activating a swap file
  Revert "btrfs: avoid monopolizing a core when activating a swap file"
  x86/i8253: Disable PIT timer 0 when not in use
  parport_pc: add support for ASIX AX99100
  serial: 8250_pci: add support for ASIX AX99100
  can: ems_pci: move ASIX AX99100 ids to pci_ids.h
  nilfs2: protect access to buffers with no active references
  nilfs2: do not force clear folio if buffer is referenced
  nilfs2: do not output warnings when clearing dirty buffers
  alpha: replace hardcoded stack offsets with autogenerated ones
  ndisc: extend RCU protection in ndisc_send_skb()
  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  arp: use RCU protection in arp_xmit()
  neighbour: use RCU protection in __neigh_notify()
  neighbour: delete redundant judgment statements
  ndisc: use RCU protection in ndisc_alloc_skb()
  ipv6: use RCU protection in ip6_default_advmss()
  ipv4: use RCU protection in inet_select_addr()
  ipv4: use RCU protection in rt_is_expired()
  net: add dev_net_rcu() helper
  net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  regmap-irq: Add missing kfree()
  partitions: mac: fix handling of bogus partition table
  gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
  alpha: align stack for page fault and user unaligned trap handlers
  serial: 8250: Fix fifo underflow on flush
  alpha: make stack 16-byte aligned (most cases)
  can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
  can: c_can: fix unbalanced runtime PM disable in error path
  USB: serial: option: drop MeiG Smart defines
  USB: serial: option: fix Telit Cinterion FN990A name
  USB: serial: option: add Telit Cinterion FN990B compositions
  USB: serial: option: add MeiG Smart SLM828
  usb: cdc-acm: Fix handling of oversized fragments
  usb: cdc-acm: Check control transfer buffer size before access
  USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
  USB: hub: Ignore non-compliant devices with too many configs or interfaces
  usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
  USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
  USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
  USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
  usb: dwc2: gadget: remove of_node reference upon udc_stop
  usb: gadget: udc: renesas_usb3: Fix compiler warning
  usb: roles: set switch registered flag early on
  batman-adv: fix panic during interface removal
  ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
  orangefs: fix a oob in orangefs_debug_write
  Grab mm lock before grabbing pt lock
  vfio/pci: Enable iowrite64 and ioread64 for vfio pci
  media: cxd2841er: fix 64-bit division on gcc-9
  x86/xen: allow larger contiguous memory regions in PV guests
  xen: remove a confusing comment on auto-translated guest I/O
  gpio: bcm-kona: Add missing newline to dev_err format string
  gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
  gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
  team: better TEAM_OPTION_TYPE_STRING validation
  vrf: use RCU protection in l3mdev_l3_out()
  ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
  HID: multitouch: Add NULL check in mt_input_configured
  ocfs2: check dir i_size in ocfs2_find_entry
  MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
  ptp: Ensure info->enable callback is always set
  net/ncsi: wait for the last response to Deselect Package before configuring channel
  misc: fastrpc: Fix registered buffer page address
  mtd: onenand: Fix uninitialized retlen in do_otp_read()
  NFC: nci: Add bounds checking in nci_hci_create_pipe()
  nilfs2: fix possible int overflows in nilfs_fiemap()
  ocfs2: handle a symlink read error correctly
  ocfs2: fix incorrect CPU endianness conversion causing mount failure
  vfio/platform: check the bounds of read/write syscalls
  nvmem: core: improve range check for nvmem_cell_write()
  crypto: qce - unregister previously registered algos in error path
  crypto: qce - fix goto jump in error path
  media: uvcvideo: Remove redundant NULL assignment
  media: uvcvideo: Fix event flags in uvc_ctrl_send_events
  media: ov5640: fix get_light_freq on auto
  soc: qcom: smem_state: fix missing of_node_put in error path
  kbuild: Move -Wenum-enum-conversion to W=2
  powerpc/pseries/eeh: Fix get PE state translation
  serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
  serial: sh-sci: Drop __initdata macro for port_cfg
  soc: qcom: socinfo: Avoid out of bounds read of serial number
  usb: gadget: f_tcm: Don't prepare BOT write request twice
  usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
  usb: gadget: f_tcm: Decrement command ref count on cleanup
  usb: gadget: f_tcm: Translate error to sense
  wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
  HID: hid-sensor-hub: don't use stale platform-data on remove
  of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
  of: Fix of_find_node_opts_by_path() handling of alias+path+options
  of: Correct child specifier used as input of the 2nd nexus node
  perf bench: Fix undefined behavior in cmpworker()
  clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
  clk: qcom: clk-alpha-pll: fix alpha mode configuration
  Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  drm/komeda: Add check for komeda_get_layer_fourcc_list()
  KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
  KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
  arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
  binfmt_flat: Fix integer overflow bug on 32 bit systems
  m68k: vga: Fix I/O defines
  s390/futex: Fix FUTEX_OP_ANDN implementation
  leds: lp8860: Write full EEPROM, not only half of it
  cpufreq: s3c64xx: Fix compilation warning
  tun: revert fix group permission check
  netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
  net: rose: lock the socket in rose_bind()
  udp: gso: do not drop small packets when PMTU reduces
  tg3: Disable tg3 PCIe AER on system reboot
  gpu: drm_dp_cec: fix broken CEC adapter properties check
  firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
  nvme: handle connectivity loss in nvme_set_queue_count
  usb: xhci: Fix NULL pointer dereference on certain command aborts
  usb: xhci: Add timeout argument in address_device USB HCD callback
  net: usb: rtl8150: enable basic endpoint checking
  net: usb: rtl8150: use new tasklet API
  tasklet: Introduce new initialization API
  kbuild: userprogs: use correct lld when linking through clang
  sched: sch_cake: add bounds checks to host bulk flow fairness counts
  media: uvcvideo: Remove dangling pointers
  media: uvcvideo: Only save async fh if success
  nilfs2: handle errors that nilfs_prepare_chunk() may return
  nilfs2: eliminate staggered calls to kunmap in nilfs_rename
  nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link
  spi-mxs: Fix chipselect glitch
  x86/mm: Don't disable PCID when INVLPG has been fixed by microcode
  APEI: GHES: Have GHES honor the panic= setting
  HID: Wacom: Add PCI Wacom device support
  mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
  tomoyo: don't emit warning in tomoyo_write_control()
  wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
  mmc: core: Respect quirk_max_rate for non-UHS SDIO card
  tun: fix group permission check
  printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
  x86/amd_nb: Restrict init function to AMD-based systems
  sched: Don't try to catch up excess steal time.
  btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
  btrfs: fix use-after-free when attempting to join an aborted transaction
  btrfs: output the reason for open_ctree() failure
  usb: gadget: f_tcm: Don't free command immediately
  media: uvcvideo: Fix double free in error path
  HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
  usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
  drivers/card_reader/rtsx_usb: Restore interrupt based detection
  ktest.pl: Check kernelrelease return in get_version
  NFSD: Reset cb_seq_status after NFS4ERR_DELAY
  hexagon: Fix unbalanced spinlock in die()
  hexagon: fix using plain integer as NULL pointer warning in cmpxchg
  genksyms: fix memory leak when the same symbol is read from *.symref file
  genksyms: fix memory leak when the same symbol is added from source
  net: sh_eth: Fix missing rtnl lock in suspend/resume path
  vsock: Allow retrying on connect() failure
  perf trace: Fix runtime error of index out of bounds
  net: davicom: fix UAF in dm9000_drv_remove
  net: rose: fix timer races against user threads
  PM: hibernate: Add error handling for syscore_suspend()
  ipmr: do not call mr_mfc_uses_dev() for unres entries
  net: fec: implement TSO descriptor cleanup
  ubifs: skip dumping tnc tree when zroot is null
  rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
  dmaengine: ti: edma: fix OF node reference leaks in edma_driver
  module: Extend the preempt disabled section in dereference_symbol_descriptor().
  ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
  scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
  scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
  staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
  media: uvcvideo: Propagate buf->error to userspace
  media: camif-core: Add check for clk_enable()
  media: mipi-csis: Add check for clk_enable()
  PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
  media: lmedm04: Handle errors for lme2510_int_read
  media: lmedm04: Use GFP_KERNEL for URB allocation/submission.
  media: rc: iguanair: handle timeouts
  fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
  ARM: dts: mediatek: mt7623: fix IR nodename
  arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
  arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
  rdma/cxgb4: Prevent potential integer overflow on 32bit
  RDMA/mlx4: Avoid false error about access to uninitialized gids array
  bpf: Send signals asynchronously if !preemptible
  perf report: Fix misleading help message about --demangle
  perf top: Don't complain about lack of vmlinux when not resolving some kernel samples
  padata: fix sysfs store callback check
  ktest.pl: Remove unused declarations in run_bisect_test function
  perf header: Fix one memory leakage in process_bpf_prog_info()
  perf header: Fix one memory leakage in process_bpf_btf()
  ASoC: sun4i-spdif: Add clock multiplier settings
  tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
  net: sched: Disallow replacing of child qdisc from one parent to another
  net/mlxfw: Drop hard coded max FW flash image size
  net: let net.core.dev_weight always be non-zero
  clk: analogbits: Fix incorrect calculation of vco rate delta
  selftests: harness: fix printing of mismatch values in __EXPECT()
  selftests/harness: Display signed values correctly
  wifi: wlcore: fix unbalanced pm_runtime calls
  regulator: of: Implement the unwind path of of_regulator_match()
  team: prevent adding a device which is already a team device lower
  cpupower: fix TSC MHz calculation
  wifi: rtlwifi: pci: wait for firmware loading before releasing memory
  wifi: rtlwifi: fix memory leaks and invalid access at probe error path
  wifi: rtlwifi: remove unused check_buddy_priv
  wifi: rtlwifi: remove unused dualmac control leftovers
  wifi: rtlwifi: remove unused timer and related code
  rtlwifi: replace usage of found with dedicated list iterator variable
  dt-bindings: mmc: controller: clarify the address-cells description
  wifi: rtlwifi: usb: fix workqueue leak when probe fails
  wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
  rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg
  wifi: rtlwifi: do not complete firmware loading needlessly
  ipmi: ipmb: Add check devm_kasprintf() returned value
  drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
  drm/etnaviv: Fix page property being used for non writecombine buffers
  partitions: ldm: remove the initial kernel-doc notation
  nbd: don't allow reconnect after disconnect
  afs: Fix directory format encoding struct
  overflow: Allow mixed type arguments
  overflow: Correct check_shl_overflow() comment
  overflow: Add __must_check attribute to check_*() helpers
  udf: Fix use of check_add_overflow() with mixed type arguments
  perf cs-etm: Add missing variable in cs_etm__process_queues()

 Conflicts:
	Documentation/devicetree/bindings/mmc/mmc-controller.yaml
	Documentation/devicetree/bindings~HEAD
	drivers/clk/qcom/clk-alpha-pll.c
	drivers/soc/qcom/socinfo.c
	drivers/usb/dwc3/gadget.c
	mm/oom_kill.c
	scripts/Makefile.extrawarn

Change-Id: I599df88164649e325b40d25cb1a8e64e5fd27cf0
 2025-05-18 08:00:20 +00:00
lixiong
1f82cea219
 		arm64: dts: qcom: Fix missing thermal cooling device thermal-cpufreq-0 
Description: lack thermal cooling device thermal-cpufreq-0, and small cpu
core is limited to 576M during running ES.

Change-Id: Ib8b19c22ca569b5f35700e6c65913100b96a13ea
Reviewed-on: https://gerrit.mot.com/3205502
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Wei Wei <weiweij@motorola.com>
Reviewed-by: Huosheng Liao <liaohs@motorola.com>
Reviewed-by: <zzy103@motorola.com>
Submit-Approved: Jira Key
 2025-05-05 10:06:09 +03:00
Hardik Gajjar
0db4cc475d
 		usb: gadget: f_ncm: Always set current gadget in ncm_bind() 
[ Upstream commit a04224da1f3424b2c607b12a3bd1f0e302fb8231 ]

Previously, gadget assignment to the net device occurred exclusively
during the initial binding attempt.

Nevertheless, the gadget pointer could change during bind/unbind
cycles due to various conditions, including the unloading/loading
of the UDC device driver or the detachment/reconnection of an
OTG-capable USB hub device.

This patch relocates the gether_set_gadget() function out from
ncm_opts->bound condition check, ensuring that the correct gadget
is assigned during each bind request.

The provided logs demonstrate the consistency of ncm_opts throughout
the power cycle, while the gadget may change.

* OTG hub connected during boot up and assignment of gadget and
  ncm_opts pointer

[    2.366301] usb 2-1.5: New USB device found, idVendor=2996, idProduct=0105
[    2.366304] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[    2.366306] usb 2-1.5: Product: H2H Bridge
[    2.366308] usb 2-1.5: Manufacturer: Aptiv
[    2.366309] usb 2-1.5: SerialNumber: 13FEB2021
[    2.427989] usb 2-1.5: New USB device found, VID=2996, PID=0105
[    2.428959] dabridge 2-1.5:1.0: dabridge 2-4 total endpoints=5, 0000000093a8d681
[    2.429710] dabridge 2-1.5:1.0: P(0105) D(22.06.22) F(17.3.16) H(1.1) high-speed
[    2.429714] dabridge 2-1.5:1.0: Hub 2-2 P(0151) V(06.87)
[    2.429956] dabridge 2-1.5:1.0: All downstream ports in host mode

[    2.430093] gadget 000000003c414d59 ------> gadget pointer

* NCM opts and associated gadget pointer during First ncm_bind

[   34.763929] NCM opts 00000000aa304ac9
[   34.763930] NCM gadget 000000003c414d59

* OTG capable hub disconnecte or assume driver unload.

[   97.203114] usb 2-1: USB disconnect, device number 2
[   97.203118] usb 2-1.1: USB disconnect, device number 3
[   97.209217] usb 2-1.5: USB disconnect, device number 4
[   97.230990] dabr_udc deleted

* Reconnect the OTG hub or load driver assaign new gadget pointer.

[  111.534035] usb 2-1.1: New USB device found, idVendor=2996, idProduct=0120, bcdDevice= 6.87
[  111.534038] usb 2-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  111.534040] usb 2-1.1: Product: Vendor
[  111.534041] usb 2-1.1: Manufacturer: Aptiv
[  111.534042] usb 2-1.1: SerialNumber: Superior
[  111.535175] usb 2-1.1: New USB device found, VID=2996, PID=0120
[  111.610995] usb 2-1.5: new high-speed USB device number 8 using xhci-hcd
[  111.630052] usb 2-1.5: New USB device found, idVendor=2996, idProduct=0105, bcdDevice=21.02
[  111.630055] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  111.630057] usb 2-1.5: Product: H2H Bridge
[  111.630058] usb 2-1.5: Manufacturer: Aptiv
[  111.630059] usb 2-1.5: SerialNumber: 13FEB2021
[  111.687464] usb 2-1.5: New USB device found, VID=2996, PID=0105
[  111.690375] dabridge 2-1.5:1.0: dabridge 2-8 total endpoints=5, 000000000d87c961
[  111.691172] dabridge 2-1.5:1.0: P(0105) D(22.06.22) F(17.3.16) H(1.1) high-speed
[  111.691176] dabridge 2-1.5:1.0: Hub 2-6 P(0151) V(06.87)
[  111.691646] dabridge 2-1.5:1.0: All downstream ports in host mode

[  111.692298] gadget 00000000dc72f7a9 --------> new gadget ptr on connect

* NCM opts and associated gadget pointer during second ncm_bind

[  113.271786] NCM opts 00000000aa304ac9 -----> same opts ptr used during first bind
[  113.271788] NCM gadget 00000000dc72f7a9 ----> however new gaget ptr, that will not set
                                                 in net_device due to ncm_opts->bound = true

Change-Id: I803f892ccd2a0f9558d4f32d8a3104aba78353ff
Signed-off-by: Hardik Gajjar <hgajjar@de.adit-jv.com>
Link: https://lore.kernel.org/r/20231020153324.82794-1-hgajjar@de.adit-jv.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2025-04-26 21:17:22 +03:00
Lorenzo Colitti
305e9e4cf9
 		FROMGIT: usb: gadget: u_ether: support configuring interface names. 
This patch allows the administrator to configure the interface
name of a function using u_ether (e.g., eem, ncm, rndis).

Currently, all such interfaces, regardless of function type, are
always called usb0, usb1, etc. This makes it very cumbersome to
use more than one such type at a time, because userspace cannnot
easily tell the interfaces apart and apply the right
configuration to each one. Interface renaming in userspace based
on driver doesn't help, because the interfaces all have the same
driver. Without this patch, doing this require hacks/workarounds
such as setting fixed MAC addresses on the functions, and then
renaming by MAC address, or scraping configfs after each
interface is created to find out what it is.

Setting the interface name is done by writing to the same
"ifname" configfs attribute that reports the interface name after
the function is bound. The write must contain an interface
pattern such as "usb%d" (which will cause the net core to pick
the next available interface name starting with "usb").
This patch does not allow writing an exact interface name (as
opposed to a pattern) because if the interface already exists at
bind time, the bind will fail and the whole gadget will fail to
activate. This could be allowed in a future patch.

For compatibility with current userspace, when reading an ifname
that has not currently been set, the result is still "(unnamed
net_device)". Once a write to ifname happens, then reading ifname
will return whatever was last written.

Tested by configuring an rndis function and an ncm function on
the same gadget, and writing "rndis%d" to ifname on the rndis
function and "ncm%d" to ifname on the ncm function. When the
gadget was bound, the rndis interface was rndis0 and the ncm
interface was ncm0.

Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit 63d152149b2d0860ccf8c4e6596b6175b2b7ace6
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
Link: https://lore.kernel.org/r/20210113234222.3272933-1-lorenzo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Change-Id: I04deb6cc1d8a5b8ee82404940de2a79c06fbafe7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2025-04-26 21:17:22 +03:00
Jack Pham
3e79ef2602
 		usb: gadget: f_ncm: Revert to upstream 
Revert the following changes to restore to upstream version:

commit 006d8adf55 ("usb: gadget: f_ncm: allocate/free net device upon driver bind/unbind")
commit ad2d551ece ("usb: gadget: Add check gadget function bind or not")

Reason for revert: Causes gether_set_ifname() support to kernel panic.

Change-Id: I51064467cad63e47a4a9734f18f1a5b95fa8db86
 2025-04-26 21:17:21 +03:00
Sevenrock
365ffb9892
 		mm: page_owner: Fix -Wstrlcpy-strlcat-size 
mm/page_owner.c:944:39: error:
 size argument in 'strlcpy' call appears to be size of the source;
 expected the size of the destination [-Werror,-Wstrlcpy-strlcat-size]
  944 |         strlcpy(call_site->name, buf, strlen(buf));
      |                                       ~~~~~~~^~~~
mm/page_owner.c:944:32: note:
 change size argument to be the size of the destination
  944 |         strlcpy(call_site->name, buf, strlen(buf));
      |                                       ^~~~~~~~~~~
      |                                       sizeof(call_site->name)

https://github.com/LineageOS/android_kernel_qcom_sm8450/blob/lineage-20/drivers/soc/qcom/minidump_memory.c#L692
contains the same code.

Change-Id: Id06f67fe18f2e00dd180afaf99c7577787198cc3
Signed-off-by: Sevenrock <sevenrock@hotmail.de>
 2025-04-26 21:17:21 +03:00
LuK1337
20d7404d1e
 		Revert "hrtimers: Handle CPU state correctly on hotplug" 
Causes sleep of death.

This reverts commit 95e4f62df2.

Change-Id: Id3e5f5a71b7d2d57aaa1b9bba7b4ef02221bdba7
 2025-04-26 12:28:45 +02:00
Greg Kroah-Hartman
1aec9e76fe Merge tag 'android11-5.4.292_r00' into android11-5.4 
This merges the android11-5.4.292_r00 tag into the android11-5.4 branch,
catching it up with the latest LTS releases.

It contains the following commits:

*   9b78f083cb Merge 5.4.292 into android11-5.4-lts
|\
| * 1b01d9c341 Linux 5.4.292
| * 2809029821 jfs: add index corruption check to DT_GETPAGE()
| * 3d6fd5b9c6 jfs: fix slab-out-of-bounds read in ea_get()
| * 42561fe62c tracing: Fix use-after-free in print_graph_function_flags during tracer switching
| * 922a70031c mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
| * a7d0f84a31 ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
| * 618d5612ec x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
| * c0189c02b5 x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
| * 2414095a8c ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
| * a1ef4447b8 can: flexcan: only change CAN state when link up in system PM
| * 661cf5d102 arcnet: Add NULL check in com20020pci_probe()
| * 5309432c67 net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
| * 87c53a1c65 ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
| * 42df95e5ea vsock: avoid timeout during connect() if the socket is closing
| * 7abc8318ce net_sched: skbprio: Remove overly strict queue assertions
| * 1ad9166cab netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
| * b9f2980327 ntb: intel: Fix using link status DB's
| * f56951f211 ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
| * 829bd61399 spufs: fix a leak in spufs_create_context()
| * b1eef06d10 spufs: fix a leak on spufs_new_file() failure
| * 5214156633 hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
| * 12d344d74c can: statistics: use atomic access in hot path
| * d6ae75c3ba locking/semaphore: Use wake_q to wake up processes outside lock critical section
| * 0ab44f03c5 sched/deadline: Use online cpus for validating runtime
| * 04039a3806 affs: don't write overlarge OFS data block size fields
| * 739499e146 affs: generate OFS sequence numbers starting at 1
| * f5302f6786 wifi: iwlwifi: fw: allocate chained SG tables for dump
| * 99bd64445f sched/smt: Always inline sched_smt_active()
| * da3b90f71b octeontx2-af: Fix mbox INTR handler when num VFs > 64
| * 4a760b682e ring-buffer: Fix bytes_dropped calculation issue
| * 536f7f3595 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
| * 6601c04a87 fs/procfs: fix the comment above proc_pid_wchan()
| * 38dffe995b perf python: Check if there is space to copy all the event
| * 213ee3d738 perf python: Decrement the refcount of just created event on failure
| * 58edf5e6a3 perf python: Fixup description of sample.id event member
| * ef34840bda ocfs2: validate l_tree_depth to avoid out-of-bounds access
| * 8a3ebead12 kexec: initialize ELF lowest address to ULONG_MAX
| * 466806997a perf units: Fix insufficient array space
| * d1696caf8b iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
| * 61c6dc3b55 coresight: catu: Fix number of pages while using 64k pages
| * 99c737ec34 isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
| * 85a17b9ab3 x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
| * 2bf98cc76b mfd: sm501: Switch to BIT() to mitigate integer overflows
| * 3b97d77049 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
| * a4be0b575a power: supply: max77693: Fix wrong conversion of charge input threshold value
| * b26152f504 x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
| * 62ae4a1b29 clk: amlogic: g12a: fix mmc A peripheral clock
| * 450a1d9eac clk: amlogic: gxbb: drop non existing 32k clock parent
| * d15e95d7b8 clk: amlogic: g12b: fix cluster A parent data
| * 0c23a6f147 IB/mad: Check available slots before posting receive WRs
| * 64f805c30c clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
| * f53c2937ab pinctrl: renesas: rza2: Fix missing of_node_put() call
| * 37e63b0af9 lib: 842: Improve error handling in sw842_compress()
| * 794d6b4b4e bpf: Use preempt_count() directly in bpf_send_signal_common()
| * 671760004d clk: amlogic: gxbb: drop incorrect flag on 32k clock
| * 90ab169fb9 fbdev: sm501fb: Add some geometry checks.
| * 38b9a21a75 mdacon: rework dependency list
| * ab846209f4 fbdev: au1100fb: Move a variable assignment behind a null pointer check
| * ed8bf338d7 PCI: pciehp: Don't enable HPIE when resuming in poll mode
| * 70a83ba1df PCI: Remove stray put_device() in pci_register_host_bridge()
| * c6f9613a22 PCI/portdrv: Only disable pciehp interrupts early when needed
| * 0a0f9aecf6 PCI/ASPM: Fix link state exit during switch upstream function removal
| * 6038b90cdf drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
| * b66baefc08 ALSA: hda/realtek: Always honor no_shutup_pins
| * fc50ed312c perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
| * c6d87a552c lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
| * 41b5a58878 PM: sleep: Fix handling devices with direct_complete set on errors
| * d0d21c8e44 thermal: int340x: Add NULL check for adev
| * cc4b161029 EDAC/ie31200: Fix the error path order of ie31200_init()
| * 563493f22c EDAC/ie31200: Fix the DIMM size mask for several SoCs
| * eb96456b70 EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
| * 095a5cba17 selinux: Chain up tool resolving errors in install_policy.sh
| * e6748cbbbd x86/platform: Only allow CONFIG_EISA for 32-bit
| * 3b2e1ce751 x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
| * 73cee9b56a cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
| * c918f836a4 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
| * 0d510e175b serial: 8250_dma: terminate correct DMA in tx_dma_flush()
| * 914c5e5bfc memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
| * e206041b55 net: usb: usbnet: restore usb%d name exception for local mac addresses
| * 52ea3f5803 net: usb: qmi_wwan: add Telit Cinterion FE990B composition
| * c960ab007a net: usb: qmi_wwan: add Telit Cinterion FN990B composition
| * 16eed55a08 tty: serial: 8250: Add some more device IDs
| * b7e4d3d707 counter: stm32-lptimer-cnt: fix error handling when enabling
| * 6488b96a79 netfilter: socket: Lookup orig tuple for IPv6 SNAT
| * 0387a57cc9 ARM: Remove address checking for MMUless devices
| * 1c078dadb4 ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
| * 11bb05969b ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
| * ab92f51c7f atm: Fix NULL pointer dereference
| * b93e9fd3ee HID: hid-plantronics: Add mic mute mapping and generalize quirks
| * ece47d9213 ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
| * 0effb378eb drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
| * 9bd50100ee batman-adv: Ignore own maximum aggregation size during RX
| * 8310e6a1c9 ARM: shmobile: smp: Enforce shmobile_smp_* alignment
| * 450cd5f5fe mmc: atmel-mci: Add missing clk_disable_unprepare()
| * a354b8bbdf drm/v3d: Don't run jobs that have errors flagged in its fence
| * d3e4439a79 i2c: omap: fix IRQ storms
| * 9dcf9db183 net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
| * 50e288097c net: atm: fix use after free in lec_send()
| * f400408c5e ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
| * 16267a5036 ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
| * b3d607e36f Bluetooth: Fix error code in chan_alloc_skb_cb()
| * 2cf5228644 RDMA/hns: Fix wrong value of max_sge_rd
| * 7cfd80fa58 RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
| * 4f0f83799a xfrm_output: Force software GSO only in tunnel mode
| * d541325120 firmware: imx-scu: fix OF node leak in .probe()
| * c9e2b3b231 i2c: sis630: Fix an error handling path in sis630_probe()
| * 20521ee78c i2c: ali15x3: Fix an error handling path in ali15x3_probe()
| * 75148adf8c i2c: ali1535: Fix an error handling path in ali1535_probe()
| * f26d827172 ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
| * 5d45755de5 drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
| * 880295b68a qlcnic: fix memory leak issues in qlcnic_sriov_common.c
| * cca3ab74f9 drm/amd/display: Assign normalized_pix_clk when color depth = 14
| * 31ed3586f4 drm/atomic: Filter out redundant DPMS calls
| * d509c47310 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
| * 2175d3c126 USB: serial: option: match on interface class for Telit FN990B
| * f26a86f829 USB: serial: option: fix Telit Cinterion FE990A name
| * 57f6ae8b88 USB: serial: option: add Telit Cinterion FE990B compositions
| * abb9f684f8 USB: serial: ftdi_sio: add support for Altera USB Blaster 3
| * 8d8e2c9961 block: fix 'kmem_cache of name 'bio-108' already exists'
| * f6e43f6aea drm/nouveau: Do not override forced connector status
| * f8e635b762 x86/irq: Define trace events conditionally
| * 34468b2e39 fuse: don't truncate cached, mutated symlink
| * e7fa90c0cb nvme: only allow entering LIVE from CONNECTING state
| * 36256b2447 sctp: Fix undefined behavior in left shift operation
| * 72f676364d nvmet-rdma: recheck queue state is LIVE in state lock in recv done
| * 3dbbc37db8 ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
| * 8b3c9b69fa s390/cio: Fix CHPID "configure" attribute caching
| * 9af297aea8 HID: ignore non-functional sensor in HP 5MP Camera
| * bfa6d90db3 HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
| * cc4d9d3a1e ACPI: resource: IRQ override for Eluktronics MECH-17
| * afa27b7c17 scsi: qla1280: Fix kernel oops when debug level > 2
| * a858cd58de iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
| * 6752747a11 powercap: call put_device() on an error path in powercap_register_control_type()
| * 66beda69bb hrtimers: Mark is_migration_base() with __always_inline
| * 27b2f3dc04 nvme-fc: go straight to connecting state when initializing
| * bb728b5521 net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
| * aaeefb9868 netfilter: nft_exthdr: fix offset with ipv4_find_option()
| * e05d9938b1 net_sched: Prevent creation of classes with TC_H_ROOT
| * ab45c0ee54 ipvs: prevent integer overflow in do_ip_vs_get_ctl()
| * f522229c55 netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
| * ca61dc0c2f Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
| * 1485aaf8d7 drivers/hv: Replace binary semaphore with mutex
| * 6a3c34e875 netpoll: hold rcu read lock in __netpoll_send_skb()
| * 413691c54e netpoll: netpoll_send_skb() returns transmit status
| * e3235e0486 netpoll: move netpoll_send_skb() out of line
| * ddf5458095 netpoll: remove dev argument from netpoll_send_skb_on_dev()
| * 0945ed0e62 netpoll: Fix use correct return type for ndo_start_xmit()
| * 9cc1b39f5a pinctrl: bcm281xx: Fix incorrect regmap max_registers value
| * cf387cdebf sctp: sysctl: auth_enable: avoid using current->nsproxy
| * 5599b212d2 sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
| * 19573dcddb Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
| * 2ced96df87 Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
| * 769f2099d9 sched/isolation: Prevent boot crash when the boot CPU is nohz_full
| * 9f89d4ad21 clockevents/drivers/i8253: Fix stop sequence for timer 0
| * 549de58dba vlan: fix memory leak in vlan_newlink()
* | 51aa3bfef8 Revert "tasklet: Introduce new initialization API"
* | fa82985d52 Revert "net: usb: rtl8150: use new tasklet API"
* | 2461d9a37e Revert "net: usb: rtl8150: enable basic endpoint checking"
* | eb00272aa5 Revert "usb: xhci: Add timeout argument in address_device USB HCD callback"
* | 4364e0f8cf Revert "usb: xhci: Fix NULL pointer dereference on certain command aborts"
* | d6a7c6fab0 Merge 5.4.291 into android11-5.4-lts
|\|
| * 52bcf31d8e Linux 5.4.291
| * 7f24cff72a eeprom: digsy_mtc: Make GPIO lookup table match the device
| * cec8c0ac17 slimbus: messaging: Free transaction ID in delayed interrupt scenario
| * 5619084876 intel_th: pci: Add Panther Lake-P/U support
| * 3940fe7d0c intel_th: pci: Add Panther Lake-H support
| * 8740a9ddc4 intel_th: pci: Add Arrow Lake support
| * 32c114a582 Squashfs: check the inode number is not the invalid value of zero
| * e722515dab xhci: pci: Fix indentation in the PCI device ID definitions
| * 19b3918840 usb: gadget: Check bmAttributes only if configuration is valid
| * 9af1d5c4d5 usb: gadget: Fix setting self-powered state on suspend
| * 7367e87b6e usb: gadget: Set self-powered based on MaxPower and bmAttributes
| * 094b49dec3 usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
| * b654e4c757 usb: typec: ucsi: increase timeout for PPM reset operations
| * dcd592ab9d usb: atm: cxacru: fix a flaw in existing endpoint checks
| * 4cd847a7b6 usb: renesas_usbhs: Flush the notify_hotplug_work
| * a5c8be5903 usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
| * 97f8c81570 usb: renesas_usbhs: Use devm_usb_get_phy()
| * d1968edada usb: renesas_usbhs: Call clk_put()
| * 0971d857c2 Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
| * efbddfb96c gpio: rcar: Fix missing of_node_put() call
| * a3895a367f net: ipv6: fix missing dst ref drop in ila lwtunnel
| * c2fb9104b3 net: ipv6: fix dst ref loop in ila lwtunnel
| * 4ca4dce141 net-timestamp: support TCP GSO case for a few missing flags
| * 7f1564b2b2 vlan: enforce underlying device type
| * d685096c81 ppp: Fix KMSAN uninit-value warning with bpf
| * 797bb9439c be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
| * f5a7fa426a drm/sched: Fix preprocessor guard
| * 7a115f431b hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
| * cd1c44327b llc: do not use skb_get() before dev_queue_xmit()
| * b205ac53a6 hwmon: (ad7314) Validate leading zero bits and return error
| * 90b2aee418 hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
| * d51369e720 hwmon: (pmbus) Initialise page count in pmbus_identify()
| * 990fff6980 caif_virtio: fix wrong pointer check in cfv_probe()
| * 9f28205ddb net: gso: fix ownership in __udp_gso_segment
| * 0c1fb475ef HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
| * 8ecee2b056 HID: google: fix unused variable warning under !CONFIG_ACPI
| * 38f0d398b6 wifi: iwlwifi: limit printed string from FW file
| * b7f3090f19 mm/page_alloc: fix uninitialized variable
| * d4ec862ce8 rapidio: fix an API misues when rio_add_net() fails
| * 6d22953c4a rapidio: add check for rio_add_net() in rio_scan_alloc_net()
| * 5ea856d937 wifi: nl80211: reject cooked mode if it is set along with other flags
| * 62b1a9bbfe wifi: cfg80211: regulatory: improve invalid hints checking
| * 62c602f3c7 x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
| * c67b103a8d x86/cpu: Validate CPUID leaf 0x2 EDX output
| * 0d1275424f x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
| * 9616539e62 platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
| * 1f75482717 drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
| * 19abf50b6c ALSA: hda/realtek: update ALC222 depop optimize
| * 07bc341d61 ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
| * 6db423b009 HID: appleir: Fix potential NULL dereference at raw event handle
| * 38807477c1 Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
| * f1f5e41577 drm/amdgpu: disable BAR resize on Dell G5 SE
| * d6566c66c2 drm/amdgpu: Check extended configuration space register when system uses large bar
| * fa996df875 drm/amdgpu: skip BAR resizing if the bios already did it
| * 8acbf4a88c acct: perform last write from workqueue
| * 8d30d9dde5 kernel/acct.c: use dedicated helper to access rlimit values
| * 1b18a0118c kernel/acct.c: use #elif instead of #end and #elif
| * 6e9e0f224f drop_monitor: fix incorrect initialization order
| * 78285b5326 pfifo_tail_enqueue: Drop new packet when sch->limit == 0
| * 321794b75a sched/core: Prevent rescheduling when interrupts are disabled
| * 4af1aff347 phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
| * 074f4e6284 phy: tegra: xusb: reset VBUS & ID OVERRIDE
| * 5f2dbabbce usbnet: gl620a: fix endpoint checking in genelink_bind()
| * 813822972e perf/core: Fix low freq setting via IOC_PERIOD
| * 5b3d32f607 ftrace: Avoid potential division by zero in function_stat_show()
| * 58446f9868 x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
| * 7ff67d1967 net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
| * 747010edd6 ipvs: Always clear ipvs_property flag in skb_scrub_packet()
| * aa91462f1f ASoC: es8328: fix route from DAC to output
| * a15efcf84f net: cadence: macb: Synchronize stats calculations
| * c75c6e6e4f net: loopback: Avoid sending IP packets without an Ethernet header
| * a049c2d86c sunrpc: suppress warnings for unused procfs functions
| * 1c33462917 batman-adv: Drop unmanaged ELP metric worker
| * 77bff7bb11 batman-adv: Ignore neighbor throughput metrics in error case
| * fe7343b8a3 acct: block access to kernel internal filesystems
| * 521ad61fc4 ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
| * d64c6ca420 nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
| * 3eb4911364 tee: optee: Fix supplicant wait loop
| * 3c6e8129a4 power: supply: da9150-fg: fix potential overflow
| * 607b0b1c83 flow_dissector: Fix port range key handling in BPF conversion
| * c67e23568e flow_dissector: Fix handling of mixed port and port-range keys
| * 895d04846e net: extract port range fields from fl_flow_key
| * d37e36db58 geneve: Suppress list corruption splat in geneve_destroy_tunnels().
| * 7f86fb07db gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
| * d5e86e27de geneve: Fix use-after-free in geneve_find_dev().
| * 97de585205 powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
| * 206c9a8f57 ALSA: hda/realtek: Fixup ALC225 depop procedure
| * 85d63c559b ALSA: hda/realtek - Add type for ALC287
| * 2ecb663224 powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
| * fc4f8ac3b9 powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
| * 727dee0857 USB: gadget: f_midi: f_midi_complete to call queue_work
| * 89019ab7a6 usb/gadget: f_midi: Replace tasklet with work
| * ec42b4a0eb usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API
| * 19aad69c2b usb: dwc3: Fix timeout issue during controller enter/exit from halt state
| * 935e842f98 usb: dwc3: Increase DWC3 controller halt timeout
| * 72f2c0b7c1 memcg: fix soft lockup in the OOM process
| * de3f6e7a84 mm: update mark_victim tracepoints fields
| * 3758d1ed60 crypto: testmgr - some more fixes to RSA test vectors
| * 5ecee5d5ee crypto: testmgr - populate RSA CRT parameters in RSA test vectors
| * 3a2f1eb708 crypto: testmgr - fix version number of RSA tests
| * 1bd5831c65 crypto: testmgr - Fix wrong test case of RSA
| * 321cc1d830 crypto: testmgr - fix wrong key length for pkcs1pad
| * 87bc3cb23c driver core: bus: Fix double free in driver API bus_register()
| * 0196802993 scsi: storvsc: Set correct data length for sending SCSI command without payload
| * eab83178ee vlan: move dev_put into vlan_dev_uninit
| * b195d229de vlan: introduce vlan_dev_free_egress_priority
| * 480afcbeb7 ima: Fix use-after-free on a dentry's dname.name
| * 785c78ed0d pps: Fix a use-after-free
| * 41d3c605bf btrfs: avoid monopolizing a core when activating a swap file
| * ed0c0c7de0 Revert "btrfs: avoid monopolizing a core when activating a swap file"
| * 67f70e61b8 x86/i8253: Disable PIT timer 0 when not in use
| * 81b605bbcd parport_pc: add support for ASIX AX99100
| * 14ffcc4571 serial: 8250_pci: add support for ASIX AX99100
| * 753ad96cdd can: ems_pci: move ASIX AX99100 ids to pci_ids.h
| * e1fc4a90a9 nilfs2: protect access to buffers with no active references
| * 7d0544bacc nilfs2: do not force clear folio if buffer is referenced
| * 1ca6d471f8 nilfs2: do not output warnings when clearing dirty buffers
| * 24d59c41e2 alpha: replace hardcoded stack offsets with autogenerated ones
| * 10a1f3fece ndisc: extend RCU protection in ndisc_send_skb()
| * e85a25d1a9 openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
| * 10f555e3f5 arp: use RCU protection in arp_xmit()
| * e1aed6be38 neighbour: use RCU protection in __neigh_notify()
| * c5d53d3ad4 neighbour: delete redundant judgment statements
| * 96fc896d0e ndisc: use RCU protection in ndisc_alloc_skb()
| * 78ad057472 ipv6: use RCU protection in ip6_default_advmss()
| * 8cc8e1285a ipv4: use RCU protection in inet_select_addr()
| * 155298112a ipv4: use RCU protection in rt_is_expired()
| * 7f86ac1f40 net: add dev_net_rcu() helper
| * fde36de3b4 net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
| * ef539316c5 regmap-irq: Add missing kfree()
| * a3e77da9f8 partitions: mac: fix handling of bogus partition table
| * 9cb4edb23c gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
| * 7ec1e5e9f2 alpha: align stack for page fault and user unaligned trap handlers
| * bbec5998d7 serial: 8250: Fix fifo underflow on flush
| * ab4f7b1d95 alpha: make stack 16-byte aligned (most cases)
| * 1abecca55d can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
| * 85069553d1 can: c_can: fix unbalanced runtime PM disable in error path
| * 039cc7d94d USB: serial: option: drop MeiG Smart defines
| * 6621ddcdda USB: serial: option: fix Telit Cinterion FN990A name
| * b95bd1248b USB: serial: option: add Telit Cinterion FN990B compositions
| * 2b03876842 USB: serial: option: add MeiG Smart SLM828
| * 7cfb70e97f usb: cdc-acm: Fix handling of oversized fragments
| * a4e1ae5c05 usb: cdc-acm: Check control transfer buffer size before access
| * 42b3050171 USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
| * 49f077106f USB: hub: Ignore non-compliant devices with too many configs or interfaces
| * 3a983390d1 usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
| * a0a18484ce USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
| * a120aad69e USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
| * 2b8a7cfefd USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
| * 1c231617ac usb: dwc2: gadget: remove of_node reference upon udc_stop
| * 3d921d29d4 usb: gadget: udc: renesas_usb3: Fix compiler warning
| * 27a15815af usb: roles: set switch registered flag early on
| * 167422a070 batman-adv: fix panic during interface removal
| * c4edbd5429 ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
| * 18b7f84110 orangefs: fix a oob in orangefs_debug_write
| * c0c082fef5 Grab mm lock before grabbing pt lock
| * d85ab22daa vfio/pci: Enable iowrite64 and ioread64 for vfio pci
| * dde407d931 media: cxd2841er: fix 64-bit division on gcc-9
| * e9d30ea730 x86/xen: allow larger contiguous memory regions in PV guests
| * 386c8657fe xen: remove a confusing comment on auto-translated guest I/O
| * 69c84cf3b1 gpio: bcm-kona: Add missing newline to dev_err format string
| * f40d5f0169 gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
| * 9b4d03e5c0 gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
| * 4371ac7b49 arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
| * 7c30483d0f team: better TEAM_OPTION_TYPE_STRING validation
| * 6ccaa5797f vrf: use RCU protection in l3mdev_l3_out()
| * a4b3863fe7 ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
| * a04d96ef67 HID: multitouch: Add NULL check in mt_input_configured
| * 3cb901b8a9 ocfs2: check dir i_size in ocfs2_find_entry
| * 16e8693eb2 MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
| * fdc1e72487 ptp: Ensure info->enable callback is always set
| * 70dc66d0cb net/ncsi: wait for the last response to Deselect Package before configuring channel
| * b04fd7cdd8 misc: fastrpc: Fix registered buffer page address
| * 2535f15d31 mtd: onenand: Fix uninitialized retlen in do_otp_read()
| * bd249109d2 NFC: nci: Add bounds checking in nci_hci_create_pipe()
| * 7649937987 nilfs2: fix possible int overflows in nilfs_fiemap()
| * cd3e22b206 ocfs2: handle a symlink read error correctly
| * 970ef46c6d ocfs2: fix incorrect CPU endianness conversion causing mount failure
| * 9377cdc118 vfio/platform: check the bounds of read/write syscalls
| * 406c63ceea nvmem: core: improve range check for nvmem_cell_write()
| * 8c735ef894 crypto: qce - unregister previously registered algos in error path
| * f933d3b26a crypto: qce - fix goto jump in error path
| * d7b11ef0c3 media: uvcvideo: Remove redundant NULL assignment
| * 4823ab3781 media: uvcvideo: Fix event flags in uvc_ctrl_send_events
| * 85b3a78845 media: ov5640: fix get_light_freq on auto
| * 5d50d51d50 soc: qcom: smem_state: fix missing of_node_put in error path
| * 6e3e74dd04 kbuild: Move -Wenum-enum-conversion to W=2
| * 1130e26e3e powerpc/pseries/eeh: Fix get PE state translation
| * 0367db43eb serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
| * 8119f3afb6 serial: sh-sci: Drop __initdata macro for port_cfg
| * 7445fa0531 soc: qcom: socinfo: Avoid out of bounds read of serial number
| * cc4e1d76a1 usb: gadget: f_tcm: Don't prepare BOT write request twice
| * 54e7215ed1 usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
| * 6e10b792fb usb: gadget: f_tcm: Decrement command ref count on cleanup
| * 5e051636b4 usb: gadget: f_tcm: Translate error to sense
| * 2326e19190 wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
| * b64e9092ab HID: hid-sensor-hub: don't use stale platform-data on remove
| * 4aac5315dc of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
| * 8c4178d2d0 of: Fix of_find_node_opts_by_path() handling of alias+path+options
| * b3f14fccde of: Correct child specifier used as input of the 2nd nexus node
| * 7cd71d7574 perf bench: Fix undefined behavior in cmpworker()
| * 523003eb6c clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
| * 5d549136fa clk: qcom: clk-alpha-pll: fix alpha mode configuration
| * a9a7672fc1 Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
| * 737c74bc17 drm/komeda: Add check for komeda_get_layer_fourcc_list()
| * a5ddf2626d KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
| * 5cce2ed69b KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
| * db9088f402 arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
| * 0b6be54d73 binfmt_flat: Fix integer overflow bug on 32 bit systems
| * 15e94cfebc m68k: vga: Fix I/O defines
| * c763d34193 s390/futex: Fix FUTEX_OP_ANDN implementation
| * 2f50af0ca0 leds: lp8860: Write full EEPROM, not only half of it
| * 619708ef44 cpufreq: s3c64xx: Fix compilation warning
| * a2bfaf4ce2 tun: revert fix group permission check
| * e395fec75a netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
| * b8bf5c3fb7 net: rose: lock the socket in rose_bind()
| * 4fae092c3c udp: gso: do not drop small packets when PMTU reduces
| * 558d3acef0 tg3: Disable tg3 PCIe AER on system reboot
| * fe8b241e5e gpu: drm_dp_cec: fix broken CEC adapter properties check
| * 309b493990 firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
| * 3a1aeef304 nvme: handle connectivity loss in nvme_set_queue_count
| * fd8bfaeba4 usb: xhci: Fix NULL pointer dereference on certain command aborts
| * 7032df572e usb: xhci: Add timeout argument in address_device USB HCD callback
| * 431be4f782 net: usb: rtl8150: enable basic endpoint checking
| * 88892dabac net: usb: rtl8150: use new tasklet API
| * 21dc5a1de2 tasklet: Introduce new initialization API
| * 579fac0e5c kbuild: userprogs: use correct lld when linking through clang
| * 44fe1efb49 sched: sch_cake: add bounds checks to host bulk flow fairness counts
| * 2a29413ace media: uvcvideo: Remove dangling pointers
| * 1df994d852 media: uvcvideo: Only save async fh if success
| * b38c6c260c nilfs2: handle errors that nilfs_prepare_chunk() may return
| * 620e036978 nilfs2: eliminate staggered calls to kunmap in nilfs_rename
| * 49d80141af nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link
| * dff1553c27 spi-mxs: Fix chipselect glitch
| * 7220b2446e x86/mm: Don't disable PCID when INVLPG has been fixed by microcode
| * 96c2ddba89 APEI: GHES: Have GHES honor the panic= setting
| * 8bec50f4c3 HID: Wacom: Add PCI Wacom device support
| * 7283aa9700 mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
| * c67efabddc tomoyo: don't emit warning in tomoyo_write_control()
| * 0a457223cb wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
| * ea7e57d54b mmc: core: Respect quirk_max_rate for non-UHS SDIO card
| * 369c063e35 tun: fix group permission check
| * 54c14022fa printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
| * 9bc723d82e x86/amd_nb: Restrict init function to AMD-based systems
| * 7c4d23b6c5 sched: Don't try to catch up excess steal time.
| * 49c8a023ed btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
| * cee55b1219 btrfs: fix use-after-free when attempting to join an aborted transaction
| * ab476f0a45 btrfs: output the reason for open_ctree() failure
| * 7cb72dc08e usb: gadget: f_tcm: Don't free command immediately
| * d6e5ba2516 media: uvcvideo: Fix double free in error path
| * 3a002e4029 HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
| * 3b269db6fe usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
| * 0692c81957 drivers/card_reader/rtsx_usb: Restore interrupt based detection
| * 270c48e652 ktest.pl: Check kernelrelease return in get_version
| * d763fa3b65 NFSD: Reset cb_seq_status after NFS4ERR_DELAY
| * 2ac1d4705b hexagon: Fix unbalanced spinlock in die()
| * bfac520978 hexagon: fix using plain integer as NULL pointer warning in cmpxchg
| * 884385cb4f genksyms: fix memory leak when the same symbol is read from *.symref file
| * a149fe312e genksyms: fix memory leak when the same symbol is added from source
| * a78fbf9765 net: sh_eth: Fix missing rtnl lock in suspend/resume path
| * 64cd120639 vsock: Allow retrying on connect() failure
| * 093c20a38c perf trace: Fix runtime error of index out of bounds
| * db79e982c5 net: davicom: fix UAF in dm9000_drv_remove
| * 52f5aff33c net: rose: fix timer races against user threads
| * a51dedd586 PM: hibernate: Add error handling for syscore_suspend()
| * 71a0fcb68c ipmr: do not call mr_mfc_uses_dev() for unres entries
| * 6ffa190852 net: fec: implement TSO descriptor cleanup
| * 428aff8f7c ubifs: skip dumping tnc tree when zroot is null
| * 21cd59fcb9 rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
| * 5057f4d0cf dmaengine: ti: edma: fix OF node reference leaks in edma_driver
| * 9fdcd0038b module: Extend the preempt disabled section in dereference_symbol_descriptor().
| * ab3e71ae07 ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
| * b4beb4a96e scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
| * 9274ff6854 scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
| * 01ace0742c staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
| * 7c22a9c3ee media: uvcvideo: Propagate buf->error to userspace
| * 12a73f441b media: camif-core: Add check for clk_enable()
| * 35654e1cb2 media: mipi-csis: Add check for clk_enable()
| * a0a943700f PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
| * 406429d873 media: lmedm04: Handle errors for lme2510_int_read
| * a6a31b4cfd media: lmedm04: Use GFP_KERNEL for URB allocation/submission.
| * 82e6f01637 media: rc: iguanair: handle timeouts
| * 9b9a7e6641 fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
| * e87fee8392 ARM: dts: mediatek: mt7623: fix IR nodename
| * f3606e14e1 arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
| * 9cd56af0c6 arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
| * 2b759f78b8 rdma/cxgb4: Prevent potential integer overflow on 32bit
| * c4e639acdf RDMA/mlx4: Avoid false error about access to uninitialized gids array
| * feba1308bc bpf: Send signals asynchronously if !preemptible
| * 66ad33b350 perf report: Fix misleading help message about --demangle
| * 819d7f3832 perf top: Don't complain about lack of vmlinux when not resolving some kernel samples
| * 8899c5146d padata: fix sysfs store callback check
| * 4bd8444adb ktest.pl: Remove unused declarations in run_bisect_test function
| * 3d13beb404 perf header: Fix one memory leakage in process_bpf_prog_info()
| * 7789f9f790 perf header: Fix one memory leakage in process_bpf_btf()
| * 3b22b8a1d2 ASoC: sun4i-spdif: Add clock multiplier settings
| * 0b920758f5 tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
| * cd796e2691 net: sched: Disallow replacing of child qdisc from one parent to another
| * cb53e470d3 net/mlxfw: Drop hard coded max FW flash image size
| * d0e0f9c821 net: let net.core.dev_weight always be non-zero
| * a24287200b clk: analogbits: Fix incorrect calculation of vco rate delta
| * 39f5d44f0a selftests: harness: fix printing of mismatch values in __EXPECT()
| * 822a5a0521 selftests/harness: Display signed values correctly
| * a84063de83 wifi: wlcore: fix unbalanced pm_runtime calls
| * d0c5fd206e regulator: of: Implement the unwind path of of_regulator_match()
| * 0a7794b9ca team: prevent adding a device which is already a team device lower
| * 6f4354ca0c cpupower: fix TSC MHz calculation
| * 167483d91a wifi: rtlwifi: pci: wait for firmware loading before releasing memory
| * 85b67b4c4a wifi: rtlwifi: fix memory leaks and invalid access at probe error path
| * f801e754ef wifi: rtlwifi: remove unused check_buddy_priv
| * 4f6d6cbf3f wifi: rtlwifi: remove unused dualmac control leftovers
| * bbac1dd053 wifi: rtlwifi: remove unused timer and related code
| * 0f02775e11 rtlwifi: replace usage of found with dedicated list iterator variable
| * 088e47ef06 dt-bindings: mmc: controller: clarify the address-cells description
| * 88f04590cd wifi: rtlwifi: usb: fix workqueue leak when probe fails
| * 1faa2647a0 wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
| * f5dad52e01 rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg
| * ee74aec777 wifi: rtlwifi: do not complete firmware loading needlessly
| * 1a8a17c5ce ipmi: ipmb: Add check devm_kasprintf() returned value
| * a713ba7167 drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
| * b4a95da4c7 drm/etnaviv: Fix page property being used for non writecombine buffers
| * 092bb58ec7 partitions: ldm: remove the initial kernel-doc notation
| * e70a578487 nbd: don't allow reconnect after disconnect
| * f84e024057 afs: Fix directory format encoding struct
| * ed6c8c1fe6 overflow: Allow mixed type arguments
| * 0f6dd56712 overflow: Correct check_shl_overflow() comment
| * dbf89a4db3 overflow: Add __must_check attribute to check_*() helpers
| * 08c32d6729 udf: Fix use of check_add_overflow() with mixed type arguments
| * a4c54df0ad perf cs-etm: Add missing variable in cs_etm__process_queues()
* 6e905d8b5a Merge branch 'android11-5.4' into android11-5.4-lts

Change-Id: I83d45c04bbee6185721829195b1bf0ddbd437f16
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2025-04-26 01:33:15 -07:00