Author	SHA1	Message	Date
Srinivasarao Pathipati	a6b9d0d53d	Merge android11-5.4.242+(e699d54) into msm-5.4 ... * remotes/origin/tmp-e699d54: ANDROID: HID: Only utilise UHID provided exports if UHID is enabled ANDROID: HID; Over-ride default maximum buffer size when using UHID Revert "ANDROID: AVB error handler to invalidate vbmeta partition." UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() UPSTREAM: efi: rt-wrapper: Add missing include BACKPORT: arm64: efi: Execute runtime services from a dedicated stack UPSTREAM: io_uring: have io_kill_timeout() honor the request references UPSTREAM: io_uring: don't drop completion lock before timer is fully initialized UPSTREAM: io_uring: always grab lock in io_cancel_async_work() UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize UPSTREAM: cdc_ncm: Fix the build warning UPSTREAM: cdc_ncm: Implement the 32-bit version of NCM Transfer Block UPSTREAM: ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum UPSTREAM: ext4: fix invalid free tracking in ext4_xattr_move_to_block() Revert "Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse"" FROMLIST: binder: fix UAF caused by faulty buffer cleanup UPSTREAM: usb: musb: mediatek: don't unregister something that wasn't registered UPSTREAM: net: fix NULL pointer in skb_segment_list UPSTREAM: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() UPSTREAM: xfrm: compat: change expression for switch in xfrm_xlate64 UPSTREAM: perf/core: Call LSM hook after copying perf_event_attr UPSTREAM: ext4: fix use-after-free in ext4_xattr_set_entry UPSTREAM: ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() UPSTREAM: Revert "ext4: fix use-after-free in ext4_xattr_set_entry" Linux 5.4.242 ASN.1: Fix check for strdup() success iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() pwm: meson: Explicitly set .polarity in .get_state() xfs: fix forkoff miscalculation related to XFS_LITINO(mp) sctp: Call inet6_destroy_sock() via sk->sk_destruct(). dccp: Call inet6_destroy_sock() via sk->sk_destruct(). inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). ext4: fix use-after-free in ext4_xattr_set_entry ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() Revert "ext4: fix use-after-free in ext4_xattr_set_entry" x86/purgatory: Don't generate debug info for purgatory.ro MIPS: Define RUNTIME_DISCARD_EXIT in LD script mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 memstick: fix memory leak if card device is never registered nilfs2: initialize unused bytes in segment summary blocks iio: light: tsl2772: fix reading proximity-diodes from device tree xen/netback: use same error messages for same errors nvme-tcp: fix a possible UAF when failing to allocate an io queue s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling net: dsa: b53: mmap: add phy ops scsi: core: Improve scsi_vpd_inquiry() checks scsi: megaraid_sas: Fix fw_crash_buffer_show() selftests: sigaltstack: fix -Wuninitialized Input: i8042 - add quirk for Fujitsu Lifebook A574/H f2fs: Fix f2fs_truncate_partial_nodes ftrace event e1000e: Disable TSO on i219-LM card to increase speed bpf: Fix incorrect verifier pruning due to missing register precision taints mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() i40e: fix i40e_setup_misc_vector() error handling i40e: fix accessing vsi->active_filters without holding lock netfilter: nf_tables: fix ifdef to also consider nf_tables=m virtio_net: bugfix overflow inside xdp_linearize_page() net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg regulator: fan53555: Explicitly include bits header netfilter: br_netfilter: fix recent physdev match breakage arm64: dts: meson-g12-common: specify full DMC range ARM: dts: rockchip: fix a typo error for rk3288 spdif node Linux 5.4.241 xfs: force log and push AIL to clear pinned inodes when aborting mount xfs: don't reuse busy extents on extent trim xfs: consider shutdown in bmapbt cursor delete assert xfs: shut down the filesystem if we screw up quota reservation xfs: report corruption only as a regular error xfs: set inode size after creating symlink xfs: fix up non-directory creation in SGID directories xfs: remove the di_version field from struct icdinode xfs: simplify a check in xfs_ioctl_setattr_check_cowextsize xfs: simplify di_flags2 inheritance in xfs_ialloc xfs: only check the superblock version for dinode size calculation xfs: add a new xfs_sb_version_has_v3inode helper xfs: remove the kuid/kgid conversion wrappers xfs: remove the icdinode di_uid/di_gid members xfs: ensure that the inode uid/gid match values match the icdinode ones xfs: merge the projid fields in struct xfs_icdinode xfs: show the proper user quota options coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug watchdog: sbsa_wdog: Make sure the timeout programming is within the limits i2c: ocores: generate stop condition after timeout in polling mode ubi: Fix deadlock caused by recursively holding work_sem mtd: ubi: wl: Fix a couple of kernel-doc issues ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size asymmetric_keys: log on fatal failures in PE/pkcs7 verify_pefile: relax wrapper length check drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L i2c: imx-lpi2c: clean rx/tx buffers upon new message power: supply: cros_usbpd: reclassify "default case!" as debug net: macb: fix a memory corruption in extended buffer descriptor mode udp6: fix potential access to stale information RDMA/core: Fix GID entry ref leak when create_ah fails sctp: fix a potential overflow in sctp_ifwdtsn_skip qlcnic: check pci_reset_function result niu: Fix missing unwind goto in niu_alloc_channels() 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition mtd: rawnand: stm32_fmc2: remove unsupported EDO mode mtd: rawnand: meson: fix bitmask for length in command word mtdblock: tolerate corrected bit-flips btrfs: fix fast csum implementation detection btrfs: print checksum type and implementation at mount time Bluetooth: Fix race condition in hidp_session_thread Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() ALSA: i2c/cs8427: fix iec958 mixer control deactivation ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard ALSA: emu10k1: fix capture interrupt handler unlinking Revert "pinctrl: amd: Disable and mask interrupts on resume" irqdomain: Fix mapping-creation race irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Look for existing mapping only once mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() ring-buffer: Fix race while reader and writer are on the same page drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path net_sched: prevent NULL dereference if default qdisc setup failed tracing: Free error logs of tracing instances can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access ftrace: Mark get_lock_parent_ip() __always_inline perf/core: Fix the same task check in perf_event_set_output ALSA: hda/realtek: Add quirk for Clevo X370SNW nilfs2: fix sysfs interface lifetime nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty tty: serial: sh-sci: Fix Rx on RZ/G2L SCI tty: serial: sh-sci: Fix transmit end interrupt handler iio: dac: cio-dac: Fix max DAC write value check for 12-bit iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip USB: serial: option: add Quectel RM500U-CN modem USB: serial: option: add Telit FE990 compositions usb: typec: altmodes/displayport: Fix configure initial pin assignment USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu NFSD: callback request does not use correct credential for AUTH_SYS sunrpc: only free unix grouplist after RCU settles gpio: davinci: Add irq chip flag to skip set wake ipv6: Fix an uninit variable access bug in __ip6_make_skb() sctp: check send stream number after wait_for_sndbuf net: don't let netpoll invoke NAPI if in xmit context icmp: guard against too small mtu wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta pwm: sprd: Explicitly set .polarity in .get_state() pwm: cros-ec: Explicitly set .polarity in .get_state() pinctrl: amd: Disable and mask interrupts on resume pinctrl: amd: disable and mask interrupts on probe pinctrl: amd: Use irqchip template smb3: fix problem with null cifs super block with previous patch treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()" cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot scsi: ses: Handle enclosure with just a primary component gracefully Linux 5.4.240 gfs2: Always check inode size of inline inodes firmware: arm_scmi: Fix device node validation for mailbox transport net: sched: fix race condition in qdisc_graft() net_sched: add __rcu annotation to netdev->qdisc ext4: fix kernel BUG in 'ext4_write_inline_data_end()' btrfs: scan device in non-exclusive mode s390/uaccess: add missing earlyclobber annotations to __clear_user() drm/etnaviv: fix reference leak when mmaping imported buffer ALSA: usb-audio: Fix regression on detection of Roland VS-100 ALSA: hda/conexant: Partial revert of a quirk for Lenovo NFSv4: Fix hangs when recovering open state after a server reboot pinctrl: at91-pio4: fix domain name assignment xen/netback: don't do grant copy across page boundary Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL cifs: prevent infinite recursion in CIFSGetDFSRefer() Input: focaltech - use explicitly signed char type Input: alps - fix compatibility with -funsigned-char pinctrl: ocelot: Fix alt mode for ocelot net: mvneta: make tx buffer array agnostic net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only bnxt_en: Fix typo in PCI id to device description string mapping i40e: fix registers dump after run ethtool adapter self test s390/vfio-ap: fix memory leak in vfio_ap device driver can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write net/net_failover: fix txq exceeding warning regulator: Handle deferred clk regulator: fix spelling mistake "Cant" -> "Can't" ptp_qoriq: fix memory leak in probe() scsi: megaraid_sas: Fix crash after a double completion mtd: rawnand: meson: invalidate cache on polling ECC bit mips: bmips: BCM6358: disable RAC flush for TP1 dma-mapping: drop the dev argument to arch_sync_dma_for_* ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() fbdev: au1200fb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: nvidia: Fix potential divide by zero sched_getaffinity: don't assume 'cpumask_size()' is fully initialized fbdev: tgafb: Fix potential divide by zero ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() ALSA: asihpi: check pao in control_message() md: avoid signed overflow in slot_store() bus: imx-weim: fix branch condition evaluates to a garbage value fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY ocfs2: fix data corruption after failed write tun: avoid double free in tun_free_netdev sched/fair: Sanitize vruntime of entity being migrated sched/fair: sanitize vruntime of entity being placed dm crypt: add cond_resched() to dmcrypt_write() dm stats: check for and propagate alloc_percpu failure i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() wifi: mac80211: fix qos on mesh interfaces usb: chipidea: core: fix possible concurrent when switch role usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: cdns3: Fix issue with using incorrect PCI device function dm thin: fix deadlock when swapping to thin device igb: revert rtnl_lock() that causes deadlock fsverity: Remove WQ_UNBOUND from fsverity read workqueue usb: gadget: u_audio: don't let userspace block driver unbind scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR cifs: empty interface list when server doesn't support query interfaces sh: sanitize the flags on sigreturn net: usb: qmi_wwan: add Telit 0x1080 composition net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 scsi: lpfc: Avoid usage of list iterator variable after loop scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: target: iscsi: Fix an error message in iscsi_check_key() selftests/bpf: check that modifier resolves after pointer m68k: Only force 030 bus error if PC not in exception table ca8210: fix mac_len negative array access riscv: Bump COMMAND_LINE_SIZE value to 1024 thunderbolt: Use const qualifier for `ring_interrupt_index` uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 scsi: qla2xxx: Perform lockless command completion in abort path hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: btqcomsmd: Fix command timeout after setting BD address net: mdio: thunder: Add missing fwnode_handle_put() hvc/xen: prevent concurrent accesses to the shared ring nvme-tcp: fix nvme_tcp_term_pdu to match spec net/sonic: use dma_mapping_error() for error check erspan: do not use skb_mac_header() in ndo_start_xmit() atm: idt77252: fix kmemleak when rmmod idt77252 net/mlx5: Read the TC mapping of all priorities on ETS query bpf: Adjust insufficient default bpf_jit_limit keys: Do not cache key in task struct if key is requested from kernel thread net/ps3_gelic_net: Use dma_mapping_error net/ps3_gelic_net: Fix RX sk_buff length net: qcom/emac: Fix use after free bug in emac_remove due to race condition xirc2ps_cs: Fix use after free bug in xirc2ps_detach qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info net: usb: smsc95xx: Limit packet length to skb->len scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() i2c: imx-lpi2c: check only for enabled interrupt flags igbvf: Regard vf reset nack as success intel/igbvf: free irq on the error path in igbvf_request_msix() iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: fix inverted Rx hash condition leading to disabled hash power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() Linux 5.4.239 selftests: Fix the executable permissions for fib_tests.sh BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio Revert "HID: core: Provide new max_buffer_size attribute to over-ride the default" Revert "HID: uhid: Over-ride the default maximum data buffer value with our own" Linux 5.4.238 HID: uhid: Over-ride the default maximum data buffer value with our own HID: core: Provide new max_buffer_size attribute to over-ride the default PCI: Unify delay handling for reset and resume s390/ipl: add missing intersection check to ipl_report handling serial: 8250_em: Fix UART port type drm/i915: Don't use stolen memory for ring buffers with LLC x86/mm: Fix use of uninitialized buffer in sme_enable() fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks ftrace: Fix invalid address access in lookup_rec() when index is 0 KVM: nVMX: add missing consistency checks for CR0 and CR4 tracing: Make tracepoint lockdep check actually test something tracing: Check field value in hist_field_name() interconnect: fix mem leak when freeing nodes tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted ext4: fix possible double unlock when moving a directory sh: intc: Avoid spurious sizeof-pointer-div warning drm/amdkfd: Fix an illegal memory access ext4: fix task hung in ext4_xattr_delete_inode ext4: fail ext4_iget if special inode unallocated jffs2: correct logic when creating a hole in jffs2_write_begin mmc: atmel-mci: fix race between stop command and start of next command media: m5mols: fix off-by-one loop termination error hwmon: (ina3221) return prober error code hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (adt7475) Display smoothing attributes in correct order ethernet: sun: add check for the mdesc_grab() net/iucv: Fix size of interrupt data net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull ipv4: Fix incorrect table ID in IOCTL path block: sunvdc: add check for mdesc_grab() returning NULL nvmet: avoid potential UAF in nvmet_req_complete() net: usb: smsc75xx: Limit packet length to skb->len nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails net: tunnels: annotate lockless accesses to dev->needed_headroom qed/qed_dev: guard against a possible division by zero i40e: Fix kernel crash during reboot when adapter is in recovery mode ipvlan: Make skb->skb_iif track skb->dev for l3s mode nfc: pn533: initialize struct pn533_out_arg properly tcp: tcp_make_synack() can be called from process context scsi: core: Fix a procfs host directory removal regression scsi: core: Fix a comment in function scsi_host_dev_release() netfilter: nft_redir: correct value of inet type `.maxattrs` ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid ALSA: hda - controller is in GPU on the DG1 ALSA: hda - add Intel DG1 PCI and HDMI ids scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate clk: HI655X: select REGMAP instead of depending on it drm/meson: fix 1px pink line on GXM when scaling video overlay cifs: Move the in_send statistic to __smb_send_rqst() drm/panfrost: Don't sync rpm suspension after mmu flushing xfrm: Allow transport-mode states with AF_UNSPEC selector ext4: fix cgroup writeback accounting with fs-layer encryption ANDROID: preserve CRC for __irq_domain_add() Revert "drm/exynos: Don't reset bridge->next" Revert "drm/bridge: Rename bridge helpers targeting a bridge chain" Revert "drm/bridge: Introduce drm_bridge_get_next_bridge()" Revert "drm: Initialize struct drm_crtc_state.no_vblank from device settings" Revert "drm/msm/mdp5: Add check for kzalloc" Linux 5.4.237 s390/dasd: add missing discipline function UML: define RUNTIME_DISCARD_EXIT sh: define RUNTIME_DISCARD_EXIT s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT arch: fix broken BuildID for arm64 and riscv x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS drm/i915: Don't use BAR mappings for ring buffers with LLC ipmi:watchdog: Set panic count to proper value on a panic ipmi/watchdog: replace atomic_add() and atomic_sub() media: ov5640: Fix analogue gain control PCI: Add SolidRun vendor ID macintosh: windfarm: Use unsigned type for 1-bit bitfields alpha: fix R_ALPHA_LITERAL reloc for large modules MIPS: Fix a compilation issue ext4: Fix deadlock during directory rename riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode net/smc: fix fallback failed while sendmsg with fastopen scsi: megaraid_sas: Update max supported LD IDs to 240 btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR netfilter: tproxy: fix deadlock due to missing BH disable bnxt_en: Avoid order-5 memory allocation for TPA data net: caif: Fix use-after-free in cfusbl_device_notify() net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver net: usb: lan78xx: Remove lots of set but unused 'ret' variables selftests: nft_nat: ensuring the listening side is up before starting the client ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register ext4: Fix possible corruption when moving a directory scsi: core: Remove the /proc/scsi/${proc_name} directory earlier cifs: Fix uninitialized memory read in smb3_qfs_tcon() SMB3: Backup intent flag missing from some more ops iommu/vt-d: Fix PASID directory pointer coherency irqdomain: Fix domain registration race irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent ipmi:ssif: Add a timer between request retries ipmi:ssif: Increase the message retry time ipmi:ssif: Remove rtc_us_timer ipmi:ssif: resend_msg() cannot fail ipmi:ssif: make ssif_i2c_send() void iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands nfc: change order inside nfc_se_io error path ext4: zero i_disksize when initializing the bootloader inode ext4: fix WARNING in ext4_update_inline_data ext4: move where set the MAY_INLINE_DATA flag is set ext4: fix another off-by-one fsmap error on 1k block filesystems ext4: fix RENAME_WHITEOUT handling for inline directories drm/connector: print max_requested_bpc in state debugfs x86/CPU/AMD: Disable XSAVES on AMD family 0x17 fs: prevent out-of-bounds array speculation when closing a file descriptor Linux 5.4.236 staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" Linux 5.4.235 dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks media: uvcvideo: Fix race condition with usb_kill_urb media: uvcvideo: Provide sync and async uvc_ctrl_status_event tcp: Fix listen() regression in 5.4.229. Bluetooth: hci_sock: purge socket queues in the destruct() callback x86/resctl: fix scheduler confusion with 'current' x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid} net: tls: avoid hanging tasks on the tx_lock phy: rockchip-typec: Fix unsigned comparison with less than zero PCI: Add ACS quirk for Wangxun NICs kernel/fail_function: fix memory leak with using debugfs_lookup() usb: uvc: Enumerate valid values for color matching USB: ene_usb6250: Allocate enough memory for full object usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() tools/iio/iio_utils:fix memory leak mei: bus-fixup:upon error print return values of send and receive tty: serial: fsl_lpuart: disable the CTS when send break signal tty: fix out-of-bounds access in tty_driver_lookup_tty() staging: emxx_udc: Add checks for dma_alloc_coherent() media: uvcvideo: Silence memcpy() run-time false positive warnings media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 media: uvcvideo: Handle errors from calls to usb_string media: uvcvideo: Handle cameras with invalid descriptors mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 tracing: Add NULL checks for buffer in ring_buffer_free_read_page() thermal: intel: BXT_PMIC: select REGMAP instead of depending on it thermal: intel: quark_dts: fix error pointer dereference scsi: ipr: Work around fortify-string warning rtc: sun6i: Always export the internal oscillator rtc: sun6i: Make external 32k oscillator optional vc_screen: modify vcs_size() handling in vcs_read() tcp: tcp_check_req() can be called from process context ARM: dts: spear320-hmi: correct STMPE GPIO compatible net/sched: act_sample: fix action bind logic nfc: fix memory leak of se_io context in nfc_genl_se_io net/mlx5: Geneve, Fix handling of Geneve object id as error code 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() 9p/xen: fix connection sequence 9p/xen: fix version parsing net: fix __dev_kfree_skb_any() vs drop monitor sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop ipv6: Add lwtunnel encap size of all siblings in nexthop calculation netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() watchdog: pcwd_usb: Fix attempting to access uninitialized memory watchdog: Fix kmemleak in watchdog_cdev_register watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: Re-statistic cleaned znode count if commit failed ubi: Fix possible null-ptr-deref in ubi_free_volume() ubifs: Fix memory leak in alloc_wbufs() ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() ubi: Fix use-after-free when volume resizing failed ubifs: Reserve one leb for each journal head while doing budget ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 ubifs: Fix wrong dirty space budget for dirty inode ubifs: Rectify space budget for ubifs_xrename() ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted ubifs: Fix build errors as symbol undefined ubi: ensure that VID header offset + VID header size <= alloc, size um: vector: Fix memory leak in vector_config fs: f2fs: initialize fsdata in pagecache_write() f2fs: use memcpy_{to,from}_page() where possible pwm: stm32-lp: fix the check on arr and cmp registers update pwm: sifive: Always let the first pwm_apply_state succeed pwm: sifive: Reduce time the controller lock is held fs/jfs: fix shift exponent db_agl2size negative net/sched: Retire tcindex classifier kbuild: Port silent mode detection to future gnu make. wifi: ath9k: use proper statements in conditionals drm/radeon: Fix eDP for single-display iMac11,2 drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv PCI: Avoid FLR for AMD FCH AHCI adapters PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI/PM: Observe reset delay irrespective of bridge_d3 scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Don't attach if enclosure has no components scsi: qla2xxx: Fix erroneous link down scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Fix link failure in NPIV environment ktest.pl: Add RUN_TIMEOUT option with default unlimited ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Give back console on Ctrt^C on monitor mm/thp: check and bail out if page in deferred queue already mm: memcontrol: deprecate charge moving media: ipu3-cio2: Fix PM runtime usage_count in driver unbind mips: fix syscall_get_nr alpha: fix FEN fault handling rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Exynos4 dm flakey: don't corrupt the zero page dm flakey: fix logic when corrupting a bio thermal: intel: powerclamp: Fix cur_state for multi package system wifi: cfg80211: Fix use after free for wext wifi: rtl8xxxu: Use a longer retry limit of 48 ext4: refuse to create ea block when umounted ext4: optimize ea_inode block expansion ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() irqdomain: Drop bogus fwspec-mapping error handling irqdomain: Fix disassociation race irqdomain: Fix association race ima: Align ima_file_mmap() parameters with mmap_file LSM hook Documentation/hw-vuln: Document the interaction between IBRS and STIBP x86/speculation: Allow enabling STIBP with legacy IBRS x86/microcode/AMD: Fix mixed steppings support x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/reboot: Disable virtualization in an emergency if SVM is supported x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) KVM: s390: disable migration mode when dirty tracking is disabled KVM: Destroy target device if coalesced MMIO unregistration fails udf: Fix file corruption when appending just after end of preallocated extent udf: Detect system inodes linked into directory hierarchy udf: Preserve link count of system files udf: Do not update file length for failed writes to inline files udf: Do not bother merging very long extents udf: Truncate added extents on failed expansion ocfs2: fix non-auto defrag path not working issue ocfs2: fix defrag path triggering jbd2 ASSERT f2fs: fix cgroup writeback accounting with fs-layer encryption f2fs: fix information leak in f2fs_move_inline_dirents() fs: hfsplus: fix UAF issue in hfsplus_put_super hfs: fix missing hfs_bnode_get() in __hfs_bnode_create ARM: dts: exynos: correct HDMI phy compatible in Exynos4 s390/kprobes: fix current_kprobe never cleared after kprobes reenter s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390: discard .interp section ipmi_ssif: Rename idle state and check rtc: pm8xxx: fix set-alarm race firmware: coreboot: framebuffer: Ignore reserved pixel color bits wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu nfsd: zero out pointers after putting nfsd_files on COPY setup error dm cache: add cond_resched() to various workqueue loops dm thin: add cond_resched() to various workqueue loops drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 pinctrl: at91: use devm_kasprintf() to avoid potential leaks hwmon: (coretemp) Simplify platform device handling regulator: s5m8767: Bounds check id indexing into arrays regulator: max77802: Bounds check regulator id against opmode ASoC: kirkwood: Iterate over array indexes instead of using pointer math docs/scripts/gdb: add necessary make scripts_gdb step drm/msm/dsi: Add missing check for alloc_ordered_workqueue drm/radeon: free iio for atombios when driver shutdown HID: Add Mapping for System Microphone Mute drm/omap: dsi: Fix excessive stack usage drm/amd/display: Fix potential null-deref in dm_resume uaccess: Add minimum bounds check on kernel buffer size coda: Avoid partial allocation of sig_inputArgs net/mlx5: fw_tracer: Fix debug print ACPI: video: Fix Lenovo Ideapad Z570 DMI match wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup m68k: Check syscall_trace_enter() return code net: bcmgenet: Add a check for oversized packets ACPI: Don't build ACPICA with '-Os' ice: add missing checks for PF vsi type inet: fix fast path in __inet_hash_connect() wifi: mt7601u: fix an integer underflow wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds x86/bugs: Reset speculation control settings on init timers: Prevent union confusion from unexpected restart_syscall() thermal: intel: Fix unsigned comparison with less than zero rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() blk-iocost: fix divide by 0 error in calc_lcoefs() ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy udf: Define EFSCORRUPTED error code rpmsg: glink: Avoid infinite loop on intent for missing channel media: usb: siano: Fix use after free bugs caused by do_submit_urb media: i2c: ov7670: 0 instead of -EINVAL was returned media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: i2c: ov772x: Fix memleak in ov772x_probe() media: ov5675: Fix memleak in ov5675_init_controls() powerpc: Remove linker flag from KBUILD_AFLAGS media: platform: ti: Add missing check for devm_regulator_get remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers MIPS: vpe-mt: drop physical_memsize MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set powerpc/eeh: Set channel state after notifying the drivers powerpc/eeh: Small refactor of eeh_handle_normal_event() powerpc/rtas: ensure 4KB alignment for rtas_data_buf powerpc/rtas: make all exports GPL powerpc/pseries/lparcfg: add missing RTAS retry status handling powerpc/pseries/lpar: add missing RTAS retry status handling clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() powerpc/powernv/ioda: Skip unallocated resources when mapping to PE clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC Input: ads7846 - don't check penirq immediately for 7845 Input: ads7846 - don't report pressure for ads7845 clk: renesas: cpg-mssr: Remove superfluous check in resume code clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed mtd: rawnand: sunxi: Fix the size of the last OOB region clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() selftests/ftrace: Fix bash specific "==" operator sparc: allow PM configs for sparc32 COMPILE_TEST perf tools: Fix auto-complete on aarch64 perf llvm: Fix inadvertent file creation gfs2: jdata writepage fix cifs: Fix warning and UAF when destroy the MR list cifs: Fix lost destroy smbd connection when MR allocate failed nfsd: fix race to check ls_layouts hid: bigben_probe(): validate report count HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T HID: asus: Add report_size to struct asus_touchpad_info HID: asus: Only set EV_REP if we are adding a mapping HID: bigben: use spinlock to safely schedule workers HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to protect concurrent accesses ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared ASoC: dapm: declare missing structure prototypes spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() dm: remove flush_scheduled_work() during local_exit() hwmon: (mlxreg-fan) Return zero speed for broken fan spi: bcm63xx-hsspi: Fix multi-bit mode setting spi: bcm63xx-hsspi: fix pm_runtime scsi: aic94xx: Add missing check for dma_map_single() hwmon: (ltc2945) Handle error case in ltc2945_value_store gpio: vf610: connect GPIO label to dev name ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() drm/mediatek: Clean dangling pointer on bind error path drm/mediatek: Drop unbalanced obj unref drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: remove cast to pointers passed to kfree gpu: host1x: Don't skip assigning syncpoints to channels drm/msm/mdp5: Add check for kzalloc drm: Initialize struct drm_crtc_state.no_vblank from device settings drm/bridge: Introduce drm_bridge_get_next_bridge() drm/bridge: Rename bridge helpers targeting a bridge chain drm/exynos: Don't reset bridge->next drm/msm/dpu: Add check for pstates drm/msm/dpu: Add check for cstate drm/msm: use strscpy instead of strncpy drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness ALSA: hda/ca0132: minor fix for allocation size ASoC: fsl_sai: initialize is_dsp_mode flag pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain drm/msm/hdmi: Add missing check for alloc_ordered_workqueue gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() drm/vc4: dpi: Fix format mapping for RGB565 drm/vc4: dpi: Add option for inverting pixel clock and output enable drm/bridge: megachips: Fix error handling in i2c_register_driver() drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats selftest: fib_tests: Always cleanup before exit selftests/net: Interpret UDP_GRO cmsg data as an int value irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error thermal/drivers/hisi: Drop second sensor hi3660 wifi: mac80211: make rate u32 in sta_set_rate_info_rx() crypto: crypto4xx - Call dma_unmap_page when done wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: iwl3945: Add missing check for create_singlethread_workqueue treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() usb: gadget: udc: Avoid tasklet passing a global RISC-V: time: initialize hrtimer based broadcast clock event device m68k: /proc/hardware should depend on PROC_FS crypto: rsa-pkcs1pad - Use akcipher_request_complete rds: rds_rm_zerocopy_callback() correct order for list_add_tail() libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() Bluetooth: L2CAP: Fix potential user-after-free OPP: fix error checking in opp_migrate_dentry() tap: tap_open(): correctly initialize socket uid tun: tun_chr_open(): correctly initialize socket uid net: add sock_init_data_uid() mptcp: add sk_stop_timer_sync helper irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains net/mlx5: Enhance debug print in page allocation failure powercap: fix possible name leak in powercap_register_zone() crypto: seqiv - Handle EBUSY correctly crypto: essiv - Handle EBUSY correctly crypto: essiv - remove redundant null pointer check before kfree crypto: ccp - Failure on re-initialization due to duplicate sysfs filename ACPI: battery: Fix missing NUL-termination with large strings wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails ath9k: htc: clean up statistics macros ath9k: hif_usb: simplify if-if to if-else wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function wifi: orinoco: check return value of hermes_write_wordrec() ACPICA: nsrepair: handle cases without a return value correctly lib/mpi: Fix buffer overrun when SG is too long genirq: Fix the return type of kstat_cpu_irqs_sum() ACPICA: Drop port I/O validation for some regions crypto: x86/ghash - fix unaligned access in ghash_setkey() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK wifi: ipw2200: fix memory leak in ipw_wdev_init() wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() ipw2x00: switch from 'pci_' to 'dma_' API wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() rtlwifi: fix -Wpointer-sign warning wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb” wifi: rsi: Fix memory leak in rsi_coex_attach() block: bio-integrity: Copy flags when bio_integrity_payload is cloned sched/rt: pick_next_rt_entity(): check list_entry sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() s390/dasd: Fix potential memleak in dasd_eckd_init() s390/dasd: Prepare for additional path event handling blk-mq: correct stale comment of .get_budget blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx block: Limit number of items taken from the I/O scheduler in one go Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle" arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node ARM: dts: imx7s: correct iomuxc gpr mux controller cells arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name ARM: imx: Call ida_simple_remove() for ida_simple_get ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() arm64: dts: meson: remove CPU opps below 1GHz for G12A boards arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix Ethernet MAC address unit name ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: qcom: qcs404: use symbol names for PCIe resets ARM: OMAP2+: Fix memory leak in realtime_counter_init() HID: asus: use spinlock to safely schedule workers HID: asus: use spinlock to protect concurrent accesses HID: asus: Remove check for same LED brightness on set Linux 5.4.234 USB: core: Don't hold device lock while reading the "descriptors" sysfs file USB: serial: option: add support for VW/Skoda "Carstick LTE" dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size vc_screen: don't clobber return value in vcs_read net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state HID: core: Fix deadloop in hid_apply_multiplier. neigh: make sure used and confirmed times are valid IB/hfi1: Assign npages earlier btrfs: send: limit number of clones and allocated memory size ACPI: NFIT: fix a potential deadlock during NFIT teardown ARM: dts: rockchip: add power-domains property to dp node on rk3288 arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc Conflicts: Documentation/devicetree/bindings Documentation/devicetree/bindings/rtc/allwinner,sun6i-a31-rtc.yaml arch/arm/mm/dma-mapping.c drivers/clk/qcom/gcc-qcs404.c drivers/iommu/dma-iommu.c drivers/mtd/ubi/wl.c kernel/dma/direct.c Change-Id: I5797c8cb2276354d851af215d431950eec734174 Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>	2023-07-26 14:21:25 +05:30
qctecmdr	3d70718402	Merge "Merge android11-5.4.233+ (4716ccc) into msm-5.4"	2023-06-05 21:38:02 -07:00
Srinivasarao Pathipati	65d21518f8	cpufreq: schedutil: Fix UAF issue ... sugov_tunables are getting deleted with kobject release() in 'commit 67c98e0231 ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")'. So save tunables before freeing. Change-Id: I9df2604210cb071bb907a39cf7fcc1131e4de5f8 Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>	2023-06-05 11:55:42 +05:30
kamasali Satyanarayan	83fdf72a16	Merge android11-5.4.233+ (4716ccc) into msm-5.4 ... * remotes/origin/tmp-4716ccc : UPSTREAM: media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() ANDROID: incremental fs: Evict inodes before freeing mount data UPSTREAM: ext4: fix kernel BUG in 'ext4_write_inline_data_end()' UPSTREAM: hid: bigben_probe(): validate report count UPSTREAM: HID: bigben: use spinlock to safely schedule workers BACKPORT: of: base: Skip CPU nodes with "fail"/"fail-..." status UPSTREAM: HID: bigben_worker() remove unneeded check on report_field UPSTREAM: HID: bigben: use spinlock to protect concurrent accesses UPSTREAM: hwrng: virtio - add an internal buffer UPSTREAM: ext4: fix another off-by-one fsmap error on 1k block filesystems UPSTREAM: ext4: refuse to create ea block when umounted UPSTREAM: ext4: optimize ea_inode block expansion UPSTREAM: ext4: allocate extended attribute value in vmalloc area BACKPORT: FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration ANDROID: fs/f2fs: fixup __f2fs_cluster_blocks with F2FS_FS_COMPRESSION UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request UPSTREAM: KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS Revert "iommu: Add gfp parameter to iommu_ops::map" Revert "iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map()" Revert "RDMA/usnic: use iommu_map_atomic() under spin_lock()" Linux 5.4.233 bpf: add missing header file include Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs" ext4: Fix function prototype mismatch for ext4_feat_ktype wifi: mwifiex: Add missing compatible string for SD8787 uaccess: Add speculation barrier to copy_from_user() mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh drm/i915/gvt: fix double free bug in split_2MB_gtt_entry alarmtimer: Prevent starvation by small intervals and SIG_IGN powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception random: always mix cycle counter in add_latent_entropy() powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G wifi: rtl8xxxu: gen2: Turn on the rate control drm/etnaviv: don't truncate physical page address drm: etnaviv: fix common struct sg_table related issues scatterlist: add generic wrappers for iterating over sgtable objects dma-mapping: add generic helpers for mapping sgtable objects Linux 5.4.232 iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map() net: sched: sch: Fix off by one in htb_activate_prios() ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak nilfs2: fix underflow in second superblock position calculations kvm: initialize all of the kvm_debugregs structure before sending it to userspace i40e: Add checking for null for nlmsg_find_attr() ipv6: Fix tcp socket connection with DSCP. ipv6: Fix datagram socket connection with DSCP. ixgbe: add double of VLAN header when computing the max MTU net: mpls: fix stale pointer if allocation fails during device rename net: stmmac: Restrict warning on disabling DMA store and fwd mode bnxt_en: Fix mqprio and XDP ring checking logic net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list net: bgmac: fix BCM5358 support by setting correct flags i40e: add double of VLAN header when computing the max MTU ixgbe: allow to increase MTU to 3K with XDP enabled revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" net: Fix unwanted sign extension in netdev_stats_to_stats64() Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." hugetlb: check for undefined shift on 32 bit architectures sched/psi: Fix use-after-free in ep_remove_wait_queue() ALSA: hda/realtek - fixed wrong gpio assigned ALSA: hda/conexant: add a new hda codec SN6180 mmc: mmc_spi: fix error handling in mmc_spi_probe() mmc: sdio: fix possible resource leaks in some error paths ipv4: Fix incorrect route flushing when source address is deleted Revert "ipv4: Fix incorrect route flushing when source address is deleted" xfs: sync lazy sb accounting on quiesce of read-only mounts xfs: prevent UAF in xfs_log_item_in_current_chkpt xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks xfs: ensure inobt record walks always make forward progress xfs: fix missing CoW blocks writeback conversion retry xfs: only relog deferred intent items if free space in the log gets low xfs: expose the log push threshold xfs: periodically relog deferred intent items xfs: change the order in which child and parent defer ops are finished xfs: fix an incore inode UAF in xfs_bui_recover xfs: clean up xfs_bui_item_recover iget/trans_alloc/ilock ordering xfs: clean up bmap intent item recovery checking xfs: xfs_defer_capture should absorb remaining transaction reservation xfs: xfs_defer_capture should absorb remaining block reservations xfs: proper replay of deferred ops queued during log recovery xfs: fix finobt btree block recovery ordering xfs: log new intent items created as part of finishing recovered intent items xfs: refactor xfs_defer_finish_noroll xfs: turn dfp_intent into a xfs_log_item xfs: merge the ->diff_items defer op into ->create_intent xfs: merge the ->log_item defer op into ->create_intent xfs: factor out a xfs_defer_create_intent helper xfs: remove the xfs_inode_log_item_t typedef xfs: remove the xfs_efd_log_item_t typedef xfs: remove the xfs_efi_log_item_t typedef netfilter: nft_tproxy: restrict to prerouting hook btrfs: free device in btrfs_close_devices for a single device filesystem aio: fix mremap after fork null-deref nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association s390/decompressor: specify __decompress() buf len to avoid overflow net: sched: sch: Bounds check priority net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC net/rose: Fix to not accept on connected socket tools/virtio: fix the vringh test for virtio ring changes ASoC: cs42l56: fix DT probe selftests/bpf: Verify copy_register_state() preserves parent/live fields migrate: hugetlb: check for hugetlb shared PMD in node migration bpf: Always return target ifindex in bpf_fib_lookup nvme-pci: Move enumeration by class to be last in the table arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte ceph: flush cap releases when the session is flushed usb: typec: altmodes/displayport: Fix probe pin assign check usb: core: add quirk for Alcor Link AK9563 smartcard reader net: USB: Fix wrong-direction WARNING in plusb.c pinctrl: intel: Restore the pins that used to be in Direct IRQ mode pinctrl: single: fix potential NULL dereference pinctrl: aspeed: Fix confusing types in return value ALSA: pci: lx6464es: fix a debug loop selftests: forwarding: lib: quote the sysctl values rds: rds_rm_zerocopy_callback() use list_first_entry() ice: Do not use WQ_MEM_RECLAIM flag for workqueue ionic: clean interrupt before enabling queue to avoid credit race net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY bonding: fix error checking in bond_debug_reregister() xfrm: fix bug with DSCP copy to v6 from v4 tunnel RDMA/usnic: use iommu_map_atomic() under spin_lock() iommu: Add gfp parameter to iommu_ops::map IB/IPoIB: Fix legacy IPoIB due to wrong number of queues IB/hfi1: Restore allocated resources on failed copyout can: j1939: do not wait 250 ms if the same addr was already claimed tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() btrfs: zlib: zero-initialize zlib workspace btrfs: limit device extents to the device size iio:adc:twl6030: Enable measurement of VAC wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads f2fs: fix to do sanity check on i_extra_isize in is_alive() fbdev: smscufx: fix error handling code in ufx_usb_probe powerpc/imc-pmu: Revert nest_init_lock to being a mutex serial: 8250_dma: Fix DMA Rx rearm race serial: 8250_dma: Fix DMA Rx completion race xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() mm: swap: properly update readahead statistics in unuse_pte_range() nvmem: core: fix cell removal on error Squashfs: fix handling and sanity checking of xattr_ids count mm/swapfile: add cond_resched() in get_swap_pages() fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps riscv: disable generation of unwind tables parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case parisc: Fix return code of pdc_iodc_print() iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: adc: berlin2-adc: Add missing of_node_put() in error path iio: hid: fix the retval in accel_3d_capture_sample efi: Accept version 2 of memory attributes table watchdog: diag288_wdt: fix __diag288() inline assembly watchdog: diag288_wdt: do not use stack buffers for hardware data fbcon: Check font dimension limits Input: i8042 - add Clevo PCX0DX to i8042 quirk table Input: i8042 - add TUXEDO devices to i8042 quirk tables Input: i8042 - merge quirk tables Input: i8042 - move __initconst to fix code styling warning vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API iio: adc: stm32-dfsdm: fill module aliases net/x25: Fix to not accept on connected socket i2c: rk3x: fix a bunch of kernel-doc warnings scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress scsi: target: core: Fix warning on RT kernels efi: fix potential NULL deref in efi_mem_reserve_persistent net: openvswitch: fix flow memory leak in ovs_flow_cmd_new virtio-net: Keep stop() to follow mirror sequence of open() selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning ata: libata: Fix sata_down_spd_limit() when no link speed is reported can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate net: phy: meson-gxl: Add generic dummy stubs for MMD register access squashfs: harden sanity check in squashfs_read_xattr_id_table netfilter: br_netfilter: disable sabotage_in hook after first suppression netrom: Fix use-after-free caused by accept on already connected socket fix "direction" argument of iov_iter_kvec() fix iov_iter_bvec() "direction" argument WRITE is "data source", not destination... scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region Linux 5.4.231 Revert "xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()" usb: host: xhci-plat: add wakeup entry at sysfs Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt ipv6: ensure sane device mtu in tunnels exit: Use READ_ONCE() for all oops/warn limit reads docs: Fix path paste-o for /sys/kernel/warn_count panic: Expose "warn_count" to sysfs panic: Introduce warn_limit panic: Consolidate open-coded panic_on_warn checks exit: Allow oops_limit to be disabled exit: Expose "oops_count" to sysfs exit: Put an upper limit on how often we can oops ia64: make IA64_MCA_RECOVERY bool instead of tristate csky: Fix function name in csky_alignment() and die() h8300: Fix build errors from do_exit() to make_task_dead() transition hexagon: Fix function name in die() objtool: Add a missing comma to avoid string concatenation exit: Add and use make_task_dead. mm: kasan: do not panic if both panic_on_warn and kasan_multishot set panic: unset panic_on_warn inside panic() sysctl: add a new register_sysctl_init() interface dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init blk-cgroup: fix missing pd_online_fn() while activating policy bpf: Skip task with pid=1 in send_signal_common() ARM: dts: imx: Fix pca9547 i2c-mux node name x86/asm: Fix an assembler warning with current binutils clk: Fix pointer casting to prevent oops in devm_clk_release() perf/x86/amd: fix potential integer overflow on shift of a int netfilter: conntrack: unify established states for SCTP paths x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL block: fix and cleanup bio_check_ro nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" net: mdio-mux-meson-g12a: force internal PHY off on mux switch net: xgene: Move shared header file into include/linux net/phy/mdio-i2c: Move header file to include/linux/mdio net/tg3: resolve deadlock in tg3_reset_task() during EEH thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net: ravb: Fix possible hang if RIS2_QFF1 happen sctp: fail if no bound addresses can be used for a given scope net/sched: sch_taprio: do not schedule in taprio_reset() netrom: Fix use-after-free of a listening socket. netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE ipv4: prevent potential spectre v1 gadget in fib_metrics_match() ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() netlink: annotate data races around sk_state netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around nlk->portid netfilter: nft_set_rbtree: skip elements in transaction from garbage collection net: fix UaF in netns ops registration error path netlink: prevent potential spectre v1 gadgets EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info EDAC/device: Respect any driver-supplied workqueue polling value ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment thermal: intel: int340x: Protect trip temperature from concurrent updates KVM: x86/vmx: Do not skip segment attributes if unusable bit is set cifs: Fix oops due to uncleared server->smbd_conn in reconnect ftrace/scripts: Update the instructions for ftrace-bisect.sh trace_events_hist: add check for return value of 'create_hist_field' tracing: Make sure trace_printk() can output as soon as it can be used module: Don't wait for GOING modules scsi: hpsa: Fix allocation size for scsi_host_alloc() Bluetooth: hci_sync: cancel cmd_timer if hci_open failed Revert "Revert "xhci: Set HCD flag to defer primary roothub registration"" fs: reiserfs: remove useless new_opts in reiserfs_remount netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci lockref: stop doing cpu_relax in the cmpxchg loop platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id KVM: s390: interrupt: use READ_ONCE() before cmpxchg() spi: spidev: remove debug messages that access spidev->spi without locking ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC cpufreq: armada-37xx: stop using 0 as NULL pointer s390/debug: add _ASM_S390_ prefix to header guard drm: Add orientation quirk for Lenovo ideapad D330-10IGL ASoC: fsl_micfil: Correct the number of steps on SX controls cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist tcp: fix rate_app_limited to default to 1 net: dsa: microchip: ksz9477: port map correction in ALU table entry register driver core: Fix test_async_probe_init saves device in wrong array w1: fix WARNING after calling w1_process() w1: fix deadloop in __w1_remove_master_device() tcp: avoid the lookup process failing to get sk in ehash table dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling dmaengine: xilinx_dma: use devm_platform_ioremap_resource() HID: betop: check shape of output reports net: macb: fix PTP TX timestamp failure due to packet padding dmaengine: Fix double increment of client_count in dma_chan_get() drm/panfrost: fix GENERIC_ATOMIC64 dependency net: mlx5: eliminate anonymous module_init & module_exit usb: gadget: f_fs: Ensure ep0req is dequeued before free_request usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait HID: revert CHERRY_MOUSE_000C quirk net: stmmac: fix invalid call to mdiobus_get_phy() HID: check empty report_list in bigben_probe() HID: check empty report_list in hid_validate_values() net: mdio: validate parameter addr in mdiobus_get_phy() net: usb: sr9700: Handle negative len l2tp: Don't sleep and disable BH under writer-side sk_callback_lock l2tp: Serialize access to sk_user_data with sk_callback_lock net: fix a concurrency bug in l2tp_tunnel_register() net/sched: sch_taprio: fix possible use-after-free wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs net: nfc: Fix use-after-free in local_cleanup() phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation amd-xgbe: Delay AN timeout during KR training amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent affs: initialize fsdata in affs_truncate() IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Reserve user expected TIDs IB/hfi1: Reject a zero-length user expected buffer RDMA/core: Fix ib block iterator counter overflow tomoyo: fix broken dependency on *.conf.default EDAC/highbank: Fix memory leak in highbank_mc_probe() HID: intel_ish-hid: Add check for ishtp_dma_tx_map ARM: imx: add missing of_node_put() ARM: imx35: Retrieve the IIM base address from devicetree ARM: imx31: Retrieve the IIM base address from devicetree ARM: imx27: Retrieve the SYSCTRL base address from devicetree ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() clk: Provide new devm_clk helpers for prepared and enabled clocks clk: generalize devm_clk_get() a bit Linux 5.4.230 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix drm/amd/display: Fix set scaling doesn's work drm/i915: re-disable RC6p on Sandy Bridge gsmi: fix null-deref in gsmi_get_variable serial: atmel: fix incorrect baudrate setup dmaengine: tegra210-adma: fix global intr clear serial: pch_uart: Pass correct sg to dma_unmap_sg() dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() usb: gadget: g_webcam: Send color matching descriptor per frame usb: typec: altmodes/displayport: Fix pin assignment calculation usb: typec: altmodes/displayport: Add pin assignment helper usb: host: ehci-fsl: Fix module alias USB: serial: cp210x: add SCALANCE LPE-9000 device id USB: gadgetfs: Fix race between mounting and unmounting cifs: do not include page data when checking signature btrfs: fix race between quota rescan and disable leading to NULL pointer deref mmc: sunxi-mmc: Fix clock refcount imbalance during unbind comedi: adv_pci1760: Fix PWM instruction handling usb: core: hub: disable autosuspend for TI TUSB8041 misc: fastrpc: Fix use-after-free race condition for maps misc: fastrpc: Don't remove map on creater_process and device_release USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 USB: serial: option: add Quectel EM05CN modem USB: serial: option: add Quectel EM05CN (SG) modem USB: serial: option: add Quectel EC200U modem USB: serial: option: add Quectel EM05-G (RS) modem USB: serial: option: add Quectel EM05-G (CS) modem USB: serial: option: add Quectel EM05-G (GR) modem prlimit: do_prlimit needs to have a speculation check xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables usb: acpi: add helper to check port lpm capability using acpi _DSM xhci: Add a flag to disable USB3 lpm on a xhci root port level. xhci: Add update_hub_device override for PCI xHCI hosts xhci: Fix null pointer dereference when host dies usb: xhci: Check endpoint is valid before dereferencing it xhci-pci: set the dma max_seg_size ALSA: hda/realtek - Turn on power early drm/i915/gt: Reset twice efi: fix userspace infinite retry read efivars after EFI runtime services page fault nilfs2: fix general protection fault in nilfs_btree_insert() Add exception protection processing for vd in axi_chan_handle_err function wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices f2fs: let's avoid panic if extent_tree is not created RDMA/srp: Move large values to a new enum for gcc13 net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID pNFS/filelayout: Fix coalescing test for single DS Revert "net: add atomic_long_t to net_device_stats fields" Revert "PM/devfreq: governor: Add a private governor_data for governor" Linux 5.4.229 tipc: call tipc_lxc_xmit without holding node_read_lock ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown tipc: Add a missing case of TIPC_DIRECT_MSG type tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started tipc: fix use-after-free in tipc_disc_rcv() Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" mm: Always release pages to the buddy allocator in memblock_free_late(). efi: fix NULL-deref in init error path arm64: cmpxchg_double*: hazard against entire exchange variable arm64: atomics: remove LL/SC trampolines arm64: atomics: format whitespace consistently drm/virtio: Fix GEM handle creation UAF x86/resctrl: Fix task CLOSID/RMID update race x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() iommu/mediatek-v1: Add error handle for mtk_iommu_probe net/mlx5: Fix ptp max frequency adjustment range net/mlx5: Rename ptp clock info net/sched: act_mpls: Fix warning during failed attribute validation nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() hvc/xen: lock console list traversal tipc: fix unexpected link reset due to discovery messages tipc: eliminate checking netns if node established tipc: improve throughput between nodes in netns regulator: da9211: Use irq handler when ready EDAC/device: Fix period calculation in edac_device_reset_delay_period() x86/boot: Avoid using Intel mnemonics in AT&T syntax asm powerpc/imc-pmu: Fix use of mutex in IRQs disabled section netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. ext4: fix uninititialized value in 'ext4_evict_inode' ext4: fix use-after-free in ext4_orphan_cleanup ext4: lost matching-pair of trace in ext4_truncate ext4: fix bug_on in __es_tree_search caused by bad quota inode quota: Factor out setup of quota inode jbd2: use the correct print format usb: ulpi: defer ulpi_register on ulpi_read_id timeout wifi: wilc1000: sdio: fix module autoloading ipv6: raw: Deduct extension header length in rawv6_push_pending_frames ixgbe: fix pci device refcount leak platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe drm/msm/adreno: Make adreno quirks not overwrite each other cifs: Fix uninitialized memory read for smb311 posix symlink create ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF net/ulp: prevent ULP without clone op from entering the LISTEN status s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() s390/kexec: fix ipl report address for kdump perf auxtrace: Fix address filter duplicate symbol selection docs: Fix the docs build with Sphinx 6.0 efi: tpm: Avoid READ_ONCE() for accessing the event log KVM: arm64: Fix S1PTW handling on RO memslots net: sched: disallow noqueue for qdisc classes driver core: Fix bus_type.match() error handling in __driver_attach() selftests: set the BUILD variable to absolute path selftests: Fix kselftest O=objdir build from cluttering top level objdir parisc: Align parisc MADV_XXX constants with all other architectures mbcache: Avoid nesting of cache->c_list_lock under bit locks hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling hfs/hfsplus: use WARN_ON for sanity check ext4: don't allow journal inode to have encrypt flag riscv: uaccess: fix type of 0 variable on error in get_user() nfsd: fix handling of readdir in v4root vs. mount upcall timeout x86/bugs: Flush IBP in ib_prctl_set() ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet udf: Fix extension of the last extent in the file caif: fix memory leak in cfctrl_linkup_request() drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() usb: rndis_host: Secure rndis_query check against int overflow drivers/net/bonding/bond_3ad: return when there's no aggregator perf tools: Fix resources leak in perf_data__open_dir() net: sched: cbq: dont intepret cls results when asked to drop net: sched: atm: dont intepret cls results when asked to drop RDMA/mlx5: Fix validation of max_rd_atomic caps for DC RDMA/uverbs: Silence shiftTooManyBitsSigned warning net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe net: amd-xgbe: add missed tasklet_kill vhost: fix range used in translate_desc() nfc: Fix potential resource leaks qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure net: sched: fix memory leak in tcindex_set_parms net: hns3: add interrupts re-initialization while doing VF FLR nfsd: shut down the NFSv4 state objects before the filecache bpf: pull before calling skb_postpull_rcsum() SUNRPC: ensure the matching upcall is in-flight upon downcall ext4: fix deadlock due to mbcache entry corruption mbcache: automatically delete entries from cache on freeing ext4: fix race when reusing xattr blocks ext4: unindent codeblock in ext4_xattr_block_set() ext4: remove EA inode entry from mbcache on inode eviction mbcache: add functions to delete entry if unused mbcache: don't reclaim used entries ext4: use kmemdup() to replace kmalloc + memcpy fs: ext4: initialize fsdata in pagecache_write() ext4: use memcpy_to_page() in pagecache_write() mm/highmem: Lift memcpy_[to|from]_page to core ext4: correct inconsistent error msg in nojournal mode ext4: goto right label 'failed_mount3a' ravb: Fix "failed to switch device to config mode" message during unbind KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 KVM: VMX: Fix the spelling of CPU_BASED_USE_TSC_OFFSETTING KVM: VMX: Rename NMI_PENDING to NMI_WINDOW KVM: VMX: Rename INTERRUPT_PENDING to INTERRUPT_WINDOW KVM: retpolines: x86: eliminate retpoline from vmx.c exit handlers KVM: x86: optimize more exit handlers in vmx.c perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor dm thin: resume even if in FAIL mode media: s5p-mfc: Fix in register read and write for H264 media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix to handle reference queue during finishing PM/devfreq: governor: Add a private governor_data for governor btrfs: replace strncpy() with strscpy() ext4: allocate extended attribute value in vmalloc area ext4: avoid unaccounted block allocation when expanding inode ext4: initialize quota before expanding inode in setproject ioctl ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: avoid BUG_ON when creating xattrs ext4: fix error code return to user-space in ext4_get_branch() ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: add helper to check quota inums ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop drm/vmwgfx: Validate the box size for the snooped cursor drm/connector: send hotplug uevent on connector cleanup device_cgroup: Roll back to original exceptions after copy failure parisc: led: Fix potential null-ptr-deref in start_task() iommu/amd: Fix ivrs_acpihid cmdline parsing code crypto: n2 - add missing hash statesize PCI/sysfs: Fix double free in error path PCI: Fix pci_device_is_present() for VFs by checking PF ipmi: fix use after free in _ipmi_destroy_user() ima: Fix a potential NULL pointer access in ima_restore_measurement_list mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ipmi: fix long wait in unload when IPMI disconnect efi: Add iMac Pro 2017 to uefi skip cert quirk md/bitmap: Fix bitmap chunk size overflow issues cifs: fix missing display of three mount options cifs: fix confusing debug message media: dvb-core: Fix UAF due to refcount races at releasing media: dvb-core: Fix double free in dvb_register_device() ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line tracing/hist: Fix wrong return value in parse_action_params() x86/microcode/intel: Do not retry microcode reloading on the APs tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' dm cache: set needs_check flag after aborting metadata dm cache: Fix UAF in destroy() dm clone: Fix UAF in clone_dtr() dm integrity: Fix UAF in dm_integrity_dtr() dm thin: Fix UAF in run_timer_softirq() dm thin: Use last transaction's pmd->root when commit failed dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort binfmt: Fix error return code in load_elf_fdpic_binary() binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf cpufreq: Init completion before kobject_init_and_add() selftests: Use optional USERCFLAGS and USERLDFLAGS arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength ARM: ux500: do not directly dereference __iomem btrfs: fix resolving backrefs for inline extent followed by prealloc mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K ktest.pl minconfig: Unset configs instead of just removing them kest.pl: Fix grub2 menu handling for rebooting soc: qcom: Select REMAP_MMIO for LLCC driver media: stv0288: use explicitly signed char net/af_packet: make sure to pull mac header net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING f2fs: should put a page when checking the summary info mm, compaction: fix fast_isolate_around() to stay within boundaries md: fix a crash in mempool_free pnode: terminate at peers of source ALSA: line6: fix stack overflow in line6_midi_transmit ALSA: line6: correct midi status byte when receiving data from podxt ovl: Use ovl mounter's fsuid and fsgid in ovl_link() hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount HID: plantronics: Additional PIDs for double volume key presses quirk HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint powerpc/rtas: avoid scheduling in rtas_os_term() powerpc/rtas: avoid device tree lookups in rtas_os_term() objtool: Fix SEGFAULT nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition nvme: resync include/linux/nvme.h with nvmecli ata: ahci: Fix PCS quirk application for suspend nvme-pci: fix doorbell buffer value endianness cifs: fix oops during encryption media: dvbdev: fix refcnt bug media: dvbdev: fix build warning due to comments gcov: add support for checksum field regulator: core: fix deadlock on regulator enable iio: adc128s052: add proper .data members in adc128_of_match table iio: adc: ad_sigma_delta: do not use internal iio_dev lock reiserfs: Add missing calls to reiserfs_security_free() HID: wacom: Ensure bootloader PID is usable in hidraw mode usb: dwc3: core: defer probe on ulpi_read_id timeout ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion ASoC: rt5670: Remove unbalanced pm_runtime_put() ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: Intel: Skylake: Fix driver hang during shutdown ALSA: hda: add snd_hdac_stop_streams() helper ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() clk: st: Fix memory leak in st_of_quadfs_setup() media: si470x: Fix use-after-free in si470x_int_in_callback() mmc: f-sdh30: Add quirks for broken timeout clock capability regulator: core: fix use_count leakage when handling boot-on blk-mq: fix possible memleak when register 'hctx' failed media: dvb-usb: fix memory leak in dvb_usb_adapter_init() media: dvbdev: adopts refcnt to avoid UAF media: dvb-frontends: fix leak of memory fw bpf: Prevent decl_tag from being referenced in func_proto arg ppp: associate skb with a device at tx mrp: introduce active flags to prevent UAF when applicant uninit net: add atomic_long_t to net_device_stats fields md/raid1: stop mdx_raid1 thread when raid1 array run failed drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() drm/sti: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() s390/lcs: Fix return type of lcs_start_xmit() s390/netiucv: Fix return type of netiucv_tx() s390/ctcm: Fix return type of ctc{mp,}m_tx() igb: Do not free q_vector unless new one was allocated wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() hamradio: baycom_epp: Fix return type of baycom_send_packet() net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() bpf: make sure skb->len != 0 when redirecting to a tunneling device ipmi: fix memleak when unload ipmi driver ASoC: codecs: rt298: Add quirk for KBL-R RVP platform wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out wifi: ath9k: verify the expected usb_endpoints are present brcmfmac: return error when getting invalid max_flowrings from dongle drm/etnaviv: add missing quirks for GC300 hfs: fix OOB Read in __hfs_brec_find acct: fix potential integer overflow in encode_comp_t() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() ACPICA: Fix error code path in acpi_ds_call_control_method() fs: jfs: fix shift-out-of-bounds in dbDiscardAG udf: Avoid double brelse() in udf_rename() fs: jfs: fix shift-out-of-bounds in dbAllocAG binfmt_misc: fix shift-out-of-bounds in check_special_flags rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() net: stream: purge sk_error_queue in sk_stream_kill_queues() myri10ge: Fix an error handling path in myri10ge_probe() rxrpc: Fix missing unlock in rxrpc_do_sendmsg() net_sched: reject TCF_EM_SIMPLE case for complex ematch module mailbox: zynq-ipi: fix error handling while device_register() fails skbuff: Account for tail adjustment during pull operations openvswitch: Fix flow lookup to use unmasked key rtc: mxc_v2: Add missing clk_disable_unprepare() r6040: Fix kmemleak in probe and remove nfc: pn533: Clear nfc_target before being used mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure NFSD: Add tracepoints to NFSD's duplicate reply cache nfsd: Define the file access mode enum for tracing rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() pwm: sifive: Call pwm_sifive_update_clock() while mutex is held selftests/powerpc: Fix resource leaks powerpc/hv-gpci: Fix hv_gpci event list powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/52xx: Fix a resource leak in an error handling path macintosh/macio-adb: check the return value of ioremap() macintosh: fix possible memory leak in macio_add_one_device() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() iommu/amd: Fix pci device refcount leak in ppr_notifier() rtc: pcf85063: Fix reading alarm rtc: snvs: Allow a time difference on clock register read include/uapi/linux/swab: Fix potentially missing __always_inline RDMA/siw: Fix pointer cast warning power: supply: fix null pointer dereferencing in power_supply_get_battery_info HSI: omap_ssi_core: Fix error handling in ssi_init() perf symbol: correction while adjusting symbol perf trace: Handle failure when trace point folder is missed perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Add a strtoul() method to 'struct syscall_arg_fmt' perf trace: Allow associating scnprintf routines with well known arg names perf trace: Add the syscall_arg_fmt pointer to syscall_arg perf trace: Factor out the initialization of syscal_arg_fmt->scnprintf perf trace: Separate 'struct syscall_fmt' definition from syscall_fmts variable perf trace: Return error if a system call doesn't exist power: supply: fix residue sysfs file in error handle route of __power_supply_register() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() fbdev: vermilion: decrease reference count in error path fbdev: via: Fix error in via_core_init() fbdev: pm2fb: fix missing pci_disable_device() fbdev: ssd1307fb: Drop optional dependency samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() tracing/hist: Fix issue of losting command info in error_log usb: storage: Add check for kcalloc i2c: ismt: Fix an out-of-bounds bug in ismt_access() vme: Fix error not catched in fake_init() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() staging: rtl8192u: Fix use after free in ieee80211_rx() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe chardev: fix error handling in cdev_device_add() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() drivers: mcb: fix resource leak in mcb_probe() usb: gadget: f_hid: fix refcount leak on error path usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: optional SETUP/SET_REPORT mode usb: roles: fix of node refcount leak in usb_role_switch_is_parent() counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: ocxl: fix possible name leak in ocxl_file_register_afu() test_firmware: fix memory leak in test_firmware_init() serial: sunsab: Fix error handling in sunsab_init() serial: altera_uart: fix locking in polling mode tty: serial: altera_uart_{r,t}x_chars() need only uart_port tty: serial: clean up stop-tx part in altera_uart_tx_chars() serial: pch: Fix PCI device refcount leak in pch_request_dma() serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: amba-pl011: avoid SBSA UART accessing DMACR register usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: Check for ops->exit instead of ops->enter in altmode_exit staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: fotg210-udc: Fix ages old endianness issues uio: uio_dmem_genirq: Fix deadlock between irq config and handling uio: uio_dmem_genirq: Fix missing unlock in irq configuration vfio: platform: Do not pass return buffer to ACPI _RST method class: fix possible memory leak in __class_register() serial: tegra: Read DMA status before terminating tty: serial: tegra: Activate RX DMA transfer by request drivers: dio: fix possible memory leak in dio_init() IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces hwrng: geode - Fix PCI device refcount leak hwrng: amd - Fix PCI device refcount leak crypto: img-hash - Fix variable dereferenced before check 'hdev->req' orangefs: Fix sysfs not cleanup when dev init failed RDMA/hfi1: Fix error return code in parse_platform_config() crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() f2fs: avoid victim selection from previous victim section RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() scsi: snic: Fix possible UAF in snic_tgt_create() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix possible name leak when device_register() fails scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak scsi: hpsa: Fix possible memory leak in hpsa_init_one() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hfi: Decrease PCI device reference count in error path PCI: Check for alloc failure in pci_request_irq() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: ccree - swap SHA384 and SHA512 larval hashes at build time scsi: scsi_debug: Fix a warning in resp_write_scat() RDMA/siw: Set defined status for work completion with undefined status RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Fix immediate work request flush to completion queue f2fs: fix normal discard process RDMA/core: Fix order of nldev_exit call apparmor: Use pointer to struct aa_label for lbs_cred apparmor: Fix abi check to include v8 abi apparmor: fix lockdep warning when removing a namespace apparmor: fix a memleak in multi_transaction_new() stmmac: fix potential division by 0 Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() ntb_netdev: Use dev_kfree_skb_any() in interrupt context net: lan9303: Fix read error execution path can: tcan4x5x: Remove invalid write in clear_interrupts net: amd-xgbe: Check only the minimum speed for active/passive cables net: amd-xgbe: Fix logic around active and passive cables net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: farsync: Fix kmemleak when rmmods farsync ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: defxx: Fix missing err handling in dfx_init() net: vmw_vsock: vmci: Check memcpy_from_msg() clk: socfpga: Fix memory leak in socfpga_gate_init() clk: socfpga: use clk_hw_register for a5/c5 clk: socfpga: clk-pll: Remove unused variable 'rc' blktrace: Fix output non-blktrace event when blk_classic option enabled wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode clk: samsung: Fix memory leak in _samsung_clk_register_pll() media: coda: Add check for kmalloc media: coda: Add check for dcoda_iram_alloc media: c8sectpfe: Add of_node_put() when breaking out of loop mmc: mmci: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: alcor: fix return value check of mmc_add_host() NFSv4.x: Fail client initialisation if state manager thread can't run SUNRPC: Fix missing release socket in rpc_sockname() xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt media: saa7164: fix missing pci_disable_device() bpf, sockmap: fix race in sock_map_free() regulator: core: fix resource leak in regulator_register() configfs: fix possible memory leak in configfs_create_dir() hsr: Avoid double remove of a node. clk: qcom: clk-krait: fix wrong div2 functions regulator: core: fix module refcount leak in set_supply() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE bonding: uninitialized variable in bond_miimon_inspect() bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data netfilter: conntrack: set icmpv6 redirects as RELATED ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() ASoC: mediatek: mt8173: Enable IRQ when pdata is ready wifi: iwlwifi: mvm: fix double free on tx path. ALSA: asihpi: fix missing pci_disable_device() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFSv4.2: Fix initialisation of struct nfs4_label NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd ASoC: dt-bindings: wcd9335: fix reset line polarity in example drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: dvb-core: Fix ignored return value in dvb_register_frontend() pinctrl: pinconf-generic: add missing of_node_put() clk: imx: replace osc_hdmi with dummy clk: imx8mn: correct the usb1_ctrl parent to be usb_bus media: imon: fix a race condition in send_packet() mtd: maps: pxa2xx-flash: fix memory leak in probe bonding: fix link recovery in mode 2 when updelay is nonzero bonding: Rename slave_arr to usable_slaves bonding: Export skip slave logic to function clk: rockchip: Fix memory leak in rockchip_clk_register_pll() regulator: core: use kfree_const() to free space conditionally ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT HID: hid-sensor-custom: set fixed size for custom attributes bpf: Move skb->len == 0 checks into __bpf_redirect media: videobuf-dma-contig: use dma_mmap_coherent media: platform: exynos4-is: Fix error handling in fimc_md_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() Input: elants_i2c - properly handle the reset GPIO when power is off mtd: lpddr2_nvm: Fix possible null-ptr-deref wifi: ath10k: Fix return value in ath10k_pci_init() ima: Fix misuse of dereference of pointer in template_desc_init_fields() integrity: Fix memory leakage in keyring allocation error path amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() ASoC: pxa: fix null-pointer dereference in filter() drm/mediatek: Modify dpi power on/off sequence. drm/radeon: Add the missed acpi_put_table() to fix memory leak rxrpc: Fix ack.bufferSize to be 0 when generating an ack net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() media: camss: Clean up received buffers on failed start of streaming wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port mtd: Fix device name leak when register device failed in add_mtd_device() bpf: propagate precision in ALU/ALU64 operations media: vivid: fix compose size exceed boundary ima: Handle -ESTALE returned by ima_filter_rule_match() ima: Fix fall-through warnings for Clang ima: Rename internal filter rule functions drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure spi: Update reference to struct spi_controller clk: renesas: r9a06g032: Repair grave increment error can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: do not increase tx statistics when sending error message frames media: i2c: ad5820: Fix error path pata_ipx4xx_cf: Fix unsigned comparison with less than zero wifi: rtl8xxxu: Fix reading the vendor of combo chips wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() rapidio: devices: fix missing put_device in mport_cdev_open hfs: Fix OOB Write in hfs_asc2mac relay: fix type mismatch when allocating memory in relay_create_buf() eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD rapidio: fix possible UAF when kfifo_alloc() fails fs: sysv: Fix sysv_nblocks() returns wrong value MIPS: OCTEON: warn only once if deprecated link status is being used MIPS: BCM63xx: Add check for NULL for clk in clk_enable platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() PM: runtime: Do not call __rpm_callback() from rpm_idle() PM: runtime: Improve path in rpm_idle() when no callback xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() x86/xen: Fix memory leak in xen_init_lock_cpu() x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() xen/events: only register debug interrupt for 2-level events uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled rapidio: rio: fix possible name leak in rio_register_mport() rapidio: fix possible name leaks when rio_add_device() fails ocfs2: fix memory leak in ocfs2_mount_volume() ocfs2: rewrite error handling of ocfs2_fill_super ocfs2: ocfs2_mount_volume does cleanup job before return error debugfs: fix error when writing negative value to atomic_t debugfs file docs: fault-injection: fix non-working usage of negative values lib/notifier-error-inject: fix error when writing -errno to debugfs file libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() genirq/irqdesc: Don't try to remove non-existing sysfs files nfsd: don't call nfsd_file_put from client states seqfile display EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() PNP: fix name memory leak in pnp_alloc_dev() selftests/efivarfs: Add checking of the test return value MIPS: vpe-cmp: fix possible memory leak while module exiting MIPS: vpe-mt: fix possible memory leak while module exiting ocfs2: fix memory leak in ocfs2_stack_glue_init() lib/fonts: fix undefined behavior in bit shift for get_default_font proc: fixup uptime selftest timerqueue: Use rb_entry_safe() in timerqueue_getnext() perf: Fix possible memleak in pmu_dev_alloc() selftests/ftrace: event_triggers: wait longer for test_event_enable fs: don't audit the capability check in simple_xattr_list() PM: hibernate: Fix mistake in kerneldoc comment alpha: fix syscall entry in !AUDUT_SYSCALL case cpuidle: dt: Return the correct numbers of parsed idle states tpm/tpm_crb: Fix error message in __crb_relinquish_locality() pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP ARM: mmp: fix timer_read delay pstore/ram: Fix error return code in ramoops_probe() arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC ARM: dts: turris-omnia: Add switch port 6 node ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync arm: dts: spear600: Fix clcd interrupt drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias ARM: dts: qcom: apq8064: fix coresight compatible usb: musb: remove extra check in musb_gadget_vbus_draw net: loopback: use NET_NAME_PREDICTABLE for name_assign_type Bluetooth: L2CAP: Fix u8 overflow HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E HID: ite: Add support for Acer S1002 keyboard-dock xen-netback: move removal of "hotplug-status" to the right place igb: Initialize mailbox message for VF reset USB: serial: f81534: fix division by zero on line-speed change USB: serial: f81232: fix division by zero on line-speed change USB: serial: cp210x: add Kamstrup RF sniffer PIDs USB: serial: option: add Quectel EM05-G modem usb: gadget: uvc: Prevent buffer overflow in setup handler udf: Fix extending file within last block udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix preallocation discarding at indirect extent boundary udf: Discard preallocation before extending file with a hole tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS ANDROID: Add more hvc devices for virtio-console. Revert "can: af_can: fix NULL pointer dereference in can_rcv_filter" ANDROID: Revert "tracing/ring-buffer: Have polling block on watermark" Linux 5.4.228 ASoC: ops: Correct bounds check for second channel on SX controls can: mcba_usb: Fix termination command argument can: sja1000: fix size of OCR_MODE_MASK define pinctrl: meditatek: Startup with the IRQs disabled ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() nfp: fix use-after-free in area_cache_get() block: unhash blkdev part inode when the part is deleted mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page x86/smpboot: Move rcu_cpu_starting() earlier net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head Linux 5.4.227 can: esd_usb: Allow REC and TEC to return to zero net: mvneta: Fix an out of bounds check ipv6: avoid use-after-free in ip6_fragment() net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() xen/netback: fix build warning ethernet: aeroflex: fix potential skb leak in greth_init_rings() ipv4: Fix incorrect route flushing when table ID 0 is used ipv4: Fix incorrect route flushing when source address is deleted tipc: Fix potential OOB in tipc_link_proto_rcv() net: hisilicon: Fix potential use-after-free in hix5hd2_rx() net: hisilicon: Fix potential use-after-free in hisi_femac_rx() net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq net: stmmac: fix "snps,axi-config" node property parsing nvme initialize core quirks before calling nvme_init_subsystem NFC: nci: Bounds check struct nfc_target arrays i40e: Disallow ip4 and ip6 l4_4_bytes i40e: Fix for VF MAC address 0 i40e: Fix not setting default xps_cpus after reset net: mvneta: Prevent out of bounds read in mvneta_config_rss() xen-netfront: Fix NULL sring after live migration net: encx24j600: Fix invalid logic in reading of MISTAT register net: encx24j600: Add parentheses to fix precedence mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload net: dsa: ksz: Check return value Bluetooth: Fix not cleanup led when bt_init fails Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() af_unix: Get user_ns from in_skb in unix_diag_get_exact(). igb: Allocate MSI-X vector when testing e1000e: Fix TX dispatch condition gpio: amd8111: Fix PCI device reference count leak drm/bridge: ti-sn65dsi86: Fix output polarity setting bug ca8210: Fix crash by zero initializing data ieee802154: cc2520: Fix error return code in cc2520_hw_init() can: af_can: fix NULL pointer dereference in can_rcv_filter HID: core: fix shift-out-of-bounds in hid_report_raw_event HID: hid-lg4ff: Add check for empty lbuf HID: usbhid: Add ALWAYS_POLL quirk for some mice drm/shmem-helper: Remove errant put in error path KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field mm/gup: fix gup_pud_range() for dax memcg: fix possible use-after-free in memcg_write_event_control() media: v4l2-dv-timings.c: fix too strict blanking sanity checks Revert "net: dsa: b53: Fix valid setting for MDB entries" xen/netback: don't call kfree_skb() with interrupts disabled xen/netback: do some code cleanup xen/netback: Ensure protocol headers don't fall in the non-linear area mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths mm/khugepaged: fix GUP-fast interaction by sending IPI mm/khugepaged: take the right locks for page table retraction net: usb: qmi_wwan: add u-blox 0x1342 composition 9p/xen: check logical size for buffer size fbcon: Use kzalloc() in fbcon_prepare_logo() regulator: twl6030: fix get status of twl6032 regulators ASoC: soc-pcm: Add NULL check in BE reparenting btrfs: send: avoid unaligned encoded writes when attempting to clone range ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event regulator: slg51000: Wait after asserting CS pin 9p/fd: Use P9_HDRSZ for header size ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name ARM: dts: rockchip: fix ir-receiver node names arm: dts: rockchip: fix node name for hym8563 rtc arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series Change-Id: I6a643eaa2ee55257328d881f5b860200719e981e Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>	2023-05-30 11:16:10 +05:30
Greg Kroah-Hartman	3b9196f720	Merge tag 'android11-5.4.242_r00' into android11-5.4 ... This is the merge of the upstream LTS release of 5.4.242 into the android11-5.4 branch. It contains the following commits: b57981e17b4b Merge tag 'android11-5.4.242_r00' into android11-5.4 734577d21e Merge 5.4.242 into android11-5.4-lts ea7862c507 Linux 5.4.242 d54a9f999e ASN.1: Fix check for strdup() success 2500d7edeb iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() 760c2e6dee pwm: meson: Explicitly set .polarity in .get_state() 7f2b8046da xfs: fix forkoff miscalculation related to XFS_LITINO(mp) c27a6bb178 sctp: Call inet6_destroy_sock() via sk->sk_destruct(). 97ce6cde1f dccp: Call inet6_destroy_sock() via sk->sk_destruct(). a01b75620e inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 9374db5bd1 tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2ac4697b77 udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). 5a62248c58 ext4: fix use-after-free in ext4_xattr_set_entry 3b0044cb28 ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() 3c4fdbf368 Revert "ext4: fix use-after-free in ext4_xattr_set_entry" ef2aab86c3 x86/purgatory: Don't generate debug info for purgatory.ro c22aefaef8 MIPS: Define RUNTIME_DISCARD_EXIT in LD script a5167e902b mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 1b8b54fc55 memstick: fix memory leak if card device is never registered 5ad61a5268 nilfs2: initialize unused bytes in segment summary blocks 988766b9d1 iio: light: tsl2772: fix reading proximity-diodes from device tree 5cb867f1ec xen/netback: use same error messages for same errors 903f82b1a6 nvme-tcp: fix a possible UAF when failing to allocate an io queue 34b74c32ff s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling 64cd99da25 net: dsa: b53: mmap: add phy ops 89dcf0dd7a scsi: core: Improve scsi_vpd_inquiry() checks f729b74bb4 scsi: megaraid_sas: Fix fw_crash_buffer_show() 4f4ef354f9 selftests: sigaltstack: fix -Wuninitialized a725dddf21 Input: i8042 - add quirk for Fujitsu Lifebook A574/H 9df3f502e3 f2fs: Fix f2fs_truncate_partial_nodes ftrace event 2f3730f182 e1000e: Disable TSO on i219-LM card to increase speed 0f0a291cc5 bpf: Fix incorrect verifier pruning due to missing register precision taints ba610df83b mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() d8e120057c i40e: fix i40e_setup_misc_vector() error handling 59fba01b6c i40e: fix accessing vsi->active_filters without holding lock 01125379e2 netfilter: nf_tables: fix ifdef to also consider nf_tables=m 7c1019391b virtio_net: bugfix overflow inside xdp_linearize_page() 35dceaeab9 net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg d61f24a454 regulator: fan53555: Explicitly include bits header 36f098e1e4 netfilter: br_netfilter: fix recent physdev match breakage 375e445b10 arm64: dts: meson-g12-common: specify full DMC range cb1f89fe93 ARM: dts: rockchip: fix a typo error for rk3288 spdif node da8b283c08 Merge 5.4.241 into android11-5.4-lts 58f42ed1cd Linux 5.4.241 8795936437 xfs: force log and push AIL to clear pinned inodes when aborting mount c76dd36875 xfs: don't reuse busy extents on extent trim 4679b73a8e xfs: consider shutdown in bmapbt cursor delete assert 9355fd118b xfs: shut down the filesystem if we screw up quota reservation 48f75df5b3 xfs: report corruption only as a regular error 3cce34ceb2 xfs: set inode size after creating symlink e76bd6da51 xfs: fix up non-directory creation in SGID directories ad6613c984 xfs: remove the di_version field from struct icdinode ca4533c951 xfs: simplify a check in xfs_ioctl_setattr_check_cowextsize e078b3de3e xfs: simplify di_flags2 inheritance in xfs_ialloc 0c553917b6 xfs: only check the superblock version for dinode size calculation 90aab52d06 xfs: add a new xfs_sb_version_has_v3inode helper edd36a57b4 xfs: remove the kuid/kgid conversion wrappers 3ef81874f7 xfs: remove the icdinode di_uid/di_gid members cc508a41ae xfs: ensure that the inode uid/gid match values match the icdinode ones 7a9dc79771 xfs: merge the projid fields in struct xfs_icdinode 4f3252e7e1 xfs: show the proper user quota options 799cafa4f3 coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug 440bdc49f7 watchdog: sbsa_wdog: Make sure the timeout programming is within the limits 70ca826d3d i2c: ocores: generate stop condition after timeout in polling mode 5fb5bdcdcd ubi: Fix deadlock caused by recursively holding work_sem 0b27716f2d mtd: ubi: wl: Fix a couple of kernel-doc issues e55588c442 ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size a652c30fa2 asymmetric_keys: log on fatal failures in PE/pkcs7 5809dbacc4 verify_pefile: relax wrapper length check 0213f027d0 drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F b3052e5d46 efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L 02a78e6539 i2c: imx-lpi2c: clean rx/tx buffers upon new message 1ef5639744 power: supply: cros_usbpd: reclassify "default case!" as debug 7169d16388 net: macb: fix a memory corruption in extended buffer descriptor mode c39fa0398a udp6: fix potential access to stale information 9c46c49ad3 RDMA/core: Fix GID entry ref leak when create_ah fails ad831a7079 sctp: fix a potential overflow in sctp_ifwdtsn_skip afffe0d1e6 qlcnic: check pci_reset_function result a841f6a0a3 niu: Fix missing unwind goto in niu_alloc_channels() fcd084e199 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 1b77cb6f5e mtd: rawnand: stm32_fmc2: remove unsupported EDO mode 4c1d882b53 mtd: rawnand: meson: fix bitmask for length in command word 2667460034 mtdblock: tolerate corrected bit-flips 50dbfd9dac btrfs: fix fast csum implementation detection c6db5f2a31 btrfs: print checksum type and implementation at mount time 8a99e6200c Bluetooth: Fix race condition in hidp_session_thread c024219925 Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} 9025cea8e0 ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards 4d419195d6 ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() fe158eeccc ALSA: i2c/cs8427: fix iec958 mixer control deactivation aa23fa32e5 ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard 62ccf2e0b1 ALSA: emu10k1: fix capture interrupt handler unlinking 9a3ba7b24d Revert "pinctrl: amd: Disable and mask interrupts on resume" 2945f948aa irqdomain: Fix mapping-creation race e8f3aea716 irqdomain: Refactor __irq_domain_alloc_irqs() 3804f265c1 irqdomain: Look for existing mapping only once e7bba7ddb4 mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() fd644712bc ring-buffer: Fix race while reader and writer are on the same page c208b4321e drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path c381527918 net_sched: prevent NULL dereference if default qdisc setup failed 987f599fc5 tracing: Free error logs of tracing instances d2136f0569 can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access 5a74a75fc3 ftrace: Mark get_lock_parent_ip() __always_inline 95bbfeb4ff perf/core: Fix the same task check in perf_event_set_output 666c25d35e ALSA: hda/realtek: Add quirk for Clevo X370SNW 83b16a60e4 nilfs2: fix sysfs interface lifetime 613bf23c07 nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() aa8e50688d tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty aabba44404 tty: serial: sh-sci: Fix Rx on RZ/G2L SCI 209ab5c234 tty: serial: sh-sci: Fix transmit end interrupt handler 9a2a6443d6 iio: dac: cio-dac: Fix max DAC write value check for 12-bit e469ebb28d iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip abc5b4f8cd USB: serial: option: add Quectel RM500U-CN modem b9c11537ef USB: serial: option: add Telit FE990 compositions 38c00a22d6 usb: typec: altmodes/displayport: Fix configure initial pin assignment f417d3fea3 USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs 47132be17d xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu 5fccf2c546 NFSD: callback request does not use correct credential for AUTH_SYS 3686380d9d sunrpc: only free unix grouplist after RCU settles 1627119153 gpio: davinci: Add irq chip flag to skip set wake 0cf600ca1b ipv6: Fix an uninit variable access bug in __ip6_make_skb() 0443fff49d sctp: check send stream number after wait_for_sndbuf 93f3885211 net: don't let netpoll invoke NAPI if in xmit context 0d2fa30078 icmp: guard against too small mtu a3593082e0 wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta 4220f83b9f pwm: sprd: Explicitly set .polarity in .get_state() 6e1f29397d pwm: cros-ec: Explicitly set .polarity in .get_state() dbd764e9d4 pinctrl: amd: Disable and mask interrupts on resume dd7e19f97f pinctrl: amd: disable and mask interrupts on probe 3f3e4bd3f0 pinctrl: amd: Use irqchip template 387236b9e0 smb3: fix problem with null cifs super block with previous patch 2e64d7b182 treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() 199197660b Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()" 522af69af2 cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() 4311ae04b3 x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot 110d425cdf scsi: ses: Handle enclosure with just a primary component gracefully 974e2ad014 Merge 5.4.240 into android11-5.4-lts 32bea3bac5 Linux 5.4.240 4d4cb76636 gfs2: Always check inode size of inline inodes 928240c368 firmware: arm_scmi: Fix device node validation for mailbox transport 0f5c0e0a4c net: sched: fix race condition in qdisc_graft() 22d95b5449 net_sched: add __rcu annotation to netdev->qdisc 14b6ad56df ext4: fix kernel BUG in 'ext4_write_inline_data_end()' 9b189af357 btrfs: scan device in non-exclusive mode 45a9877d6c s390/uaccess: add missing earlyclobber annotations to __clear_user() 0c6df53647 drm/etnaviv: fix reference leak when mmaping imported buffer 37958ac31f ALSA: usb-audio: Fix regression on detection of Roland VS-100 6dabafd829 ALSA: hda/conexant: Partial revert of a quirk for Lenovo f3a6726878 NFSv4: Fix hangs when recovering open state after a server reboot c81e2965a9 pinctrl: at91-pio4: fix domain name assignment 82c25ac3a2 xen/netback: don't do grant copy across page boundary 99c8ba920f Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table 657d7c215c cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL 03af69bd67 cifs: prevent infinite recursion in CIFSGetDFSRefer() 51d6573711 Input: focaltech - use explicitly signed char type f0f85f5e40 Input: alps - fix compatibility with -funsigned-char 7e71d4d190 pinctrl: ocelot: Fix alt mode for ocelot 70728d639e net: mvneta: make tx buffer array agnostic 704e06b979 net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only fd7cff5066 bnxt_en: Fix typo in PCI id to device description string mapping 58279cea0b i40e: fix registers dump after run ethtool adapter self test 5195de1d5f s390/vfio-ap: fix memory leak in vfio_ap device driver 78bc7f0ab9 can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write 105cc26832 net/net_failover: fix txq exceeding warning e633fd26ab regulator: Handle deferred clk be7b622cd6 regulator: fix spelling mistake "Cant" -> "Can't" 46c4993a15 ptp_qoriq: fix memory leak in probe() c122daa0fa scsi: megaraid_sas: Fix crash after a double completion 317c07d382 mtd: rawnand: meson: invalidate cache on polling ECC bit d65de5ee8b mips: bmips: BCM6358: disable RAC flush for TP1 9690e34f22 dma-mapping: drop the dev argument to arch_sync_dma_for_* f6e2d76aa3 ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() 856fb74f60 fbdev: au1200fb: Fix potential divide by zero deef33c081 fbdev: lxfb: Fix potential divide by zero 4f5cc5ffa8 fbdev: intelfb: Fix potential divide by zero 868f247e47 fbdev: nvidia: Fix potential divide by zero f3359f5fc9 sched_getaffinity: don't assume 'cpumask_size()' is fully initialized 521877bf26 fbdev: tgafb: Fix potential divide by zero 7f12f99b80 ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() 9155a5958e ALSA: asihpi: check pao in control_message() 88a3c63a96 md: avoid signed overflow in slot_store() 9966fc59d3 bus: imx-weim: fix branch condition evaluates to a garbage value d121f7883a fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY 4c24eb49ab ocfs2: fix data corruption after failed write 0c0e566f03 tun: avoid double free in tun_free_netdev d253120a58 sched/fair: Sanitize vruntime of entity being migrated c23928c70b sched/fair: sanitize vruntime of entity being placed 885c28ceae dm crypt: add cond_resched() to dmcrypt_write() 4a32a9a818 dm stats: check for and propagate alloc_percpu failure f8cbad984b i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() 8f5cbf6a8c nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() 4ae966a7f6 wifi: mac80211: fix qos on mesh interfaces f558789a88 usb: chipidea: core: fix possible concurrent when switch role 6b3287b147 usb: chipdea: core: fix return -EINVAL if request role is the same with current role 0b2a56fe46 usb: cdns3: Fix issue with using incorrect PCI device function e9e93fdfce dm thin: fix deadlock when swapping to thin device cd1e320ac0 igb: revert rtnl_lock() that causes deadlock 123698a5c6 fsverity: Remove WQ_UNBOUND from fsverity read workqueue 0eda2004f3 usb: gadget: u_audio: don't let userspace block driver unbind 44f080d7d7 scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR 223274d5c3 cifs: empty interface list when server doesn't support query interfaces 299a309b98 sh: sanitize the flags on sigreturn f4c610f6ca net: usb: qmi_wwan: add Telit 0x1080 composition e6b1fa6d06 net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 04f4a1aa94 scsi: lpfc: Avoid usage of list iterator variable after loop 11cdced6a0 scsi: ufs: core: Add soft dependency on governor_simpleondemand 54ec697e3c scsi: target: iscsi: Fix an error message in iscsi_check_key() 9711522191 selftests/bpf: check that modifier resolves after pointer 2100e37425 m68k: Only force 030 bus error if PC not in exception table d2b3bd0d4c ca8210: fix mac_len negative array access 9e7723b684 riscv: Bump COMMAND_LINE_SIZE value to 1024 32518cd0fc thunderbolt: Use const qualifier for `ring_interrupt_index` b40fe2e1f9 uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 9189f20b4c scsi: qla2xxx: Perform lockless command completion in abort path da0383f0e8 hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs 13493ad6a2 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl a18fb433ce Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work b517808795 Bluetooth: btqcomsmd: Fix command timeout after setting BD address dcd4d36462 net: mdio: thunder: Add missing fwnode_handle_put() 707335918f hvc/xen: prevent concurrent accesses to the shared ring 83e442eba3 nvme-tcp: fix nvme_tcp_term_pdu to match spec d673ae1840 net/sonic: use dma_mapping_error() for error check b72f453e88 erspan: do not use skb_mac_header() in ndo_start_xmit() 82e07cc5a6 atm: idt77252: fix kmemleak when rmmod idt77252 fd6f643dea net/mlx5: Read the TC mapping of all priorities on ETS query d69c2ded95 bpf: Adjust insufficient default bpf_jit_limit 97674f4cd0 keys: Do not cache key in task struct if key is requested from kernel thread f8ee2c8b0d net/ps3_gelic_net: Use dma_mapping_error 6d7e18b1d0 net/ps3_gelic_net: Fix RX sk_buff length 0e5c7d00ec net: qcom/emac: Fix use after free bug in emac_remove due to race condition a07ec453e8 xirc2ps_cs: Fix use after free bug in xirc2ps_detach 42d72c6d1e qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info f2111c791d net: usb: smsc95xx: Limit packet length to skb->len 5c4d71424d scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() 283fdc5cfb i2c: imx-lpi2c: check only for enabled interrupt flags 90116b8289 igbvf: Regard vf reset nack as success 584771762c intel/igbvf: free irq on the error path in igbvf_request_msix() 6999f85418 iavf: fix non-tunneled IPv6 UDP packet type and hashing 4e752d2bae iavf: fix inverted Rx hash condition leading to disabled hash 6fe078c286 power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition 754838aa02 net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() a03da9c9ae Merge 5.4.239 into android11-5.4-lts 09b1a76e78 Linux 5.4.239 f0c95f229a selftests: Fix the executable permissions for fib_tests.sh 1221512b02 BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses 8ac436fa26 FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio b6d6caabaf Merge branch 'android11-5.4' into android11-5.4-lts 5fd4376e12 Revert "HID: core: Provide new max_buffer_size attribute to over-ride the default" 6efc429d3f Revert "HID: uhid: Over-ride the default maximum data buffer value with our own" 1e58c0c8e9 Merge 5.4.238 into android11-5.4-lts 6849d8c4a6 Linux 5.4.238 eb7716a054 HID: uhid: Over-ride the default maximum data buffer value with our own b687ac70e6 HID: core: Provide new max_buffer_size attribute to over-ride the default 144019e813 PCI: Unify delay handling for reset and resume d2130f37a4 s390/ipl: add missing intersection check to ipl_report handling 3f5a833dca serial: 8250_em: Fix UART port type c5afb97d1b drm/i915: Don't use stolen memory for ring buffers with LLC 8d26a4fecc x86/mm: Fix use of uninitialized buffer in sme_enable() a976ff743e fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks ac58b88ccb ftrace: Fix invalid address access in lookup_rec() when index is 0 65e4c9a6d0 KVM: nVMX: add missing consistency checks for CR0 and CR4 6fe55dce9d tracing: Make tracepoint lockdep check actually test something 780f69a268 tracing: Check field value in hist_field_name() f1e3a20c60 interconnect: fix mem leak when freeing nodes 325608ab60 tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted c16cbd8233 ext4: fix possible double unlock when moving a directory 6a1bd14d5e sh: intc: Avoid spurious sizeof-pointer-div warning bbf5eada43 drm/amdkfd: Fix an illegal memory access 2c96c52aea ext4: fix task hung in ext4_xattr_delete_inode 20ba6f8a80 ext4: fail ext4_iget if special inode unallocated ab519e2989 jffs2: correct logic when creating a hole in jffs2_write_begin 00bfc67c65 mmc: atmel-mci: fix race between stop command and start of next command 75f6faae2d media: m5mols: fix off-by-one loop termination error 9eb394919c hwmon: (ina3221) return prober error code 26c176ce90 hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition 13efd488d3 hwmon: (adt7475) Fix masking of hysteresis registers 0d3095e958 hwmon: (adt7475) Display smoothing attributes in correct order 674fce59d6 ethernet: sun: add check for the mdesc_grab() 71da5991b6 net/iucv: Fix size of interrupt data e0d07a3203 net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull 5c06bd3de1 ipv4: Fix incorrect table ID in IOCTL path c4fcfbf80c block: sunvdc: add check for mdesc_grab() returning NULL 04c3942088 nvmet: avoid potential UAF in nvmet_req_complete() 9fabdd7905 net: usb: smsc75xx: Limit packet length to skb->len b0c202a8dc nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition 668de67d41 net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails 5aaab217c8 net: tunnels: annotate lockless accesses to dev->needed_headroom cba20ade78 qed/qed_dev: guard against a possible division by zero 6e18f66b70 i40e: Fix kernel crash during reboot when adapter is in recovery mode f0216046ae ipvlan: Make skb->skb_iif track skb->dev for l3s mode 0f9c1f26d4 nfc: pn533: initialize struct pn533_out_arg properly 442aa78ed7 tcp: tcp_make_synack() can be called from process context 88c3d3bb64 scsi: core: Fix a procfs host directory removal regression 4b4f5e34f0 scsi: core: Fix a comment in function scsi_host_dev_release() 0d59732f2a netfilter: nft_redir: correct value of inet type `.maxattrs` 90279211e9 ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() 0b7057c523 ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid 5bb9fcaadb ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid 9efbdc743d ALSA: hda - controller is in GPU on the DG1 fc52e51c2c ALSA: hda - add Intel DG1 PCI and HDMI ids 090305c361 scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() b8849e31a0 docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate 9e45e45715 clk: HI655X: select REGMAP instead of depending on it dac08e46f0 drm/meson: fix 1px pink line on GXM when scaling video overlay d7e48aa17a cifs: Move the in_send statistic to __smb_send_rqst() 06c208002d drm/panfrost: Don't sync rpm suspension after mmu flushing c9900d1d86 xfrm: Allow transport-mode states with AF_UNSPEC selector 4008fb9ad4 ext4: fix cgroup writeback accounting with fs-layer encryption 6eb1bfc752 ANDROID: preserve CRC for __irq_domain_add() 812963276d Merge 5.4.237 into android11-5.4-lts fd02046fbd Merge 5.4.236 into android11-5.4-lts 48b8328041 Revert "drm/exynos: Don't reset bridge->next" 7edc66298a Revert "drm/bridge: Rename bridge helpers targeting a bridge chain" 8d15e5fac1 Revert "drm/bridge: Introduce drm_bridge_get_next_bridge()" aac98e0c73 Revert "drm: Initialize struct drm_crtc_state.no_vblank from device settings" af8848e0d9 Revert "drm/msm/mdp5: Add check for kzalloc" e4b5c766f5 Linux 5.4.237 6a16810068 s390/dasd: add missing discipline function 7a934a77f1 UML: define RUNTIME_DISCARD_EXIT 87fcce7a6f sh: define RUNTIME_DISCARD_EXIT eb9dbb70cd s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 219cc98501 powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds 4eede1173f powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT d0fcf59038 arch: fix broken BuildID for arm64 and riscv a4bd6d4df3 x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS 1aed78cfda drm/i915: Don't use BAR mappings for ring buffers with LLC 52fc917855 ipmi:watchdog: Set panic count to proper value on a panic dbfae25b01 ipmi/watchdog: replace atomic_add() and atomic_sub() f266cdd679 media: ov5640: Fix analogue gain control fc9bc83150 PCI: Add SolidRun vendor ID 094a073605 macintosh: windfarm: Use unsigned type for 1-bit bitfields 737985dbcb alpha: fix R_ALPHA_LITERAL reloc for large modules 2fea235ef0 MIPS: Fix a compilation issue 6b06c4ae64 ext4: Fix deadlock during directory rename a99a61d9e1 riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode 1a517302db net/smc: fix fallback failed while sendmsg with fastopen 3a747490f9 scsi: megaraid_sas: Update max supported LD IDs to 240 d800996fcf btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR 9f2e063dcb netfilter: tproxy: fix deadlock due to missing BH disable 16f3aae1aa bnxt_en: Avoid order-5 memory allocation for TPA data 9dc16be373 net: caif: Fix use-after-free in cfusbl_device_notify() 8018aa0863 net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver 1c618f150c net: usb: lan78xx: Remove lots of set but unused 'ret' variables e4e5006c13 selftests: nft_nat: ensuring the listening side is up before starting the client 783f218940 ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() 0a3664a105 nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 43f33642f2 drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register 8dac5a63cf ext4: Fix possible corruption when moving a directory 891a3cba42 scsi: core: Remove the /proc/scsi/${proc_name} directory earlier 57f78226b1 cifs: Fix uninitialized memory read in smb3_qfs_tcon() a6e44cb215 SMB3: Backup intent flag missing from some more ops 1b48c70fee iommu/vt-d: Fix PASID directory pointer coherency 985d9fa06b irqdomain: Fix domain registration race 01ed8ff22a irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent 36c5682cbb ipmi:ssif: Add a timer between request retries e8ba1b693a ipmi:ssif: Increase the message retry time 89fb3fa848 ipmi:ssif: Remove rtc_us_timer d1a7f56b20 ipmi:ssif: resend_msg() cannot fail 59349bfcff ipmi:ssif: make ssif_i2c_send() void 5e97dc748d iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter 774c63f536 iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options 11852cc78f iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands 3cdf19a29c nfc: change order inside nfc_se_io error path 0d8a6c9a64 ext4: zero i_disksize when initializing the bootloader inode 74d775083e ext4: fix WARNING in ext4_update_inline_data b36093c6f7 ext4: move where set the MAY_INLINE_DATA flag is set c24f838493 ext4: fix another off-by-one fsmap error on 1k block filesystems aee90b0278 ext4: fix RENAME_WHITEOUT handling for inline directories 1277ba3db6 drm/connector: print max_requested_bpc in state debugfs e40c1e9da1 x86/CPU/AMD: Disable XSAVES on AMD family 0x17 6631c8da02 fs: prevent out-of-bounds array speculation when closing a file descriptor b829e8b6e1 Linux 5.4.236 6e55d84223 staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh 9498448b9e staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script 6ee84b8b79 wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" 0d9d32f54c Merge 5.4.235 into android11-5.4-lts 126ee8982b Linux 5.4.235 d03bc164f3 dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks 6ab6705463 media: uvcvideo: Fix race condition with usb_kill_urb 0b8962c64b media: uvcvideo: Provide sync and async uvc_ctrl_status_event 2b1c5145b0 tcp: Fix listen() regression in 5.4.229. 800a1c4c8a Bluetooth: hci_sock: purge socket queues in the destruct() callback 27c64d90d9 x86/resctl: fix scheduler confusion with 'current' 81da72aaf5 x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid} bde541a57b net: tls: avoid hanging tasks on the tx_lock d94fbfcd9a phy: rockchip-typec: Fix unsigned comparison with less than zero f0ee43d61d PCI: Add ACS quirk for Wangxun NICs f6d3aee1c6 kernel/fail_function: fix memory leak with using debugfs_lookup() 195c1e9f45 usb: uvc: Enumerate valid values for color matching da4e715a46 USB: ene_usb6250: Allocate enough memory for full object 1170979668 usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math f5b76a8166 iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() 11b4b3b769 iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() b854c66dd7 tools/iio/iio_utils:fix memory leak ea9b587896 mei: bus-fixup:upon error print return values of send and receive c7ca2ca12a tty: serial: fsl_lpuart: disable the CTS when send break signal 953a4a352a tty: fix out-of-bounds access in tty_driver_lookup_tty() 70369a1117 staging: emxx_udc: Add checks for dma_alloc_coherent() 2072ed7c1a media: uvcvideo: Silence memcpy() run-time false positive warnings e2cc773f1f media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 e4c535ecce media: uvcvideo: Handle errors from calls to usb_string 4e4e6ca62e media: uvcvideo: Handle cameras with invalid descriptors 7195e642b4 mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak fde59e273b firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 2cc6a3e98f tracing: Add NULL checks for buffer in ring_buffer_free_read_page() 4cfeb55a10 thermal: intel: BXT_PMIC: select REGMAP instead of depending on it e23f1d9e6e thermal: intel: quark_dts: fix error pointer dereference 584f664c57 scsi: ipr: Work around fortify-string warning e93bda4ebb rtc: sun6i: Always export the internal oscillator 728b047f4c rtc: sun6i: Make external 32k oscillator optional 9c7c1cf29f vc_screen: modify vcs_size() handling in vcs_read() 821362a2df tcp: tcp_check_req() can be called from process context 77606e383e ARM: dts: spear320-hmi: correct STMPE GPIO compatible dda4f0a424 net/sched: act_sample: fix action bind logic 271eed1736 nfc: fix memory leak of se_io context in nfc_genl_se_io f81af781f9 net/mlx5: Geneve, Fix handling of Geneve object id as error code 4b71f2b543 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() 7cc9dbae8a 9p/xen: fix connection sequence 9d1c625c99 9p/xen: fix version parsing edfba7b322 net: fix __dev_kfree_skb_any() vs drop monitor cec326443f sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop aba298b356 ipv6: Add lwtunnel encap size of all siblings in nexthop calculation 5d0d38805d netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() fe65d6f26b watchdog: pcwd_usb: Fix attempting to access uninitialized memory 59e391b3fc watchdog: Fix kmemleak in watchdog_cdev_register 7c428fc974 watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path a8816afcaf x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list b5be23f6ae ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 1cb14c06d6 ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() 7fcbc41d76 ubifs: ubifs_writepage: Mark page dirty after writing inode failed 510b80abe8 ubifs: dirty_cow_znode: Fix memleak in error handling path 0875edcad4 ubifs: Re-statistic cleaned znode count if commit failed 234c53e574 ubi: Fix possible null-ptr-deref in ubi_free_volume() 1f206002c6 ubifs: Fix memory leak in alloc_wbufs() 07b60f7452 ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() 9c8be1f165 ubi: Fix use-after-free when volume resizing failed e86d1b2bb7 ubifs: Reserve one leb for each journal head while doing budget 82c096d0c9 ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 bf8f549584 ubifs: Fix wrong dirty space budget for dirty inode f29168fb52 ubifs: Rectify space budget for ubifs_xrename() 8666030627 ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted 4ca0d74622 ubifs: Fix build errors as symbol undefined f7adb740f9 ubi: ensure that VID header offset + VID header size <= alloc, size 6480c3a127 um: vector: Fix memory leak in vector_config 01c92f033b fs: f2fs: initialize fsdata in pagecache_write() c4a89ebe92 f2fs: use memcpy_{to,from}_page() where possible b915fac020 pwm: stm32-lp: fix the check on arr and cmp registers update 1abd385802 pwm: sifive: Always let the first pwm_apply_state succeed 30a3636fe6 pwm: sifive: Reduce time the controller lock is held 62462a5b4f fs/jfs: fix shift exponent db_agl2size negative 7a6fb69bbc net/sched: Retire tcindex classifier b3d346ece9 kbuild: Port silent mode detection to future gnu make. 68b0cdcfa1 wifi: ath9k: use proper statements in conditionals 96a8424a27 drm/radeon: Fix eDP for single-display iMac11,2 6e6173886f drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv efc72cceb7 PCI: Avoid FLR for AMD FCH AHCI adapters bcc1bafb06 PCI: hotplug: Allow marking devices as disconnected during bind/unbind 2a50583117 PCI/PM: Observe reset delay irrespective of bridge_d3 40af9a6dee scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() 79ec5dd5fb scsi: ses: Fix possible desc_ptr out-of-bounds accesses 8e454aba72 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses 467afb1dd6 scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() 6069e04a92 scsi: ses: Don't attach if enclosure has no components 70e9a93f09 scsi: qla2xxx: Fix erroneous link down 3a564de3a2 scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests 05a0f6fa52 scsi: qla2xxx: Fix link failure in NPIV environment 18d347d1b0 ktest.pl: Add RUN_TIMEOUT option with default unlimited 150ee1fc90 ktest.pl: Fix missing "end_monitor" when machine check fails 2f42bfc54d ktest.pl: Give back console on Ctrt^C on monitor b53d209d71 mm/thp: check and bail out if page in deferred queue already 24900f3596 mm: memcontrol: deprecate charge moving 964e9e1288 media: ipu3-cio2: Fix PM runtime usage_count in driver unbind 58c0d0b2d4 mips: fix syscall_get_nr 229edf8d7b alpha: fix FEN fault handling 9787b328c4 rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails 7055754dd0 ARM: dts: exynos: correct TMU phandle in Odroid XU 7b6707d66e ARM: dts: exynos: correct TMU phandle in Exynos4 3c4a56ef7c dm flakey: don't corrupt the zero page a2be4225c3 dm flakey: fix logic when corrupting a bio 64fbe39232 thermal: intel: powerclamp: Fix cur_state for multi package system 6f1959c17d wifi: cfg80211: Fix use after free for wext 342cb34c52 wifi: rtl8xxxu: Use a longer retry limit of 48 a92b67e768 ext4: refuse to create ea block when umounted 3b28c799a1 ext4: optimize ea_inode block expansion 87005d0ab5 ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC 84ed1ade54 ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() df129eaa2b irqdomain: Drop bogus fwspec-mapping error handling 72232dbe14 irqdomain: Fix disassociation race 2101663687 irqdomain: Fix association race f9d9320189 ima: Align ima_file_mmap() parameters with mmap_file LSM hook 4d47cba074 Documentation/hw-vuln: Document the interaction between IBRS and STIBP 34c1b60e7a x86/speculation: Allow enabling STIBP with legacy IBRS 979e197968 x86/microcode/AMD: Fix mixed steppings support 727bc2c285 x86/microcode/AMD: Add a @cpu parameter to the reloading functions 4c26edf2ea x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter a0415b79dd x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range ec206a38d3 x86/kprobes: Fix __recover_optprobed_insn check optimizing logic e4ce333cc6 x86/reboot: Disable SVM, not just VMX, when stopping CPUs 37459195d9 x86/reboot: Disable virtualization in an emergency if SVM is supported 87459b9fce x86/crash: Disable virt in core NMI crash handler to avoid double shootdown ee80fb1dca x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) 4c9812d989 KVM: s390: disable migration mode when dirty tracking is disabled 10c2a20d73 KVM: Destroy target device if coalesced MMIO unregistration fails 38a1f5e9fc udf: Fix file corruption when appending just after end of preallocated extent d747b31e29 udf: Detect system inodes linked into directory hierarchy ce17ef97de udf: Preserve link count of system files 7bd8d9e1cf udf: Do not update file length for failed writes to inline files 3d20e3b768 udf: Do not bother merging very long extents 4e41b1c5a2 udf: Truncate added extents on failed expansion dee96928d8 ocfs2: fix non-auto defrag path not working issue 669134a66d ocfs2: fix defrag path triggering jbd2 ASSERT 68a47ca958 f2fs: fix cgroup writeback accounting with fs-layer encryption 2bef8314fc f2fs: fix information leak in f2fs_move_inline_dirents() 3776ef785e fs: hfsplus: fix UAF issue in hfsplus_put_super eda6879272 hfs: fix missing hfs_bnode_get() in __hfs_bnode_create 8ecde537ed ARM: dts: exynos: correct HDMI phy compatible in Exynos4 e71e6fa07f s390/kprobes: fix current_kprobe never cleared after kprobes reenter 18075c0dc3 s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler c5db76fcdd s390: discard .interp section a9391f8bc9 ipmi_ssif: Rename idle state and check 0ff4c222bd rtc: pm8xxx: fix set-alarm race 69b8af77ef firmware: coreboot: framebuffer: Ignore reserved pixel color bits 791402dd05 wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu 3132aa35cf nfsd: zero out pointers after putting nfsd_files on COPY setup error 38b4d3eacb dm cache: add cond_resched() to various workqueue loops 3b46b2cb91 dm thin: add cond_resched() to various workqueue loops 2c055b6a07 drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 718ce68b3a pinctrl: at91: use devm_kasprintf() to avoid potential leaks 4000384684 hwmon: (coretemp) Simplify platform device handling 5026260ac2 regulator: s5m8767: Bounds check id indexing into arrays 12527ae49d regulator: max77802: Bounds check regulator id against opmode 7fae534a30 ASoC: kirkwood: Iterate over array indexes instead of using pointer math 90c278c6d0 docs/scripts/gdb: add necessary make scripts_gdb step 3a9a4a9725 drm/msm/dsi: Add missing check for alloc_ordered_workqueue f9f55fc649 drm/radeon: free iio for atombios when driver shutdown 5ccd8d09fe HID: Add Mapping for System Microphone Mute 341a4c04ed drm/omap: dsi: Fix excessive stack usage d236103782 drm/amd/display: Fix potential null-deref in dm_resume 5bc391944d uaccess: Add minimum bounds check on kernel buffer size 0467681f09 coda: Avoid partial allocation of sig_inputArgs 1a98c4d926 net/mlx5: fw_tracer: Fix debug print 21856d5615 ACPI: video: Fix Lenovo Ideapad Z570 DMI match c727c1eb58 wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup 51c0dca573 m68k: Check syscall_trace_enter() return code 87363d1ab5 net: bcmgenet: Add a check for oversized packets fe00ab1eb3 ACPI: Don't build ACPICA with '-Os' 8ec82cfe4e ice: add missing checks for PF vsi type f81c0d484a inet: fix fast path in __inet_hash_connect() 67e4519afb wifi: mt7601u: fix an integer underflow 423a1297ea wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds f3a324362b x86/bugs: Reset speculation control settings on init c8157f67b0 timers: Prevent union confusion from unexpected restart_syscall() f570968d01 thermal: intel: Fix unsigned comparison with less than zero 596d1fea05 rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() 17dbe90e13 wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() 9e8bf9f95f blk-iocost: fix divide by 0 error in calc_lcoefs() f10001af0f ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy dae4d5ae6b udf: Define EFSCORRUPTED error code 824b167fa8 rpmsg: glink: Avoid infinite loop on intent for missing channel a41bb59eff media: usb: siano: Fix use after free bugs caused by do_submit_urb 2a72e3b6bb media: i2c: ov7670: 0 instead of -EINVAL was returned d120334278 media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() 448ce1cd50 media: i2c: ov772x: Fix memleak in ov772x_probe() 086a80b842 media: ov5675: Fix memleak in ov5675_init_controls() ec6bd0dccd powerpc: Remove linker flag from KBUILD_AFLAGS 44aef56083 media: platform: ti: Add missing check for devm_regulator_get fc85fb5763 remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers 3acbec356d MIPS: vpe-mt: drop physical_memsize a3c9200405 MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set 1abc7be57c powerpc/eeh: Set channel state after notifying the drivers 7719aba7a3 powerpc/eeh: Small refactor of eeh_handle_normal_event() a39becb905 powerpc/rtas: ensure 4KB alignment for rtas_data_buf 0616586eef powerpc/rtas: make all exports GPL d8ca498591 powerpc/pseries/lparcfg: add missing RTAS retry status handling 421c59c23a powerpc/pseries/lpar: add missing RTAS retry status handling 2c5ad2d642 clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() 4d178dc25f powerpc/powernv/ioda: Skip unallocated resources when mapping to PE b1c1b6da5a clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC e3617778eb Input: ads7846 - don't check penirq immediately for 7845 ea9c4fbfda Input: ads7846 - don't report pressure for ads7845 17761a1c7f clk: renesas: cpg-mssr: Remove superfluous check in resume code 8ff19db903 clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag 330b70949c clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed f34eb1e433 mtd: rawnand: sunxi: Fix the size of the last OOB region cdfdd882fa clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents b419e91378 clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents 588edb4fb1 mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() 6e0a0eb18e selftests/ftrace: Fix bash specific "==" operator 16a35042ff sparc: allow PM configs for sparc32 COMPILE_TEST 090a22f599 perf tools: Fix auto-complete on aarch64 5d32f3e922 perf llvm: Fix inadvertent file creation ce43565a6c gfs2: jdata writepage fix 3524d6da0f cifs: Fix warning and UAF when destroy the MR list 324c0c34ff cifs: Fix lost destroy smbd connection when MR allocate failed a22f1ecab6 nfsd: fix race to check ls_layouts 5a195fa41d hid: bigben_probe(): validate report count 9f525559ea HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T bc786dfeb7 HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T bad4a822a1 HID: asus: Add report_size to struct asus_touchpad_info 63792d0ae9 HID: asus: Only set EV_REP if we are adding a mapping 25e14bf0c8 HID: bigben: use spinlock to safely schedule workers 715edb0109 HID: bigben_worker() remove unneeded check on report_field 12533ad854 HID: bigben: use spinlock to protect concurrent accesses 05cb432c09 ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared 84beaa3e2e ASoC: dapm: declare missing structure prototypes d6250e00bf spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() b89d2ed564 dm: remove flush_scheduled_work() during local_exit() e6d9a876d9 hwmon: (mlxreg-fan) Return zero speed for broken fan 870a0f519a spi: bcm63xx-hsspi: Fix multi-bit mode setting dd271f1798 spi: bcm63xx-hsspi: fix pm_runtime 904b717bb5 scsi: aic94xx: Add missing check for dma_map_single() 3414be1c8c hwmon: (ltc2945) Handle error case in ltc2945_value_store 75a1c3f822 gpio: vf610: connect GPIO label to dev name 584cb84e2c ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() a161f1d92a drm/mediatek: Clean dangling pointer on bind error path b8b166db78 drm/mediatek: Drop unbalanced obj unref 367c80fb34 drm/mediatek: Use NULL instead of 0 for NULL pointer a0555f90d8 drm/mediatek: remove cast to pointers passed to kfree 2b59e87c92 gpu: host1x: Don't skip assigning syncpoints to channels 3975ea6eaf drm/msm/mdp5: Add check for kzalloc 2a8bb9dce7 drm: Initialize struct drm_crtc_state.no_vblank from device settings 9b2f584490 drm/bridge: Introduce drm_bridge_get_next_bridge() bb08be7232 drm/bridge: Rename bridge helpers targeting a bridge chain 2c33a6141d drm/exynos: Don't reset bridge->next dadd30fcc7 drm/msm/dpu: Add check for pstates a6afb8293e drm/msm/dpu: Add check for cstate 8f9fdc830d drm/msm: use strscpy instead of strncpy d7ea84cddf drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness a9eafb0448 ALSA: hda/ca0132: minor fix for allocation size a80767caed ASoC: fsl_sai: initialize is_dsp_mode flag 95ab6d7905 pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain fc34608fa2 drm/msm/hdmi: Add missing check for alloc_ordered_workqueue 62430b3210 gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() 31701e54d3 drm/vc4: dpi: Fix format mapping for RGB565 d66f26b93c drm/vc4: dpi: Add option for inverting pixel clock and output enable 7ddd8a5ecf drm/bridge: megachips: Fix error handling in i2c_register_driver() d56e589f8b drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC c879003a6f drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats c82ca67ca0 selftest: fib_tests: Always cleanup before exit c31985922e selftests/net: Interpret UDP_GRO cmsg data as an int value 6165747888 irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts 3947b16613 irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts d772090078 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error 3cf2181e43 thermal/drivers/hisi: Drop second sensor hi3660 21c701cbc8 wifi: mac80211: make rate u32 in sta_set_rate_info_rx() b70d56e728 crypto: crypto4xx - Call dma_unmap_page when done a3b75b1e76 wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() c002d27414 wifi: iwl4965: Add missing check for create_singlethread_workqueue() 7e594abc04 wifi: iwl3945: Add missing check for create_singlethread_workqueue 5de7a4254e treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() 9198eefd10 usb: gadget: udc: Avoid tasklet passing a global cf04507f42 RISC-V: time: initialize hrtimer based broadcast clock event device 142bcf7240 m68k: /proc/hardware should depend on PROC_FS c4d8c23efe crypto: rsa-pkcs1pad - Use akcipher_request_complete 8c1447495f rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 291e6a6820 libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() 60aaccf16d Bluetooth: L2CAP: Fix potential user-after-free d19bd48535 OPP: fix error checking in opp_migrate_dentry() 522d319cda tap: tap_open(): correctly initialize socket uid d92d87000e tun: tun_chr_open(): correctly initialize socket uid 11c9c72272 net: add sock_init_data_uid() 276ccbc15f mptcp: add sk_stop_timer_sync helper 07fceab320 irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe c7d78d36e1 irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe 9e79ac4f70 irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains 7cce0c9fdd net/mlx5: Enhance debug print in page allocation failure dbd6ae0956 powercap: fix possible name leak in powercap_register_zone() 63551e4b7c crypto: seqiv - Handle EBUSY correctly c61e7d182e crypto: essiv - Handle EBUSY correctly bfef5e3e73 crypto: essiv - remove redundant null pointer check before kfree 2d1ac2f2e2 crypto: ccp - Failure on re-initialization due to duplicate sysfs filename 40627e6e29 ACPI: battery: Fix missing NUL-termination with large strings bf6dc175a2 wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() cd83167670 wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails c3ff385b94 ath9k: htc: clean up statistics macros a49c13ecce ath9k: hif_usb: simplify if-if to if-else 564bc2222b wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function 17a0e61cd9 wifi: orinoco: check return value of hermes_write_wordrec() 573dfeba2d ACPICA: nsrepair: handle cases without a return value correctly 987b0ff1b9 lib/mpi: Fix buffer overrun when SG is too long b55ada30b5 genirq: Fix the return type of kstat_cpu_irqs_sum() 6b9f61c8b8 ACPICA: Drop port I/O validation for some regions c300697690 crypto: x86/ghash - fix unaligned access in ghash_setkey() 0c4f20c8fc wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() 14ba31bb1b wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() 38ef777203 wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() 1879fe9e40 wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() 0b7b734744 wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() 318005127c wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() d869a18950 wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() a12610e837 wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() a6059cf02a wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK 112c1af02b wifi: ipw2200: fix memory leak in ipw_wdev_init() ba1d3623fe wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() 0d438ae7ba ipw2x00: switch from 'pci_' to 'dma_' API 28ea268d95 wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() 5d171ab48b rtlwifi: fix -Wpointer-sign warning 5dd30d1acc wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() 23b34e08de wifi: libertas: fix memory leak in lbs_init_adapter() 1864b22e23 wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() 9004aa391a net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb” fe4d7280cf wifi: rsi: Fix memory leak in rsi_coex_attach() 82d68c3244 block: bio-integrity: Copy flags when bio_integrity_payload is cloned 084cd75643 sched/rt: pick_next_rt_entity(): check list_entry 0ff7ba5e8b sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() ee986d80ac s390/dasd: Fix potential memleak in dasd_eckd_init() 8bc5a76268 s390/dasd: Prepare for additional path event handling 946515fad4 blk-mq: correct stale comment of .get_budget 2dc5f68fe6 blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait 8c225150ea blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx 260dcf1ccd block: Limit number of items taken from the I/O scheduler in one go 578c8f09c0 Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle" 2d3c3aa412 arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node 38af86810d ARM: dts: imx7s: correct iomuxc gpr mux controller cells 7fe5dc2fee arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name 8b7aa62f4a arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name d5fbeae6d6 arm64: dts: amlogic: meson-gx: add missing unit address to rng node name c5cd41bd10 arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible 1e3ec4d1d7 arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name e515d41185 arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name 1e1b84b022 ARM: imx: Call ida_simple_remove() for ida_simple_get b0a1b2f3ef ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato 91ac4bf35a ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() af3352c16e arm64: dts: meson: remove CPU opps below 1GHz for G12A boards 9dd61d9542 arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address cba890c4bd arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name 69bdc5d014 arm64: dts: meson-gx: Fix Ethernet MAC address unit name ede0334bf4 ARM: zynq: Fix refcount leak in zynq_early_slcr_init 45b44ba5df arm64: dts: qcom: qcs404: use symbol names for PCIe resets 8041f9a2a9 ARM: OMAP2+: Fix memory leak in realtime_counter_init() dd08e68d04 HID: asus: use spinlock to safely schedule workers 136a9bcc0e HID: asus: use spinlock to protect concurrent accesses 9a25b22fd5 HID: asus: Remove check for same LED brightness on set f9c844d00d Merge 5.4.234 into android11-5.4-lts a103859aaa Linux 5.4.234 a1e89c8b29 USB: core: Don't hold device lock while reading the "descriptors" sysfs file 96d380d2ae USB: serial: option: add support for VW/Skoda "Carstick LTE" 91c877d431 dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size 465ce31a2b vc_screen: don't clobber return value in vcs_read ee8cd3abe7 net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). db25b41eb5 bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state 23affaed76 HID: core: Fix deadloop in hid_apply_multiplier. 93b17c7e1e neigh: make sure used and confirmed times are valid bc4601ad97 IB/hfi1: Assign npages earlier 98e626c115 btrfs: send: limit number of clones and allocated memory size ae03fa7ad3 ACPI: NFIT: fix a potential deadlock during NFIT teardown 785bde8459 ARM: dts: rockchip: add power-domains property to dp node on rk3288 da2bba879e arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc And update the .xml file due to the __irq_domain_add() change that came into this branch. Change-Id: Ia973c369a8bb9da89df14007cd6b820c9a7a2155 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-05-25 17:49:55 +00:00
Namhyung Kim	35093f38c4	UPSTREAM: perf/core: Call LSM hook after copying perf_event_attr ... It passes the attr struct to the security_perf_event_open() but it's not initialized yet. Bug: 254441685 Fixes: da97e18458fb ("perf_event: Add support for LSM and SELinux checks") Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20221220223140.4020470-1-namhyung@kernel.org (cherry picked from commit 0a041ebca4956292cadfb14a63ace3a9c1dcb0a3) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I99add105e7ef0a34b201e970c6a938f799aefdc1	2023-05-04 16:25:21 +01:00
Greg Kroah-Hartman	734577d21e	This is the 5.4.242 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRI7cMACgkQONu9yGCS aT4KYhAA11Pj8JrPzyk0LSUHlFmZ6LRUA1/0aAog2V4wIY0tSODHiYMqcqsgiay9 SGg+eGlHU5+6FL36BGHneg8iLVwX/HHERPdRrOrTJO8YUe/GumFkgz0h2O7+ILOa QAao9FB9OBCNaR0guQjTZk+8QQtgfj3X381mBbzoFIIprNUw9/P3lYowyVPSWjHZ Ax+ptL2oxfBTGylrU543q7Vfzvy56DSNeDnCNyAHHVAXpQU3YhsWqW5pXcxQhtDh aEt21YB0CVBs4BF2sdSpUSXlQYS9NsH814lK3T1pEYONRJ/Osxl9QpdZ077avhTA 7pS9oKUMNfak8BoK4aRsSy51UrKBnb6IOflJVQiXYRft0GvF630qra47hwZLeZOf Sl1tIW0cwlzJcv7H5tsg2eWXsZBCfmvd2MtDHjdYD/fxED7NSvPXjCyO4Qs1UqB9 vq2cTU0CiCBQPL0UzKeuhPXfSwpbDXYmCMpH2GfHVtlYA1g+zPOlLA9HfGBR0pzH X1tdZ9hjUYSBdD5PoaTJzMcg+cME+tPq2kN09dECM+cTdlB/s5cKj8OcNLIv6jVD PfFXjJCL1CJk93C4UaHlO7efdQbferEVViu6hmfhGIAYOd3S400/5p71b22rfViH 9CwkhhlafZ25/AF2NCfhvK5gjRTFH+gOtw0JmG2AQ4f1z44joWw= =4sA8 -----END PGP SIGNATURE----- Merge 5.4.242 into android11-5.4-lts Changes in 5.4.242 ARM: dts: rockchip: fix a typo error for rk3288 spdif node arm64: dts: meson-g12-common: specify full DMC range netfilter: br_netfilter: fix recent physdev match breakage regulator: fan53555: Explicitly include bits header net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg virtio_net: bugfix overflow inside xdp_linearize_page() netfilter: nf_tables: fix ifdef to also consider nf_tables=m i40e: fix accessing vsi->active_filters without holding lock i40e: fix i40e_setup_misc_vector() error handling mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() bpf: Fix incorrect verifier pruning due to missing register precision taints e1000e: Disable TSO on i219-LM card to increase speed f2fs: Fix f2fs_truncate_partial_nodes ftrace event Input: i8042 - add quirk for Fujitsu Lifebook A574/H selftests: sigaltstack: fix -Wuninitialized scsi: megaraid_sas: Fix fw_crash_buffer_show() scsi: core: Improve scsi_vpd_inquiry() checks net: dsa: b53: mmap: add phy ops s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling nvme-tcp: fix a possible UAF when failing to allocate an io queue xen/netback: use same error messages for same errors iio: light: tsl2772: fix reading proximity-diodes from device tree nilfs2: initialize unused bytes in segment summary blocks memstick: fix memory leak if card device is never registered mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 MIPS: Define RUNTIME_DISCARD_EXIT in LD script x86/purgatory: Don't generate debug info for purgatory.ro Revert "ext4: fix use-after-free in ext4_xattr_set_entry" ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() ext4: fix use-after-free in ext4_xattr_set_entry udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). dccp: Call inet6_destroy_sock() via sk->sk_destruct(). sctp: Call inet6_destroy_sock() via sk->sk_destruct(). xfs: fix forkoff miscalculation related to XFS_LITINO(mp) pwm: meson: Explicitly set .polarity in .get_state() iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() ASN.1: Fix check for strdup() success Linux 5.4.242 Change-Id: Id72de17865bf93d2a6d39009fbc46cb3f8f7b6ca Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-26 13:21:48 +00:00
Daniel Borkmann	0f0a291cc5	bpf: Fix incorrect verifier pruning due to missing register precision taints ... [ Upstream commit 71b547f561247897a0a14f3082730156c0533fed ] Juan Jose et al reported an issue found via fuzzing where the verifier's pruning logic prematurely marks a program path as safe. Consider the following program: 0: (b7) r6 = 1024 1: (b7) r7 = 0 2: (b7) r8 = 0 3: (b7) r9 = -2147483648 4: (97) r6 %= 1025 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 7: (97) r6 %= 1 8: (b7) r9 = 0 9: (bd) if r6 <= r9 goto pc+1 10: (b7) r6 = 0 11: (b7) r0 = 0 12: (63) *(u32 *)(r10 -4) = r0 13: (18) r4 = 0xffff888103693400 // map_ptr(ks=4,vs=48) 15: (bf) r1 = r4 16: (bf) r2 = r10 17: (07) r2 += -4 18: (85) call bpf_map_lookup_elem#1 19: (55) if r0 != 0x0 goto pc+1 20: (95) exit 21: (77) r6 >>= 10 22: (27) r6 *= 8192 23: (bf) r1 = r0 24: (0f) r0 += r6 25: (79) r3 = *(u64 *)(r0 +0) 26: (7b) *(u64 *)(r1 +0) = r3 27: (95) exit The verifier treats this as safe, leading to oob read/write access due to an incorrect verifier conclusion: func#0 @0 0: R1=ctx(off=0,imm=0) R10=fp0 0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff00000000; 0xffffffff)) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0 20: (95) exit from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? 21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0) 24: (0f) r0 += r6 last_idx 24 first_idx 19 regs=40 stack=0 before 23: (bf) r1 = r0 regs=40 stack=0 before 22: (27) r6 *= 8192 regs=40 stack=0 before 21: (77) r6 >>= 10 regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1 parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 regs=40 stack=0 before 10: (b7) r6 = 0 25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 27: (95) exit from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 11 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 frame 0: propagating r6 last_idx 19 first_idx 11 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9 regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=0 R10=fp0 last_idx 8 first_idx 0 regs=40 stack=0 before 8: (b7) r9 = 0 regs=40 stack=0 before 7: (97) r6 %= 1 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=40 stack=0 before 5: (05) goto pc+0 regs=40 stack=0 before 4: (97) r6 %= 1025 regs=40 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 19: safe frame 0: propagating r6 last_idx 9 first_idx 0 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=40 stack=0 before 5: (05) goto pc+0 regs=40 stack=0 before 4: (97) r6 %= 1025 regs=40 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 from 6 to 9: safe verification time 110 usec stack depth 4 processed 36 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2 The verifier considers this program as safe by mistakenly pruning unsafe code paths. In the above func#0, code lines 0-10 are of interest. In line 0-3 registers r6 to r9 are initialized with known scalar values. In line 4 the register r6 is reset to an unknown scalar given the verifier does not track modulo operations. Due to this, the verifier can also not determine precisely which branches in line 6 and 9 are taken, therefore it needs to explore them both. As can be seen, the verifier starts with exploring the false/fall-through paths first. The 'from 19 to 21' path has both r6=0 and r9=0 and the pointer arithmetic on r0 += r6 is therefore considered safe. Given the arithmetic, r6 is correctly marked for precision tracking where backtracking kicks in where it walks back the current path all the way where r6 was set to 0 in the fall-through branch. Next, the pruning logics pops the path 'from 9 to 11' from the stack. Also here, the state of the registers is the same, that is, r6=0 and r9=0, so that at line 19 the path can be pruned as it is considered safe. It is interesting to note that the conditional in line 9 turned r6 into a more precise state, that is, in the fall-through path at the beginning of line 10, it is R6=scalar(umin=1), and in the branch-taken path (which is analyzed here) at the beginning of line 11, r6 turned into a known const r6=0 as r9=0 prior to that and therefore (unsigned) r6 <= 0 concludes that r6 must be 0 (**): [...] ; R6_w=scalar() 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 [...] from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 [...] The next path is 'from 6 to 9'. The verifier considers the old and current state equivalent, and therefore prunes the search incorrectly. Looking into the two states which are being compared by the pruning logic at line 9, the old state consists of R6_rwD=Pscalar() R9_rwD=0 R10=fp0 and the new state consists of R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0. While r6 had the reg->precise flag correctly set in the old state, r9 did not. Both r6'es are considered as equivalent given the old one is a superset of the current, more precise one, however, r9's actual values (0 vs 0x80000000) mismatch. Given the old r9 did not have reg->precise flag set, the verifier does not consider the register as contributing to the precision state of r6, and therefore it considered both r9 states as equivalent. However, for this specific pruned path (which is also the actual path taken at runtime), register r6 will be 0x400 and r9 0x80000000 when reaching line 21, thus oob-accessing the map. The purpose of precision tracking is to initially mark registers (including spilled ones) as imprecise to help verifier's pruning logic finding equivalent states it can then prune if they don't contribute to the program's safety aspects. For example, if registers are used for pointer arithmetic or to pass constant length to a helper, then the verifier sets reg->precise flag and backtracks the BPF program instruction sequence and chain of verifier states to ensure that the given register or stack slot including their dependencies are marked as precisely tracked scalar. This also includes any other registers and slots that contribute to a tracked state of given registers/stack slot. This backtracking relies on recorded jmp_history and is able to traverse entire chain of parent states. This process ends only when all the necessary registers/slots and their transitive dependencies are marked as precise. The backtrack_insn() is called from the current instruction up to the first instruction, and its purpose is to compute a bitmask of registers and stack slots that need precision tracking in the parent's verifier state. For example, if a current instruction is r6 = r7, then r6 needs precision after this instruction and r7 needs precision before this instruction, that is, in the parent state. Hence for the latter r7 is marked and r6 unmarked. For the class of jmp/jmp32 instructions, backtrack_insn() today only looks at call and exit instructions and for all other conditionals the masks remain as-is. However, in the given situation register r6 has a dependency on r9 (as described above in **), so also that one needs to be marked for precision tracking. In other words, if an imprecise register influences a precise one, then the imprecise register should also be marked precise. Meaning, in the parent state both dest and src register need to be tracked for precision and therefore the marking must be more conservative by setting reg->precise flag for both. The precision propagation needs to cover both for the conditional: if the src reg was marked but not the dst reg and vice versa. After the fix the program is correctly rejected: func#0 @0 0: R1=ctx(off=0,imm=0) R10=fp0 0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff80000000; 0x7fffffff),u32_min=-2147483648) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0 20: (95) exit from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? 21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0) 24: (0f) r0 += r6 last_idx 24 first_idx 19 regs=40 stack=0 before 23: (bf) r1 = r0 regs=40 stack=0 before 22: (27) r6 *= 8192 regs=40 stack=0 before 21: (77) r6 >>= 10 regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1 parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 regs=40 stack=0 before 10: (b7) r6 = 0 25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 27: (95) exit from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 11 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 frame 0: propagating r6 last_idx 19 first_idx 11 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9 regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1 parent didn't have regs=240 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=P0 R10=fp0 last_idx 8 first_idx 0 regs=240 stack=0 before 8: (b7) r9 = 0 regs=40 stack=0 before 7: (97) r6 %= 1 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 19: safe from 6 to 9: R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 9: (bd) if r6 <= r9 goto pc+1 last_idx 9 first_idx 0 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 last_idx 9 first_idx 0 regs=200 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 11: R6=scalar(umax=18446744071562067968) R9=-2147483648 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 11 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null(id=3,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0_w=0 20: (95) exit from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=scalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm???? 21: (77) r6 >>= 10 ; R6_w=scalar(umax=18014398507384832,var_off=(0x0; 0x3fffffffffffff)) 22: (27) r6 *= 8192 ; R6_w=scalar(smax=9223372036854767616,umax=18446744073709543424,var_off=(0x0; 0xffffffffffffe000),s32_max=2147475456,u32_max=-8192) 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0) 24: (0f) r0 += r6 last_idx 24 first_idx 21 regs=40 stack=0 before 23: (bf) r1 = r0 regs=40 stack=0 before 22: (27) r6 *= 8192 regs=40 stack=0 before 21: (77) r6 >>= 10 parent didn't have regs=40 stack=0 marks: R0_rw=map_value(off=0,ks=4,vs=48,imm=0) R6_r=Pscalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm???? last_idx 19 first_idx 11 regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 last_idx 9 first_idx 0 regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1 regs=240 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 math between map_value pointer and register with unbounded min value is not allowed verification time 886 usec stack depth 4 processed 49 insns (limit 1000000) max_states_per_insn 1 total_states 5 peak_states 5 mark_read 2 Fixes: b5dc0163d8 ("bpf: precise scalar_value tracking") Reported-by: Juan Jose Lopez Jaimez <jjlopezjaimez@google.com> Reported-by: Meador Inge <meadori@google.com> Reported-by: Simon Scannell <simonscannell@google.com> Reported-by: Nenad Stojanovski <thenenadx@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Co-developed-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Reviewed-by: Juan Jose Lopez Jaimez <jjlopezjaimez@google.com> Reviewed-by: Meador Inge <meadori@google.com> Reviewed-by: Simon Scannell <simonscannell@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-26 11:24:02 +02:00
Greg Kroah-Hartman	da8b283c08	This is the 5.4.241 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRBDvQACgkQONu9yGCS aT58+g/+PmTvsCcjSlTvpHw+kFsIu2F2pIjlJNlX+YHSzEYMG/G2mn7XD1rUE7JB mQQ7hFXEeQZTuN4zsFnviotzn1xd6bV26Od598m+yFZ3Fty07NXy3OD1/08ZdP0G k+U9u4TDr47BV3WdokGWIdXAjnlvC0kwjc+EWznOmXquhW8hSrGvz0IUJQWgDue1 IpOkuRs60T85dUHoPYEL8T23XRyhFhdeIrlx6Hqzlp1fGg7dSpfh0yYJmDLF6Y21 CXO2WcADhMMszk+CFEXgfWVem5mheUuVsfmBUg34ZGzzNos0rPyHG+VmwZxnsPYE SVLVxLL649CzAuJdpXflTghdBUU/WKT/ZZ0aQddohPjij55My2oCV6/FpHXg7kuo ZTXN0ByyeAbV4DlY2+ooY6Vhr5lzQG1l15Ap9xj4ioQO8U3jeCCQ5wT9L01ig6a9 /9U9wb6CYp3thrY94x1WapJF5utiIigbiS+rioRfAwHAzj5JiLfQvdH1nVgBNz+9 DWCEGIiUONmHMRrt+X6Nnu8KkHWOkDFF2lisphXUsaY140gFG0+d3xnRArsU4ZDi j1zT0ErqigV6vzA39ic898EW8wkNqVCWPwYRLVRSBuPCDKK7SjnOuStGi7eIoYp2 zI2NV9UUMm5Qxub5zUNktpWDFFn9knN3E7Gc4wAKWkHkWc/DJ+U= =ffeb -----END PGP SIGNATURE----- Merge 5.4.241 into android11-5.4-lts Changes in 5.4.241 scsi: ses: Handle enclosure with just a primary component gracefully x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()" treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() smb3: fix problem with null cifs super block with previous patch pinctrl: amd: Use irqchip template pinctrl: amd: disable and mask interrupts on probe pinctrl: amd: Disable and mask interrupts on resume pwm: cros-ec: Explicitly set .polarity in .get_state() pwm: sprd: Explicitly set .polarity in .get_state() wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta icmp: guard against too small mtu net: don't let netpoll invoke NAPI if in xmit context sctp: check send stream number after wait_for_sndbuf ipv6: Fix an uninit variable access bug in __ip6_make_skb() gpio: davinci: Add irq chip flag to skip set wake sunrpc: only free unix grouplist after RCU settles NFSD: callback request does not use correct credential for AUTH_SYS xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs usb: typec: altmodes/displayport: Fix configure initial pin assignment USB: serial: option: add Telit FE990 compositions USB: serial: option: add Quectel RM500U-CN modem iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip iio: dac: cio-dac: Fix max DAC write value check for 12-bit tty: serial: sh-sci: Fix transmit end interrupt handler tty: serial: sh-sci: Fix Rx on RZ/G2L SCI tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() nilfs2: fix sysfs interface lifetime ALSA: hda/realtek: Add quirk for Clevo X370SNW perf/core: Fix the same task check in perf_event_set_output ftrace: Mark get_lock_parent_ip() __always_inline can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access tracing: Free error logs of tracing instances net_sched: prevent NULL dereference if default qdisc setup failed drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path ring-buffer: Fix race while reader and writer are on the same page mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() irqdomain: Look for existing mapping only once irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Fix mapping-creation race Revert "pinctrl: amd: Disable and mask interrupts on resume" ALSA: emu10k1: fix capture interrupt handler unlinking ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard ALSA: i2c/cs8427: fix iec958 mixer control deactivation ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Bluetooth: Fix race condition in hidp_session_thread btrfs: print checksum type and implementation at mount time btrfs: fix fast csum implementation detection mtdblock: tolerate corrected bit-flips mtd: rawnand: meson: fix bitmask for length in command word mtd: rawnand: stm32_fmc2: remove unsupported EDO mode 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition niu: Fix missing unwind goto in niu_alloc_channels() qlcnic: check pci_reset_function result sctp: fix a potential overflow in sctp_ifwdtsn_skip RDMA/core: Fix GID entry ref leak when create_ah fails udp6: fix potential access to stale information net: macb: fix a memory corruption in extended buffer descriptor mode power: supply: cros_usbpd: reclassify "default case!" as debug i2c: imx-lpi2c: clean rx/tx buffers upon new message efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F verify_pefile: relax wrapper length check asymmetric_keys: log on fatal failures in PE/pkcs7 ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size mtd: ubi: wl: Fix a couple of kernel-doc issues ubi: Fix deadlock caused by recursively holding work_sem i2c: ocores: generate stop condition after timeout in polling mode watchdog: sbsa_wdog: Make sure the timeout programming is within the limits coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug xfs: show the proper user quota options xfs: merge the projid fields in struct xfs_icdinode xfs: ensure that the inode uid/gid match values match the icdinode ones xfs: remove the icdinode di_uid/di_gid members xfs: remove the kuid/kgid conversion wrappers xfs: add a new xfs_sb_version_has_v3inode helper xfs: only check the superblock version for dinode size calculation xfs: simplify di_flags2 inheritance in xfs_ialloc xfs: simplify a check in xfs_ioctl_setattr_check_cowextsize xfs: remove the di_version field from struct icdinode xfs: fix up non-directory creation in SGID directories xfs: set inode size after creating symlink xfs: report corruption only as a regular error xfs: shut down the filesystem if we screw up quota reservation xfs: consider shutdown in bmapbt cursor delete assert xfs: don't reuse busy extents on extent trim xfs: force log and push AIL to clear pinned inodes when aborting mount Linux 5.4.241 Change-Id: I428eec45c4ac9796104683d40b7cb0d38d4c8015 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-21 13:34:52 +00:00
Johan Hovold	2945f948aa	irqdomain: Fix mapping-creation race ... [ Upstream commit 601363cc08da25747feb87c55573dd54de91d66a ] Parallel probing of devices that share interrupts (e.g. when a driver uses asynchronous probing) can currently result in two mappings for the same hardware interrupt to be created due to missing serialisation. Make sure to hold the irq_domain_mutex when creating mappings so that looking for an existing mapping before creating a new one is done atomically. Fixes: 765230b5f0 ("driver-core: add asynchronous probing support for drivers") Fixes: b62b2cf575 ("irqdomain: Fix handling of type settings for existing mappings") Link: https://lore.kernel.org/r/YuJXMHoT4ijUxnRb@hovoldconsulting.com Cc: stable@vger.kernel.org # 4.8 Cc: Dmitry Torokhov <dtor@chromium.org> Cc: Jon Hunter <jonathanh@nvidia.com> Tested-by: Hsin-Yi Wang <hsinyi@chromium.org> Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-7-johan+linaro@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:35 +02:00
Johan Hovold	e8f3aea716	irqdomain: Refactor __irq_domain_alloc_irqs() ... [ Upstream commit d55f7f4c58c07beb5050a834bf57ae2ede599c7e ] Refactor __irq_domain_alloc_irqs() so that it can be called internally while holding the irq_domain_mutex. This will be used to fix a shared-interrupt mapping race, hence the Fixes tag. Fixes: b62b2cf575 ("irqdomain: Fix handling of type settings for existing mappings") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang <hsinyi@chromium.org> Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-6-johan+linaro@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:35 +02:00
Johan Hovold	3804f265c1	irqdomain: Look for existing mapping only once ... commit 6e6f75c9c98d2d246d90411ff2b6f0cd271f4cba upstream. Avoid looking for an existing mapping twice when creating a new mapping using irq_create_fwspec_mapping() by factoring out the actual allocation which is shared with irq_create_mapping_affinity(). The new helper function will also be used to fix a shared-interrupt mapping race, hence the Fixes tag. Fixes: b62b2cf575 ("irqdomain: Fix handling of type settings for existing mappings") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang <hsinyi@chromium.org> Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-5-johan+linaro@kernel.org Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:35 +02:00
Zheng Yejian	fd644712bc	ring-buffer: Fix race while reader and writer are on the same page ... commit 6455b6163d8c680366663cdb8c679514d55fc30c upstream. When user reads file 'trace_pipe', kernel keeps printing following logs that warn at "cpu_buffer->reader_page->read > rb_page_size(reader)" in rb_get_reader_page(). It just looks like there's an infinite loop in tracing_read_pipe(). This problem occurs several times on arm64 platform when testing v5.10 and below. Call trace: rb_get_reader_page+0x248/0x1300 rb_buffer_peek+0x34/0x160 ring_buffer_peek+0xbc/0x224 peek_next_entry+0x98/0xbc __find_next_entry+0xc4/0x1c0 trace_find_next_entry_inc+0x30/0x94 tracing_read_pipe+0x198/0x304 vfs_read+0xb4/0x1e0 ksys_read+0x74/0x100 __arm64_sys_read+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Then I dump the vmcore and look into the problematic per_cpu ring_buffer, I found that tail_page/commit_page/reader_page are on the same page while reader_page->read is obviously abnormal: tail_page == commit_page == reader_page == { .write = 0x100d20, .read = 0x8f9f4805, // Far greater than 0xd20, obviously abnormal!!! .entries = 0x10004c, .real_end = 0x0, .page = { .time_stamp = 0x857257416af0, .commit = 0xd20, // This page hasn't been full filled. // .data[0...0xd20] seems normal. } } The root cause is most likely the race that reader and writer are on the same page while reader saw an event that not fully committed by writer. To fix this, add memory barriers to make sure the reader can see the content of what is committed. Since commit a0fcaaed0c46 ("ring-buffer: Fix race between reset page and reading page") has added the read barrier in rb_get_reader_page(), here we just need to add the write barrier. Link: https://lore.kernel.org/linux-trace-kernel/20230325021247.2923907-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: 77ae365eca ("ring-buffer: make lockless") Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:34 +02:00
Steven Rostedt (Google)	987f599fc5	tracing: Free error logs of tracing instances ... commit 3357c6e429643231e60447b52ffbb7ac895aca22 upstream. When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger # cat instances/foo/error_log [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=x ^ # rmdir instances/foo Then check for memory leaks: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff88810d8ec700 (size 192): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... backtrace: [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 [<00000000b2938940>] tracing_log_err+0x277/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff888170c35a00 (size 32): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... backtrace: [<000000006a747de5>] __kmalloc+0x4d/0x160 [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc The problem is that the error log needs to be freed when the instance is removed. Link: https://lore.kernel.org/lkml/76134d9f-a5ba-6a0d-37b3-28310b4a1e91@alu.unizg.hr/ Link: https://lore.kernel.org/linux-trace-kernel/20230404194504.5790b95f@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Thorsten Leemhuis <regressions@leemhuis.info> Cc: Ulf Hansson <ulf.hansson@linaro.org> Cc: Eric Biggers <ebiggers@kernel.org> Fixes: 2f754e771b ("tracing: Have the error logs show up in the proper instances") Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:34 +02:00
Kan Liang	95bbfeb4ff	perf/core: Fix the same task check in perf_event_set_output ... [ Upstream commit 24d3ae2f37d8bc3c14b31d353c5d27baf582b6a6 ] The same task check in perf_event_set_output has some potential issues for some usages. For the current perf code, there is a problem if using of perf_event_open() to have multiple samples getting into the same mmap’d memory when they are both attached to the same process. https://lore.kernel.org/all/92645262-D319-4068-9C44-2409EF44888E@gmail.com/ Because the event->ctx is not ready when the perf_event_set_output() is invoked in the perf_event_open(). Besides the above issue, before the commit bd2756811766 ("perf: Rewrite core context handling"), perf record can errors out when sampling with a hardware event and a software event as below. $ perf record -e cycles,dummy --per-thread ls failed to mmap with 22 (Invalid argument) That's because that prior to the commit a hardware event and a software event are from different task context. The problem should be a long time issue since commit c3f00c7027 ("perk: Separate find_get_context() from event initialization"). The task struct is stored in the event->hw.target for each per-thread event. It is a more reliable way to determine whether two events are attached to the same task. The event->hw.target was also introduced several years ago by the commit 50f16a8bf9 ("perf: Remove type specific target pointers"). It can not only be used to fix the issue with the current code, but also back port to fix the issues with an older kernel. Note: The event->hw.target was introduced later than commit c3f00c7027. The patch may cannot be applied between the commit c3f00c7027 and commit 50f16a8bf9. Anybody that wants to back-port this at that period may have to find other solutions. Fixes: c3f00c7027 ("perf: Separate find_get_context() from event initialization") Signed-off-by: Kan Liang <kan.liang@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Zhengjun Xing <zhengjun.xing@linux.intel.com> Link: https://lkml.kernel.org/r/20230322202449.512091-1-kan.liang@linux.intel.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-20 12:07:34 +02:00
Kees Cook	2e64d7b182	treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() ... [ Upstream commit b13fecb1c3a603c4b8e99b306fecf4f668c11b32 ] This converts all the existing DECLARE_TASKLET() (and ...DISABLED) macros with DECLARE_TASKLET_OLD() in preparation for refactoring the tasklet callback type. All existing DECLARE_TASKLET() users had a "0" data argument, it has been removed here as well. Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Kees Cook <keescook@chromium.org> Stable-dep-of: 1fdeb8b9f29d ("wifi: iwl3945: Add missing check for create_singlethread_workqueue") Signed-off-by: Sasha Levin <sashal@kernel.org> [Tom: fix backport to 5.4.y] AUTOSEL backport to 5.4.y of: b13fecb1c3a6 ("treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()") changed all locations of DECLARE_TASKLET with DECLARE_TASKLET_OLD, except one, in arch/mips/lasat/pcivue_proc.c. This is due to: 10760dde9be3 ("MIPS: Remove support for LASAT") preceeding b13fecb1c3a6 ("treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y. Fix this by changing DECLARE_TASKLET to DECLARE_TASKLET_OLD in arch/mips/lasat/pcivue_proc.c. Fixes: 5de7a4254e ("treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()") Reported-by: "kernelci.org bot" <bot@kernelci.org> Signed-off-by: Tom Saeger <tom.saeger@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:32 +02:00
Tom Saeger	199197660b	Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()" ... This reverts commit 5de7a4254e which caused mips build failures. kernelci.org bot reports: arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function) arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function] Link: https://lore.kernel.org/stable/64041dda.170a0220.8cc25.79c9@mx.google.com/ Reported-by: "kernelci.org bot" <bot@kernelci.org> Signed-off-by: Tom Saeger <tom.saeger@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:32 +02:00
Waiman Long	522af69af2	cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() ... commit ba9182a89626d5f83c2ee4594f55cb9c1e60f0e2 upstream. After a successful cpuset_can_attach() call which increments the attach_in_progress flag, either cpuset_cancel_attach() or cpuset_attach() will be called later. In cpuset_attach(), tasks in cpuset_attach_wq, if present, will be woken up at the end. That is not the case in cpuset_cancel_attach(). So missed wakeup is possible if the attach operation is somehow cancelled. Fix that by doing the wakeup in cpuset_cancel_attach() as well. Fixes: e44193d39e ("cpuset: let hotplug propagation work wait for task attaching") Signed-off-by: Waiman Long <longman@redhat.com> Reviewed-by: Michal Koutný <mkoutny@suse.com> Cc: stable@vger.kernel.org # v3.11+ Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-20 12:07:32 +02:00
Greg Kroah-Hartman	974e2ad014	This is the 5.4.240 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQtPbUACgkQONu9yGCS aT462xAAhgh6J/KB4thj31ULLDPkX3zEuTLKIBlLK617NkKHF9k0XA6oAo9A2Fyy t/MfXJvjmmL0kxsWqmoir0ZrPMifgdAK5hoxjXfvjWYtlYi3k0CXqXlg4YQ9Xalp VU3O0RRli3KQxKK3u1PhnMMui7+l3pMELza3pUvyhCxRJx3K9loXkbrFZqdOvXEV QuZ0ugKaxEwWnwStqIzIAUw+jt/13TwPrVQC6cBjkeOOItw2kNw1SPzrjptfHahG M8fApzAKEgZPa49gDw95hZLawt4Acf5suITLgktBtzniFbj8c5A7jaYMFnaKVv3/ 1zUhDu6VYZ5UfLzwYoLnmZ08vWVCTi8r28MJ/f1UdkPlhH9T6blos5RdGB9+4Al8 17KmOPSXLjzs36cSJFaj521earJSrcwvhsc/sc0ENk0U3CO1d0JkqZKClD2QRt82 z4yOlkd8j7SbpMgLdwwKbn0PqlK9YddCH7vXNCeMu9thA+Zjy7Z1zCWzENrh8btt EcQls3VfHSue9avVhkb5THlhEjY8Pe4/x061YWCYqzamIg5/9xjmYTE8mJdXQVxs zr2wgDikAfXHM440/yQgCiAYLT+gB7ewef+ubbhWVwMDviu8vTWlPAiLqnR7TUAp CHvypmojDa6iLVnLGvPmIZTkChGCj0x3u7b5VDBJmlt/DLi8amw= =Y+Jp -----END PGP SIGNATURE----- Merge 5.4.240 into android11-5.4-lts Changes in 5.4.240 net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition iavf: fix inverted Rx hash condition leading to disabled hash iavf: fix non-tunneled IPv6 UDP packet type and hashing intel/igbvf: free irq on the error path in igbvf_request_msix() igbvf: Regard vf reset nack as success i2c: imx-lpi2c: check only for enabled interrupt flags scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() net: usb: smsc95xx: Limit packet length to skb->len qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info xirc2ps_cs: Fix use after free bug in xirc2ps_detach net: qcom/emac: Fix use after free bug in emac_remove due to race condition net/ps3_gelic_net: Fix RX sk_buff length net/ps3_gelic_net: Use dma_mapping_error keys: Do not cache key in task struct if key is requested from kernel thread bpf: Adjust insufficient default bpf_jit_limit net/mlx5: Read the TC mapping of all priorities on ETS query atm: idt77252: fix kmemleak when rmmod idt77252 erspan: do not use skb_mac_header() in ndo_start_xmit() net/sonic: use dma_mapping_error() for error check nvme-tcp: fix nvme_tcp_term_pdu to match spec hvc/xen: prevent concurrent accesses to the shared ring net: mdio: thunder: Add missing fwnode_handle_put() Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs scsi: qla2xxx: Perform lockless command completion in abort path uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 thunderbolt: Use const qualifier for `ring_interrupt_index` riscv: Bump COMMAND_LINE_SIZE value to 1024 ca8210: fix mac_len negative array access m68k: Only force 030 bus error if PC not in exception table selftests/bpf: check that modifier resolves after pointer scsi: target: iscsi: Fix an error message in iscsi_check_key() scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: lpfc: Avoid usage of list iterator variable after loop net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 net: usb: qmi_wwan: add Telit 0x1080 composition sh: sanitize the flags on sigreturn cifs: empty interface list when server doesn't support query interfaces scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR usb: gadget: u_audio: don't let userspace block driver unbind fsverity: Remove WQ_UNBOUND from fsverity read workqueue igb: revert rtnl_lock() that causes deadlock dm thin: fix deadlock when swapping to thin device usb: cdns3: Fix issue with using incorrect PCI device function usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: chipidea: core: fix possible concurrent when switch role wifi: mac80211: fix qos on mesh interfaces nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() dm stats: check for and propagate alloc_percpu failure dm crypt: add cond_resched() to dmcrypt_write() sched/fair: sanitize vruntime of entity being placed sched/fair: Sanitize vruntime of entity being migrated tun: avoid double free in tun_free_netdev ocfs2: fix data corruption after failed write fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY bus: imx-weim: fix branch condition evaluates to a garbage value md: avoid signed overflow in slot_store() ALSA: asihpi: check pao in control_message() ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() fbdev: tgafb: Fix potential divide by zero sched_getaffinity: don't assume 'cpumask_size()' is fully initialized fbdev: nvidia: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: au1200fb: Fix potential divide by zero ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() dma-mapping: drop the dev argument to arch_sync_dma_for_* mips: bmips: BCM6358: disable RAC flush for TP1 mtd: rawnand: meson: invalidate cache on polling ECC bit scsi: megaraid_sas: Fix crash after a double completion ptp_qoriq: fix memory leak in probe() regulator: fix spelling mistake "Cant" -> "Can't" regulator: Handle deferred clk net/net_failover: fix txq exceeding warning can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write s390/vfio-ap: fix memory leak in vfio_ap device driver i40e: fix registers dump after run ethtool adapter self test bnxt_en: Fix typo in PCI id to device description string mapping net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only net: mvneta: make tx buffer array agnostic pinctrl: ocelot: Fix alt mode for ocelot Input: alps - fix compatibility with -funsigned-char Input: focaltech - use explicitly signed char type cifs: prevent infinite recursion in CIFSGetDFSRefer() cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table xen/netback: don't do grant copy across page boundary pinctrl: at91-pio4: fix domain name assignment NFSv4: Fix hangs when recovering open state after a server reboot ALSA: hda/conexant: Partial revert of a quirk for Lenovo ALSA: usb-audio: Fix regression on detection of Roland VS-100 drm/etnaviv: fix reference leak when mmaping imported buffer s390/uaccess: add missing earlyclobber annotations to __clear_user() btrfs: scan device in non-exclusive mode ext4: fix kernel BUG in 'ext4_write_inline_data_end()' net_sched: add __rcu annotation to netdev->qdisc net: sched: fix race condition in qdisc_graft() firmware: arm_scmi: Fix device node validation for mailbox transport gfs2: Always check inode size of inline inodes Linux 5.4.240 Change-Id: Ibe603c6cdf434feacfd91e87ba359dc544223a21 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-05 13:51:54 +00:00
Christoph Hellwig	9690e34f22	dma-mapping: drop the dev argument to arch_sync_dma_for_* ... [ Upstream commit 56e35f9c5b87ec1ae93e483284e189c84388de16 ] These are pure cache maintainance routines, so drop the unused struct device argument. Signed-off-by: Christoph Hellwig <hch@lst.de> Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch> Stable-dep-of: ab327f8acdf8 ("mips: bmips: BCM6358: disable RAC flush for TP1") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-05 11:16:43 +02:00
Linus Torvalds	f3359f5fc9	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized ... [ Upstream commit 6015b1aca1a233379625385feb01dd014aca60b5 ] The getaffinity() system call uses 'cpumask_size()' to decide how big the CPU mask is - so far so good. It is indeed the allocation size of a cpumask. But the code also assumes that the whole allocation is initialized without actually doing so itself. That's wrong, because we might have fixed-size allocations (making copying and clearing more efficient), but not all of it is then necessarily used if 'nr_cpu_ids' is smaller. Having checked other users of 'cpumask_size()', they all seem to be ok, either using it purely for the allocation size, or explicitly zeroing the cpumask before using the size in bytes to copy it. See for example the ublk_ctrl_get_queue_affinity() function that uses the proper 'zalloc_cpumask_var()' to make sure that the whole mask is cleared, whether the storage is on the stack or if it was an external allocation. Fix this by just zeroing the allocation before using it. Do the same for the compat version of sched_getaffinity(), which had the same logic. Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to access the bits. For a cpumask_var_t, it ends up being a pointer to the same data either way, but it's just a good idea to treat it like you would a 'cpumask_t'. The compat case already did that. Reported-by: Ryan Roberts <ryan.roberts@arm.com> Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/ Cc: Yury Norov <yury.norov@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-05 11:16:42 +02:00
Vincent Guittot	d253120a58	sched/fair: Sanitize vruntime of entity being migrated ... commit a53ce18cacb477dd0513c607f187d16f0fa96f71 upstream. Commit 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") fixes an overflowing bug, but ignore a case that se->exec_start is reset after a migration. For fixing this case, we delay the reset of se->exec_start after placing the entity which se->exec_start to detect long sleeping task. In order to take into account a possible divergence between the clock_task of 2 rqs, we increase the threshold to around 104 days. Fixes: 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") Originally-by: Zhang Qiao <zhangqiao22@huawei.com> Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Tested-by: Zhang Qiao <zhangqiao22@huawei.com> Link: https://lore.kernel.org/r/20230317160810.107988-1-vincent.guittot@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-05 11:16:41 +02:00
Zhang Qiao	c23928c70b	sched/fair: sanitize vruntime of entity being placed ... commit 829c1651e9c4a6f78398d3e67651cef9bb6b42cc upstream. When a scheduling entity is placed onto cfs_rq, its vruntime is pulled to the base level (around cfs_rq->min_vruntime), so that the entity doesn't gain extra boost when placed backwards. However, if the entity being placed wasn't executed for a long time, its vruntime may get too far behind (e.g. while cfs_rq was executing a low-weight hog), which can inverse the vruntime comparison due to s64 overflow. This results in the entity being placed with its original vruntime way forwards, so that it will effectively never get to the cpu. To prevent that, ignore the vruntime of the entity being placed if it didn't execute for much longer than the characteristic sheduler time scale. [rkagan: formatted, adjusted commit log, comments, cutoff value] Signed-off-by: Zhang Qiao <zhangqiao22@huawei.com> Co-developed-by: Roman Kagan <rkagan@amazon.de> Signed-off-by: Roman Kagan <rkagan@amazon.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20230130122216.3555094-1-rkagan@amazon.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-05 11:16:41 +02:00
Daniel Borkmann	d69c2ded95	bpf: Adjust insufficient default bpf_jit_limit ... [ Upstream commit 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 ] We've seen recent AWS EKS (Kubernetes) user reports like the following: After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS clusters after a few days a number of the nodes have containers stuck in ContainerCreating state or liveness/readiness probes reporting the following error: Readiness probe errored: rpc error: code = Unknown desc = failed to exec in container: failed to start exec "4a11039f730203ffc003b7[...]": OCI runtime exec failed: exec failed: unable to start container process: unable to init seccomp: error loading seccomp filter into kernel: error loading seccomp filter: errno 524: unknown However, we had not been seeing this issue on previous AMIs and it only started to occur on v20230217 (following the upgrade from kernel 5.4 to 5.10) with no other changes to the underlying cluster or workloads. We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) which helped to immediately allow containers to be created and probes to execute but after approximately a day the issue returned and the value returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' was steadily increasing. I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, seccomp BPF and native (e)BPF programs, and the behavior all looks sane and expected, that is nothing "leaking" from an upstream perspective. The bpf_jit_limit knob was originally added in order to avoid a situation where unprivileged applications loading BPF programs (e.g. seccomp BPF policies) consuming all the module memory space via BPF JIT such that loading of kernel modules would be prevented. The default limit was defined back in 2018 and while good enough back then, we are generally seeing far more BPF consumers today. Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the module memory space to better reflect today's needs and avoid more users running into potentially hard to debug issues. Fixes: fdadd04931 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") Reported-by: Stephen Haynes <sh@synk.net> Reported-by: Lefteris Alexakis <lefteris.alexakis@kpn.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://github.com/awslabs/amazon-eks-ami/issues/1179 Link: https://github.com/awslabs/amazon-eks-ami/issues/1219 Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20230320143725.8394-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-05 11:16:37 +02:00
Greg Kroah-Hartman	b6d6caabaf	Merge branch 'android11-5.4' into android11-5.4-lts ... Sync up with android11-5.4 for the following commits: * b86f2ce54f Merge tag 'android11-5.4.233_r00' into android11-5.4 * 5ccb6ea4bc UPSTREAM: ext4: fix another off-by-one fsmap error on 1k block filesystems * f756dbba7b UPSTREAM: ext4: refuse to create ea block when umounted * aefbae5b92 UPSTREAM: ext4: optimize ea_inode block expansion * 7431096bfd UPSTREAM: ext4: allocate extended attribute value in vmalloc area * 7cfbc7501b BACKPORT: FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration * b62f2af118 ANDROID: fs/f2fs: fixup __f2fs_cluster_blocks with F2FS_FS_COMPRESSION * 9f71ba69cd UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request * 62b8ef0458 UPSTREAM: KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS * 2af3bdf293 UPSTREAM: ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop * 9adb062d06 UPSTREAM: net_sched: reject TCF_EM_SIMPLE case for complex ematch module * 5a1412b39b UPSTREAM: ipv6: ensure sane device mtu in tunnels * 2490e55ff4 BACKPORT: iommu: Avoid races around device probe * 3daec397ee BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses * b6a441d634 FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio * 1866ee1a90 ANDROID: ABI: Cuttlefish Symbol update * e55bdca2cb UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing * d72fdcc709 ANDROID: abi_gki_aarch64_qcom: Add hrtimer_sleeper_start_expires * b63a7aff8a UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF Update the .xml file with the new symbols being tracked now: 2 Added functions: [A] 'function void hrtimer_sleeper_start_expires(hrtimer_sleeper*, hrtimer_mode)' [A] 'function bool ieee80211_tx_prepare_skb(ieee80211_hw*, ieee80211_vif*, sk_buff*, int, ieee80211_sta**)' Change-Id: Ida9475b812bf2e4b2f80bff6c554df60b288d2e7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-24 07:35:02 +00:00
Greg Kroah-Hartman	b86f2ce54f	Merge tag 'android11-5.4.233_r00' into android11-5.4 ... This is the merge of the upstream LTS release of 5.4.233 into the android11-5.4 branch. It contains the following commits: 6bb176e034 Merge 5.4.233 into android11-5.4-lts 7f7f254975 Revert "iommu: Add gfp parameter to iommu_ops::map" 7f7f83ce87 Revert "iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map()" bbf1c13935 Revert "RDMA/usnic: use iommu_map_atomic() under spin_lock()" 69f65d442e Linux 5.4.233 c6cc0121d4 bpf: add missing header file include 5d873a6c65 Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs" 99e3fd21f8 ext4: Fix function prototype mismatch for ext4_feat_ktype 6f86bb6f85 wifi: mwifiex: Add missing compatible string for SD8787 6c750ed036 uaccess: Add speculation barrier to copy_from_user() 4d2e5de071 mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh 787ef0db01 drm/i915/gvt: fix double free bug in split_2MB_gtt_entry 100cf2af1b alarmtimer: Prevent starvation by small intervals and SIG_IGN dab2066c5f powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 113e0cde39 can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len f93a1a5bdc KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS db209f39f1 KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception dc399695df random: always mix cycle counter in add_latent_entropy() eff0e02f7d powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G ead0689bd6 wifi: rtl8xxxu: gen2: Turn on the rate control 0a77a966aa drm/etnaviv: don't truncate physical page address fa2845b216 drm: etnaviv: fix common struct sg_table related issues 4626550b09 scatterlist: add generic wrappers for iterating over sgtable objects fe3e217272 dma-mapping: add generic helpers for mapping sgtable objects abc4ede193 Merge 5.4.232 into android11-5.4-lts 64121e2adf Linux 5.4.232 8b47e324af iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map() 7519069f1f net: sched: sch: Fix off by one in htb_activate_prios() 5660a6ffa7 ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak 52844d8382 nilfs2: fix underflow in second superblock position calculations 9f95a161a7 kvm: initialize all of the kvm_debugregs structure before sending it to userspace 9f4abf2048 i40e: Add checking for null for nlmsg_find_attr() e71554a09e ipv6: Fix tcp socket connection with DSCP. 388886f970 ipv6: Fix datagram socket connection with DSCP. 905199dac2 ixgbe: add double of VLAN header when computing the max MTU df099e6556 net: mpls: fix stale pointer if allocation fails during device rename 736f8f66d7 net: stmmac: Restrict warning on disabling DMA store and fwd mode 1a2c795142 bnxt_en: Fix mqprio and XDP ring checking logic de44bdebcf net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence a753352622 net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path 0c2651c763 dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. a4e9411769 sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list e1b54b5612 net: bgmac: fix BCM5358 support by setting correct flags 8a4d05b0ff i40e: add double of VLAN header when computing the max MTU fdeb4c258b ixgbe: allow to increase MTU to 3K with XDP enabled 32d81fd54e revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 4c8011e77c net: Fix unwanted sign extension in netdev_stats_to_stats64() 6b08c9fc72 Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." 8c07792e79 hugetlb: check for undefined shift on 32 bit architectures 7caeb5457b sched/psi: Fix use-after-free in ep_remove_wait_queue() 6c38aa4020 ALSA: hda/realtek - fixed wrong gpio assigned 6e0ef3fc65 ALSA: hda/conexant: add a new hda codec SN6180 e9b488d60f mmc: mmc_spi: fix error handling in mmc_spi_probe() 761db46b29 mmc: sdio: fix possible resource leaks in some error paths 98895c225e ipv4: Fix incorrect route flushing when source address is deleted 04a331c9dd Revert "ipv4: Fix incorrect route flushing when source address is deleted" 85eda80883 xfs: sync lazy sb accounting on quiesce of read-only mounts fb8ee907c1 xfs: prevent UAF in xfs_log_item_in_current_chkpt 7c07806ab0 xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks 313699d505 xfs: ensure inobt record walks always make forward progress 7f9309a9f5 xfs: fix missing CoW blocks writeback conversion retry 6246b3a18f xfs: only relog deferred intent items if free space in the log gets low 09d6181447 xfs: expose the log push threshold 5d711e4136 xfs: periodically relog deferred intent items 870e7d7108 xfs: change the order in which child and parent defer ops are finished f5af1d5c2d xfs: fix an incore inode UAF in xfs_bui_recover efcdc2e70e xfs: clean up xfs_bui_item_recover iget/trans_alloc/ilock ordering abad319dee xfs: clean up bmap intent item recovery checking 6601531db8 xfs: xfs_defer_capture should absorb remaining transaction reservation 411b14e68c xfs: xfs_defer_capture should absorb remaining block reservations 3324249e6e xfs: proper replay of deferred ops queued during log recovery 1c89c04305 xfs: fix finobt btree block recovery ordering 6678b2787b xfs: log new intent items created as part of finishing recovered intent items 562da8e704 xfs: refactor xfs_defer_finish_noroll 42a2406f90 xfs: turn dfp_intent into a xfs_log_item e11f1516fc xfs: merge the ->diff_items defer op into ->create_intent e84096edf8 xfs: merge the ->log_item defer op into ->create_intent 64b21eaa33 xfs: factor out a xfs_defer_create_intent helper d24633f3c2 xfs: remove the xfs_inode_log_item_t typedef e0373eeaaa xfs: remove the xfs_efd_log_item_t typedef 94e0639992 xfs: remove the xfs_efi_log_item_t typedef 83ef55c428 netfilter: nft_tproxy: restrict to prerouting hook b6ac5e6be5 btrfs: free device in btrfs_close_devices for a single device filesystem 4326d0080f aio: fix mremap after fork null-deref 62b19b9f3a nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association 16409f7d9c s390/decompressor: specify __decompress() buf len to avoid overflow fbe71c5dac net: sched: sch: Bounds check priority 09561d5e6a net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC a74d3b0ea9 net/rose: Fix to not accept on connected socket ec54c946b4 tools/virtio: fix the vringh test for virtio ring changes 6644685f79 ASoC: cs42l56: fix DT probe d23b66b16e selftests/bpf: Verify copy_register_state() preserves parent/live fields a94695e0f9 migrate: hugetlb: check for hugetlb shared PMD in node migration bcd34f1eea bpf: Always return target ifindex in bpf_fib_lookup 776f2ccfdc nvme-pci: Move enumeration by class to be last in the table 5c86809882 arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive 4b97dab7cd arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive f0302e98ed arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive 1509e93916 riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte bb3187311e ceph: flush cap releases when the session is flushed 9b5d37d328 usb: typec: altmodes/displayport: Fix probe pin assign check d9758f7deb usb: core: add quirk for Alcor Link AK9563 smartcard reader 43379fcace net: USB: Fix wrong-direction WARNING in plusb.c 1bcb431237 pinctrl: intel: Restore the pins that used to be in Direct IRQ mode 2b763f7de1 pinctrl: single: fix potential NULL dereference cc1affa234 pinctrl: aspeed: Fix confusing types in return value f209431be1 ALSA: pci: lx6464es: fix a debug loop 1aab663ecb selftests: forwarding: lib: quote the sysctl values ba38eacade rds: rds_rm_zerocopy_callback() use list_first_entry() 87a5e3fc84 ice: Do not use WQ_MEM_RECLAIM flag for workqueue f312958f58 ionic: clean interrupt before enabling queue to avoid credit race a532f7ebf9 net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY 73b8e217fe bonding: fix error checking in bond_debug_reregister() c89ddf134c xfrm: fix bug with DSCP copy to v6 from v4 tunnel 80282a3d10 RDMA/usnic: use iommu_map_atomic() under spin_lock() fe4d708668 iommu: Add gfp parameter to iommu_ops::map 4a779187db IB/IPoIB: Fix legacy IPoIB due to wrong number of queues 7896accedf IB/hfi1: Restore allocated resources on failed copyout ae774f480d can: j1939: do not wait 250 ms if the same addr was already claimed 56ee31167c tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw 039f935ae0 ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() 7e43bb69bc btrfs: zlib: zero-initialize zlib workspace ed29d8b309 btrfs: limit device extents to the device size 9f296c615e iio:adc:twl6030: Enable measurement of VAC 9cf5e99c1a wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads e5142a4935 f2fs: fix to do sanity check on i_extra_isize in is_alive() 3b3d3127f5 fbdev: smscufx: fix error handling code in ufx_usb_probe 8edda487f0 powerpc/imc-pmu: Revert nest_init_lock to being a mutex fc8548c75c serial: 8250_dma: Fix DMA Rx rearm race 71d6b277c4 serial: 8250_dma: Fix DMA Rx completion race ec5b4ca3d3 xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() 5af2f74f90 mm: swap: properly update readahead statistics in unuse_pte_range() ce62df33fc nvmem: core: fix cell removal on error 1369322c1d Squashfs: fix handling and sanity checking of xattr_ids count d49c85a191 mm/swapfile: add cond_resched() in get_swap_pages() c127bf9a95 fpga: stratix10-soc: Fix return value check in s10_ops_write_init() 6d86b4ceb0 mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps 845a3708f0 riscv: disable generation of unwind tables c89af52d91 parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case 8e6cc45ba8 parisc: Fix return code of pdc_iodc_print() 7f5df45fcb iio:adc:twl6030: Enable measurements of VUSB, VBAT and others 4b82cc9f7f iio: adc: berlin2-adc: Add missing of_node_put() in error path a300e358c6 iio: hid: fix the retval in accel_3d_capture_sample 2035cfb958 efi: Accept version 2 of memory attributes table f6ea834e8d watchdog: diag288_wdt: fix __diag288() inline assembly 78e55b52b2 watchdog: diag288_wdt: do not use stack buffers for hardware data 4abcd352a0 fbcon: Check font dimension limits e00d6a74c3 Input: i8042 - add Clevo PCX0DX to i8042 quirk table faed5af8a9 Input: i8042 - add TUXEDO devices to i8042 quirk tables ee77a19ee5 Input: i8042 - merge quirk tables a789c05516 Input: i8042 - move __initconst to fix code styling warning d0332cbf53 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF 5bf0010b87 usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait db3798943a usb: dwc3: qcom: enable vbus override when in OTG dr-mode fefffc7825 usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API e4650c04de iio: adc: stm32-dfsdm: fill module aliases 165511b99e net/x25: Fix to not accept on connected socket b05664e036 i2c: rk3x: fix a bunch of kernel-doc warnings d4d765f476 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress 6122ce1de1 scsi: target: core: Fix warning on RT kernels d92a25627b efi: fix potential NULL deref in efi_mem_reserve_persistent ed6c5e8caf net: openvswitch: fix flow memory leak in ovs_flow_cmd_new 743f7b51fe virtio-net: Keep stop() to follow mirror sequence of open() aed972fbf6 selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking df1213a267 selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs 6c70ece3d3 selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided d47f886d0c selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning db3f016ad5 ata: libata: Fix sata_down_spd_limit() when no link speed is reported 6950df42a0 can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate cb079b0770 net: phy: meson-gxl: Add generic dummy stubs for MMD register access db76fc535f squashfs: harden sanity check in squashfs_read_xattr_id_table dffe83a198 netfilter: br_netfilter: disable sabotage_in hook after first suppression 20355b9569 netrom: Fix use-after-free caused by accept on already connected socket 03eb2a1b03 fix "direction" argument of iov_iter_kvec() 34b0fab797 fix iov_iter_bvec() "direction" argument 50b70599c0 WRITE is "data source", not destination... 21081886de scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" 14be8b0c4e arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX d6870f3800 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() 412fddc096 ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use 79dfde344e bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() 53785fd9b3 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region e367c7b762 Merge 5.4.231 into android11-5.4-lts 59342376e8 Linux 5.4.231 268d595d4d Revert "xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()" 6c24a20223 usb: host: xhci-plat: add wakeup entry at sysfs 1c1291a84e Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt af51fc23a0 ipv6: ensure sane device mtu in tunnels a7cc1b5d76 exit: Use READ_ONCE() for all oops/warn limit reads eb768617da docs: Fix path paste-o for /sys/kernel/warn_count 6f18d28c26 panic: Expose "warn_count" to sysfs 7c1273646f panic: Introduce warn_limit 51538bdde3 panic: Consolidate open-coded panic_on_warn checks 7020a9234e exit: Allow oops_limit to be disabled 5a3482f2c1 exit: Expose "oops_count" to sysfs 28facdf7b0 exit: Put an upper limit on how often we can oops 3fa431bac2 ia64: make IA64_MCA_RECOVERY bool instead of tristate 86926761ca csky: Fix function name in csky_alignment() and die() 3bf1fa2c7b h8300: Fix build errors from do_exit() to make_task_dead() transition fcae924b94 hexagon: Fix function name in die() 49a128ae28 objtool: Add a missing comma to avoid string concatenation 9a18c9c833 exit: Add and use make_task_dead. 2f87e25512 mm: kasan: do not panic if both panic_on_warn and kasan_multishot set 119f6bcef7 panic: unset panic_on_warn inside panic() f6c20ed17e sysctl: add a new register_sysctl_init() interface dbe634ce82 dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init 1986cd616b blk-cgroup: fix missing pd_online_fn() while activating policy 4923160393 bpf: Skip task with pid=1 in send_signal_common() bd393f0ad5 ARM: dts: imx: Fix pca9547 i2c-mux node name 8667280a67 x86/asm: Fix an assembler warning with current binutils 1a5119369a clk: Fix pointer casting to prevent oops in devm_clk_release() fbf7b0e4ce perf/x86/amd: fix potential integer overflow on shift of a int f571e34005 netfilter: conntrack: unify established states for SCTP paths 8770cd9d7c x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL 4d1757f9fe block: fix and cleanup bio_check_ro 3a10a4d5d0 nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted 5246266958 Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" f7a5644129 net: mdio-mux-meson-g12a: force internal PHY off on mux switch 2635c4fd91 net: xgene: Move shared header file into include/linux a70b966c6c net/phy/mdio-i2c: Move header file to include/linux/mdio a9a022a0db net/tg3: resolve deadlock in tg3_reset_task() during EEH 92a65b0f20 thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() e249cea3ab net: ravb: Fix possible hang if RIS2_QFF1 happen a7585028ac sctp: fail if no bound addresses can be used for a given scope dae05cd371 net/sched: sch_taprio: do not schedule in taprio_reset() fe9b9e621c netrom: Fix use-after-free of a listening socket. 67ac3b4cd5 netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE 8f0eb24f1a ipv4: prevent potential spectre v1 gadget in fib_metrics_match() 746db9ec1e ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() 4cde1d2f16 netlink: annotate data races around sk_state c64bb85471 netlink: annotate data races around dst_portid and dst_group ea11a52f55 netlink: annotate data races around nlk->portid cfdd81ae47 netfilter: nft_set_rbtree: skip elements in transaction from garbage collection ddd49cbbd4 net: fix UaF in netns ops registration error path 3e5082b1c6 netlink: prevent potential spectre v1 gadgets 66e10d5f39 EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info 594618c701 EDAC/device: Respect any driver-supplied workqueue polling value a536d87ec7 ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment 768e8cdf93 thermal: intel: int340x: Protect trip temperature from concurrent updates aa33d334bd KVM: x86/vmx: Do not skip segment attributes if unusable bit is set 91be54849d cifs: Fix oops due to uncleared server->smbd_conn in reconnect bcb65adaa9 ftrace/scripts: Update the instructions for ftrace-bisect.sh 31b2414abe trace_events_hist: add check for return value of 'create_hist_field' 76b2390fdc tracing: Make sure trace_printk() can output as soon as it can be used 4a4a22dda0 module: Don't wait for GOING modules 1cd70d8427 scsi: hpsa: Fix allocation size for scsi_host_alloc() 4d55f918e1 Bluetooth: hci_sync: cancel cmd_timer if hci_open failed e588a5872d Revert "Revert "xhci: Set HCD flag to defer primary roothub registration"" 8eb5a68064 fs: reiserfs: remove useless new_opts in reiserfs_remount a61bc9197d netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state d39117d779 Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" b4253b47bf mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting 14b70b4b4a mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning 7e66f28ce5 mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci a58c144b9e lockref: stop doing cpu_relax in the cmpxchg loop d6ff82a4d7 platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK 295690bb05 platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD 890d850cb2 scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id 45b3fc9cc6 KVM: s390: interrupt: use READ_ONCE() before cmpxchg() dc0867c447 spi: spidev: remove debug messages that access spidev->spi without locking 0dfd34fb45 ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets 9e02118045 ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC 3163f4ed49 cpufreq: armada-37xx: stop using 0 as NULL pointer 1ec79234c2 s390/debug: add _ASM_S390_ prefix to header guard 1869922405 drm: Add orientation quirk for Lenovo ideapad D330-10IGL aff2bc5784 ASoC: fsl_micfil: Correct the number of steps on SX controls 1c587aa6cd cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist 8cca0afcce tcp: fix rate_app_limited to default to 1 11a4d51a4f net: dsa: microchip: ksz9477: port map correction in ALU table entry register 02a4a7dc90 driver core: Fix test_async_probe_init saves device in wrong array 276052159b w1: fix WARNING after calling w1_process() 82867190ce w1: fix deadloop in __w1_remove_master_device() c9ada35340 tcp: avoid the lookup process failing to get sk in ehash table e963b33723 dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() 9b4482267e dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling fe39e74a64 dmaengine: xilinx_dma: use devm_platform_ioremap_resource() d3065cc562 HID: betop: check shape of output reports d16b83c804 net: macb: fix PTP TX timestamp failure due to packet padding 18dd3b30d4 dmaengine: Fix double increment of client_count in dma_chan_get() cbed756bd1 drm/panfrost: fix GENERIC_ATOMIC64 dependency 914c58fec1 net: mlx5: eliminate anonymous module_init & module_exit 7335ba0c03 usb: gadget: f_fs: Ensure ep0req is dequeued before free_request a8d40942df usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait edec50677b HID: revert CHERRY_MOUSE_000C quirk efa29f4ba0 net: stmmac: fix invalid call to mdiobus_get_phy() 8c3653c4e7 HID: check empty report_list in bigben_probe() 89e7fe3999 HID: check empty report_list in hid_validate_values() 8a7b9560a3 net: mdio: validate parameter addr in mdiobus_get_phy() ce1e79bf31 net: usb: sr9700: Handle negative len 4fd6a6b101 l2tp: Don't sleep and disable BH under writer-side sk_callback_lock 7188c37f3c l2tp: Serialize access to sk_user_data with sk_callback_lock 24c7614d31 net: fix a concurrency bug in l2tp_tunnel_register() 1200388a0b net/sched: sch_taprio: fix possible use-after-free 9042a9a3f2 wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid de0e084f85 gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode 8df414fce4 net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs a59cdbda37 net: nfc: Fix use-after-free in local_cleanup() 2a05d513d2 phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() 81b3374944 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation 8b35c7f692 amd-xgbe: Delay AN timeout during KR training b85e0bb478 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent 3d41f4eeab affs: initialize fsdata in affs_truncate() 03965f8ad2 IB/hfi1: Fix expected receive setup error exit issues f5c918dc4e IB/hfi1: Reserve user expected TIDs d307c75f43 IB/hfi1: Reject a zero-length user expected buffer 902063a9fe RDMA/core: Fix ib block iterator counter overflow 048c17b619 tomoyo: fix broken dependency on *.conf.default 8d23f5d252 EDAC/highbank: Fix memory leak in highbank_mc_probe() 97445814ef HID: intel_ish-hid: Add check for ishtp_dma_tx_map 4be51ea91a ARM: imx: add missing of_node_put() 12a763015b ARM: imx35: Retrieve the IIM base address from devicetree 3b76bc1598 ARM: imx31: Retrieve the IIM base address from devicetree 61669e6dec ARM: imx27: Retrieve the SYSCTRL base address from devicetree d4e913bad2 ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' 6d7f384268 memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() 8959188b2f memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() 310268050d clk: Provide new devm_clk helpers for prepared and enabled clocks c7ef7185a1 clk: generalize devm_clk_get() a bit 46d9b30a0c Merge changes into android11-5.4-lts cc162d31ce Merge branch 'android11-5.4' into android11-5.4-lts bc37d9c8b3 Merge 5.4.230 into android11-5.4-lts 90245959a5 Linux 5.4.230 29487eed37 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma 7242fc8c2f x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN 2b1375fac0 drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix 763a74e1de drm/amd/display: Fix set scaling doesn's work 39e0844a1e drm/i915: re-disable RC6p on Sandy Bridge ffef77794f gsmi: fix null-deref in gsmi_get_variable b4461af0a5 serial: atmel: fix incorrect baudrate setup 55f9aca283 dmaengine: tegra210-adma: fix global intr clear 5d99369685 serial: pch_uart: Pass correct sg to dma_unmap_sg() 97697a252b dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation aa1b22daa0 usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 a21da7f7aa usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() 83b0aac55d usb: gadget: g_webcam: Send color matching descriptor per frame 004fbb049b usb: typec: altmodes/displayport: Fix pin assignment calculation a1478ef59b usb: typec: altmodes/displayport: Add pin assignment helper 040e0d1281 usb: host: ehci-fsl: Fix module alias 8d5740ad8f USB: serial: cp210x: add SCALANCE LPE-9000 device id 9a39f4626b USB: gadgetfs: Fix race between mounting and unmounting 1bc1fdd73f cifs: do not include page data when checking signature 89ac597e3e btrfs: fix race between quota rescan and disable leading to NULL pointer deref 61cad0c61c mmc: sunxi-mmc: Fix clock refcount imbalance during unbind 4f96ae71d3 comedi: adv_pci1760: Fix PWM instruction handling f11a689164 usb: core: hub: disable autosuspend for TI TUSB8041 556dfdb226 misc: fastrpc: Fix use-after-free race condition for maps 4b5c44e924 misc: fastrpc: Don't remove map on creater_process and device_release 04eb41ec96 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 7ebb3ecab1 USB: serial: option: add Quectel EM05CN modem 32165699a0 USB: serial: option: add Quectel EM05CN (SG) modem 81affe3b46 USB: serial: option: add Quectel EC200U modem a7c19d94b8 USB: serial: option: add Quectel EM05-G (RS) modem 5966eda550 USB: serial: option: add Quectel EM05-G (CS) modem eece7a6c97 USB: serial: option: add Quectel EM05-G (GR) modem 96b02125dd prlimit: do_prlimit needs to have a speculation check afcb4e0ab8 xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables 84e2e57769 usb: acpi: add helper to check port lpm capability using acpi _DSM 8a6e963bf2 xhci: Add a flag to disable USB3 lpm on a xhci root port level. cf6e5d3c2d xhci: Add update_hub_device override for PCI xHCI hosts 133b902378 xhci: Fix null pointer dereference when host dies 9891e5c73c usb: xhci: Check endpoint is valid before dereferencing it 643f7da782 xhci-pci: set the dma max_seg_size 890792b579 ALSA: hda/realtek - Turn on power early e60730280b drm/i915/gt: Reset twice 2e3e2649ea efi: fix userspace infinite retry read efivars after EFI runtime services page fault b0ba060d32 nilfs2: fix general protection fault in nilfs_btree_insert() 53dd833fd0 Add exception protection processing for vd in axi_chan_handle_err function 33a4d05138 wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices 557e85ff9a f2fs: let's avoid panic if extent_tree is not created 7165dd4c3b RDMA/srp: Move large values to a new enum for gcc13 19304ffb7b net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats 4de1a5af1b selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID a869f7b054 pNFS/filelayout: Fix coalescing test for single DS 931c2a07ff Revert "net: add atomic_long_t to net_device_stats fields" b1330360db Revert "PM/devfreq: governor: Add a private governor_data for governor" 68fdd20442 Merge 5.4.229 into android11-5.4-lts 1349fe3a33 Linux 5.4.229 68a37dc77e tipc: call tipc_lxc_xmit without holding node_read_lock 1140c3f7ad ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown 2db88851fa tipc: Add a missing case of TIPC_DIRECT_MSG type 38b5d7054d tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started 3188f80b80 tipc: fix use-after-free in tipc_disc_rcv() 3eeb06132d Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" ecd47ffc99 mm: Always release pages to the buddy allocator in memblock_free_late(). 5fcf75a8a4 efi: fix NULL-deref in init error path b30e5dd077 arm64: cmpxchg_double*: hazard against entire exchange variable ecdd65051b arm64: atomics: remove LL/SC trampolines f840000928 arm64: atomics: format whitespace consistently d01d6d2b06 drm/virtio: Fix GEM handle creation UAF 3030f11f27 x86/resctrl: Fix task CLOSID/RMID update race 22c4eeafc3 x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI b3f9242467 iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() ecfe33e075 iommu/mediatek-v1: Add error handle for mtk_iommu_probe ec049ae2b4 net/mlx5: Fix ptp max frequency adjustment range 62d707dabb net/mlx5: Rename ptp clock info 2b157c3c5d net/sched: act_mpls: Fix warning during failed attribute validation 9424d2205f nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() 576eadef2c hvc/xen: lock console list traversal 7d04fe153d tipc: fix unexpected link reset due to discovery messages 95b2d4889f tipc: eliminate checking netns if node established d6418829ce tipc: improve throughput between nodes in netns d443308edb regulator: da9211: Use irq handler when ready 43f48e6c30 EDAC/device: Fix period calculation in edac_device_reset_delay_period() a5b737623e x86/boot: Avoid using Intel mnemonics in AT&T syntax asm d0c6d2a310 powerpc/imc-pmu: Fix use of mutex in IRQs disabled section feefb33eef netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. e431b4fb1f ext4: fix uninititialized value in 'ext4_evict_inode' 026a4490b5 ext4: fix use-after-free in ext4_orphan_cleanup fa41a133ea ext4: lost matching-pair of trace in ext4_truncate 1d5524832f ext4: fix bug_on in __es_tree_search caused by bad quota inode 3da22d06e0 quota: Factor out setup of quota inode ecb9d0d2e1 jbd2: use the correct print format 06bb3f4e3b usb: ulpi: defer ulpi_register on ulpi_read_id timeout a2689a4464 wifi: wilc1000: sdio: fix module autoloading 3998dba0f7 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames 53cefa802f ixgbe: fix pci device refcount leak e0d6f3b62b platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe 1ad759df6a drm/msm/adreno: Make adreno quirks not overwrite each other 098416c4e3 cifs: Fix uninitialized memory read for smb311 posix symlink create d6546426cd ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list eaa5580a74 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF c6d29a5ffd net/ulp: prevent ULP without clone op from entering the LISTEN status b318d41f1b s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() f6da927c92 s390/kexec: fix ipl report address for kdump 4bf6e11c34 perf auxtrace: Fix address filter duplicate symbol selection 2e4164d3d1 docs: Fix the docs build with Sphinx 6.0 3ed183074c efi: tpm: Avoid READ_ONCE() for accessing the event log 3ad31129ce KVM: arm64: Fix S1PTW handling on RO memslots 9b83ec63d0 net: sched: disallow noqueue for qdisc classes aa52acefc6 driver core: Fix bus_type.match() error handling in __driver_attach() 8d60a90560 selftests: set the BUILD variable to absolute path cad6d2bb47 selftests: Fix kselftest O=objdir build from cluttering top level objdir 320dbbd86f parisc: Align parisc MADV_XXX constants with all other architectures d868597b71 mbcache: Avoid nesting of cache->c_list_lock under bit locks da23752d96 hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling 781fa14141 hfs/hfsplus: use WARN_ON for sanity check b47c690109 ext4: don't allow journal inode to have encrypt flag 1464feb5b6 riscv: uaccess: fix type of 0 variable on error in get_user() da41069c61 nfsd: fix handling of readdir in v4root vs. mount upcall timeout 8cbd7f2643 x86/bugs: Flush IBP in ib_prctl_set() ba780bff9f ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet e66ae100e7 udf: Fix extension of the last extent in the file 33df9c5d5e caif: fix memory leak in cfctrl_linkup_request() 3cb1ee82e4 drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() ebe6d2fcf7 usb: rndis_host: Secure rndis_query check against int overflow a07b4895b9 drivers/net/bonding/bond_3ad: return when there's no aggregator 2f7a09c1ee perf tools: Fix resources leak in perf_data__open_dir() 6b17b84634 net: sched: cbq: dont intepret cls results when asked to drop 63e469cb54 net: sched: atm: dont intepret cls results when asked to drop d16e5fefd8 RDMA/mlx5: Fix validation of max_rd_atomic caps for DC 564fdc2f8b RDMA/uverbs: Silence shiftTooManyBitsSigned warning 00616bd191 net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe 904ad95b39 net: amd-xgbe: add missed tasklet_kill a15cbe9b84 vhost: fix range used in translate_desc() d8e410315a nfc: Fix potential resource leaks 8f97eeb02a qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure 55ac68b53f net: sched: fix memory leak in tcindex_set_parms b6a0623f75 net: hns3: add interrupts re-initialization while doing VF FLR f9c551d874 nfsd: shut down the NFSv4 state objects before the filecache 7eaaee5268 bpf: pull before calling skb_postpull_rcsum() 1d449cd240 SUNRPC: ensure the matching upcall is in-flight upon downcall af53065276 ext4: fix deadlock due to mbcache entry corruption 711ef736dd mbcache: automatically delete entries from cache on freeing af8ecc8d20 ext4: fix race when reusing xattr blocks ea4b9091aa ext4: unindent codeblock in ext4_xattr_block_set() a5f9bd4bea ext4: remove EA inode entry from mbcache on inode eviction 951ea4d3df mbcache: add functions to delete entry if unused 81b0bb1eb2 mbcache: don't reclaim used entries c2f1e12b65 ext4: use kmemdup() to replace kmalloc + memcpy 6453836e37 fs: ext4: initialize fsdata in pagecache_write() 1af609646c ext4: use memcpy_to_page() in pagecache_write() 49dac5e017 mm/highmem: Lift memcpy_[to|from]_page to core f44dcd9dce ext4: correct inconsistent error msg in nojournal mode b02aa6a05a ext4: goto right label 'failed_mount3a' e0fce1d665 ravb: Fix "failed to switch device to config mode" message during unbind 0ebcfdc8c9 KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 e723bafd8f KVM: VMX: Fix the spelling of CPU_BASED_USE_TSC_OFFSETTING 7290669045 KVM: VMX: Rename NMI_PENDING to NMI_WINDOW da8ff59210 KVM: VMX: Rename INTERRUPT_PENDING to INTERRUPT_WINDOW db99c8d6b7 KVM: retpolines: x86: eliminate retpoline from vmx.c exit handlers 2c82f134b9 KVM: x86: optimize more exit handlers in vmx.c 6e3f6d9562 perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data fc67c00def perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor d06a7e2049 dm thin: resume even if in FAIL mode 28cdd90c26 media: s5p-mfc: Fix in register read and write for H264 640075400c media: s5p-mfc: Clear workbit to handle error condition 4a52a1a3ea media: s5p-mfc: Fix to handle reference queue during finishing b9275d8a92 PM/devfreq: governor: Add a private governor_data for governor 839f3ca8bc btrfs: replace strncpy() with strscpy() b5db135457 ext4: allocate extended attribute value in vmalloc area 6ef8b0a743 ext4: avoid unaccounted block allocation when expanding inode b14a553b0f ext4: initialize quota before expanding inode in setproject ioctl 9ef603086c ext4: fix inode leak in ext4_xattr_inode_create() on an error path 7138ef745e ext4: avoid BUG_ON when creating xattrs 4d84ec8e5c ext4: fix error code return to user-space in ext4_get_branch() a4c3c1d57d ext4: fix corruption when online resizing a 1K bigalloc fs 6f4200ec76 ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline f263e349ba ext4: init quota for 'old.inode' in 'ext4_rename' 78e335fb57 ext4: fix bug_on in __es_tree_search caused by bad boot loader inode 362ce137d5 ext4: fix reserved cluster accounting in __es_remove_extent() e1d946d9c8 ext4: add helper to check quota inums 2142dfa1de ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode 4690a4bdcf ext4: fix undefined behavior in bit shift for ext4_check_flag_values e347c269b5 ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop 94b283341f drm/vmwgfx: Validate the box size for the snooped cursor eea62f0461 drm/connector: send hotplug uevent on connector cleanup fbfd6dee52 device_cgroup: Roll back to original exceptions after copy failure 5e4500454d parisc: led: Fix potential null-ptr-deref in start_task() 662dc7c6be iommu/amd: Fix ivrs_acpihid cmdline parsing code 93e919d9ac crypto: n2 - add missing hash statesize a5866d531b PCI/sysfs: Fix double free in error path 65bd096299 PCI: Fix pci_device_is_present() for VFs by checking PF d23006f2a5 ipmi: fix use after free in _ipmi_destroy_user() cf19abbe4b ima: Fix a potential NULL pointer access in ima_restore_measurement_list b163363535 mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() 74531c23ad ipmi: fix long wait in unload when IPMI disconnect d4f48c648a efi: Add iMac Pro 2017 to uefi skip cert quirk 2c4832a089 md/bitmap: Fix bitmap chunk size overflow issues b869cb7a3d cifs: fix missing display of three mount options 149babe5e0 cifs: fix confusing debug message a29d621309 media: dvb-core: Fix UAF due to refcount races at releasing b21f62b49e media: dvb-core: Fix double free in dvb_register_device() 50c2379f87 ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod c42cb66a89 tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line cb03fc217b tracing/hist: Fix wrong return value in parse_action_params() f5489d5a24 x86/microcode/intel: Do not retry microcode reloading on the APs cf79d5410a tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' 1a5165e80a dm cache: set needs_check flag after aborting metadata 2f097dfac7 dm cache: Fix UAF in destroy() 520b56cfd9 dm clone: Fix UAF in clone_dtr() 792e51aac3 dm integrity: Fix UAF in dm_integrity_dtr() 7ae6aa6493 dm thin: Fix UAF in run_timer_softirq() f758987ff0 dm thin: Use last transaction's pmd->root when commit failed 200aa33b5d dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata f472bfc95d dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort 52ba5b87a3 binfmt: Fix error return code in load_elf_fdpic_binary() 33933af45d binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 3cdd91a916 cpufreq: Init completion before kobject_init_and_add() 6ccb116e6b selftests: Use optional USERCFLAGS and USERLDFLAGS 2b8f2e127d arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength b22d683c90 ARM: ux500: do not directly dereference __iomem c59ee1528b btrfs: fix resolving backrefs for inline extent followed by prealloc e63e1c6793 mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K 3de2c36283 ktest.pl minconfig: Unset configs instead of just removing them d10523afa8 kest.pl: Fix grub2 menu handling for rebooting d089baa5b6 soc: qcom: Select REMAP_MMIO for LLCC driver bcce46e115 media: stv0288: use explicitly signed char de2ea2a0ad net/af_packet: make sure to pull mac header ad3f90a9c4 net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO aa91afe597 SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails e027f3b9fa tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak 927860dfa1 tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak f1c08947ab mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING f4b5a27f56 f2fs: should put a page when checking the summary info f02d2e2b9b mm, compaction: fix fast_isolate_around() to stay within boundaries 384ef33d37 md: fix a crash in mempool_free 2dae4211b5 pnode: terminate at peers of source 25e8c6ecb4 ALSA: line6: fix stack overflow in line6_midi_transmit 10a07d81f6 ALSA: line6: correct midi status byte when receiving data from podxt 0e727c328e ovl: Use ovl mounter's fsuid and fsgid in ovl_link() cae6dddef2 hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount fe83242eab HID: plantronics: Additional PIDs for double volume key presses quirk b201fe49ee HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint 515959eb49 powerpc/rtas: avoid scheduling in rtas_os_term() c2fa91abf2 powerpc/rtas: avoid device tree lookups in rtas_os_term() 418ef921cc objtool: Fix SEGFAULT 28046827c3 nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition 24561f5d09 nvme: resync include/linux/nvme.h with nvmecli e69e8d7867 ata: ahci: Fix PCS quirk application for suspend e74d9f13a4 nvme-pci: fix doorbell buffer value endianness e8e2861cc3 cifs: fix oops during encryption 3c3baa40dc media: dvbdev: fix refcnt bug 334a76861b media: dvbdev: fix build warning due to comments 2a0e42877d gcov: add support for checksum field 328f3c084f regulator: core: fix deadlock on regulator enable fb0407d8cd iio: adc128s052: add proper .data members in adc128_of_match table bcb052a87d iio: adc: ad_sigma_delta: do not use internal iio_dev lock ad4eb32ced reiserfs: Add missing calls to reiserfs_security_free() 5a5ef1882f HID: wacom: Ensure bootloader PID is usable in hidraw mode 9e8f60094e usb: dwc3: core: defer probe on ulpi_read_id timeout 7778fa1ca8 ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list 12622fa053 ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB fad324bc07 pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES e56423bb8e pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion e8a1ccd120 ASoC: rt5670: Remove unbalanced pm_runtime_put() 737058bd0b ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() d456c253f3 ASoC: wm8994: Fix potential deadlock 2705bb1661 ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ed1376f771 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() df9cd38c3b ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() 56f630a0d5 ASoC: Intel: Skylake: Fix driver hang during shutdown fd0d3bf37d ALSA: hda: add snd_hdac_stop_streams() helper d5952155d6 ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c bdc2d33fa2 orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() 2e7c091210 orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() 511b48ee8e drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() 6c00350c9f drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() fa71639873 hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() 713ad301c2 clk: st: Fix memory leak in st_of_quadfs_setup() 0ca298d548 media: si470x: Fix use-after-free in si470x_int_in_callback() 21d26381e1 mmc: f-sdh30: Add quirks for broken timeout clock capability 5bfc53df28 regulator: core: fix use_count leakage when handling boot-on 87fd18016a blk-mq: fix possible memleak when register 'hctx' failed 17217737c1 media: dvb-usb: fix memory leak in dvb_usb_adapter_init() 6d18b44bb4 media: dvbdev: adopts refcnt to avoid UAF 438a4a8dec media: dvb-frontends: fix leak of memory fw 89357aa97b bpf: Prevent decl_tag from being referenced in func_proto arg 7da524781c ppp: associate skb with a device at tx aadb1507a7 mrp: introduce active flags to prevent UAF when applicant uninit 4bdcc6a5aa net: add atomic_long_t to net_device_stats fields 19d5a0e17a md/raid1: stop mdx_raid1 thread when raid1 array run failed 5d8d046f3d drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() 2b1b145ca1 drm/sti: Use drm_mode_copy() 272d12b5f3 drm/rockchip: Use drm_mode_copy() 20022d551f s390/lcs: Fix return type of lcs_start_xmit() 4bee3c75d5 s390/netiucv: Fix return type of netiucv_tx() e859e02fbf s390/ctcm: Fix return type of ctc{mp,}m_tx() f96bd8adc8 igb: Do not free q_vector unless new one was allocated 5b06a8a25e wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() e390838eef hamradio: baycom_epp: Fix return type of baycom_send_packet() dbe1a6b930 net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() 772431f30c bpf: make sure skb->len != 0 when redirecting to a tunneling device 9066300fe8 ipmi: fix memleak when unload ipmi driver 8234c522ef ASoC: codecs: rt298: Add quirk for KBL-R RVP platform 7360b323e0 wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ca57748593 wifi: ath9k: verify the expected usb_endpoints are present 3cc9299036 brcmfmac: return error when getting invalid max_flowrings from dongle e44bfef5bf drm/etnaviv: add missing quirks for GC300 90103ccb6e hfs: fix OOB Read in __hfs_brec_find a815a3e019 acct: fix potential integer overflow in encode_comp_t() d706485dff nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() 9ef353c92f ACPICA: Fix error code path in acpi_ds_call_control_method() 50163a1158 fs: jfs: fix shift-out-of-bounds in dbDiscardAG 156d440dea udf: Avoid double brelse() in udf_rename() 359616ce58 fs: jfs: fix shift-out-of-bounds in dbAllocAG 419b808504 binfmt_misc: fix shift-out-of-bounds in check_special_flags 3d92527a91 rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() 4f1d37ff42 net: stream: purge sk_error_queue in sk_stream_kill_queues() fbae0dc7e2 myri10ge: Fix an error handling path in myri10ge_probe() 67af8655c8 rxrpc: Fix missing unlock in rxrpc_do_sendmsg() 93e794d4fe net_sched: reject TCF_EM_SIMPLE case for complex ematch module b3a5c76f61 mailbox: zynq-ipi: fix error handling while device_register() fails 668dc454bc skbuff: Account for tail adjustment during pull operations 8b74211bf6 openvswitch: Fix flow lookup to use unmasked key 0e91836628 rtc: mxc_v2: Add missing clk_disable_unprepare() b0a6135902 r6040: Fix kmemleak in probe and remove 8bddef54cb nfc: pn533: Clear nfc_target before being used db77d4d005 mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() 82ff73638c mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() 5a35d18e79 mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() fddac3b457 nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure f06d3feee9 NFSD: Add tracepoints to NFSD's duplicate reply cache fe142d5cee nfsd: Define the file access mode enum for tracing aa5fafd4a6 rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() 686f0793f7 rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() 1240ed71a0 remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() 27441fab26 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() 292c0f3b4a pwm: sifive: Call pwm_sifive_update_clock() while mutex is held 2b7ad43574 selftests/powerpc: Fix resource leaks 39633b4051 powerpc/hv-gpci: Fix hv_gpci event list aed862896d powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() d539b77bae powerpc/perf: callchain validate kernel stack pointer bounds cfb5bbfcb6 powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() f2d60f6ba1 cxl: Fix refcount leak in cxl_calc_capp_routing 9bf842ffdd powerpc/52xx: Fix a resource leak in an error handling path b703da16dc macintosh/macio-adb: check the return value of ioremap() b29a2f1dd3 macintosh: fix possible memory leak in macio_add_one_device() 17fd440594 iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() 8581ec1feb iommu/amd: Fix pci device refcount leak in ppr_notifier() 0d96a6f5db rtc: pcf85063: Fix reading alarm bb1bdc72dd rtc: snvs: Allow a time difference on clock register read 6a54d03337 include/uapi/linux/swab: Fix potentially missing __always_inline f170d4bd38 RDMA/siw: Fix pointer cast warning 8ea68b4e3f power: supply: fix null pointer dereferencing in power_supply_get_battery_info 61e80e7929 HSI: omap_ssi_core: Fix error handling in ssi_init() 7ae85631ae perf symbol: correction while adjusting symbol 739b4294f8 perf trace: Handle failure when trace point folder is missed 1b4053ad54 perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number 443aaf605f perf trace: Add a strtoul() method to 'struct syscall_arg_fmt' 339e08e185 perf trace: Allow associating scnprintf routines with well known arg names 97cc27a28d perf trace: Add the syscall_arg_fmt pointer to syscall_arg a2fcb44f5e perf trace: Factor out the initialization of syscal_arg_fmt->scnprintf ba67de37ad perf trace: Separate 'struct syscall_fmt' definition from syscall_fmts variable 6086919d8c perf trace: Return error if a system call doesn't exist f84fff700d power: supply: fix residue sysfs file in error handle route of __power_supply_register() ef87ed9add HSI: omap_ssi_core: fix possible memory leak in ssi_probe() e9a32f7523 HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() 0f049375ad fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() 3c9aaa58f7 fbdev: vermilion: decrease reference count in error path 9413f188ef fbdev: via: Fix error in via_core_init() 65dbd8eefa fbdev: pm2fb: fix missing pci_disable_device() 77738055e2 fbdev: ssd1307fb: Drop optional dependency 72c8770e35 samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() 19b651db94 tracing/hist: Fix issue of losting command info in error_log fab2536ba1 usb: storage: Add check for kcalloc cdcbae2c50 i2c: ismt: Fix an out-of-bounds bug in ismt_access() f3f65c4177 vme: Fix error not catched in fake_init() e5c97a433c staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() 288ada16a9 staging: rtl8192u: Fix use after free in ieee80211_rx() c226717aa8 i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe d85b5247a7 chardev: fix error handling in cdev_device_add() 110dc34c9f mcb: mcb-parse: fix error handing in chameleon_parse_gdd() 68e54d9ee8 drivers: mcb: fix resource leak in mcb_probe() 80dc47e751 usb: gadget: f_hid: fix refcount leak on error path c78c87c4e3 usb: gadget: f_hid: fix f_hidg lifetime vs cdev efa2ed93e5 usb: gadget: f_hid: optional SETUP/SET_REPORT mode 5e193764c2 usb: roles: fix of node refcount leak in usb_role_switch_is_parent() 76740fd8c6 counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update 361412dae1 cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() 60b2ed21a6 cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() 0078dd8758 misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os ee2715faf7 misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() 0cd0506237 misc: ocxl: fix possible name leak in ocxl_file_register_afu() 628de998a3 test_firmware: fix memory leak in test_firmware_init() 98c01a728b serial: sunsab: Fix error handling in sunsab_init() 61f4146a7e serial: altera_uart: fix locking in polling mode ce40c44e62 tty: serial: altera_uart_{r,t}x_chars() need only uart_port 071bb9e363 tty: serial: clean up stop-tx part in altera_uart_tx_chars() d165388227 serial: pch: Fix PCI device refcount leak in pch_request_dma() 06c886548c serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. 965f07ea5f serial: amba-pl011: avoid SBSA UART accessing DMACR register 4f257e2eba usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() af4049a2ff usb: typec: Check for ops->exit instead of ops->enter in altmode_exit a45ba33d39 staging: vme_user: Fix possible UAF in tsi148_dma_list_add 90e227d8b4 usb: fotg210-udc: Fix ages old endianness issues 12d20ba3ce uio: uio_dmem_genirq: Fix deadlock between irq config and handling eca77a25a7 uio: uio_dmem_genirq: Fix missing unlock in irq configuration c2163ecc48 vfio: platform: Do not pass return buffer to ACPI _RST method 3e0efc3f3f class: fix possible memory leak in __class_register() 0c44f584e3 serial: tegra: Read DMA status before terminating dcb26ea75d tty: serial: tegra: Activate RX DMA transfer by request da64e01da4 drivers: dio: fix possible memory leak in dio_init() d4bf3fcccd IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces 5cc818ad53 hwrng: geode - Fix PCI device refcount leak 1199f8e029 hwrng: amd - Fix PCI device refcount leak c75ea343e4 crypto: img-hash - Fix variable dereferenced before check 'hdev->req' 76a9a58a71 orangefs: Fix sysfs not cleanup when dev init failed 5a2028369d RDMA/hfi1: Fix error return code in parse_platform_config() 7917484c99 crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() c21a09ed1e f2fs: avoid victim selection from previous victim section 91f63dd622 RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() 6866154c23 scsi: snic: Fix possible UAF in snic_tgt_create() be5f1a82ad scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails eccbec017c scsi: ipr: Fix WARNING in ipr_init() c9f83544fb scsi: fcoe: Fix possible name leak when device_register() fails 3c4bb9446d scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() 6fac40d806 scsi: hpsa: Fix error handling in hpsa_add_sas_host() d60000cb11 scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() 89e3f7324a crypto: tcrypt - Fix multibuffer skcipher speed test mem leak f8fc2f1865 scsi: hpsa: Fix possible memory leak in hpsa_init_one() bd7106a600 RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed a36c929fd7 crypto: ccree - Make cc_debugfs_global_fini() available for module init function 895bbed5ae RDMA/hfi: Decrease PCI device reference count in error path 7e68c0d095 PCI: Check for alloc failure in pci_request_irq() a234815cee crypto: ccree - Remove debugfs when platform_driver_register failed ca438aa466 crypto: ccree - swap SHA384 and SHA512 larval hashes at build time 263d21afba scsi: scsi_debug: Fix a warning in resp_write_scat() b5848661f1 RDMA/siw: Set defined status for work completion with undefined status ad1676587c RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port 6af043089d RDMA/siw: Fix immediate work request flush to completion queue ef6079d98f f2fs: fix normal discard process 7826e4c85e RDMA/core: Fix order of nldev_exit call 3339d808b6 apparmor: Use pointer to struct aa_label for lbs_cred f7368ac846 apparmor: Fix abi check to include v8 abi e1a68ac015 apparmor: fix lockdep warning when removing a namespace eb0f78e28c apparmor: fix a memleak in multi_transaction_new() df121012e4 stmmac: fix potential division by 0 203d604bd5 Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() 5e832e0182 Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() 8ae86c1ec2 Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() f360585691 Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() 78e76830c7 Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() b38b064cba Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() f6d822ce4b Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() a6b9e09403 ntb_netdev: Use dev_kfree_skb_any() in interrupt context 3f2946a54b net: lan9303: Fix read error execution path 7d67e8ccfc can: tcan4x5x: Remove invalid write in clear_interrupts 068672e75b net: amd-xgbe: Check only the minimum speed for active/passive cables 291b9669f6 net: amd-xgbe: Fix logic around active and passive cables bc06c239d5 net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() 1e39d57a0e hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() 20dd873605 net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() 3b748ba07b net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() 4b8256d9bf net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() bc51a3cadf net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() 303000c793 net/tunnel: wait until all sk_user_data reader finish before releasing the sock 0c5f2c7700 net: farsync: Fix kmemleak when rmmods farsync cf7416aa01 ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() 9ec5781879 of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() a44490abaf drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() 429370c40d net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() bba527e4ec net: defxx: Fix missing err handling in dfx_init() f54731a70c net: vmw_vsock: vmci: Check memcpy_from_msg() 6f2198914f clk: socfpga: Fix memory leak in socfpga_gate_init() dbd1a4fdf5 clk: socfpga: use clk_hw_register for a5/c5 49513eabda clk: socfpga: clk-pll: Remove unused variable 'rc' fe783eeac4 blktrace: Fix output non-blktrace event when blk_classic option enabled d628d5c5b4 wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() 1a49bba59d wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h 9e8440a657 spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode a00b4e0fa2 clk: samsung: Fix memory leak in _samsung_clk_register_pll() 7a2c66429b media: coda: Add check for kmalloc 2b436f1410 media: coda: Add check for dcoda_iram_alloc 6250bc7331 media: c8sectpfe: Add of_node_put() when breaking out of loop 0fcee27507 mmc: mmci: fix return value check of mmc_add_host() 0a41ea4fd4 mmc: wbsd: fix return value check of mmc_add_host() f59ef2a47a mmc: via-sdmmc: fix return value check of mmc_add_host() 9e11c6bb74 mmc: meson-gx: fix return value check of mmc_add_host() f153c9e15f mmc: omap_hsmmc: fix return value check of mmc_add_host() 6bb26abb92 mmc: atmel-mci: fix return value check of mmc_add_host() c7a328cea7 mmc: wmt-sdmmc: fix return value check of mmc_add_host() 3b29f8769d mmc: vub300: fix return value check of mmc_add_host() 3dbb69a024 mmc: toshsd: fix return value check of mmc_add_host() 937112e991 mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() 0b7b634225 mmc: pxamci: fix return value check of mmc_add_host() 32eb502c97 mmc: mxcmmc: fix return value check of mmc_add_host() b174f2b36c mmc: moxart: fix return value check of mmc_add_host() 289c964fe1 mmc: alcor: fix return value check of mmc_add_host() e8f20523cf NFSv4.x: Fail client initialisation if state manager thread can't run f7a8a1e36d SUNRPC: Fix missing release socket in rpc_sockname() bcebcb11fc xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() c7e9624d90 ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt 6a8c0abcb5 media: saa7164: fix missing pci_disable_device() 4cabc3af4a bpf, sockmap: fix race in sock_map_free() 35593d60b1 regulator: core: fix resource leak in regulator_register() 90c38f57a8 configfs: fix possible memory leak in configfs_create_dir() 6dea95f640 hsr: Avoid double remove of a node. de7dbee4bd clk: qcom: clk-krait: fix wrong div2 functions 339ba693da regulator: core: fix module refcount leak in set_supply() 46dfff9102 wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails 624a989db9 spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE 52fb0ffee0 bonding: uninitialized variable in bond_miimon_inspect() 31631c2ab4 bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect 7508b9f4da bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data d4145d028a netfilter: conntrack: set icmpv6 redirects as RELATED 27c09443dd ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe 981024abf5 drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() 470a779890 drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() 190685ff4e ASoC: mediatek: mt8173: Enable IRQ when pdata is ready 0e1e311fd9 wifi: iwlwifi: mvm: fix double free on tx path. 8b0c003e37 ALSA: asihpi: fix missing pci_disable_device() 5447f1ad0b NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn e53a7c28a4 NFSv4.2: Fix initialisation of struct nfs4_label b2b472bcda NFSv4.2: Fix a memory stomp in decode_attr_security_label 96f3c70600 NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding 2672977dc0 ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd d63e9eca94 ASoC: dt-bindings: wcd9335: fix reset line polarity in example 4ea79d0747 drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() 542a87f1cf media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC 8b256d2336 media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() 9103bf2187 media: dvb-core: Fix ignored return value in dvb_register_frontend() 3359f8d533 pinctrl: pinconf-generic: add missing of_node_put() ffd53b7892 clk: imx: replace osc_hdmi with dummy aa79b53df7 clk: imx8mn: correct the usb1_ctrl parent to be usb_bus 1d8521e112 media: imon: fix a race condition in send_packet() cf9c4c25ca mtd: maps: pxa2xx-flash: fix memory leak in probe a7fc25159d bonding: fix link recovery in mode 2 when updelay is nonzero 0879f594a7 bonding: Rename slave_arr to usable_slaves 9eaeb3e460 bonding: Export skip slave logic to function 26b94635f1 clk: rockchip: Fix memory leak in rockchip_clk_register_pll() 96be283d10 regulator: core: use kfree_const() to free space conditionally d884ed9a2f ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT 497279199d ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT e6364854f5 HID: hid-sensor-custom: set fixed size for custom attributes 75a5bf8eeb bpf: Move skb->len == 0 checks into __bpf_redirect 61688b8819 media: videobuf-dma-contig: use dma_mmap_coherent 9ca9d7fd7d media: platform: exynos4-is: Fix error handling in fimc_md_init() 7b02c50d39 media: solo6x10: fix possible memory leak in solo_sysfs_init() f81f63168f Input: elants_i2c - properly handle the reset GPIO when power is off 8eb64dc5a7 mtd: lpddr2_nvm: Fix possible null-ptr-deref 8e51f5894d wifi: ath10k: Fix return value in ath10k_pci_init() 8176538866 ima: Fix misuse of dereference of pointer in template_desc_init_fields() 9b7c44885a integrity: Fix memory leakage in keyring allocation error path 4d3dc0de9c amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() d39937f8de regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() a8baccb79d ASoC: pxa: fix null-pointer dereference in filter() 6f13a895ce drm/mediatek: Modify dpi power on/off sequence. a0f26560be drm/radeon: Add the missed acpi_put_table() to fix memory leak 832d0e19ce rxrpc: Fix ack.bufferSize to be 0 when generating an ack c9c9350d30 net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() fe443b3fe3 media: camss: Clean up received buffers on failed start of streaming 08114dc185 wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port fa0d32ab84 mtd: Fix device name leak when register device failed in add_mtd_device() d70fa0a6ce bpf: propagate precision in ALU/ALU64 operations 54f2599060 media: vivid: fix compose size exceed boundary 38d48fd224 ima: Handle -ESTALE returned by ima_filter_rule_match() ecd0a6f81a ima: Fix fall-through warnings for Clang 55e2430e43 ima: Rename internal filter rule functions 0b7c47b7f3 drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure 3fcdc1534b spi: Update reference to struct spi_controller d87dd4528d clk: renesas: r9a06g032: Repair grave increment error a2046e5a36 can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming 7482f95315 can: kvaser_usb: Add struct kvaser_usb_busparams f3d20de76f can: kvaser_usb_leaf: Fix bogus restart events ad63992b64 can: kvaser_usb_leaf: Fix wrong CAN state after stopping 9208795770 can: kvaser_usb_leaf: Fix improved state not being reported 60ad08be78 can: kvaser_usb_leaf: Set Warning state even without bus errors 12d95e65f7 can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT 5779a9d0e3 can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event 0e56748852 can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device 3a9d74f339 can: kvaser_usb: do not increase tx statistics when sending error message frames 3f2384f09b media: i2c: ad5820: Fix error path e8e2da03c2 pata_ipx4xx_cf: Fix unsigned comparison with less than zero 5994e7a806 wifi: rtl8xxxu: Fix reading the vendor of combo chips 988bd27de2 wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() 9850791d38 wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() bb7397f631 rapidio: devices: fix missing put_device in mport_cdev_open 6a95b17e4d hfs: Fix OOB Write in hfs_asc2mac 657fea0a8d relay: fix type mismatch when allocating memory in relay_create_buf() e275249e5e eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD 311b488405 rapidio: fix possible UAF when kfifo_alloc() fails 7aa5325e1b fs: sysv: Fix sysv_nblocks() returns wrong value cb5859603c MIPS: OCTEON: warn only once if deprecated link status is being used b7ca75207e MIPS: BCM63xx: Add check for NULL for clk in clk_enable 14bb4bde3b platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() 11ad95912b PM: runtime: Do not call __rpm_callback() from rpm_idle() c40ee4e04b PM: runtime: Improve path in rpm_idle() when no callback 4f983ee5e5 xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() 29198f667f x86/xen: Fix memory leak in xen_init_lock_cpu() ec88254208 x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() 6e98158d97 xen/events: only register debug interrupt for 2-level events 314d510535 uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix dfdde4d513 ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() 805665aa52 clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled 1bbad5793f rapidio: rio: fix possible name leak in rio_register_mport() 440afd7fd9 rapidio: fix possible name leaks when rio_add_device() fails 7ef516888c ocfs2: fix memory leak in ocfs2_mount_volume() a4d3062f0a ocfs2: rewrite error handling of ocfs2_fill_super 227cc62e00 ocfs2: ocfs2_mount_volume does cleanup job before return error 5c27b46c20 debugfs: fix error when writing negative value to atomic_t debugfs file c7bd49275d docs: fault-injection: fix non-working usage of negative values 6865a549f2 lib/notifier-error-inject: fix error when writing -errno to debugfs file 6fc6461672 libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value 75940697c0 cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() d25bf9af86 genirq/irqdesc: Don't try to remove non-existing sysfs files b4e28099cd nfsd: don't call nfsd_file_put from client states seqfile display e6e295a434 EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() d5c06dba46 irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() e293263248 perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() 81b024df47 PNP: fix name memory leak in pnp_alloc_dev() 821afb8c89 selftests/efivarfs: Add checking of the test return value c0b8cff014 MIPS: vpe-cmp: fix possible memory leak while module exiting b3325a4435 MIPS: vpe-mt: fix possible memory leak while module exiting 7c8bf45cea ocfs2: fix memory leak in ocfs2_stack_glue_init() e039929e36 lib/fonts: fix undefined behavior in bit shift for get_default_font 160d6d6f14 proc: fixup uptime selftest d7b9e43a5c timerqueue: Use rb_entry_safe() in timerqueue_getnext() 248fa44cde perf: Fix possible memleak in pmu_dev_alloc() 044ede4c38 selftests/ftrace: event_triggers: wait longer for test_event_enable 8511186f10 fs: don't audit the capability check in simple_xattr_list() c907c55dc7 PM: hibernate: Fix mistake in kerneldoc comment f0ff6c60bc alpha: fix syscall entry in !AUDUT_SYSCALL case 1399ce344e cpuidle: dt: Return the correct numbers of parsed idle states 082b55fe9f tpm/tpm_crb: Fix error message in __crb_relinquish_locality() 4d3126f242 pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP e2516652da ARM: mmp: fix timer_read delay 2de791ff6f pstore/ram: Fix error return code in ramoops_probe() ded1b82716 arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC 03a666631a ARM: dts: turris-omnia: Add switch port 6 node fe1fc4d84d ARM: dts: turris-omnia: Add ethernet aliases b20454ea05 ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port 1b7017211e ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port 87b951b7c2 ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port e3cf3f7a6d ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port e302758caf ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port 0a8544b723 ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port f707c3fee2 arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name fdf511fc07 arm64: dts: mt2712-evb: Fix usb vbus regulators unit names 06fbfc5f43 arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names f0c1f46e49 arm64: dts: mt2712e: Fix unit address for pinctrl node aaabd7e3e4 arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators d69bdb61d5 perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() af2256d778 perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() 1e9186d628 soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe 83cfc38091 soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe 5f07c85ca1 soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync f5c521195e arm: dts: spear600: Fix clcd interrupt 3a90edbab8 drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static 3459e05ad3 arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias 6a24277840 ARM: dts: qcom: apq8064: fix coresight compatible 1a19212a71 usb: musb: remove extra check in musb_gadget_vbus_draw 40075e7975 net: loopback: use NET_NAME_PREDICTABLE for name_assign_type 9fdc79b571 Bluetooth: L2CAP: Fix u8 overflow 77d5e6f260 HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk c05a7fa010 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 d535a33e83 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E 7346b2529f HID: ite: Add support for Acer S1002 keyboard-dock 2d91b7a0b0 xen-netback: move removal of "hotplug-status" to the right place c581439a97 igb: Initialize mailbox message for VF reset 50aa193a4b USB: serial: f81534: fix division by zero on line-speed change 0d6bf63eb3 USB: serial: f81232: fix division by zero on line-speed change fe0f214385 USB: serial: cp210x: add Kamstrup RF sniffer PIDs d487670654 USB: serial: option: add Quectel EM05-G modem b8fb1cba93 usb: gadget: uvc: Prevent buffer overflow in setup handler 2610c2e59c udf: Fix extending file within last block ade1726d8c udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size 4d835efd56 udf: Fix preallocation discarding at indirect extent boundary 0905c78f62 udf: Discard preallocation before extending file with a hole 0758b50692 tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS e1d491fcbf ANDROID: Add more hvc devices for virtio-console. 92a0ce5d0a Merge 5.4.228 into android11-5.4-lts 6429852aef Revert "can: af_can: fix NULL pointer dereference in can_rcv_filter" 4ae923b7c6 Merge 5.4.227 into android11-5.4-lts 57e53c3fa3 ANDROID: Revert "tracing/ring-buffer: Have polling block on watermark" 851c2b5fb7 Linux 5.4.228 ff484a9ba4 ASoC: ops: Correct bounds check for second channel on SX controls 7d4aa09299 can: mcba_usb: Fix termination command argument f843fdcac0 can: sja1000: fix size of OCR_MODE_MASK define b439b12d10 pinctrl: meditatek: Startup with the IRQs disabled 9796d07c75 ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() 3c837460f9 nfp: fix use-after-free in area_cache_get() a40c3c9ae5 block: unhash blkdev part inode when the part is deleted 176ba4c19d mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page 69d4f3baa6 x86/smpboot: Move rcu_cpu_starting() earlier d1988bf2bb net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head 66bb2e2b24 Linux 5.4.227 898270ec11 can: esd_usb: Allow REC and TEC to return to zero 08bf219d62 net: mvneta: Fix an out of bounds check 6b6d3be366 ipv6: avoid use-after-free in ip6_fragment() f73eb3fc9b net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() f0af234e2e xen/netback: fix build warning 99669d94ce ethernet: aeroflex: fix potential skb leak in greth_init_rings() 3295582cd7 ipv4: Fix incorrect route flushing when table ID 0 is used 2537b637ea ipv4: Fix incorrect route flushing when source address is deleted 36eedb9a05 tipc: Fix potential OOB in tipc_link_proto_rcv() 1b6360a093 net: hisilicon: Fix potential use-after-free in hix5hd2_rx() e71a46cc8c net: hisilicon: Fix potential use-after-free in hisi_femac_rx() 7081cf86e1 net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq bc06207b4c net: stmmac: fix "snps,axi-config" node property parsing 7fab7add08 nvme initialize core quirks before calling nvme_init_subsystem 6778434706 NFC: nci: Bounds check struct nfc_target arrays e5292711b0 i40e: Disallow ip4 and ip6 l4_4_bytes 9337d87da4 i40e: Fix for VF MAC address 0 a1e295517b i40e: Fix not setting default xps_cpus after reset eec1fc21ed net: mvneta: Prevent out of bounds read in mvneta_config_rss() ed773dd798 xen-netfront: Fix NULL sring after live migration 18e10a9e0e net: encx24j600: Fix invalid logic in reading of MISTAT register 1356c17758 net: encx24j600: Add parentheses to fix precedence 1831d45404 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 8fb4b50f54 selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload 0834d4b121 net: dsa: ksz: Check return value 2c6cf0afc3 Bluetooth: Fix not cleanup led when bt_init fails 07ea5d74fc Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() c66d78aee5 af_unix: Get user_ns from in_skb in unix_diag_get_exact(). 9d2ee8abf1 igb: Allocate MSI-X vector when testing cff8ba243f e1000e: Fix TX dispatch condition 48bd5d3801 gpio: amd8111: Fix PCI device reference count leak d2be7ba2d4 drm/bridge: ti-sn65dsi86: Fix output polarity setting bug e2e2181772 ca8210: Fix crash by zero initializing data efbca8234a ieee802154: cc2520: Fix error return code in cc2520_hw_init() 3982652957 can: af_can: fix NULL pointer dereference in can_rcv_filter db1ed1b3fb HID: core: fix shift-out-of-bounds in hid_report_raw_event 60bce926a8 HID: hid-lg4ff: Add check for empty lbuf 625814b85f HID: usbhid: Add ALWAYS_POLL quirk for some mice 585a07b820 drm/shmem-helper: Remove errant put in error path b8419d16f4 KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field 04edfa3dc0 mm/gup: fix gup_pud_range() for dax 35963b3182 memcg: fix possible use-after-free in memcg_write_event_control() 4afc77068e media: v4l2-dv-timings.c: fix too strict blanking sanity checks 91516ba54a Revert "net: dsa: b53: Fix valid setting for MDB entries" 50e1ab7e63 xen/netback: don't call kfree_skb() with interrupts disabled 6b1d47f9c3 xen/netback: do some code cleanup 8fe1bf6f32 xen/netback: Ensure protocol headers don't fall in the non-linear area 5ffc2a7553 mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths 48b00ceb54 mm/khugepaged: fix GUP-fast interaction by sending IPI 324abbd8b9 mm/khugepaged: take the right locks for page table retraction b2963819d0 net: usb: qmi_wwan: add u-blox 0x1342 composition e35c3ad0c2 9p/xen: check logical size for buffer size 9d5126b574 fbcon: Use kzalloc() in fbcon_prepare_logo() 102459222d regulator: twl6030: fix get status of twl6032 regulators f2ba66d873 ASoC: soc-pcm: Add NULL check in BE reparenting 3b2c064a8e btrfs: send: avoid unaligned encoded writes when attempting to clone range 63badfed20 ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event 8d16d3826f regulator: slg51000: Wait after asserting CS pin 9327a9c624 9p/fd: Use P9_HDRSZ for header size 671f950d17 ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 2c2c5d1d10 ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation 29917e381e ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels 3f39d53bc7 ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name 135fcc4581 ARM: dts: rockchip: fix ir-receiver node names 368f2c2640 arm: dts: rockchip: fix node name for hym8563 rtc 4b346f07f0 arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series Change-Id: I0cec2e1f212747f2f82af4006b2b2c19daa97369 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-23 09:12:29 +00:00
Greg Kroah-Hartman	1e58c0c8e9	This is the 5.4.238 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQa9GUACgkQONu9yGCS aT7WQQ/6A3UoCjvRNAyt6E9eLZtioHQEc3Nrep18tkkMQFTEyv3EMrmS8GWuvwYm n+gsDDzJS+v1irMQnaUm3hBsD5Iji52fwr3FL3ec2cZsLt0ulHFdH+xDakLXV+oe Zs40Hpuf5hLIPpEOi0xsSRHtMQeKRUyeAxw6qHzok3oVPI//vh5VawjpLN4mNYwx EXht4BDpV8A07Qn1SmX91qmfyn6ZLfsyOwGPZPfmL5L57SgAQVHVcKbwLZBcWKaa XCc3oGvVGAUX/93hZzWEGtELYUzjWNK8THX+OdkvFwGqP/JCjx602qtBS52znG76 2cNBIiAzpi115yEFS4xlAEVUHXUNFWJ3duDgYpBuQJX57QuA8SEOLYeycFlZYEMp iIxGUfhnXmn4nSZNNvLKjWv+wyW33tHfBIp8CEdTKizLeL6r9H5Z1yExJE4xGWhJ hpg+qbqHvvcCJ2Yk1qKST3VxoCCHNM3X94nopyrPkRFpUMzzd+lwUiqZSGe6nzVk k/B0Xr/JqWuCc7p9DguwC5yKJNNAKQeL+0vAR/2isE/WM4b26wIwbrECOwLv1Epq ClBNORLmiVgM+lG2LgMJkKxvoIwTtelzGpD6Ybg3MeubJbFoAta9QBLVTuCKVuze VRUbVE4E7jotAOmqp6qdM9r89tAE68laayY82wOFxS6X/T5AaZk= =wski -----END PGP SIGNATURE----- Merge 5.4.238 into android11-5.4-lts Changes in 5.4.238 ext4: fix cgroup writeback accounting with fs-layer encryption xfrm: Allow transport-mode states with AF_UNSPEC selector drm/panfrost: Don't sync rpm suspension after mmu flushing cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() ALSA: hda - add Intel DG1 PCI and HDMI ids ALSA: hda - controller is in GPU on the DG1 ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Fix a comment in function scsi_host_dev_release() scsi: core: Fix a procfs host directory removal regression tcp: tcp_make_synack() can be called from process context nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode qed/qed_dev: guard against a possible division by zero net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition net: usb: smsc75xx: Limit packet length to skb->len nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net/iucv: Fix size of interrupt data ethernet: sun: add check for the mdesc_grab() hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command jffs2: correct logic when creating a hole in jffs2_write_begin ext4: fail ext4_iget if special inode unallocated ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access sh: intc: Avoid spurious sizeof-pointer-div warning ext4: fix possible double unlock when moving a directory tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted interconnect: fix mem leak when freeing nodes tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something KVM: nVMX: add missing consistency checks for CR0 and CR4 ftrace: Fix invalid address access in lookup_rec() when index is 0 fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks x86/mm: Fix use of uninitialized buffer in sme_enable() drm/i915: Don't use stolen memory for ring buffers with LLC serial: 8250_em: Fix UART port type s390/ipl: add missing intersection check to ipl_report handling PCI: Unify delay handling for reset and resume HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own Linux 5.4.238 Change-Id: I29d1460644a834fba41654b94a3bb35551976001 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-22 20:18:40 +00:00
Chen Zhongjin	ac58b88ccb	ftrace: Fix invalid address access in lookup_rec() when index is 0 ... commit ee92fa443358f4fc0017c1d0d325c27b37802504 upstream. KASAN reported follow problem: BUG: KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modprobe CPU: 2 Comm: modprobe Call trace: kasan_report __asan_load8 lookup_rec ftrace_location arch_check_ftrace_location check_kprobe_address_safe register_kprobe When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a pg which is newly added to ftrace_pages_start in ftrace_process_locs(). Before the first pg->index++, index is 0 and accessing pg->records[-1].ip will cause this problem. Don't check the ip when pg->index is 0. Link: https://lore.kernel.org/linux-trace-kernel/20230309080230.36064-1-chenzhongjin@huawei.com Cc: stable@vger.kernel.org Fixes: 9644302e33 ("ftrace: Speed up search by skipping pages by address") Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:28:09 +01:00
Steven Rostedt (Google)	780f69a268	tracing: Check field value in hist_field_name() ... commit 9f116f76fa8c04c81aef33ad870dbf9a158e5b70 upstream. The function hist_field_name() cannot handle being passed a NULL field parameter. It should never be NULL, but due to a previous bug, NULL was passed to the function and the kernel crashed due to a NULL dereference. Mark Rutland reported this to me on IRC. The bug was fixed, but to prevent future bugs from crashing the kernel, check the field and add a WARN_ON() if it is NULL. Link: https://lkml.kernel.org/r/20230302020810.762384440@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Reported-by: Mark Rutland <mark.rutland@arm.com> Fixes: c6afad49d1 ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers") Tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:28:08 +01:00
Greg Kroah-Hartman	812963276d	This is the 5.4.237 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQUF8AACgkQONu9yGCS aT7Ivg/9HDcZ73/ntBZYD5TCbUl8yEEFqaqhb6vBdzC/Uba8CJNgeM91ti0GB0x0 Zue4GNrlP7NQzYV+E9pnTXxagAKxtQfZJc/kJmBbbpXgisJWJlgQ4aqtoRoXnCE1 1NwRVQlyVjmPG/AvU7p1jGUdw6Or/OEhMz+kN89XtUiAI2uCuPxM7W02zWxCZtQy EHonZ4nqhE6mQpAvYpwJ9x11hnAmnJNMOJQI+S/aL6M2geZ6lIblOG7+D8F4Vbz6 nsNQ9LguJ89ffuZe7W3kXvLwqDBZingURxh4r70hNwcmDSNw0o3VpDfL+znUmixw g1TfuFR4zBp4vB9WOFQBlZs7XQUE+InQXm79CL62l5b01JgvoGxPBwguBsjyuBJI 9b/bWOcgRsDNKjLwhql3yj8SIN5a7csjofN5BqsZqihXSdoKc1mmHQHzf8NzS+HU 5juQGDtvFGqXj6L0N/PDTBH8cOhjqyao+1FPdIWlL1XNI0XekCVncakrx0HNxiPv YTXnETEIf13bfIjY88UcoigGTz/4rULO2G2ykwZQdP+F+r3U1BFHaxM9nd7aQaS6 LoabYP/mlIoYUN/Kc0FI+Pp6052+IU70LFAm0urYqJ7RBvRolWn/arpK2PbXdVO4 Z5D2fGuX/E5ZCBm4l5PSIQgfOEdRqQr9roIN0tfVjSQn6y+n3ww= =nqJu -----END PGP SIGNATURE----- Merge 5.4.237 into android11-5.4-lts Changes in 5.4.237 fs: prevent out-of-bounds array speculation when closing a file descriptor x86/CPU/AMD: Disable XSAVES on AMD family 0x17 drm/connector: print max_requested_bpc in state debugfs ext4: fix RENAME_WHITEOUT handling for inline directories ext4: fix another off-by-one fsmap error on 1k block filesystems ext4: move where set the MAY_INLINE_DATA flag is set ext4: fix WARNING in ext4_update_inline_data ext4: zero i_disksize when initializing the bootloader inode nfc: change order inside nfc_se_io error path iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter ipmi:ssif: make ssif_i2c_send() void ipmi:ssif: resend_msg() cannot fail ipmi:ssif: Remove rtc_us_timer ipmi:ssif: Increase the message retry time ipmi:ssif: Add a timer between request retries irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent irqdomain: Fix domain registration race iommu/vt-d: Fix PASID directory pointer coherency SMB3: Backup intent flag missing from some more ops cifs: Fix uninitialized memory read in smb3_qfs_tcon() scsi: core: Remove the /proc/scsi/${proc_name} directory earlier ext4: Fix possible corruption when moving a directory drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() selftests: nft_nat: ensuring the listening side is up before starting the client net: usb: lan78xx: Remove lots of set but unused 'ret' variables net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver net: caif: Fix use-after-free in cfusbl_device_notify() bnxt_en: Avoid order-5 memory allocation for TPA data netfilter: tproxy: fix deadlock due to missing BH disable btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR scsi: megaraid_sas: Update max supported LD IDs to 240 net/smc: fix fallback failed while sendmsg with fastopen riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode ext4: Fix deadlock during directory rename MIPS: Fix a compilation issue alpha: fix R_ALPHA_LITERAL reloc for large modules macintosh: windfarm: Use unsigned type for 1-bit bitfields PCI: Add SolidRun vendor ID media: ov5640: Fix analogue gain control ipmi/watchdog: replace atomic_add() and atomic_sub() ipmi:watchdog: Set panic count to proper value on a panic drm/i915: Don't use BAR mappings for ring buffers with LLC x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS arch: fix broken BuildID for arm64 and riscv powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 sh: define RUNTIME_DISCARD_EXIT UML: define RUNTIME_DISCARD_EXIT s390/dasd: add missing discipline function Linux 5.4.237 Change-Id: Ic3637e3e33d2e4e109773803306c3941219152d7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-22 10:04:49 +00:00
Lorenz Bauer	d800996fcf	btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR ... [ Upstream commit 9b459804ff9973e173fabafba2a1319f771e85fa ] btf_datasec_resolve contains a bug that causes the following BTF to fail loading: [1] DATASEC a size=2 vlen=2 type_id=4 offset=0 size=1 type_id=7 offset=1 size=1 [2] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) [3] PTR (anon) type_id=2 [4] VAR a type_id=3 linkage=0 [5] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) [6] TYPEDEF td type_id=5 [7] VAR b type_id=6 linkage=0 This error message is printed during btf_check_all_types: [1] DATASEC a size=2 vlen=2 type_id=7 offset=1 size=1 Invalid type By tracing btf_*_resolve we can pinpoint the problem: btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_TBD) = 0 btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_TBD) = 0 btf_ptr_resolve(depth: 3, type_id: 3, mode: RESOLVE_PTR) = 0 btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_PTR) = 0 btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_PTR) = -22 The last invocation of btf_datasec_resolve should invoke btf_var_resolve by means of env_stack_push, instead it returns EINVAL. The reason is that env_stack_push is never executed for the second VAR. if (!env_type_is_resolve_sink(env, var_type) && !env_type_is_resolved(env, var_type_id)) { env_stack_set_next_member(env, i + 1); return env_stack_push(env, var_type, var_type_id); } env_type_is_resolve_sink() changes its behaviour based on resolve_mode. For RESOLVE_PTR, we can simplify the if condition to the following: (btf_type_is_modifier() || btf_type_is_ptr) && !env_type_is_resolved() Since we're dealing with a VAR the clause evaluates to false. This is not sufficient to trigger the bug however. The log output and EINVAL are only generated if btf_type_id_size() fails. if (!btf_type_id_size(btf, &type_id, &type_size)) { btf_verifier_log_vsi(env, v->t, vsi, "Invalid type"); return -EINVAL; } Most types are sized, so for example a VAR referring to an INT is not a problem. The bug is only triggered if a VAR points at a modifier. Since we skipped btf_var_resolve that modifier was also never resolved, which means that btf_resolved_type_id returns 0 aka VOID for the modifier. This in turn causes btf_type_id_size to return NULL, triggering EINVAL. To summarise, the following conditions are necessary: - VAR pointing at PTR, STRUCT, UNION or ARRAY - Followed by a VAR pointing at TYPEDEF, VOLATILE, CONST, RESTRICT or TYPE_TAG The fix is to reset resolve_mode to RESOLVE_TBD before attempting to resolve a VAR from a DATASEC. Fixes: 1dc9285184 ("bpf: kernel side support for BTF Var and DataSec") Signed-off-by: Lorenz Bauer <lmb@isovalent.com> Link: https://lore.kernel.org/r/20230306112138.155352-2-lmb@isovalent.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-17 08:32:51 +01:00
Marc Zyngier	985d9fa06b	irqdomain: Fix domain registration race ... [ Upstream commit 8932c32c3053accd50702b36e944ac2016cd103c ] Hierarchical domains created using irq_domain_create_hierarchy() are currently added to the domain list before having been fully initialised. This specifically means that a racing allocation request might fail to allocate irq data for the inner domains of a hierarchy in case the parent domain pointer has not yet been set up. Note that this is not really any issue for irqchip drivers that are registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE()) but could potentially cause trouble with drivers that are registered later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(), gpiochip drivers, etc.). Fixes: afb7da83b9 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()") Cc: stable@vger.kernel.org # 3.19 Signed-off-by: Marc Zyngier <maz@kernel.org> [ johan: add commit message ] Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-17 08:32:49 +01:00
Bixuan Cui	01ed8ff22a	irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent ... [ Upstream commit 20c36ce2164f1774b487d443ece99b754bc6ad43 ] The 'size' is used in struct_size(domain, revmap, size) and its input parameter type is 'size_t'(unsigned int). Changing the size to 'unsigned int' to make the type consistent. Signed-off-by: Bixuan Cui <cuibixuan@huawei.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20210916025203.44841-1-cuibixuan@huawei.com Stable-dep-of: 8932c32c3053 ("irqdomain: Fix domain registration race") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-17 08:32:49 +01:00
Tejun Heo	7cfbc7501b	BACKPORT: FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration ... Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tasks about. This is done by linking cset->mg_preload_node on either the mgctx->preloaded_dst_csets or mgctx->preloaded_dst_csets list. Using the same cset->mg_preload_node for both the src and dst lists was deemed okay as a cset can't be both the source and destination at the same time. Unfortunately, this overloading becomes problematic when multiple tasks are involved in a migration and some of them are identity noop migrations while others are actually moving across cgroups. For example, this can happen with the following sequence on cgroup1: #1> mkdir -p /sys/fs/cgroup/misc/a/b #2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs #3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS & #4> PID=$! #5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks #6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs the process including the group leader back into a. In this final migration, non-leader threads would be doing identity migration while the group leader is doing an actual one. After #3, let's say the whole process was in cset A, and that after #4, the leader moves to cset B. Then, during #6, the following happens: 1. cgroup_migrate_add_src() is called on B for the leader. 2. cgroup_migrate_add_src() is called on A for the other threads. 3. cgroup_migrate_prepare_dst() is called. It scans the src list. 3. It notices that B wants to migrate to A, so it tries to A to the dst list but realizes that its ->mg_preload_node is already busy. 4. and then it notices A wants to migrate to A as it's an identity migration, it culls it by list_del_init()'ing its ->mg_preload_node and putting references accordingly. 5. The rest of migration takes place with B on the src list but nothing on the dst list. This means that A isn't held while migration is in progress. If all tasks leave A before the migration finishes and the incoming task pins it, the cset will be destroyed leading to use-after-free. This is caused by overloading cset->mg_preload_node for both src and dst preload lists. We wanted to exclude the cset from the src list but ended up inadvertently excluding it from the dst list too. This patch fixes the issue by separating out cset->mg_preload_node into ->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst preloadings don't interfere with each other. Bug: 236582926 Change-Id: Ieaf1c0c8fc23753570897fd6e48a54335ab939ce Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Mukesh Ojha <quic_mojha@quicinc.com> Reported-by: shisiyuan <shisiyuan19870131@gmail.com> Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com Link: https://lore.kernel.org/lkml/Yh+RGIJ0f3nrqIiN@slm.duckdns.org/#t Fixes: f817de9851 ("cgroup: prepare migration path for unified hierarchy") Cc: stable@vger.kernel.org # v3.16+ (cherry picked from commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447 https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git for-5.19-fixes) Signed-off-by: Elliot Berman <quic_eberman@quicinc.com> Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> [mojha: Move the two new list heads into a wrapper ext_css_set struct to ensure ABI doesn't break and also defined a macro init_css_set which will be replaced with init_ext_css_set.cset to avoid too much code changes] Signed-off-by: Srinivasarao Pathipati <quic_spathi@quicinc.com>	2023-03-14 16:59:42 +00:00
Greg Kroah-Hartman	0d9d32f54c	This is the 5.4.235 stable release ... -----BEGIN PGP SIGNATURE----- iQIyBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQModwACgkQONu9yGCS aT7W7A/1EyhortcaMdZXEkdl7kZYupASsOm2QgOzeRkK0ELtbYRTt1qXdZgl40hU binrh5Yib2avHTEAF9I6AKVXMirSUTtODe/zQ7icyxVNcXeanlIbobEVBzSWIBtC Wxj129KZyCQlucagWihngQ9D+66bvD5JCsJ3EHKJjpheSqmZI88KVnOSnvyoJArj yLDY21UgxRN4KASgB+tpLBT4x0yN9zk8VuCGpyJjO/nHzhj6Y6DkOcx2q7hAxdn+ H1OBCQ2QBCODCMrpW4xBuwy2blBZsRytUdEy8JsfxjgXvUp8+TdxUsuxb16a31jW pVo9LYB0cdKVoAzNJ2pTD8rhaATSbq+2MYDEUYCz8Rr+dZ/Nt2nTKSYeJprLsTwx TzPRNErQMKxKoQUQU/seWx47ebwt+Z8Rk4FAoyQMxRITw/9bBGLWpDKrGjNsByz9 A2Q9UU+uM+jyqZnjQMvkzKSznggwfJ+SgaeqDMjwyyCQysJS8DTXPr9nA+IC9cht Kz00QetNgvPvZPE/gg81XOcKtJVTmA4AITQ0PlxYJT0hHCHx02GxvdPH2XBspgUt aNbDgVsupq8ONvRZlEf9hJKltTUmIRvI9JSOXnuhaN2jCv88SNv1M0TKfAo0XDNK Z/prv3qCnugMZ0KB0TD7d09XqSlKbefOq8TdtbXoTcC0NzFQkw== =29jZ -----END PGP SIGNATURE----- Merge 5.4.235 into android11-5.4-lts Changes in 5.4.235 HID: asus: Remove check for same LED brightness on set HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers ARM: OMAP2+: Fix memory leak in realtime_counter_init() arm64: dts: qcom: qcs404: use symbol names for PCIe resets ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: meson-gx: Fix Ethernet MAC address unit name arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address arm64: dts: meson: remove CPU opps below 1GHz for G12A boards ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name ARM: dts: imx7s: correct iomuxc gpr mux controller cells arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle" block: Limit number of items taken from the I/O scheduler in one go blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: correct stale comment of .get_budget s390/dasd: Prepare for additional path event handling s390/dasd: Fix potential memleak in dasd_eckd_init() sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() sched/rt: pick_next_rt_entity(): check list_entry block: bio-integrity: Copy flags when bio_integrity_payload is cloned wifi: rsi: Fix memory leak in rsi_coex_attach() net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb” wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() rtlwifi: fix -Wpointer-sign warning wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() ipw2x00: switch from 'pci_' to 'dma_' API wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: ipw2200: fix memory leak in ipw_wdev_init() wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() crypto: x86/ghash - fix unaligned access in ghash_setkey() ACPICA: Drop port I/O validation for some regions genirq: Fix the return type of kstat_cpu_irqs_sum() lib/mpi: Fix buffer overrun when SG is too long ACPICA: nsrepair: handle cases without a return value correctly wifi: orinoco: check return value of hermes_write_wordrec() wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function ath9k: hif_usb: simplify if-if to if-else ath9k: htc: clean up statistics macros wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() ACPI: battery: Fix missing NUL-termination with large strings crypto: ccp - Failure on re-initialization due to duplicate sysfs filename crypto: essiv - remove redundant null pointer check before kfree crypto: essiv - Handle EBUSY correctly crypto: seqiv - Handle EBUSY correctly powercap: fix possible name leak in powercap_register_zone() net/mlx5: Enhance debug print in page allocation failure irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe mptcp: add sk_stop_timer_sync helper net: add sock_init_data_uid() tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid OPP: fix error checking in opp_migrate_dentry() Bluetooth: L2CAP: Fix potential user-after-free libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() rds: rds_rm_zerocopy_callback() correct order for list_add_tail() crypto: rsa-pkcs1pad - Use akcipher_request_complete m68k: /proc/hardware should depend on PROC_FS RISC-V: time: initialize hrtimer based broadcast clock event device usb: gadget: udc: Avoid tasklet passing a global treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() wifi: iwl3945: Add missing check for create_singlethread_workqueue wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() crypto: crypto4xx - Call dma_unmap_page when done wifi: mac80211: make rate u32 in sta_set_rate_info_rx() thermal/drivers/hisi: Drop second sensor hi3660 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts selftests/net: Interpret UDP_GRO cmsg data as an int value selftest: fib_tests: Always cleanup before exit drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/bridge: megachips: Fix error handling in i2c_register_driver() drm/vc4: dpi: Add option for inverting pixel clock and output enable drm/vc4: dpi: Fix format mapping for RGB565 gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() drm/msm/hdmi: Add missing check for alloc_ordered_workqueue pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain ASoC: fsl_sai: initialize is_dsp_mode flag ALSA: hda/ca0132: minor fix for allocation size drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness drm/msm: use strscpy instead of strncpy drm/msm/dpu: Add check for cstate drm/msm/dpu: Add check for pstates drm/exynos: Don't reset bridge->next drm/bridge: Rename bridge helpers targeting a bridge chain drm/bridge: Introduce drm_bridge_get_next_bridge() drm: Initialize struct drm_crtc_state.no_vblank from device settings drm/msm/mdp5: Add check for kzalloc gpu: host1x: Don't skip assigning syncpoints to channels drm/mediatek: remove cast to pointers passed to kfree drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: Drop unbalanced obj unref drm/mediatek: Clean dangling pointer on bind error path ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() gpio: vf610: connect GPIO label to dev name hwmon: (ltc2945) Handle error case in ltc2945_value_store scsi: aic94xx: Add missing check for dma_map_single() spi: bcm63xx-hsspi: fix pm_runtime spi: bcm63xx-hsspi: Fix multi-bit mode setting hwmon: (mlxreg-fan) Return zero speed for broken fan dm: remove flush_scheduled_work() during local_exit() spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() ASoC: dapm: declare missing structure prototypes ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared HID: bigben: use spinlock to protect concurrent accesses HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to safely schedule workers HID: asus: Only set EV_REP if we are adding a mapping HID: asus: Add report_size to struct asus_touchpad_info HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T hid: bigben_probe(): validate report count nfsd: fix race to check ls_layouts cifs: Fix lost destroy smbd connection when MR allocate failed cifs: Fix warning and UAF when destroy the MR list gfs2: jdata writepage fix perf llvm: Fix inadvertent file creation perf tools: Fix auto-complete on aarch64 sparc: allow PM configs for sparc32 COMPILE_TEST selftests/ftrace: Fix bash specific "==" operator mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents mtd: rawnand: sunxi: Fix the size of the last OOB region clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag clk: renesas: cpg-mssr: Remove superfluous check in resume code Input: ads7846 - don't report pressure for ads7845 Input: ads7846 - don't check penirq immediately for 7845 clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC powerpc/powernv/ioda: Skip unallocated resources when mapping to PE clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() powerpc/pseries/lpar: add missing RTAS retry status handling powerpc/pseries/lparcfg: add missing RTAS retry status handling powerpc/rtas: make all exports GPL powerpc/rtas: ensure 4KB alignment for rtas_data_buf powerpc/eeh: Small refactor of eeh_handle_normal_event() powerpc/eeh: Set channel state after notifying the drivers MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set MIPS: vpe-mt: drop physical_memsize remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers media: platform: ti: Add missing check for devm_regulator_get powerpc: Remove linker flag from KBUILD_AFLAGS media: ov5675: Fix memleak in ov5675_init_controls() media: i2c: ov772x: Fix memleak in ov772x_probe() media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: i2c: ov7670: 0 instead of -EINVAL was returned media: usb: siano: Fix use after free bugs caused by do_submit_urb rpmsg: glink: Avoid infinite loop on intent for missing channel udf: Define EFSCORRUPTED error code ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy blk-iocost: fix divide by 0 error in calc_lcoefs() wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() thermal: intel: Fix unsigned comparison with less than zero timers: Prevent union confusion from unexpected restart_syscall() x86/bugs: Reset speculation control settings on init wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds wifi: mt7601u: fix an integer underflow inet: fix fast path in __inet_hash_connect() ice: add missing checks for PF vsi type ACPI: Don't build ACPICA with '-Os' net: bcmgenet: Add a check for oversized packets m68k: Check syscall_trace_enter() return code wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup ACPI: video: Fix Lenovo Ideapad Z570 DMI match net/mlx5: fw_tracer: Fix debug print coda: Avoid partial allocation of sig_inputArgs uaccess: Add minimum bounds check on kernel buffer size drm/amd/display: Fix potential null-deref in dm_resume drm/omap: dsi: Fix excessive stack usage HID: Add Mapping for System Microphone Mute drm/radeon: free iio for atombios when driver shutdown drm/msm/dsi: Add missing check for alloc_ordered_workqueue docs/scripts/gdb: add necessary make scripts_gdb step ASoC: kirkwood: Iterate over array indexes instead of using pointer math regulator: max77802: Bounds check regulator id against opmode regulator: s5m8767: Bounds check id indexing into arrays hwmon: (coretemp) Simplify platform device handling pinctrl: at91: use devm_kasprintf() to avoid potential leaks drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 dm thin: add cond_resched() to various workqueue loops dm cache: add cond_resched() to various workqueue loops nfsd: zero out pointers after putting nfsd_files on COPY setup error wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu firmware: coreboot: framebuffer: Ignore reserved pixel color bits rtc: pm8xxx: fix set-alarm race ipmi_ssif: Rename idle state and check s390: discard .interp section s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/kprobes: fix current_kprobe never cleared after kprobes reenter ARM: dts: exynos: correct HDMI phy compatible in Exynos4 hfs: fix missing hfs_bnode_get() in __hfs_bnode_create fs: hfsplus: fix UAF issue in hfsplus_put_super f2fs: fix information leak in f2fs_move_inline_dirents() f2fs: fix cgroup writeback accounting with fs-layer encryption ocfs2: fix defrag path triggering jbd2 ASSERT ocfs2: fix non-auto defrag path not working issue udf: Truncate added extents on failed expansion udf: Do not bother merging very long extents udf: Do not update file length for failed writes to inline files udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy udf: Fix file corruption when appending just after end of preallocated extent KVM: Destroy target device if coalesced MMIO unregistration fails KVM: s390: disable migration mode when dirty tracking is disabled x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/AMD: Fix mixed steppings support x86/speculation: Allow enabling STIBP with legacy IBRS Documentation/hw-vuln: Document the interaction between IBRS and STIBP ima: Align ima_file_mmap() parameters with mmap_file LSM hook irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Drop bogus fwspec-mapping error handling ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC ext4: optimize ea_inode block expansion ext4: refuse to create ea block when umounted wifi: rtl8xxxu: Use a longer retry limit of 48 wifi: cfg80211: Fix use after free for wext thermal: intel: powerclamp: Fix cur_state for multi package system dm flakey: fix logic when corrupting a bio dm flakey: don't corrupt the zero page ARM: dts: exynos: correct TMU phandle in Exynos4 ARM: dts: exynos: correct TMU phandle in Odroid XU rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails alpha: fix FEN fault handling mips: fix syscall_get_nr media: ipu3-cio2: Fix PM runtime usage_count in driver unbind mm: memcontrol: deprecate charge moving mm/thp: check and bail out if page in deferred queue already ktest.pl: Give back console on Ctrt^C on monitor ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Add RUN_TIMEOUT option with default unlimited scsi: qla2xxx: Fix link failure in NPIV environment scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Fix erroneous link down scsi: ses: Don't attach if enclosure has no components scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() PCI/PM: Observe reset delay irrespective of bridge_d3 PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: Avoid FLR for AMD FCH AHCI adapters drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv drm/radeon: Fix eDP for single-display iMac11,2 wifi: ath9k: use proper statements in conditionals kbuild: Port silent mode detection to future gnu make. net/sched: Retire tcindex classifier fs/jfs: fix shift exponent db_agl2size negative pwm: sifive: Reduce time the controller lock is held pwm: sifive: Always let the first pwm_apply_state succeed pwm: stm32-lp: fix the check on arr and cmp registers update f2fs: use memcpy_{to,from}_page() where possible fs: f2fs: initialize fsdata in pagecache_write() um: vector: Fix memory leak in vector_config ubi: ensure that VID header offset + VID header size <= alloc, size ubifs: Fix build errors as symbol undefined ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted ubifs: Rectify space budget for ubifs_xrename() ubifs: Fix wrong dirty space budget for dirty inode ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 ubifs: Reserve one leb for each journal head while doing budget ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() ubifs: Fix memory leak in alloc_wbufs() ubi: Fix possible null-ptr-deref in ubi_free_volume() ubifs: Re-statistic cleaned znode count if commit failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path watchdog: Fix kmemleak in watchdog_cdev_register watchdog: pcwd_usb: Fix attempting to access uninitialized memory netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() ipv6: Add lwtunnel encap size of all siblings in nexthop calculation sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop net: fix __dev_kfree_skb_any() vs drop monitor 9p/xen: fix version parsing 9p/xen: fix connection sequence 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() net/mlx5: Geneve, Fix handling of Geneve object id as error code nfc: fix memory leak of se_io context in nfc_genl_se_io net/sched: act_sample: fix action bind logic ARM: dts: spear320-hmi: correct STMPE GPIO compatible tcp: tcp_check_req() can be called from process context vc_screen: modify vcs_size() handling in vcs_read() rtc: sun6i: Make external 32k oscillator optional rtc: sun6i: Always export the internal oscillator scsi: ipr: Work around fortify-string warning thermal: intel: quark_dts: fix error pointer dereference thermal: intel: BXT_PMIC: select REGMAP instead of depending on it tracing: Add NULL checks for buffer in ring_buffer_free_read_page() firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak media: uvcvideo: Handle cameras with invalid descriptors media: uvcvideo: Handle errors from calls to usb_string media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 media: uvcvideo: Silence memcpy() run-time false positive warnings staging: emxx_udc: Add checks for dma_alloc_coherent() tty: fix out-of-bounds access in tty_driver_lookup_tty() tty: serial: fsl_lpuart: disable the CTS when send break signal mei: bus-fixup:upon error print return values of send and receive tools/iio/iio_utils:fix memory leak iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math USB: ene_usb6250: Allocate enough memory for full object usb: uvc: Enumerate valid values for color matching kernel/fail_function: fix memory leak with using debugfs_lookup() PCI: Add ACS quirk for Wangxun NICs phy: rockchip-typec: Fix unsigned comparison with less than zero net: tls: avoid hanging tasks on the tx_lock x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid} x86/resctl: fix scheduler confusion with 'current' Bluetooth: hci_sock: purge socket queues in the destruct() callback tcp: Fix listen() regression in 5.4.229. media: uvcvideo: Provide sync and async uvc_ctrl_status_event media: uvcvideo: Fix race condition with usb_kill_urb dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks Linux 5.4.235 Change-Id: I256ca8288bf61707f5103c9b7c7831da0d7a08a0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-12 15:42:52 +00:00
Greg Kroah-Hartman	f6d3aee1c6	kernel/fail_function: fix memory leak with using debugfs_lookup() ... [ Upstream commit 2bb3669f576559db273efe49e0e69f82450efbca ] When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20230202151633.2310897-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:44:15 +01:00
Jia-Ju Bai	2cc6a3e98f	tracing: Add NULL checks for buffer in ring_buffer_free_read_page() ... [ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ] In a previous commit 7433632c9ff6, buffer, buffer->buffers and buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL, and thus the related checks are added. However, in the same call stack, these variables are also used in ring_buffer_free_read_page(): tracing_buffers_release() ring_buffer_wake_waiters(iter->array_buffer->buffer) cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit ring_buffer_free_read_page(iter->array_buffer->buffer) cpu_buffer = buffer->buffers[cpu] -> No check Thus, to avod possible null-pointer derefernces, the related checks should be added. These results are reported by a static tool designed by myself. Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:44:13 +01:00
Johan Hovold	df129eaa2b	irqdomain: Drop bogus fwspec-mapping error handling ... commit e3b7ab025e931accdc2c12acf9b75c6197f1c062 upstream. In case a newly allocated IRQ ever ends up not having any associated struct irq_data it would not even be possible to dispose the mapping. Replace the bogus disposal with a WARN_ON(). This will also be used to fix a shared-interrupt mapping race, hence the CC-stable tag. Fixes: 1e2a7d7849 ("irqdomain: Don't set type when mapping an IRQ") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang <hsinyi@chromium.org> Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-11 16:44:03 +01:00
Johan Hovold	72232dbe14	irqdomain: Fix disassociation race ... commit 3f883c38f5628f46b30bccf090faec054088e262 upstream. The global irq_domain_mutex is held when mapping interrupts from non-hierarchical domains but currently not when disposing them. This specifically means that updates of the domain mapcount is racy (currently only used for statistics in debugfs). Make sure to hold the global irq_domain_mutex also when disposing mappings from non-hierarchical domains. Fixes: 9dc6be3d41 ("genirq/irqdomain: Add map counter") Cc: stable@vger.kernel.org # 4.13 Tested-by: Hsin-Yi Wang <hsinyi@chromium.org> Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-11 16:44:03 +01:00
Johan Hovold	2101663687	irqdomain: Fix association race ... commit b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 upstream. The sanity check for an already mapped virq is done outside of the irq_domain_mutex-protected section which means that an (unlikely) racing association may not be detected. Fix this by factoring out the association implementation, which will also be used in a follow-on change to fix a shared-interrupt mapping race. Fixes: ddaf144c61 ("irqdomain: Refactor irq_domain_associate_many()") Cc: stable@vger.kernel.org # 3.11 Tested-by: Hsin-Yi Wang <hsinyi@chromium.org> Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-11 16:44:02 +01:00
Yang Jihong	a0415b79dd	x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range ... commit f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 upstream. When arch_prepare_optimized_kprobe calculating jump destination address, it copies original instructions from jmp-optimized kprobe (see __recover_optprobed_insn), and calculated based on length of original instruction. arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when checking whether jmp-optimized kprobe exists. As a result, setup_detour_execution may jump to a range that has been overwritten by jump destination address, resulting in an inval opcode error. For example, assume that register two kprobes whose addresses are <func+9> and <func+11> in "func" function. The original code of "func" function is as follows: 0xffffffff816cb5e9 <+9>: push %r12 0xffffffff816cb5eb <+11>: xor %r12d,%r12d 0xffffffff816cb5ee <+14>: test %rdi,%rdi 0xffffffff816cb5f1 <+17>: setne %r12b 0xffffffff816cb5f5 <+21>: push %rbp 1.Register the kprobe for <func+11>, assume that is kp1, corresponding optimized_kprobe is op1. After the optimization, "func" code changes to: 0xffffffff816cc079 <+9>: push %r12 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp Now op1->flags == KPROBE_FLAG_OPTIMATED; 2. Register the kprobe for <func+9>, assume that is kp2, corresponding optimized_kprobe is op2. register_kprobe(kp2) register_aggr_kprobe alloc_aggr_kprobe __prepare_optimized_kprobe arch_prepare_optimized_kprobe __recover_optprobed_insn // copy original bytes from kp1->optinsn.copied_insn, // jump address = <func+14> 3. disable kp1: disable_kprobe(kp1) __disable_kprobe ... if (p == orig_p || aggr_kprobe_disabled(orig_p)) { ret = disarm_kprobe(orig_p, true) // add op1 in unoptimizing_list, not unoptimized orig_p->flags |= KPROBE_FLAG_DISABLED; // op1->flags == KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED ... 4. unregister kp2 __unregister_kprobe_top ... if (!kprobe_disabled(ap) && !kprobes_all_disarmed) { optimize_kprobe(op) ... if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return return; p->kp.flags |= KPROBE_FLAG_OPTIMIZED; // now op2 has KPROBE_FLAG_OPTIMIZED } "func" code now is: 0xffffffff816cc079 <+9>: int3 0xffffffff816cc07a <+10>: push %rsp 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp 5. if call "func", int3 handler call setup_detour_execution: if (p->flags & KPROBE_FLAG_OPTIMIZED) { ... regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX; ... } The code for the destination address is 0xffffffffa021072c: push %r12 0xffffffffa021072e: xor %r12d,%r12d 0xffffffffa0210731: jmp 0xffffffff816cb5ee <func+14> However, <func+14> is not a valid start instruction address. As a result, an error occurs. Link: https://lore.kernel.org/all/20230216034247.32348-3-yangjihong1@huawei.com/ Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-11 16:44:02 +01:00
Yang Jihong	ec206a38d3	x86/kprobes: Fix __recover_optprobed_insn check optimizing logic ... commit 868a6fc0ca2407622d2833adefe1c4d284766c4c upstream. Since the following commit: commit f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe may be in the optimizing or unoptimizing state when op.kp->flags has KPROBE_FLAG_OPTIMIZED and op->list is not empty. The __recover_optprobed_insn check logic is incorrect, a kprobe in the unoptimizing state may be incorrectly determined as unoptimizing. As a result, incorrect instructions are copied. The optprobe_queued_unopt function needs to be exported for invoking in arch directory. Link: https://lore.kernel.org/all/20230216034247.32348-2-yangjihong1@huawei.com/ Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") Cc: stable@vger.kernel.org Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-11 16:44:01 +01:00
Jann Horn	c8157f67b0	timers: Prevent union confusion from unexpected restart_syscall() ... [ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ] The nanosleep syscalls use the restart_block mechanism, with a quirk: The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on syscall entry, while the rest of the restart_block is only set up in the unlikely case that the syscall is actually interrupted by a signal (or pseudo-signal) that doesn't have a signal handler. If the restart_block was set up by a previous syscall (futex(..., FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then, this will clobber some of the union fields used by futex_wait_restart() and do_restart_poll(). If userspace afterwards wrongly calls the restart_syscall syscall, futex_wait_restart()/do_restart_poll() will read struct fields that have been clobbered. This doesn't actually lead to anything particularly interesting because none of the union fields contain trusted kernel data, and futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much sense to apply seccomp filters to their arguments. So the current consequences are just of the "if userspace does bad stuff, it can damage itself, and that's not a problem" flavor. But still, it seems like a hazard for future developers, so invalidate the restart_block when partly setting it up in the nanosleep syscalls. Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:43:54 +01:00
Paul E. McKenney	596d1fea05	rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() ... [ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ] The normal grace period's RCU CPU stall warnings are invoked from the scheduling-clock interrupt handler, and can thus invoke smp_processor_id() with impunity, which allows them to directly invoke dump_cpu_task(). In contrast, the expedited grace period's RCU CPU stall warnings are invoked from process context, which causes the dump_cpu_task() function's calls to smp_processor_id() to complain bitterly in debug kernels. This commit therefore causes synchronize_rcu_expedited_wait() to disable preemption around its call to dump_cpu_task(). Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:43:54 +01:00
Kees Cook	5de7a4254e	treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() ... [ Upstream commit b13fecb1c3a603c4b8e99b306fecf4f668c11b32 ] This converts all the existing DECLARE_TASKLET() (and ...DISABLED) macros with DECLARE_TASKLET_OLD() in preparation for refactoring the tasklet callback type. All existing DECLARE_TASKLET() users had a "0" data argument, it has been removed here as well. Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Kees Cook <keescook@chromium.org> Stable-dep-of: 1fdeb8b9f29d ("wifi: iwl3945: Add missing check for create_singlethread_workqueue") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:43:42 +01:00
Pietro Borrello	084cd75643	sched/rt: pick_next_rt_entity(): check list_entry ... [ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ] Commit 326587b840 ("sched: fix goto retry in pick_next_task_rt()") removed any path which could make pick_next_rt_entity() return NULL. However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of pick_next_rt_entity()) still checks the error condition, which can never happen, since list_entry() never returns NULL. Remove the BUG_ON check, and instead emit a warning in the only possible error condition here: the queue being empty which should never happen. Fixes: 326587b840 ("sched: fix goto retry in pick_next_task_rt()") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Phil Auld <pauld@redhat.com> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1ac6b@diag.uniroma1.it Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:43:35 +01:00
Dietmar Eggemann	0ff7ba5e8b	sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() ... [ Upstream commit 821aecd09e5ad2f8d4c3d8195333d272b392f7d3 ] The `struct rq *rq` parameter isn't used. Remove it. Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Juri Lelli <juri.lelli@redhat.com> Link: https://lore.kernel.org/r/20220302183433.333029-7-dietmar.eggemann@arm.com Stable-dep-of: 7c4a5b89a0b5 ("sched/rt: pick_next_rt_entity(): check list_entry") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:43:35 +01:00
Tejun Heo	064252c4f2	BACKPORT: FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration ... Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tasks about. This is done by linking cset->mg_preload_node on either the mgctx->preloaded_dst_csets or mgctx->preloaded_dst_csets list. Using the same cset->mg_preload_node for both the src and dst lists was deemed okay as a cset can't be both the source and destination at the same time. Unfortunately, this overloading becomes problematic when multiple tasks are involved in a migration and some of them are identity noop migrations while others are actually moving across cgroups. For example, this can happen with the following sequence on cgroup1: #1> mkdir -p /sys/fs/cgroup/misc/a/b #2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs #3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS & #4> PID=$! #5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks #6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs the process including the group leader back into a. In this final migration, non-leader threads would be doing identity migration while the group leader is doing an actual one. After #3, let's say the whole process was in cset A, and that after #4, the leader moves to cset B. Then, during #6, the following happens: 1. cgroup_migrate_add_src() is called on B for the leader. 2. cgroup_migrate_add_src() is called on A for the other threads. 3. cgroup_migrate_prepare_dst() is called. It scans the src list. 3. It notices that B wants to migrate to A, so it tries to A to the dst list but realizes that its ->mg_preload_node is already busy. 4. and then it notices A wants to migrate to A as it's an identity migration, it culls it by list_del_init()'ing its ->mg_preload_node and putting references accordingly. 5. The rest of migration takes place with B on the src list but nothing on the dst list. This means that A isn't held while migration is in progress. If all tasks leave A before the migration finishes and the incoming task pins it, the cset will be destroyed leading to use-after-free. This is caused by overloading cset->mg_preload_node for both src and dst preload lists. We wanted to exclude the cset from the src list but ended up inadvertently excluding it from the dst list too. This patch fixes the issue by separating out cset->mg_preload_node into ->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst preloadings don't interfere with each other. Bug: 236582926 Change-Id: Ieaf1c0c8fc23753570897fd6e48a54335ab939ce Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Mukesh Ojha <quic_mojha@quicinc.com> Reported-by: shisiyuan <shisiyuan19870131@gmail.com> Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com Link: https://lore.kernel.org/lkml/Yh+RGIJ0f3nrqIiN@slm.duckdns.org/#t Fixes: f817de9851 ("cgroup: prepare migration path for unified hierarchy") Cc: stable@vger.kernel.org # v3.16+ (cherry picked from commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447 https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git for-5.19-fixes) Signed-off-by: Elliot Berman <quic_eberman@quicinc.com> Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> [mojha: Move the two new list heads into a wrapper ext_css_set struct to ensure ABI doesn't break and also defined a macro init_css_set which will be replaced with init_ext_css_set.cset to avoid too much code changes] Git-commit: e8fce594347a77af0481c18b6b56509b954fa771 Git-repo: https://android.googlesource.com/kernel/common/ Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>	2023-03-06 16:58:34 +05:30
Greg Kroah-Hartman	6bb176e034	Merge 5.4.233 into android11-5.4-lts ... Changes in 5.4.233 dma-mapping: add generic helpers for mapping sgtable objects scatterlist: add generic wrappers for iterating over sgtable objects drm: etnaviv: fix common struct sg_table related issues drm/etnaviv: don't truncate physical page address wifi: rtl8xxxu: gen2: Turn on the rate control powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G random: always mix cycle counter in add_latent_entropy() KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 alarmtimer: Prevent starvation by small intervals and SIG_IGN drm/i915/gvt: fix double free bug in split_2MB_gtt_entry mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh uaccess: Add speculation barrier to copy_from_user() wifi: mwifiex: Add missing compatible string for SD8787 ext4: Fix function prototype mismatch for ext4_feat_ktype Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs" bpf: add missing header file include Linux 5.4.233 Change-Id: I83441dec5bd3c2ad6af19017fe9b467f7ffa2ea5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-27 11:20:30 +00:00
Linus Torvalds	c6cc0121d4	bpf: add missing header file include ... commit f3dd0c53370e70c0f9b7e931bbec12916f3bb8cc upstream. Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") built fine on x86-64 and arm64, and that's the extent of my local build testing. It turns out those got the <linux/nospec.h> include incidentally through other header files (<linux/kvm_host.h> in particular), but that was not true of other architectures, resulting in build errors kernel/bpf/core.c: In function ‘___bpf_prog_run’: kernel/bpf/core.c:1913:3: error: implicit declaration of function ‘barrier_nospec’ so just make sure to explicitly include the proper <linux/nospec.h> header file to make everybody see it. Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Viresh Kumar <viresh.kumar@linaro.org> Reported-by: Huacai Chen <chenhuacai@loongson.cn> Tested-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Dave Hansen <dave.hansen@linux.intel.com> Acked-by: Alexei Starovoitov <alexei.starovoitov@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-25 11:53:27 +01:00