This is the merge of the upstream LTS release of 5.4.233 into the
android11-5.4 branch.
It contains the following commits:
6bb176e034 Merge 5.4.233 into android11-5.4-lts
7f7f254975 Revert "iommu: Add gfp parameter to iommu_ops::map"
7f7f83ce87 Revert "iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map()"
bbf1c13935 Revert "RDMA/usnic: use iommu_map_atomic() under spin_lock()"
69f65d442e Linux 5.4.233
c6cc0121d4 bpf: add missing header file include
5d873a6c65 Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs"
99e3fd21f8 ext4: Fix function prototype mismatch for ext4_feat_ktype
6f86bb6f85 wifi: mwifiex: Add missing compatible string for SD8787
6c750ed036 uaccess: Add speculation barrier to copy_from_user()
4d2e5de071 mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
787ef0db01 drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
100cf2af1b alarmtimer: Prevent starvation by small intervals and SIG_IGN
dab2066c5f powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
113e0cde39 can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
f93a1a5bdc KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
db209f39f1 KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
dc399695df random: always mix cycle counter in add_latent_entropy()
eff0e02f7d powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
ead0689bd6 wifi: rtl8xxxu: gen2: Turn on the rate control
0a77a966aa drm/etnaviv: don't truncate physical page address
fa2845b216 drm: etnaviv: fix common struct sg_table related issues
4626550b09 scatterlist: add generic wrappers for iterating over sgtable objects
fe3e217272 dma-mapping: add generic helpers for mapping sgtable objects
abc4ede193 Merge 5.4.232 into android11-5.4-lts
64121e2adf Linux 5.4.232
8b47e324af iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map()
7519069f1f net: sched: sch: Fix off by one in htb_activate_prios()
5660a6ffa7 ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
52844d8382 nilfs2: fix underflow in second superblock position calculations
9f95a161a7 kvm: initialize all of the kvm_debugregs structure before sending it to userspace
9f4abf2048 i40e: Add checking for null for nlmsg_find_attr()
e71554a09e ipv6: Fix tcp socket connection with DSCP.
388886f970 ipv6: Fix datagram socket connection with DSCP.
905199dac2 ixgbe: add double of VLAN header when computing the max MTU
df099e6556 net: mpls: fix stale pointer if allocation fails during device rename
736f8f66d7 net: stmmac: Restrict warning on disabling DMA store and fwd mode
1a2c795142 bnxt_en: Fix mqprio and XDP ring checking logic
de44bdebcf net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
a753352622 net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
0c2651c763 dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
a4e9411769 sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
e1b54b5612 net: bgmac: fix BCM5358 support by setting correct flags
8a4d05b0ff i40e: add double of VLAN header when computing the max MTU
fdeb4c258b ixgbe: allow to increase MTU to 3K with XDP enabled
32d81fd54e revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
4c8011e77c net: Fix unwanted sign extension in netdev_stats_to_stats64()
6b08c9fc72 Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."
8c07792e79 hugetlb: check for undefined shift on 32 bit architectures
7caeb5457b sched/psi: Fix use-after-free in ep_remove_wait_queue()
6c38aa4020 ALSA: hda/realtek - fixed wrong gpio assigned
6e0ef3fc65 ALSA: hda/conexant: add a new hda codec SN6180
e9b488d60f mmc: mmc_spi: fix error handling in mmc_spi_probe()
761db46b29 mmc: sdio: fix possible resource leaks in some error paths
98895c225e ipv4: Fix incorrect route flushing when source address is deleted
04a331c9dd Revert "ipv4: Fix incorrect route flushing when source address is deleted"
85eda80883 xfs: sync lazy sb accounting on quiesce of read-only mounts
fb8ee907c1 xfs: prevent UAF in xfs_log_item_in_current_chkpt
7c07806ab0 xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks
313699d505 xfs: ensure inobt record walks always make forward progress
7f9309a9f5 xfs: fix missing CoW blocks writeback conversion retry
6246b3a18f xfs: only relog deferred intent items if free space in the log gets low
09d6181447 xfs: expose the log push threshold
5d711e4136 xfs: periodically relog deferred intent items
870e7d7108 xfs: change the order in which child and parent defer ops are finished
f5af1d5c2d xfs: fix an incore inode UAF in xfs_bui_recover
efcdc2e70e xfs: clean up xfs_bui_item_recover iget/trans_alloc/ilock ordering
abad319dee xfs: clean up bmap intent item recovery checking
6601531db8 xfs: xfs_defer_capture should absorb remaining transaction reservation
411b14e68c xfs: xfs_defer_capture should absorb remaining block reservations
3324249e6e xfs: proper replay of deferred ops queued during log recovery
1c89c04305 xfs: fix finobt btree block recovery ordering
6678b2787b xfs: log new intent items created as part of finishing recovered intent items
562da8e704 xfs: refactor xfs_defer_finish_noroll
42a2406f90 xfs: turn dfp_intent into a xfs_log_item
e11f1516fc xfs: merge the ->diff_items defer op into ->create_intent
e84096edf8 xfs: merge the ->log_item defer op into ->create_intent
64b21eaa33 xfs: factor out a xfs_defer_create_intent helper
d24633f3c2 xfs: remove the xfs_inode_log_item_t typedef
e0373eeaaa xfs: remove the xfs_efd_log_item_t typedef
94e0639992 xfs: remove the xfs_efi_log_item_t typedef
83ef55c428 netfilter: nft_tproxy: restrict to prerouting hook
b6ac5e6be5 btrfs: free device in btrfs_close_devices for a single device filesystem
4326d0080f aio: fix mremap after fork null-deref
62b19b9f3a nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
16409f7d9c s390/decompressor: specify __decompress() buf len to avoid overflow
fbe71c5dac net: sched: sch: Bounds check priority
09561d5e6a net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
a74d3b0ea9 net/rose: Fix to not accept on connected socket
ec54c946b4 tools/virtio: fix the vringh test for virtio ring changes
6644685f79 ASoC: cs42l56: fix DT probe
d23b66b16e selftests/bpf: Verify copy_register_state() preserves parent/live fields
a94695e0f9 migrate: hugetlb: check for hugetlb shared PMD in node migration
bcd34f1eea bpf: Always return target ifindex in bpf_fib_lookup
776f2ccfdc nvme-pci: Move enumeration by class to be last in the table
5c86809882 arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
4b97dab7cd arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive
f0302e98ed arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
1509e93916 riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
bb3187311e ceph: flush cap releases when the session is flushed
9b5d37d328 usb: typec: altmodes/displayport: Fix probe pin assign check
d9758f7deb usb: core: add quirk for Alcor Link AK9563 smartcard reader
43379fcace net: USB: Fix wrong-direction WARNING in plusb.c
1bcb431237 pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
2b763f7de1 pinctrl: single: fix potential NULL dereference
cc1affa234 pinctrl: aspeed: Fix confusing types in return value
f209431be1 ALSA: pci: lx6464es: fix a debug loop
1aab663ecb selftests: forwarding: lib: quote the sysctl values
ba38eacade rds: rds_rm_zerocopy_callback() use list_first_entry()
87a5e3fc84 ice: Do not use WQ_MEM_RECLAIM flag for workqueue
f312958f58 ionic: clean interrupt before enabling queue to avoid credit race
a532f7ebf9 net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
73b8e217fe bonding: fix error checking in bond_debug_reregister()
c89ddf134c xfrm: fix bug with DSCP copy to v6 from v4 tunnel
80282a3d10 RDMA/usnic: use iommu_map_atomic() under spin_lock()
fe4d708668 iommu: Add gfp parameter to iommu_ops::map
4a779187db IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
7896accedf IB/hfi1: Restore allocated resources on failed copyout
ae774f480d can: j1939: do not wait 250 ms if the same addr was already claimed
56ee31167c tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw
039f935ae0 ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
7e43bb69bc btrfs: zlib: zero-initialize zlib workspace
ed29d8b309 btrfs: limit device extents to the device size
9f296c615e iio:adc:twl6030: Enable measurement of VAC
9cf5e99c1a wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
e5142a4935 f2fs: fix to do sanity check on i_extra_isize in is_alive()
3b3d3127f5 fbdev: smscufx: fix error handling code in ufx_usb_probe
8edda487f0 powerpc/imc-pmu: Revert nest_init_lock to being a mutex
fc8548c75c serial: 8250_dma: Fix DMA Rx rearm race
71d6b277c4 serial: 8250_dma: Fix DMA Rx completion race
ec5b4ca3d3 xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
5af2f74f90 mm: swap: properly update readahead statistics in unuse_pte_range()
ce62df33fc nvmem: core: fix cell removal on error
1369322c1d Squashfs: fix handling and sanity checking of xattr_ids count
d49c85a191 mm/swapfile: add cond_resched() in get_swap_pages()
c127bf9a95 fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
6d86b4ceb0 mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
845a3708f0 riscv: disable generation of unwind tables
c89af52d91 parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
8e6cc45ba8 parisc: Fix return code of pdc_iodc_print()
7f5df45fcb iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
4b82cc9f7f iio: adc: berlin2-adc: Add missing of_node_put() in error path
a300e358c6 iio: hid: fix the retval in accel_3d_capture_sample
2035cfb958 efi: Accept version 2 of memory attributes table
f6ea834e8d watchdog: diag288_wdt: fix __diag288() inline assembly
78e55b52b2 watchdog: diag288_wdt: do not use stack buffers for hardware data
4abcd352a0 fbcon: Check font dimension limits
e00d6a74c3 Input: i8042 - add Clevo PCX0DX to i8042 quirk table
faed5af8a9 Input: i8042 - add TUXEDO devices to i8042 quirk tables
ee77a19ee5 Input: i8042 - merge quirk tables
a789c05516 Input: i8042 - move __initconst to fix code styling warning
d0332cbf53 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
5bf0010b87 usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
db3798943a usb: dwc3: qcom: enable vbus override when in OTG dr-mode
fefffc7825 usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
e4650c04de iio: adc: stm32-dfsdm: fill module aliases
165511b99e net/x25: Fix to not accept on connected socket
b05664e036 i2c: rk3x: fix a bunch of kernel-doc warnings
d4d765f476 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
6122ce1de1 scsi: target: core: Fix warning on RT kernels
d92a25627b efi: fix potential NULL deref in efi_mem_reserve_persistent
ed6c5e8caf net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
743f7b51fe virtio-net: Keep stop() to follow mirror sequence of open()
aed972fbf6 selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
df1213a267 selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
6c70ece3d3 selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
d47f886d0c selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
db3f016ad5 ata: libata: Fix sata_down_spd_limit() when no link speed is reported
6950df42a0 can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
cb079b0770 net: phy: meson-gxl: Add generic dummy stubs for MMD register access
db76fc535f squashfs: harden sanity check in squashfs_read_xattr_id_table
dffe83a198 netfilter: br_netfilter: disable sabotage_in hook after first suppression
20355b9569 netrom: Fix use-after-free caused by accept on already connected socket
03eb2a1b03 fix "direction" argument of iov_iter_kvec()
34b0fab797 fix iov_iter_bvec() "direction" argument
50b70599c0 WRITE is "data source", not destination...
21081886de scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
14be8b0c4e arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
d6870f3800 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
412fddc096 ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
79dfde344e bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
53785fd9b3 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
e367c7b762 Merge 5.4.231 into android11-5.4-lts
59342376e8 Linux 5.4.231
268d595d4d Revert "xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()"
6c24a20223 usb: host: xhci-plat: add wakeup entry at sysfs
1c1291a84e Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
af51fc23a0 ipv6: ensure sane device mtu in tunnels
a7cc1b5d76 exit: Use READ_ONCE() for all oops/warn limit reads
eb768617da docs: Fix path paste-o for /sys/kernel/warn_count
6f18d28c26 panic: Expose "warn_count" to sysfs
7c1273646f panic: Introduce warn_limit
51538bdde3 panic: Consolidate open-coded panic_on_warn checks
7020a9234e exit: Allow oops_limit to be disabled
5a3482f2c1 exit: Expose "oops_count" to sysfs
28facdf7b0 exit: Put an upper limit on how often we can oops
3fa431bac2 ia64: make IA64_MCA_RECOVERY bool instead of tristate
86926761ca csky: Fix function name in csky_alignment() and die()
3bf1fa2c7b h8300: Fix build errors from do_exit() to make_task_dead() transition
fcae924b94 hexagon: Fix function name in die()
49a128ae28 objtool: Add a missing comma to avoid string concatenation
9a18c9c833 exit: Add and use make_task_dead.
2f87e25512 mm: kasan: do not panic if both panic_on_warn and kasan_multishot set
119f6bcef7 panic: unset panic_on_warn inside panic()
f6c20ed17e sysctl: add a new register_sysctl_init() interface
dbe634ce82 dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
1986cd616b blk-cgroup: fix missing pd_online_fn() while activating policy
4923160393 bpf: Skip task with pid=1 in send_signal_common()
bd393f0ad5 ARM: dts: imx: Fix pca9547 i2c-mux node name
8667280a67 x86/asm: Fix an assembler warning with current binutils
1a5119369a clk: Fix pointer casting to prevent oops in devm_clk_release()
fbf7b0e4ce perf/x86/amd: fix potential integer overflow on shift of a int
f571e34005 netfilter: conntrack: unify established states for SCTP paths
8770cd9d7c x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
4d1757f9fe block: fix and cleanup bio_check_ro
3a10a4d5d0 nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
5246266958 Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
f7a5644129 net: mdio-mux-meson-g12a: force internal PHY off on mux switch
2635c4fd91 net: xgene: Move shared header file into include/linux
a70b966c6c net/phy/mdio-i2c: Move header file to include/linux/mdio
a9a022a0db net/tg3: resolve deadlock in tg3_reset_task() during EEH
92a65b0f20 thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
e249cea3ab net: ravb: Fix possible hang if RIS2_QFF1 happen
a7585028ac sctp: fail if no bound addresses can be used for a given scope
dae05cd371 net/sched: sch_taprio: do not schedule in taprio_reset()
fe9b9e621c netrom: Fix use-after-free of a listening socket.
67ac3b4cd5 netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
8f0eb24f1a ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
746db9ec1e ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
4cde1d2f16 netlink: annotate data races around sk_state
c64bb85471 netlink: annotate data races around dst_portid and dst_group
ea11a52f55 netlink: annotate data races around nlk->portid
cfdd81ae47 netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
ddd49cbbd4 net: fix UaF in netns ops registration error path
3e5082b1c6 netlink: prevent potential spectre v1 gadgets
66e10d5f39 EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
594618c701 EDAC/device: Respect any driver-supplied workqueue polling value
a536d87ec7 ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
768e8cdf93 thermal: intel: int340x: Protect trip temperature from concurrent updates
aa33d334bd KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
91be54849d cifs: Fix oops due to uncleared server->smbd_conn in reconnect
bcb65adaa9 ftrace/scripts: Update the instructions for ftrace-bisect.sh
31b2414abe trace_events_hist: add check for return value of 'create_hist_field'
76b2390fdc tracing: Make sure trace_printk() can output as soon as it can be used
4a4a22dda0 module: Don't wait for GOING modules
1cd70d8427 scsi: hpsa: Fix allocation size for scsi_host_alloc()
4d55f918e1 Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
e588a5872d Revert "Revert "xhci: Set HCD flag to defer primary roothub registration""
8eb5a68064 fs: reiserfs: remove useless new_opts in reiserfs_remount
a61bc9197d netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
d39117d779 Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
b4253b47bf mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
14b70b4b4a mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning
7e66f28ce5 mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci
a58c144b9e lockref: stop doing cpu_relax in the cmpxchg loop
d6ff82a4d7 platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
295690bb05 platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
890d850cb2 scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
45b3fc9cc6 KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
dc0867c447 spi: spidev: remove debug messages that access spidev->spi without locking
0dfd34fb45 ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
9e02118045 ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
3163f4ed49 cpufreq: armada-37xx: stop using 0 as NULL pointer
1ec79234c2 s390/debug: add _ASM_S390_ prefix to header guard
1869922405 drm: Add orientation quirk for Lenovo ideapad D330-10IGL
aff2bc5784 ASoC: fsl_micfil: Correct the number of steps on SX controls
1c587aa6cd cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
8cca0afcce tcp: fix rate_app_limited to default to 1
11a4d51a4f net: dsa: microchip: ksz9477: port map correction in ALU table entry register
02a4a7dc90 driver core: Fix test_async_probe_init saves device in wrong array
276052159b w1: fix WARNING after calling w1_process()
82867190ce w1: fix deadloop in __w1_remove_master_device()
c9ada35340 tcp: avoid the lookup process failing to get sk in ehash table
e963b33723 dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
9b4482267e dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
fe39e74a64 dmaengine: xilinx_dma: use devm_platform_ioremap_resource()
d3065cc562 HID: betop: check shape of output reports
d16b83c804 net: macb: fix PTP TX timestamp failure due to packet padding
18dd3b30d4 dmaengine: Fix double increment of client_count in dma_chan_get()
cbed756bd1 drm/panfrost: fix GENERIC_ATOMIC64 dependency
914c58fec1 net: mlx5: eliminate anonymous module_init & module_exit
7335ba0c03 usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
a8d40942df usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
edec50677b HID: revert CHERRY_MOUSE_000C quirk
efa29f4ba0 net: stmmac: fix invalid call to mdiobus_get_phy()
8c3653c4e7 HID: check empty report_list in bigben_probe()
89e7fe3999 HID: check empty report_list in hid_validate_values()
8a7b9560a3 net: mdio: validate parameter addr in mdiobus_get_phy()
ce1e79bf31 net: usb: sr9700: Handle negative len
4fd6a6b101 l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
7188c37f3c l2tp: Serialize access to sk_user_data with sk_callback_lock
24c7614d31 net: fix a concurrency bug in l2tp_tunnel_register()
1200388a0b net/sched: sch_taprio: fix possible use-after-free
9042a9a3f2 wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
de0e084f85 gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
8df414fce4 net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
a59cdbda37 net: nfc: Fix use-after-free in local_cleanup()
2a05d513d2 phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
81b3374944 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
8b35c7f692 amd-xgbe: Delay AN timeout during KR training
b85e0bb478 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
3d41f4eeab affs: initialize fsdata in affs_truncate()
03965f8ad2 IB/hfi1: Fix expected receive setup error exit issues
f5c918dc4e IB/hfi1: Reserve user expected TIDs
d307c75f43 IB/hfi1: Reject a zero-length user expected buffer
902063a9fe RDMA/core: Fix ib block iterator counter overflow
048c17b619 tomoyo: fix broken dependency on *.conf.default
8d23f5d252 EDAC/highbank: Fix memory leak in highbank_mc_probe()
97445814ef HID: intel_ish-hid: Add check for ishtp_dma_tx_map
4be51ea91a ARM: imx: add missing of_node_put()
12a763015b ARM: imx35: Retrieve the IIM base address from devicetree
3b76bc1598 ARM: imx31: Retrieve the IIM base address from devicetree
61669e6dec ARM: imx27: Retrieve the SYSCTRL base address from devicetree
d4e913bad2 ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
6d7f384268 memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
8959188b2f memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
310268050d clk: Provide new devm_clk helpers for prepared and enabled clocks
c7ef7185a1 clk: generalize devm_clk_get() a bit
46d9b30a0c Merge changes into android11-5.4-lts
cc162d31ce Merge branch 'android11-5.4' into android11-5.4-lts
bc37d9c8b3 Merge 5.4.230 into android11-5.4-lts
90245959a5 Linux 5.4.230
29487eed37 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
7242fc8c2f x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
2b1375fac0 drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
763a74e1de drm/amd/display: Fix set scaling doesn's work
39e0844a1e drm/i915: re-disable RC6p on Sandy Bridge
ffef77794f gsmi: fix null-deref in gsmi_get_variable
b4461af0a5 serial: atmel: fix incorrect baudrate setup
55f9aca283 dmaengine: tegra210-adma: fix global intr clear
5d99369685 serial: pch_uart: Pass correct sg to dma_unmap_sg()
97697a252b dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
aa1b22daa0 usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
a21da7f7aa usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
83b0aac55d usb: gadget: g_webcam: Send color matching descriptor per frame
004fbb049b usb: typec: altmodes/displayport: Fix pin assignment calculation
a1478ef59b usb: typec: altmodes/displayport: Add pin assignment helper
040e0d1281 usb: host: ehci-fsl: Fix module alias
8d5740ad8f USB: serial: cp210x: add SCALANCE LPE-9000 device id
9a39f4626b USB: gadgetfs: Fix race between mounting and unmounting
1bc1fdd73f cifs: do not include page data when checking signature
89ac597e3e btrfs: fix race between quota rescan and disable leading to NULL pointer deref
61cad0c61c mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
4f96ae71d3 comedi: adv_pci1760: Fix PWM instruction handling
f11a689164 usb: core: hub: disable autosuspend for TI TUSB8041
556dfdb226 misc: fastrpc: Fix use-after-free race condition for maps
4b5c44e924 misc: fastrpc: Don't remove map on creater_process and device_release
04eb41ec96 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
7ebb3ecab1 USB: serial: option: add Quectel EM05CN modem
32165699a0 USB: serial: option: add Quectel EM05CN (SG) modem
81affe3b46 USB: serial: option: add Quectel EC200U modem
a7c19d94b8 USB: serial: option: add Quectel EM05-G (RS) modem
5966eda550 USB: serial: option: add Quectel EM05-G (CS) modem
eece7a6c97 USB: serial: option: add Quectel EM05-G (GR) modem
96b02125dd prlimit: do_prlimit needs to have a speculation check
afcb4e0ab8 xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
84e2e57769 usb: acpi: add helper to check port lpm capability using acpi _DSM
8a6e963bf2 xhci: Add a flag to disable USB3 lpm on a xhci root port level.
cf6e5d3c2d xhci: Add update_hub_device override for PCI xHCI hosts
133b902378 xhci: Fix null pointer dereference when host dies
9891e5c73c usb: xhci: Check endpoint is valid before dereferencing it
643f7da782 xhci-pci: set the dma max_seg_size
890792b579 ALSA: hda/realtek - Turn on power early
e60730280b drm/i915/gt: Reset twice
2e3e2649ea efi: fix userspace infinite retry read efivars after EFI runtime services page fault
b0ba060d32 nilfs2: fix general protection fault in nilfs_btree_insert()
53dd833fd0 Add exception protection processing for vd in axi_chan_handle_err function
33a4d05138 wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
557e85ff9a f2fs: let's avoid panic if extent_tree is not created
7165dd4c3b RDMA/srp: Move large values to a new enum for gcc13
19304ffb7b net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
4de1a5af1b selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
a869f7b054 pNFS/filelayout: Fix coalescing test for single DS
931c2a07ff Revert "net: add atomic_long_t to net_device_stats fields"
b1330360db Revert "PM/devfreq: governor: Add a private governor_data for governor"
68fdd20442 Merge 5.4.229 into android11-5.4-lts
1349fe3a33 Linux 5.4.229
68a37dc77e tipc: call tipc_lxc_xmit without holding node_read_lock
1140c3f7ad ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
2db88851fa tipc: Add a missing case of TIPC_DIRECT_MSG type
38b5d7054d tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started
3188f80b80 tipc: fix use-after-free in tipc_disc_rcv()
3eeb06132d Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
ecd47ffc99 mm: Always release pages to the buddy allocator in memblock_free_late().
5fcf75a8a4 efi: fix NULL-deref in init error path
b30e5dd077 arm64: cmpxchg_double*: hazard against entire exchange variable
ecdd65051b arm64: atomics: remove LL/SC trampolines
f840000928 arm64: atomics: format whitespace consistently
d01d6d2b06 drm/virtio: Fix GEM handle creation UAF
3030f11f27 x86/resctrl: Fix task CLOSID/RMID update race
22c4eeafc3 x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI
b3f9242467 iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
ecfe33e075 iommu/mediatek-v1: Add error handle for mtk_iommu_probe
ec049ae2b4 net/mlx5: Fix ptp max frequency adjustment range
62d707dabb net/mlx5: Rename ptp clock info
2b157c3c5d net/sched: act_mpls: Fix warning during failed attribute validation
9424d2205f nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
576eadef2c hvc/xen: lock console list traversal
7d04fe153d tipc: fix unexpected link reset due to discovery messages
95b2d4889f tipc: eliminate checking netns if node established
d6418829ce tipc: improve throughput between nodes in netns
d443308edb regulator: da9211: Use irq handler when ready
43f48e6c30 EDAC/device: Fix period calculation in edac_device_reset_delay_period()
a5b737623e x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
d0c6d2a310 powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
feefb33eef netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
e431b4fb1f ext4: fix uninititialized value in 'ext4_evict_inode'
026a4490b5 ext4: fix use-after-free in ext4_orphan_cleanup
fa41a133ea ext4: lost matching-pair of trace in ext4_truncate
1d5524832f ext4: fix bug_on in __es_tree_search caused by bad quota inode
3da22d06e0 quota: Factor out setup of quota inode
ecb9d0d2e1 jbd2: use the correct print format
06bb3f4e3b usb: ulpi: defer ulpi_register on ulpi_read_id timeout
a2689a4464 wifi: wilc1000: sdio: fix module autoloading
3998dba0f7 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
53cefa802f ixgbe: fix pci device refcount leak
e0d6f3b62b platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
1ad759df6a drm/msm/adreno: Make adreno quirks not overwrite each other
098416c4e3 cifs: Fix uninitialized memory read for smb311 posix symlink create
d6546426cd ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
eaa5580a74 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
c6d29a5ffd net/ulp: prevent ULP without clone op from entering the LISTEN status
b318d41f1b s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
f6da927c92 s390/kexec: fix ipl report address for kdump
4bf6e11c34 perf auxtrace: Fix address filter duplicate symbol selection
2e4164d3d1 docs: Fix the docs build with Sphinx 6.0
3ed183074c efi: tpm: Avoid READ_ONCE() for accessing the event log
3ad31129ce KVM: arm64: Fix S1PTW handling on RO memslots
9b83ec63d0 net: sched: disallow noqueue for qdisc classes
aa52acefc6 driver core: Fix bus_type.match() error handling in __driver_attach()
8d60a90560 selftests: set the BUILD variable to absolute path
cad6d2bb47 selftests: Fix kselftest O=objdir build from cluttering top level objdir
320dbbd86f parisc: Align parisc MADV_XXX constants with all other architectures
d868597b71 mbcache: Avoid nesting of cache->c_list_lock under bit locks
da23752d96 hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
781fa14141 hfs/hfsplus: use WARN_ON for sanity check
b47c690109 ext4: don't allow journal inode to have encrypt flag
1464feb5b6 riscv: uaccess: fix type of 0 variable on error in get_user()
da41069c61 nfsd: fix handling of readdir in v4root vs. mount upcall timeout
8cbd7f2643 x86/bugs: Flush IBP in ib_prctl_set()
ba780bff9f ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
e66ae100e7 udf: Fix extension of the last extent in the file
33df9c5d5e caif: fix memory leak in cfctrl_linkup_request()
3cb1ee82e4 drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
ebe6d2fcf7 usb: rndis_host: Secure rndis_query check against int overflow
a07b4895b9 drivers/net/bonding/bond_3ad: return when there's no aggregator
2f7a09c1ee perf tools: Fix resources leak in perf_data__open_dir()
6b17b84634 net: sched: cbq: dont intepret cls results when asked to drop
63e469cb54 net: sched: atm: dont intepret cls results when asked to drop
d16e5fefd8 RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
564fdc2f8b RDMA/uverbs: Silence shiftTooManyBitsSigned warning
00616bd191 net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
904ad95b39 net: amd-xgbe: add missed tasklet_kill
a15cbe9b84 vhost: fix range used in translate_desc()
d8e410315a nfc: Fix potential resource leaks
8f97eeb02a qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
55ac68b53f net: sched: fix memory leak in tcindex_set_parms
b6a0623f75 net: hns3: add interrupts re-initialization while doing VF FLR
f9c551d874 nfsd: shut down the NFSv4 state objects before the filecache
7eaaee5268 bpf: pull before calling skb_postpull_rcsum()
1d449cd240 SUNRPC: ensure the matching upcall is in-flight upon downcall
af53065276 ext4: fix deadlock due to mbcache entry corruption
711ef736dd mbcache: automatically delete entries from cache on freeing
af8ecc8d20 ext4: fix race when reusing xattr blocks
ea4b9091aa ext4: unindent codeblock in ext4_xattr_block_set()
a5f9bd4bea ext4: remove EA inode entry from mbcache on inode eviction
951ea4d3df mbcache: add functions to delete entry if unused
81b0bb1eb2 mbcache: don't reclaim used entries
c2f1e12b65 ext4: use kmemdup() to replace kmalloc + memcpy
6453836e37 fs: ext4: initialize fsdata in pagecache_write()
1af609646c ext4: use memcpy_to_page() in pagecache_write()
49dac5e017 mm/highmem: Lift memcpy_[to|from]_page to core
f44dcd9dce ext4: correct inconsistent error msg in nojournal mode
b02aa6a05a ext4: goto right label 'failed_mount3a'
e0fce1d665 ravb: Fix "failed to switch device to config mode" message during unbind
0ebcfdc8c9 KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1
e723bafd8f KVM: VMX: Fix the spelling of CPU_BASED_USE_TSC_OFFSETTING
7290669045 KVM: VMX: Rename NMI_PENDING to NMI_WINDOW
da8ff59210 KVM: VMX: Rename INTERRUPT_PENDING to INTERRUPT_WINDOW
db99c8d6b7 KVM: retpolines: x86: eliminate retpoline from vmx.c exit handlers
2c82f134b9 KVM: x86: optimize more exit handlers in vmx.c
6e3f6d9562 perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
fc67c00def perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
d06a7e2049 dm thin: resume even if in FAIL mode
28cdd90c26 media: s5p-mfc: Fix in register read and write for H264
640075400c media: s5p-mfc: Clear workbit to handle error condition
4a52a1a3ea media: s5p-mfc: Fix to handle reference queue during finishing
b9275d8a92 PM/devfreq: governor: Add a private governor_data for governor
839f3ca8bc btrfs: replace strncpy() with strscpy()
b5db135457 ext4: allocate extended attribute value in vmalloc area
6ef8b0a743 ext4: avoid unaccounted block allocation when expanding inode
b14a553b0f ext4: initialize quota before expanding inode in setproject ioctl
9ef603086c ext4: fix inode leak in ext4_xattr_inode_create() on an error path
7138ef745e ext4: avoid BUG_ON when creating xattrs
4d84ec8e5c ext4: fix error code return to user-space in ext4_get_branch()
a4c3c1d57d ext4: fix corruption when online resizing a 1K bigalloc fs
6f4200ec76 ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
f263e349ba ext4: init quota for 'old.inode' in 'ext4_rename'
78e335fb57 ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
362ce137d5 ext4: fix reserved cluster accounting in __es_remove_extent()
e1d946d9c8 ext4: add helper to check quota inums
2142dfa1de ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
4690a4bdcf ext4: fix undefined behavior in bit shift for ext4_check_flag_values
e347c269b5 ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
94b283341f drm/vmwgfx: Validate the box size for the snooped cursor
eea62f0461 drm/connector: send hotplug uevent on connector cleanup
fbfd6dee52 device_cgroup: Roll back to original exceptions after copy failure
5e4500454d parisc: led: Fix potential null-ptr-deref in start_task()
662dc7c6be iommu/amd: Fix ivrs_acpihid cmdline parsing code
93e919d9ac crypto: n2 - add missing hash statesize
a5866d531b PCI/sysfs: Fix double free in error path
65bd096299 PCI: Fix pci_device_is_present() for VFs by checking PF
d23006f2a5 ipmi: fix use after free in _ipmi_destroy_user()
cf19abbe4b ima: Fix a potential NULL pointer access in ima_restore_measurement_list
b163363535 mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
74531c23ad ipmi: fix long wait in unload when IPMI disconnect
d4f48c648a efi: Add iMac Pro 2017 to uefi skip cert quirk
2c4832a089 md/bitmap: Fix bitmap chunk size overflow issues
b869cb7a3d cifs: fix missing display of three mount options
149babe5e0 cifs: fix confusing debug message
a29d621309 media: dvb-core: Fix UAF due to refcount races at releasing
b21f62b49e media: dvb-core: Fix double free in dvb_register_device()
50c2379f87 ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
c42cb66a89 tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
cb03fc217b tracing/hist: Fix wrong return value in parse_action_params()
f5489d5a24 x86/microcode/intel: Do not retry microcode reloading on the APs
cf79d5410a tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
1a5165e80a dm cache: set needs_check flag after aborting metadata
2f097dfac7 dm cache: Fix UAF in destroy()
520b56cfd9 dm clone: Fix UAF in clone_dtr()
792e51aac3 dm integrity: Fix UAF in dm_integrity_dtr()
7ae6aa6493 dm thin: Fix UAF in run_timer_softirq()
f758987ff0 dm thin: Use last transaction's pmd->root when commit failed
200aa33b5d dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
f472bfc95d dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
52ba5b87a3 binfmt: Fix error return code in load_elf_fdpic_binary()
33933af45d binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf
3cdd91a916 cpufreq: Init completion before kobject_init_and_add()
6ccb116e6b selftests: Use optional USERCFLAGS and USERLDFLAGS
2b8f2e127d arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
b22d683c90 ARM: ux500: do not directly dereference __iomem
c59ee1528b btrfs: fix resolving backrefs for inline extent followed by prealloc
e63e1c6793 mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
3de2c36283 ktest.pl minconfig: Unset configs instead of just removing them
d10523afa8 kest.pl: Fix grub2 menu handling for rebooting
d089baa5b6 soc: qcom: Select REMAP_MMIO for LLCC driver
bcce46e115 media: stv0288: use explicitly signed char
de2ea2a0ad net/af_packet: make sure to pull mac header
ad3f90a9c4 net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
aa91afe597 SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
e027f3b9fa tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
927860dfa1 tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
f1c08947ab mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
f4b5a27f56 f2fs: should put a page when checking the summary info
f02d2e2b9b mm, compaction: fix fast_isolate_around() to stay within boundaries
384ef33d37 md: fix a crash in mempool_free
2dae4211b5 pnode: terminate at peers of source
25e8c6ecb4 ALSA: line6: fix stack overflow in line6_midi_transmit
10a07d81f6 ALSA: line6: correct midi status byte when receiving data from podxt
0e727c328e ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
cae6dddef2 hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
fe83242eab HID: plantronics: Additional PIDs for double volume key presses quirk
b201fe49ee HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
515959eb49 powerpc/rtas: avoid scheduling in rtas_os_term()
c2fa91abf2 powerpc/rtas: avoid device tree lookups in rtas_os_term()
418ef921cc objtool: Fix SEGFAULT
28046827c3 nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
24561f5d09 nvme: resync include/linux/nvme.h with nvmecli
e69e8d7867 ata: ahci: Fix PCS quirk application for suspend
e74d9f13a4 nvme-pci: fix doorbell buffer value endianness
e8e2861cc3 cifs: fix oops during encryption
3c3baa40dc media: dvbdev: fix refcnt bug
334a76861b media: dvbdev: fix build warning due to comments
2a0e42877d gcov: add support for checksum field
328f3c084f regulator: core: fix deadlock on regulator enable
fb0407d8cd iio: adc128s052: add proper .data members in adc128_of_match table
bcb052a87d iio: adc: ad_sigma_delta: do not use internal iio_dev lock
ad4eb32ced reiserfs: Add missing calls to reiserfs_security_free()
5a5ef1882f HID: wacom: Ensure bootloader PID is usable in hidraw mode
9e8f60094e usb: dwc3: core: defer probe on ulpi_read_id timeout
7778fa1ca8 ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
12622fa053 ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
fad324bc07 pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
e56423bb8e pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
e8a1ccd120 ASoC: rt5670: Remove unbalanced pm_runtime_put()
737058bd0b ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
d456c253f3 ASoC: wm8994: Fix potential deadlock
2705bb1661 ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
ed1376f771 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
df9cd38c3b ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
56f630a0d5 ASoC: Intel: Skylake: Fix driver hang during shutdown
fd0d3bf37d ALSA: hda: add snd_hdac_stop_streams() helper
d5952155d6 ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
bdc2d33fa2 orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
2e7c091210 orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
511b48ee8e drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
6c00350c9f drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
fa71639873 hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
713ad301c2 clk: st: Fix memory leak in st_of_quadfs_setup()
0ca298d548 media: si470x: Fix use-after-free in si470x_int_in_callback()
21d26381e1 mmc: f-sdh30: Add quirks for broken timeout clock capability
5bfc53df28 regulator: core: fix use_count leakage when handling boot-on
87fd18016a blk-mq: fix possible memleak when register 'hctx' failed
17217737c1 media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
6d18b44bb4 media: dvbdev: adopts refcnt to avoid UAF
438a4a8dec media: dvb-frontends: fix leak of memory fw
89357aa97b bpf: Prevent decl_tag from being referenced in func_proto arg
7da524781c ppp: associate skb with a device at tx
aadb1507a7 mrp: introduce active flags to prevent UAF when applicant uninit
4bdcc6a5aa net: add atomic_long_t to net_device_stats fields
19d5a0e17a md/raid1: stop mdx_raid1 thread when raid1 array run failed
5d8d046f3d drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
2b1b145ca1 drm/sti: Use drm_mode_copy()
272d12b5f3 drm/rockchip: Use drm_mode_copy()
20022d551f s390/lcs: Fix return type of lcs_start_xmit()
4bee3c75d5 s390/netiucv: Fix return type of netiucv_tx()
e859e02fbf s390/ctcm: Fix return type of ctc{mp,}m_tx()
f96bd8adc8 igb: Do not free q_vector unless new one was allocated
5b06a8a25e wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
e390838eef hamradio: baycom_epp: Fix return type of baycom_send_packet()
dbe1a6b930 net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
772431f30c bpf: make sure skb->len != 0 when redirecting to a tunneling device
9066300fe8 ipmi: fix memleak when unload ipmi driver
8234c522ef ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
7360b323e0 wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
ca57748593 wifi: ath9k: verify the expected usb_endpoints are present
3cc9299036 brcmfmac: return error when getting invalid max_flowrings from dongle
e44bfef5bf drm/etnaviv: add missing quirks for GC300
90103ccb6e hfs: fix OOB Read in __hfs_brec_find
a815a3e019 acct: fix potential integer overflow in encode_comp_t()
d706485dff nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
9ef353c92f ACPICA: Fix error code path in acpi_ds_call_control_method()
50163a1158 fs: jfs: fix shift-out-of-bounds in dbDiscardAG
156d440dea udf: Avoid double brelse() in udf_rename()
359616ce58 fs: jfs: fix shift-out-of-bounds in dbAllocAG
419b808504 binfmt_misc: fix shift-out-of-bounds in check_special_flags
3d92527a91 rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
4f1d37ff42 net: stream: purge sk_error_queue in sk_stream_kill_queues()
fbae0dc7e2 myri10ge: Fix an error handling path in myri10ge_probe()
67af8655c8 rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
93e794d4fe net_sched: reject TCF_EM_SIMPLE case for complex ematch module
b3a5c76f61 mailbox: zynq-ipi: fix error handling while device_register() fails
668dc454bc skbuff: Account for tail adjustment during pull operations
8b74211bf6 openvswitch: Fix flow lookup to use unmasked key
0e91836628 rtc: mxc_v2: Add missing clk_disable_unprepare()
b0a6135902 r6040: Fix kmemleak in probe and remove
8bddef54cb nfc: pn533: Clear nfc_target before being used
db77d4d005 mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
82ff73638c mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
5a35d18e79 mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
fddac3b457 nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
f06d3feee9 NFSD: Add tracepoints to NFSD's duplicate reply cache
fe142d5cee nfsd: Define the file access mode enum for tracing
aa5fafd4a6 rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
686f0793f7 rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
1240ed71a0 remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
27441fab26 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
292c0f3b4a pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
2b7ad43574 selftests/powerpc: Fix resource leaks
39633b4051 powerpc/hv-gpci: Fix hv_gpci event list
aed862896d powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
d539b77bae powerpc/perf: callchain validate kernel stack pointer bounds
cfb5bbfcb6 powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
f2d60f6ba1 cxl: Fix refcount leak in cxl_calc_capp_routing
9bf842ffdd powerpc/52xx: Fix a resource leak in an error handling path
b703da16dc macintosh/macio-adb: check the return value of ioremap()
b29a2f1dd3 macintosh: fix possible memory leak in macio_add_one_device()
17fd440594 iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
8581ec1feb iommu/amd: Fix pci device refcount leak in ppr_notifier()
0d96a6f5db rtc: pcf85063: Fix reading alarm
bb1bdc72dd rtc: snvs: Allow a time difference on clock register read
6a54d03337 include/uapi/linux/swab: Fix potentially missing __always_inline
f170d4bd38 RDMA/siw: Fix pointer cast warning
8ea68b4e3f power: supply: fix null pointer dereferencing in power_supply_get_battery_info
61e80e7929 HSI: omap_ssi_core: Fix error handling in ssi_init()
7ae85631ae perf symbol: correction while adjusting symbol
739b4294f8 perf trace: Handle failure when trace point folder is missed
1b4053ad54 perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
443aaf605f perf trace: Add a strtoul() method to 'struct syscall_arg_fmt'
339e08e185 perf trace: Allow associating scnprintf routines with well known arg names
97cc27a28d perf trace: Add the syscall_arg_fmt pointer to syscall_arg
a2fcb44f5e perf trace: Factor out the initialization of syscal_arg_fmt->scnprintf
ba67de37ad perf trace: Separate 'struct syscall_fmt' definition from syscall_fmts variable
6086919d8c perf trace: Return error if a system call doesn't exist
f84fff700d power: supply: fix residue sysfs file in error handle route of __power_supply_register()
ef87ed9add HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
e9a32f7523 HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
0f049375ad fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
3c9aaa58f7 fbdev: vermilion: decrease reference count in error path
9413f188ef fbdev: via: Fix error in via_core_init()
65dbd8eefa fbdev: pm2fb: fix missing pci_disable_device()
77738055e2 fbdev: ssd1307fb: Drop optional dependency
72c8770e35 samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
19b651db94 tracing/hist: Fix issue of losting command info in error_log
fab2536ba1 usb: storage: Add check for kcalloc
cdcbae2c50 i2c: ismt: Fix an out-of-bounds bug in ismt_access()
f3f65c4177 vme: Fix error not catched in fake_init()
e5c97a433c staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
288ada16a9 staging: rtl8192u: Fix use after free in ieee80211_rx()
c226717aa8 i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
d85b5247a7 chardev: fix error handling in cdev_device_add()
110dc34c9f mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
68e54d9ee8 drivers: mcb: fix resource leak in mcb_probe()
80dc47e751 usb: gadget: f_hid: fix refcount leak on error path
c78c87c4e3 usb: gadget: f_hid: fix f_hidg lifetime vs cdev
efa2ed93e5 usb: gadget: f_hid: optional SETUP/SET_REPORT mode
5e193764c2 usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
76740fd8c6 counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
361412dae1 cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
60b2ed21a6 cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
0078dd8758 misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
ee2715faf7 misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
0cd0506237 misc: ocxl: fix possible name leak in ocxl_file_register_afu()
628de998a3 test_firmware: fix memory leak in test_firmware_init()
98c01a728b serial: sunsab: Fix error handling in sunsab_init()
61f4146a7e serial: altera_uart: fix locking in polling mode
ce40c44e62 tty: serial: altera_uart_{r,t}x_chars() need only uart_port
071bb9e363 tty: serial: clean up stop-tx part in altera_uart_tx_chars()
d165388227 serial: pch: Fix PCI device refcount leak in pch_request_dma()
06c886548c serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
965f07ea5f serial: amba-pl011: avoid SBSA UART accessing DMACR register
4f257e2eba usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
af4049a2ff usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
a45ba33d39 staging: vme_user: Fix possible UAF in tsi148_dma_list_add
90e227d8b4 usb: fotg210-udc: Fix ages old endianness issues
12d20ba3ce uio: uio_dmem_genirq: Fix deadlock between irq config and handling
eca77a25a7 uio: uio_dmem_genirq: Fix missing unlock in irq configuration
c2163ecc48 vfio: platform: Do not pass return buffer to ACPI _RST method
3e0efc3f3f class: fix possible memory leak in __class_register()
0c44f584e3 serial: tegra: Read DMA status before terminating
dcb26ea75d tty: serial: tegra: Activate RX DMA transfer by request
da64e01da4 drivers: dio: fix possible memory leak in dio_init()
d4bf3fcccd IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
5cc818ad53 hwrng: geode - Fix PCI device refcount leak
1199f8e029 hwrng: amd - Fix PCI device refcount leak
c75ea343e4 crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
76a9a58a71 orangefs: Fix sysfs not cleanup when dev init failed
5a2028369d RDMA/hfi1: Fix error return code in parse_platform_config()
7917484c99 crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
c21a09ed1e f2fs: avoid victim selection from previous victim section
91f63dd622 RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
6866154c23 scsi: snic: Fix possible UAF in snic_tgt_create()
be5f1a82ad scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
eccbec017c scsi: ipr: Fix WARNING in ipr_init()
c9f83544fb scsi: fcoe: Fix possible name leak when device_register() fails
3c4bb9446d scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
6fac40d806 scsi: hpsa: Fix error handling in hpsa_add_sas_host()
d60000cb11 scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
89e3f7324a crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
f8fc2f1865 scsi: hpsa: Fix possible memory leak in hpsa_init_one()
bd7106a600 RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
a36c929fd7 crypto: ccree - Make cc_debugfs_global_fini() available for module init function
895bbed5ae RDMA/hfi: Decrease PCI device reference count in error path
7e68c0d095 PCI: Check for alloc failure in pci_request_irq()
a234815cee crypto: ccree - Remove debugfs when platform_driver_register failed
ca438aa466 crypto: ccree - swap SHA384 and SHA512 larval hashes at build time
263d21afba scsi: scsi_debug: Fix a warning in resp_write_scat()
b5848661f1 RDMA/siw: Set defined status for work completion with undefined status
ad1676587c RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
6af043089d RDMA/siw: Fix immediate work request flush to completion queue
ef6079d98f f2fs: fix normal discard process
7826e4c85e RDMA/core: Fix order of nldev_exit call
3339d808b6 apparmor: Use pointer to struct aa_label for lbs_cred
f7368ac846 apparmor: Fix abi check to include v8 abi
e1a68ac015 apparmor: fix lockdep warning when removing a namespace
eb0f78e28c apparmor: fix a memleak in multi_transaction_new()
df121012e4 stmmac: fix potential division by 0
203d604bd5 Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
5e832e0182 Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
8ae86c1ec2 Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
f360585691 Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
78e76830c7 Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
b38b064cba Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
f6d822ce4b Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
a6b9e09403 ntb_netdev: Use dev_kfree_skb_any() in interrupt context
3f2946a54b net: lan9303: Fix read error execution path
7d67e8ccfc can: tcan4x5x: Remove invalid write in clear_interrupts
068672e75b net: amd-xgbe: Check only the minimum speed for active/passive cables
291b9669f6 net: amd-xgbe: Fix logic around active and passive cables
bc06c239d5 net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
1e39d57a0e hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
20dd873605 net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
3b748ba07b net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
4b8256d9bf net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
bc51a3cadf net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
303000c793 net/tunnel: wait until all sk_user_data reader finish before releasing the sock
0c5f2c7700 net: farsync: Fix kmemleak when rmmods farsync
cf7416aa01 ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
9ec5781879 of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
a44490abaf drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
429370c40d net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
bba527e4ec net: defxx: Fix missing err handling in dfx_init()
f54731a70c net: vmw_vsock: vmci: Check memcpy_from_msg()
6f2198914f clk: socfpga: Fix memory leak in socfpga_gate_init()
dbd1a4fdf5 clk: socfpga: use clk_hw_register for a5/c5
49513eabda clk: socfpga: clk-pll: Remove unused variable 'rc'
fe783eeac4 blktrace: Fix output non-blktrace event when blk_classic option enabled
d628d5c5b4 wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
1a49bba59d wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
9e8440a657 spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
a00b4e0fa2 clk: samsung: Fix memory leak in _samsung_clk_register_pll()
7a2c66429b media: coda: Add check for kmalloc
2b436f1410 media: coda: Add check for dcoda_iram_alloc
6250bc7331 media: c8sectpfe: Add of_node_put() when breaking out of loop
0fcee27507 mmc: mmci: fix return value check of mmc_add_host()
0a41ea4fd4 mmc: wbsd: fix return value check of mmc_add_host()
f59ef2a47a mmc: via-sdmmc: fix return value check of mmc_add_host()
9e11c6bb74 mmc: meson-gx: fix return value check of mmc_add_host()
f153c9e15f mmc: omap_hsmmc: fix return value check of mmc_add_host()
6bb26abb92 mmc: atmel-mci: fix return value check of mmc_add_host()
c7a328cea7 mmc: wmt-sdmmc: fix return value check of mmc_add_host()
3b29f8769d mmc: vub300: fix return value check of mmc_add_host()
3dbb69a024 mmc: toshsd: fix return value check of mmc_add_host()
937112e991 mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
0b7b634225 mmc: pxamci: fix return value check of mmc_add_host()
32eb502c97 mmc: mxcmmc: fix return value check of mmc_add_host()
b174f2b36c mmc: moxart: fix return value check of mmc_add_host()
289c964fe1 mmc: alcor: fix return value check of mmc_add_host()
e8f20523cf NFSv4.x: Fail client initialisation if state manager thread can't run
f7a8a1e36d SUNRPC: Fix missing release socket in rpc_sockname()
bcebcb11fc xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
c7e9624d90 ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
6a8c0abcb5 media: saa7164: fix missing pci_disable_device()
4cabc3af4a bpf, sockmap: fix race in sock_map_free()
35593d60b1 regulator: core: fix resource leak in regulator_register()
90c38f57a8 configfs: fix possible memory leak in configfs_create_dir()
6dea95f640 hsr: Avoid double remove of a node.
de7dbee4bd clk: qcom: clk-krait: fix wrong div2 functions
339ba693da regulator: core: fix module refcount leak in set_supply()
46dfff9102 wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
624a989db9 spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
52fb0ffee0 bonding: uninitialized variable in bond_miimon_inspect()
31631c2ab4 bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
7508b9f4da bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
d4145d028a netfilter: conntrack: set icmpv6 redirects as RELATED
27c09443dd ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
981024abf5 drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
470a779890 drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
190685ff4e ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
0e1e311fd9 wifi: iwlwifi: mvm: fix double free on tx path.
8b0c003e37 ALSA: asihpi: fix missing pci_disable_device()
5447f1ad0b NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
e53a7c28a4 NFSv4.2: Fix initialisation of struct nfs4_label
b2b472bcda NFSv4.2: Fix a memory stomp in decode_attr_security_label
96f3c70600 NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
2672977dc0 ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
d63e9eca94 ASoC: dt-bindings: wcd9335: fix reset line polarity in example
4ea79d0747 drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
542a87f1cf media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
8b256d2336 media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
9103bf2187 media: dvb-core: Fix ignored return value in dvb_register_frontend()
3359f8d533 pinctrl: pinconf-generic: add missing of_node_put()
ffd53b7892 clk: imx: replace osc_hdmi with dummy
aa79b53df7 clk: imx8mn: correct the usb1_ctrl parent to be usb_bus
1d8521e112 media: imon: fix a race condition in send_packet()
cf9c4c25ca mtd: maps: pxa2xx-flash: fix memory leak in probe
a7fc25159d bonding: fix link recovery in mode 2 when updelay is nonzero
0879f594a7 bonding: Rename slave_arr to usable_slaves
9eaeb3e460 bonding: Export skip slave logic to function
26b94635f1 clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
96be283d10 regulator: core: use kfree_const() to free space conditionally
d884ed9a2f ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
497279199d ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
e6364854f5 HID: hid-sensor-custom: set fixed size for custom attributes
75a5bf8eeb bpf: Move skb->len == 0 checks into __bpf_redirect
61688b8819 media: videobuf-dma-contig: use dma_mmap_coherent
9ca9d7fd7d media: platform: exynos4-is: Fix error handling in fimc_md_init()
7b02c50d39 media: solo6x10: fix possible memory leak in solo_sysfs_init()
f81f63168f Input: elants_i2c - properly handle the reset GPIO when power is off
8eb64dc5a7 mtd: lpddr2_nvm: Fix possible null-ptr-deref
8e51f5894d wifi: ath10k: Fix return value in ath10k_pci_init()
8176538866 ima: Fix misuse of dereference of pointer in template_desc_init_fields()
9b7c44885a integrity: Fix memory leakage in keyring allocation error path
4d3dc0de9c amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
d39937f8de regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
a8baccb79d ASoC: pxa: fix null-pointer dereference in filter()
6f13a895ce drm/mediatek: Modify dpi power on/off sequence.
a0f26560be drm/radeon: Add the missed acpi_put_table() to fix memory leak
832d0e19ce rxrpc: Fix ack.bufferSize to be 0 when generating an ack
c9c9350d30 net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
fe443b3fe3 media: camss: Clean up received buffers on failed start of streaming
08114dc185 wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
fa0d32ab84 mtd: Fix device name leak when register device failed in add_mtd_device()
d70fa0a6ce bpf: propagate precision in ALU/ALU64 operations
54f2599060 media: vivid: fix compose size exceed boundary
38d48fd224 ima: Handle -ESTALE returned by ima_filter_rule_match()
ecd0a6f81a ima: Fix fall-through warnings for Clang
55e2430e43 ima: Rename internal filter rule functions
0b7c47b7f3 drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
3fcdc1534b spi: Update reference to struct spi_controller
d87dd4528d clk: renesas: r9a06g032: Repair grave increment error
a2046e5a36 can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
7482f95315 can: kvaser_usb: Add struct kvaser_usb_busparams
f3d20de76f can: kvaser_usb_leaf: Fix bogus restart events
ad63992b64 can: kvaser_usb_leaf: Fix wrong CAN state after stopping
9208795770 can: kvaser_usb_leaf: Fix improved state not being reported
60ad08be78 can: kvaser_usb_leaf: Set Warning state even without bus errors
12d95e65f7 can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
5779a9d0e3 can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
0e56748852 can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
3a9d74f339 can: kvaser_usb: do not increase tx statistics when sending error message frames
3f2384f09b media: i2c: ad5820: Fix error path
e8e2da03c2 pata_ipx4xx_cf: Fix unsigned comparison with less than zero
5994e7a806 wifi: rtl8xxxu: Fix reading the vendor of combo chips
988bd27de2 wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
9850791d38 wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
bb7397f631 rapidio: devices: fix missing put_device in mport_cdev_open
6a95b17e4d hfs: Fix OOB Write in hfs_asc2mac
657fea0a8d relay: fix type mismatch when allocating memory in relay_create_buf()
e275249e5e eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
311b488405 rapidio: fix possible UAF when kfifo_alloc() fails
7aa5325e1b fs: sysv: Fix sysv_nblocks() returns wrong value
cb5859603c MIPS: OCTEON: warn only once if deprecated link status is being used
b7ca75207e MIPS: BCM63xx: Add check for NULL for clk in clk_enable
14bb4bde3b platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
11ad95912b PM: runtime: Do not call __rpm_callback() from rpm_idle()
c40ee4e04b PM: runtime: Improve path in rpm_idle() when no callback
4f983ee5e5 xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
29198f667f x86/xen: Fix memory leak in xen_init_lock_cpu()
ec88254208 x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
6e98158d97 xen/events: only register debug interrupt for 2-level events
314d510535 uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
dfdde4d513 ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
805665aa52 clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
1bbad5793f rapidio: rio: fix possible name leak in rio_register_mport()
440afd7fd9 rapidio: fix possible name leaks when rio_add_device() fails
7ef516888c ocfs2: fix memory leak in ocfs2_mount_volume()
a4d3062f0a ocfs2: rewrite error handling of ocfs2_fill_super
227cc62e00 ocfs2: ocfs2_mount_volume does cleanup job before return error
5c27b46c20 debugfs: fix error when writing negative value to atomic_t debugfs file
c7bd49275d docs: fault-injection: fix non-working usage of negative values
6865a549f2 lib/notifier-error-inject: fix error when writing -errno to debugfs file
6fc6461672 libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
75940697c0 cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
d25bf9af86 genirq/irqdesc: Don't try to remove non-existing sysfs files
b4e28099cd nfsd: don't call nfsd_file_put from client states seqfile display
e6e295a434 EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
d5c06dba46 irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
e293263248 perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
81b024df47 PNP: fix name memory leak in pnp_alloc_dev()
821afb8c89 selftests/efivarfs: Add checking of the test return value
c0b8cff014 MIPS: vpe-cmp: fix possible memory leak while module exiting
b3325a4435 MIPS: vpe-mt: fix possible memory leak while module exiting
7c8bf45cea ocfs2: fix memory leak in ocfs2_stack_glue_init()
e039929e36 lib/fonts: fix undefined behavior in bit shift for get_default_font
160d6d6f14 proc: fixup uptime selftest
d7b9e43a5c timerqueue: Use rb_entry_safe() in timerqueue_getnext()
248fa44cde perf: Fix possible memleak in pmu_dev_alloc()
044ede4c38 selftests/ftrace: event_triggers: wait longer for test_event_enable
8511186f10 fs: don't audit the capability check in simple_xattr_list()
c907c55dc7 PM: hibernate: Fix mistake in kerneldoc comment
f0ff6c60bc alpha: fix syscall entry in !AUDUT_SYSCALL case
1399ce344e cpuidle: dt: Return the correct numbers of parsed idle states
082b55fe9f tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
4d3126f242 pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
e2516652da ARM: mmp: fix timer_read delay
2de791ff6f pstore/ram: Fix error return code in ramoops_probe()
ded1b82716 arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
03a666631a ARM: dts: turris-omnia: Add switch port 6 node
fe1fc4d84d ARM: dts: turris-omnia: Add ethernet aliases
b20454ea05 ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
1b7017211e ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
87b951b7c2 ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
e3cf3f7a6d ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
e302758caf ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
0a8544b723 ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
f707c3fee2 arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
fdf511fc07 arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
06fbfc5f43 arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
f0c1f46e49 arm64: dts: mt2712e: Fix unit address for pinctrl node
aaabd7e3e4 arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
d69bdb61d5 perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
af2256d778 perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
1e9186d628 soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
83cfc38091 soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
5f07c85ca1 soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
f5c521195e arm: dts: spear600: Fix clcd interrupt
3a90edbab8 drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
3459e05ad3 arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
6a24277840 ARM: dts: qcom: apq8064: fix coresight compatible
1a19212a71 usb: musb: remove extra check in musb_gadget_vbus_draw
40075e7975 net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
9fdc79b571 Bluetooth: L2CAP: Fix u8 overflow
77d5e6f260 HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk
c05a7fa010 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10
d535a33e83 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E
7346b2529f HID: ite: Add support for Acer S1002 keyboard-dock
2d91b7a0b0 xen-netback: move removal of "hotplug-status" to the right place
c581439a97 igb: Initialize mailbox message for VF reset
50aa193a4b USB: serial: f81534: fix division by zero on line-speed change
0d6bf63eb3 USB: serial: f81232: fix division by zero on line-speed change
fe0f214385 USB: serial: cp210x: add Kamstrup RF sniffer PIDs
d487670654 USB: serial: option: add Quectel EM05-G modem
b8fb1cba93 usb: gadget: uvc: Prevent buffer overflow in setup handler
2610c2e59c udf: Fix extending file within last block
ade1726d8c udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size
4d835efd56 udf: Fix preallocation discarding at indirect extent boundary
0905c78f62 udf: Discard preallocation before extending file with a hole
0758b50692 tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS
e1d491fcbf ANDROID: Add more hvc devices for virtio-console.
92a0ce5d0a Merge 5.4.228 into android11-5.4-lts
6429852aef Revert "can: af_can: fix NULL pointer dereference in can_rcv_filter"
4ae923b7c6 Merge 5.4.227 into android11-5.4-lts
57e53c3fa3 ANDROID: Revert "tracing/ring-buffer: Have polling block on watermark"
851c2b5fb7 Linux 5.4.228
ff484a9ba4 ASoC: ops: Correct bounds check for second channel on SX controls
7d4aa09299 can: mcba_usb: Fix termination command argument
f843fdcac0 can: sja1000: fix size of OCR_MODE_MASK define
b439b12d10 pinctrl: meditatek: Startup with the IRQs disabled
9796d07c75 ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
3c837460f9 nfp: fix use-after-free in area_cache_get()
a40c3c9ae5 block: unhash blkdev part inode when the part is deleted
176ba4c19d mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
69d4f3baa6 x86/smpboot: Move rcu_cpu_starting() earlier
d1988bf2bb net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
66bb2e2b24 Linux 5.4.227
898270ec11 can: esd_usb: Allow REC and TEC to return to zero
08bf219d62 net: mvneta: Fix an out of bounds check
6b6d3be366 ipv6: avoid use-after-free in ip6_fragment()
f73eb3fc9b net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
f0af234e2e xen/netback: fix build warning
99669d94ce ethernet: aeroflex: fix potential skb leak in greth_init_rings()
3295582cd7 ipv4: Fix incorrect route flushing when table ID 0 is used
2537b637ea ipv4: Fix incorrect route flushing when source address is deleted
36eedb9a05 tipc: Fix potential OOB in tipc_link_proto_rcv()
1b6360a093 net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
e71a46cc8c net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
7081cf86e1 net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
bc06207b4c net: stmmac: fix "snps,axi-config" node property parsing
7fab7add08 nvme initialize core quirks before calling nvme_init_subsystem
6778434706 NFC: nci: Bounds check struct nfc_target arrays
e5292711b0 i40e: Disallow ip4 and ip6 l4_4_bytes
9337d87da4 i40e: Fix for VF MAC address 0
a1e295517b i40e: Fix not setting default xps_cpus after reset
eec1fc21ed net: mvneta: Prevent out of bounds read in mvneta_config_rss()
ed773dd798 xen-netfront: Fix NULL sring after live migration
18e10a9e0e net: encx24j600: Fix invalid logic in reading of MISTAT register
1356c17758 net: encx24j600: Add parentheses to fix precedence
1831d45404 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
8fb4b50f54 selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
0834d4b121 net: dsa: ksz: Check return value
2c6cf0afc3 Bluetooth: Fix not cleanup led when bt_init fails
07ea5d74fc Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
c66d78aee5 af_unix: Get user_ns from in_skb in unix_diag_get_exact().
9d2ee8abf1 igb: Allocate MSI-X vector when testing
cff8ba243f e1000e: Fix TX dispatch condition
48bd5d3801 gpio: amd8111: Fix PCI device reference count leak
d2be7ba2d4 drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
e2e2181772 ca8210: Fix crash by zero initializing data
efbca8234a ieee802154: cc2520: Fix error return code in cc2520_hw_init()
3982652957 can: af_can: fix NULL pointer dereference in can_rcv_filter
db1ed1b3fb HID: core: fix shift-out-of-bounds in hid_report_raw_event
60bce926a8 HID: hid-lg4ff: Add check for empty lbuf
625814b85f HID: usbhid: Add ALWAYS_POLL quirk for some mice
585a07b820 drm/shmem-helper: Remove errant put in error path
b8419d16f4 KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
04edfa3dc0 mm/gup: fix gup_pud_range() for dax
35963b3182 memcg: fix possible use-after-free in memcg_write_event_control()
4afc77068e media: v4l2-dv-timings.c: fix too strict blanking sanity checks
91516ba54a Revert "net: dsa: b53: Fix valid setting for MDB entries"
50e1ab7e63 xen/netback: don't call kfree_skb() with interrupts disabled
6b1d47f9c3 xen/netback: do some code cleanup
8fe1bf6f32 xen/netback: Ensure protocol headers don't fall in the non-linear area
5ffc2a7553 mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
48b00ceb54 mm/khugepaged: fix GUP-fast interaction by sending IPI
324abbd8b9 mm/khugepaged: take the right locks for page table retraction
b2963819d0 net: usb: qmi_wwan: add u-blox 0x1342 composition
e35c3ad0c2 9p/xen: check logical size for buffer size
9d5126b574 fbcon: Use kzalloc() in fbcon_prepare_logo()
102459222d regulator: twl6030: fix get status of twl6032 regulators
f2ba66d873 ASoC: soc-pcm: Add NULL check in BE reparenting
3b2c064a8e btrfs: send: avoid unaligned encoded writes when attempting to clone range
63badfed20 ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
8d16d3826f regulator: slg51000: Wait after asserting CS pin
9327a9c624 9p/fd: Use P9_HDRSZ for header size
671f950d17 ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
2c2c5d1d10 ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
29917e381e ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
3f39d53bc7 ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
135fcc4581 ARM: dts: rockchip: fix ir-receiver node names
368f2c2640 arm: dts: rockchip: fix node name for hym8563 rtc
4b346f07f0 arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
Change-Id: I0cec2e1f212747f2f82af4006b2b2c19daa97369
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit b687ac70e6 which is
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
It breaks the Android KABI and if needed, should come back in an
abi-safe way.
Bug: 161946584
Cc: Lee Jones <joneslee@google.com>
Change-Id: I1f160797720e8bdf4960542e711fd17940a975d9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit eb7716a054 which is
commit eb7716a054 upstream.
It breaks the Android KABI and if needed, should come back in an
abi-safe way.
Bug: 161946584
Cc: Lee Jones <joneslee@google.com>
Change-Id: I9a460d9dbc41512ee71ff607e875f2da9be7f9f6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQa9GUACgkQONu9yGCS
aT7WQQ/6A3UoCjvRNAyt6E9eLZtioHQEc3Nrep18tkkMQFTEyv3EMrmS8GWuvwYm
n+gsDDzJS+v1irMQnaUm3hBsD5Iji52fwr3FL3ec2cZsLt0ulHFdH+xDakLXV+oe
Zs40Hpuf5hLIPpEOi0xsSRHtMQeKRUyeAxw6qHzok3oVPI//vh5VawjpLN4mNYwx
EXht4BDpV8A07Qn1SmX91qmfyn6ZLfsyOwGPZPfmL5L57SgAQVHVcKbwLZBcWKaa
XCc3oGvVGAUX/93hZzWEGtELYUzjWNK8THX+OdkvFwGqP/JCjx602qtBS52znG76
2cNBIiAzpi115yEFS4xlAEVUHXUNFWJ3duDgYpBuQJX57QuA8SEOLYeycFlZYEMp
iIxGUfhnXmn4nSZNNvLKjWv+wyW33tHfBIp8CEdTKizLeL6r9H5Z1yExJE4xGWhJ
hpg+qbqHvvcCJ2Yk1qKST3VxoCCHNM3X94nopyrPkRFpUMzzd+lwUiqZSGe6nzVk
k/B0Xr/JqWuCc7p9DguwC5yKJNNAKQeL+0vAR/2isE/WM4b26wIwbrECOwLv1Epq
ClBNORLmiVgM+lG2LgMJkKxvoIwTtelzGpD6Ybg3MeubJbFoAta9QBLVTuCKVuze
VRUbVE4E7jotAOmqp6qdM9r89tAE68laayY82wOFxS6X/T5AaZk=
=wski
-----END PGP SIGNATURE-----
Merge 5.4.238 into android11-5.4-lts
Changes in 5.4.238
ext4: fix cgroup writeback accounting with fs-layer encryption
xfrm: Allow transport-mode states with AF_UNSPEC selector
drm/panfrost: Don't sync rpm suspension after mmu flushing
cifs: Move the in_send statistic to __smb_send_rqst()
drm/meson: fix 1px pink line on GXM when scaling video overlay
clk: HI655X: select REGMAP instead of depending on it
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
ALSA: hda - add Intel DG1 PCI and HDMI ids
ALSA: hda - controller is in GPU on the DG1
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
netfilter: nft_redir: correct value of inet type `.maxattrs`
scsi: core: Fix a comment in function scsi_host_dev_release()
scsi: core: Fix a procfs host directory removal regression
tcp: tcp_make_synack() can be called from process context
nfc: pn533: initialize struct pn533_out_arg properly
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
i40e: Fix kernel crash during reboot when adapter is in recovery mode
qed/qed_dev: guard against a possible division by zero
net: tunnels: annotate lockless accesses to dev->needed_headroom
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
net: usb: smsc75xx: Limit packet length to skb->len
nvmet: avoid potential UAF in nvmet_req_complete()
block: sunvdc: add check for mdesc_grab() returning NULL
ipv4: Fix incorrect table ID in IOCTL path
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
net/iucv: Fix size of interrupt data
ethernet: sun: add check for the mdesc_grab()
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
hwmon: (ina3221) return prober error code
media: m5mols: fix off-by-one loop termination error
mmc: atmel-mci: fix race between stop command and start of next command
jffs2: correct logic when creating a hole in jffs2_write_begin
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
drm/amdkfd: Fix an illegal memory access
sh: intc: Avoid spurious sizeof-pointer-div warning
ext4: fix possible double unlock when moving a directory
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
interconnect: fix mem leak when freeing nodes
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
KVM: nVMX: add missing consistency checks for CR0 and CR4
ftrace: Fix invalid address access in lookup_rec() when index is 0
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
x86/mm: Fix use of uninitialized buffer in sme_enable()
drm/i915: Don't use stolen memory for ring buffers with LLC
serial: 8250_em: Fix UART port type
s390/ipl: add missing intersection check to ipl_report handling
PCI: Unify delay handling for reset and resume
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Linux 5.4.238
Change-Id: I29d1460644a834fba41654b94a3bb35551976001
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 1c5d4221240a233df2440fe75c881465cdf8da07 upstream.
The default maximum data buffer size for this interface is UHID_DATA_MAX
(4k). When data buffers are being processed, ensure this value is used
when ensuring the sanity, rather than a value between the user provided
value and HID_MAX_BUFFER_SIZE (16k).
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[Lee: Backported to v5.10.y]
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ac91e6980563ed53afadd925fa6585ffd2bc4a2c upstream.
Sheng Bi reports that pci_bridge_secondary_bus_reset() may fail to wait
for devices on the secondary bus to become accessible after reset:
Although it does call pci_dev_wait(), it erroneously passes the bridge's
pci_dev rather than that of a child. The bridge of course is always
accessible while its secondary bus is reset, so pci_dev_wait() returns
immediately.
Sheng Bi proposes introducing a new pci_bridge_secondary_bus_wait()
function which is called from pci_bridge_secondary_bus_reset():
https://lore.kernel.org/linux-pci/20220523171517.32407-1-windy.bi.enflame@gmail.com/
However we already have pci_bridge_wait_for_secondary_bus() which does
almost exactly what we need. So far it's only called on resume from
D3cold (which implies a Fundamental Reset per PCIe r6.0 sec 5.8).
Re-using it for Secondary Bus Resets is a leaner and more rational
approach than introducing a new function.
That only requires a few minor tweaks:
- Amend pci_bridge_wait_for_secondary_bus() to await accessibility of
the first device on the secondary bus by calling pci_dev_wait() after
performing the prescribed delays. pci_dev_wait() needs two parameters,
a reset reason and a timeout, which callers must now pass to
pci_bridge_wait_for_secondary_bus(). The timeout is 1 sec for resume
(PCIe r6.0 sec 6.6.1) and 60 sec for reset (commit 821cdad5c4 ("PCI:
Wait up to 60 seconds for device to become ready after FLR")).
Introduce a PCI_RESET_WAIT macro for the 1 sec timeout.
- Amend pci_bridge_wait_for_secondary_bus() to return 0 on success or
-ENOTTY on error for consumption by pci_bridge_secondary_bus_reset().
- Drop an unnecessary 1 sec delay from pci_reset_secondary_bus() which
is now performed by pci_bridge_wait_for_secondary_bus(). A static
delay this long is only necessary for Conventional PCI, so modern
PCIe systems benefit from shorter reset times as a side effect.
Fixes: 6b2f1351af ("PCI: Wait for device to become ready after secondary bus reset")
Link: https://lore.kernel.org/r/da77c92796b99ec568bd070cbe4725074a117038.1673769517.git.lukas@wunner.de
Reported-by: Sheng Bi <windy.bi.enflame@gmail.com>
Tested-by: Ravi Kishore Koppuravuri <ravi.kishore.koppuravuri@intel.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org # v4.17+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9 upstream.
The code which handles the ipl report is searching for a free location
in memory where it could copy the component and certificate entries to.
It checks for intersection between the sections required for the kernel
and the component/certificate data area, but fails to check whether
the data structures linking these data areas together intersect.
This might cause the iplreport copy code to overwrite the iplreport
itself. Fix this by adding two addtional intersection checks.
Cc: <stable@vger.kernel.org>
Fixes: 9641b8cc73 ("s390/ipl: read IPL report at early boot")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 32e293be736b853f168cd065d9cbc1b0c69f545d upstream.
As per HW manual for EMEV2 "R19UH0040EJ0400 Rev.4.00", the UART
IP found on EMMA mobile SoC is Register-compatible with the
general-purpose 16750 UART chip. Fix UART port type as 16750 and
enable 64-bytes fifo support.
Fixes: 22886ee968 ("serial8250-em: Emma Mobile UART driver V2")
Cc: stable@vger.kernel.org
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20230227114152.22265-2-biju.das.jz@bp.renesas.com
[biju: manually fixed the conflicts]
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 690e0ec8e63da9a29b39fedc6ed5da09c7c82651 upstream.
Direction from hardware is that stolen memory should never be used for
ring buffer allocations on platforms with LLC. There are too many
caching pitfalls due to the way stolen memory accesses are routed. So
it is safest to just not use it.
Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
Fixes: c58b735fc7 ("drm/i915: Allocate rings from stolen")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v4.9+
Tested-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-2-John.C.Harrison@Intel.com
(cherry picked from commit f54c1f6c697c4297f7ed94283c184acc338a5cf8)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit cbebd68f59f03633469f3ecf9bea99cd6cce3854 upstream.
cmdline_find_option() may fail before doing any initialization of
the buffer array. This may lead to unpredictable results when the same
buffer is used later in calls to strncmp() function. Fix the issue by
returning early if cmdline_find_option() returns an error.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: aca20d5462 ("x86/mm: Add support to make use of Secure Memory Encryption")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/20230306160656.14844-1-n.zhandarovich@fintech.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 203873a535d627c668f293be0cb73e26c30f9cc7 upstream.
Find a valid modeline depending on the machine graphic card
configuration and add the fb_check_var() function to validate
Xorg provided graphics settings.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ee92fa443358f4fc0017c1d0d325c27b37802504 upstream.
KASAN reported follow problem:
BUG: KASAN: use-after-free in lookup_rec
Read of size 8 at addr ffff000199270ff0 by task modprobe
CPU: 2 Comm: modprobe
Call trace:
kasan_report
__asan_load8
lookup_rec
ftrace_location
arch_check_ftrace_location
check_kprobe_address_safe
register_kprobe
When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a
pg which is newly added to ftrace_pages_start in ftrace_process_locs().
Before the first pg->index++, index is 0 and accessing pg->records[-1].ip
will cause this problem.
Don't check the ip when pg->index is 0.
Link: https://lore.kernel.org/linux-trace-kernel/20230309080230.36064-1-chenzhongjin@huawei.com
Cc: stable@vger.kernel.org
Fixes: 9644302e33 ("ftrace: Speed up search by skipping pages by address")
Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 112e66017bff7f2837030f34c2bc19501e9212d5 upstream.
The effective values of the guest CR0 and CR4 registers may differ from
those included in the VMCS12. In particular, disabling EPT forces
CR4.PAE=1 and disabling unrestricted guest mode forces CR0.PG=CR0.PE=1.
Therefore, checks on these bits cannot be delegated to the processor
and must be performed by KVM.
Reported-by: Reima ISHII <ishiir@g.ecc.u-tokyo.ac.jp>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c2679254b9c9980d9045f0f722cf093a2b1f7590 upstream.
A while ago where the trace events had the following:
rcu_read_lock_sched_notrace();
rcu_dereference_sched(...);
rcu_read_unlock_sched_notrace();
If the tracepoint is enabled, it could trigger RCU issues if called in
the wrong place. And this warning was only triggered if lockdep was
enabled. If the tracepoint was never enabled with lockdep, the bug would
not be caught. To handle this, the above sequence was done when lockdep
was enabled regardless if the tracepoint was enabled or not (although the
always enabled code really didn't do anything, it would still trigger a
warning).
But a lot has changed since that lockdep code was added. One is, that
sequence no longer triggers any warning. Another is, the tracepoint when
enabled doesn't even do that sequence anymore.
The main check we care about today is whether RCU is "watching" or not.
So if lockdep is enabled, always check if rcu_is_watching() which will
trigger a warning if it is not (tracepoints require RCU to be watching).
Note, that old sequence did add a bit of overhead when lockdep was enabled,
and with the latest kernel updates, would cause the system to slow down
enough to trigger kernel "stalled" warnings.
Link: http://lore.kernel.org/lkml/20140806181801.GA4605@redhat.com
Link: http://lore.kernel.org/lkml/20140807175204.C257CAC5@viggo.jf.intel.com
Link: https://lore.kernel.org/lkml/20230307184645.521db5c9@gandalf.local.home/
Link: https://lore.kernel.org/linux-trace-kernel/20230310172856.77406446@gandalf.local.home
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Joel Fernandes <joel@joelfernandes.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Paul E. McKenney <paulmck@kernel.org>
Fixes: e6753f23d9 ("tracepoint: Make rcuidle tracepoint callers use SRCU")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9f116f76fa8c04c81aef33ad870dbf9a158e5b70 upstream.
The function hist_field_name() cannot handle being passed a NULL field
parameter. It should never be NULL, but due to a previous bug, NULL was
passed to the function and the kernel crashed due to a NULL dereference.
Mark Rutland reported this to me on IRC.
The bug was fixed, but to prevent future bugs from crashing the kernel,
check the field and add a WARN_ON() if it is NULL.
Link: https://lkml.kernel.org/r/20230302020810.762384440@goodmis.org
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Mark Rutland <mark.rutland@arm.com>
Fixes: c6afad49d1 ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers")
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a5904f415e1af72fa8fe6665aa4f554dc2099a95 upstream.
The node link array is allocated when adding links to a node but is not
deallocated when nodes are destroyed.
Fixes: 11f1ceca70 ("interconnect: Add generic on-chip interconnect API")
Cc: stable@vger.kernel.org # 5.1
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # i.MX8MP MSC SM2-MB-EP1 Board
Link: https://lore.kernel.org/r/20230306075651.2449-2-johan+linaro@kernel.org
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2411fd94ceaa6e11326e95d6ebf876cbfed28d23 upstream.
According to LPUART RM, Transmission Complete Flag becomes 0 if queuing
a break character by writing 1 to CTRL[SBK], so here need to skip
waiting for transmission complete when UARTCTRL_SBK is asserted,
otherwise the kernel may stuck here.
And actually set_termios() adds transmission completion waiting to avoid
data loss or data breakage when changing the baud rate, but we don't
need to worry about this when queuing break characters.
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20230223093941.31790-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 250870824c1cf199b032b1ef889c8e8d69d9123a ]
GCC warns about the pattern sizeof(void*)/sizeof(void), as it looks like
the abuse of a pattern to calculate the array size. This pattern appears
in the unevaluated part of the ternary operator in _INTC_ARRAY if the
parameter is NULL.
The replacement uses an alternate approach to return 0 in case of NULL
which does not generate the pattern sizeof(void*)/sizeof(void), but still
emits the warning if _INTC_ARRAY is called with a nonarray parameter.
This patch is required for successful compilation with -Werror enabled.
The idea to use _Generic for type distinction is taken from Comment #7
in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108483 by Jakub Jelinek
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Link: https://lore.kernel.org/r/619fa552-c988-35e5-b1d7-fe256c46a272@mkarcher.dialup.fu-berlin.de
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0f7bfd6f8164be32dbbdf36aa1e5d00485c53cd7 ]
Syzbot reported a hung task problem:
==================================================================
INFO: task syz-executor232:5073 blocked for more than 143 seconds.
Not tainted 6.2.0-rc2-syzkaller-00024-g512dee0c00ad #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-exec232 state:D stack:21024 pid:5073 ppid:5072 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5244 [inline]
__schedule+0x995/0xe20 kernel/sched/core.c:6555
schedule+0xcb/0x190 kernel/sched/core.c:6631
__wait_on_freeing_inode fs/inode.c:2196 [inline]
find_inode_fast+0x35a/0x4c0 fs/inode.c:950
iget_locked+0xb1/0x830 fs/inode.c:1273
__ext4_iget+0x22e/0x3ed0 fs/ext4/inode.c:4861
ext4_xattr_inode_iget+0x68/0x4e0 fs/ext4/xattr.c:389
ext4_xattr_inode_dec_ref_all+0x1a7/0xe50 fs/ext4/xattr.c:1148
ext4_xattr_delete_inode+0xb04/0xcd0 fs/ext4/xattr.c:2880
ext4_evict_inode+0xd7c/0x10b0 fs/ext4/inode.c:296
evict+0x2a4/0x620 fs/inode.c:664
ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5516 [inline]
ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644
get_tree_bdev+0x400/0x620 fs/super.c:1282
vfs_get_tree+0x88/0x270 fs/super.c:1489
do_new_mount+0x289/0xad0 fs/namespace.c:3145
do_mount fs/namespace.c:3488 [inline]
__do_sys_mount fs/namespace.c:3697 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fa5406fd5ea
RSP: 002b:00007ffc7232f968 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa5406fd5ea
RDX: 0000000020000440 RSI: 0000000020000000 RDI: 00007ffc7232f970
RBP: 00007ffc7232f970 R08: 00007ffc7232f9b0 R09: 0000000000000432
R10: 0000000000804a03 R11: 0000000000000202 R12: 0000000000000004
R13: 0000555556a7a2c0 R14: 00007ffc7232f9b0 R15: 0000000000000000
</TASK>
==================================================================
The problem is that the inode contains an xattr entry with ea_inum of 15
when cleaning up an orphan inode <15>. When evict inode <15>, the reference
counting of the corresponding EA inode is decreased. When EA inode <15> is
found by find_inode_fast() in __ext4_iget(), it is found that the EA inode
holds the I_FREEING flag and waits for the EA inode to complete deletion.
As a result, when inode <15> is being deleted, we wait for inode <15> to
complete the deletion, resulting in an infinite loop and triggering Hung
Task. To solve this problem, we only need to check whether the ino of EA
inode and parent is the same before getting EA inode.
Link: https://syzkaller.appspot.com/bug?extid=77d6fcc37bbb92f26048
Reported-by: syzbot+77d6fcc37bbb92f26048@syzkaller.appspotmail.com
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230110133436.996350-1-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 5cd740287ae5e3f9d1c46f5bfe8778972fd6d3fe ]
In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after
ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is
called to get an inode whose i_nlink is 0 when the flag exists, no error
is returned. If the inode is a special inode, a null pointer dereference
may occur. If the value of i_nlink is 0 for any inodes (except boot loader
inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system
is corrupted. Therefore, make the ext4_iget() function return an error if
it gets such an abnormal special inode.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539
Reported-by: Luís Henriques <lhenriques@suse.de>
Suggested-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230107032126.4165860-2-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 23892d383bee15b64f5463bd7195615734bb2415 ]
Bug description and fix:
1. Write data to a file, say all 1s from offset 0 to 16.
2. Truncate the file to a smaller size, say 8 bytes.
3. Write new bytes (say 2s) from an offset past the original size of the
file, say at offset 20, for 4 bytes. This is supposed to create a "hole"
in the file, meaning that the bytes from offset 8 (where it was truncated
above) up to the new write at offset 20, should all be 0s (zeros).
4. Flush all caches using "echo 3 > /proc/sys/vm/drop_caches" (or unmount
and remount) the f/s.
5. Check the content of the file. It is wrong. The 1s that used to be
between bytes 9 and 16, before the truncation, have REAPPEARED (they should
be 0s).
We wrote a script and helper C program to reproduce the bug
(reproduce_jffs2_write_begin_issue.sh, write_file.c, and Makefile). We can
make them available to anyone.
The above example is shown when writing a small file within the same first
page. But the bug happens for larger files, as long as steps 1, 2, and 3
above all happen within the same page.
The problem was traced to the jffs2_write_begin code, where it goes into an
'if' statement intended to handle writes past the current EOF (i.e., writes
that may create a hole). The code computes a 'pageofs' that is the floor
of the write position (pos), aligned to the page size boundary. In other
words, 'pageofs' will never be larger than 'pos'. The code then sets the
internal jffs2_raw_inode->isize to the size of max(current inode size,
pageofs) but that is wrong: the new file size should be the 'pos', which is
larger than both the current inode size and pageofs.
Similarly, the code incorrectly sets the internal jffs2_raw_inode->dsize to
the difference between the pageofs minus current inode size; instead it
should be the current pos minus the current inode size. Finally,
inode->i_size was also set incorrectly.
The patch below fixes this bug. The bug was discovered using a new tool
for finding f/s bugs using model checking, called MCFS (Model Checking File
Systems).
Signed-off-by: Yifei Liu <yifeliu@cs.stonybrook.edu>
Signed-off-by: Erez Zadok <ezk@cs.stonybrook.edu>
Signed-off-by: Manish Adkar <madkar@cs.stonybrook.edu>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit eca5bd666b0aa7dc0bca63292e4778968241134e ]
This commit fixes a race between completion of stop command and start of a
new command.
Previously the command ready interrupt was enabled before stop command
was written to the command register. This caused the command ready
interrupt to fire immediately since the CMDRDY flag is asserted constantly
while there is no command in progress.
Consequently the command state machine will immediately advance to the
next state when the tasklet function is executed again, no matter
actual completion state of the stop command.
Thus a new command can then be dispatched immediately, interrupting and
corrupting the stop command on the CMD line.
Fix that by dropping the command ready interrupt enable before calling
atmci_send_stop_cmd. atmci_send_stop_cmd does already enable the
command ready interrupt, no further writes to ATMCI_IER are necessary.
Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20221230194315.809903-2-t.schramm@manjaro.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit efbcbb12ee99f750c9f25c873b55ad774871de2a ]
The __find_restype() function loops over the m5mols_default_ffmt[]
array, and the termination condition ends up being wrong: instead of
stopping when the iterator becomes the size of the array it traverses,
it stops after it has already overshot the array.
Now, in practice this doesn't likely matter, because the code will
always find the entry it looks for, and will thus return early and never
hit that last extra iteration.
But it turns out that clang will unroll the loop fully, because it has
only two iterations (well, three due to the off-by-one bug), and then
clang will end up just giving up in the middle of the loop unrolling
when it notices that the code walks past the end of the array.
And that made 'objtool' very unhappy indeed, because the generated code
just falls off the edge of the universe, and ends up falling through to
the next function, causing this warning:
drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc()
Fix the loop ending condition.
Reported-by: Jens Axboe <axboe@kernel.dk>
Analyzed-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Analyzed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/
Fixes: bc125106f8 ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP")
Cc: HeungJun, Kim <riverful.kim@samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c93f5e2ab53243b17febabb9422a697017d3d49a ]
ret is set to 0 which do not indicate an error.
Return -EINVAL instead.
Fixes: a9e9dd9c6d ("hwmon: (ina3221) Read channel input source info from DT")
Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Link: https://lore.kernel.org/r/20230310075035.246083-1-marcus.folkesson@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cb090e64cf25602b9adaf32d5dfc9c8bec493cd1 ]
In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work.
Then it will be started.
If we remove the driver which will call xgene_hwmon_remove to clean up,
there may be unfinished work.
The possible sequence is as follows:
Fix it by finishing the work before cleanup in xgene_hwmon_remove.
CPU0 CPU1
|xgene_hwmon_evt_work
xgene_hwmon_remove |
kfifo_free(&ctx->async_msg_fifo);|
|
|kfifo_out_spinlocked
|//use &ctx->async_msg_fifo
Fixes: 2ca492e22c ("hwmon: (xgene) Fix crash when alarm occurs before driver probe")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Link: https://lore.kernel.org/r/20230310084007.1403388-1-zyytlz.wz@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 48e8186870d9d0902e712d601ccb7098cb220688 ]
The wrong bits are masked in the hysteresis register; indices 0 and 2
should zero bits [7:4] and preserve bits [3:0], and index 1 should zero
bits [3:0] and preserve bits [7:4].
Fixes: 1c301fc539 ("hwmon: Add a driver for the ADT7475 hardware monitoring chip")
Signed-off-by: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20230222005228.158661-3-tony.obrien@alliedtelesis.co.nz
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 5f8d1e3b6f9b5971f9c06d5846ce00c49e3a8d94 ]
Throughout the ADT7475 driver, attributes relating to the temperature
sensors are displayed in the order Remote 1, Local, Remote 2. Make
temp_st_show() conform to this expectation so that values set by
temp_st_store() can be displayed using the correct attribute.
Fixes: 8f05bcc33e ("hwmon: (adt7475) temperature smoothing")
Signed-off-by: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20230222005228.158661-2-tony.obrien@alliedtelesis.co.nz
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 90de546d9a0b3c771667af18bb3f80567eabb89b ]
In vnet_port_probe() and vsw_port_probe(), we should
check the return value of mdesc_grab() as it may
return NULL which can caused NPD bugs.
Fixes: 5d01fa0c6b ("ldmvsw: Add ldmvsw.c driver code")
Fixes: 43fdf27470 ("[SPARC64]: Abstract out mdesc accesses for better MD update handling.")
Signed-off-by: Liang He <windhl@126.com>
Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3d87debb8ed2649608ff432699e7c961c0c6f03b ]
iucv_irq_data needs to be 4 bytes larger.
These bytes are not used by the iucv module, but written by
the z/VM hypervisor in case a CPU is deconfigured.
Reported as:
BUG dma-kmalloc-64 (Not tainted): kmalloc Redzone overwritten
-----------------------------------------------------------------------------
0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc
Allocated in iucv_cpu_prepare+0x44/0xd0 age=167839 cpu=2 pid=1
__kmem_cache_alloc_node+0x166/0x450
kmalloc_node_trace+0x3a/0x70
iucv_cpu_prepare+0x44/0xd0
cpuhp_invoke_callback+0x156/0x2f0
cpuhp_issue_call+0xf0/0x298
__cpuhp_setup_state_cpuslocked+0x136/0x338
__cpuhp_setup_state+0xf4/0x288
iucv_init+0xf4/0x280
do_one_initcall+0x78/0x390
do_initcalls+0x11a/0x140
kernel_init_freeable+0x25e/0x2a0
kernel_init+0x2e/0x170
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
Freed in iucv_init+0x92/0x280 age=167839 cpu=2 pid=1
__kmem_cache_free+0x308/0x358
iucv_init+0x92/0x280
do_one_initcall+0x78/0x390
do_initcalls+0x11a/0x140
kernel_init_freeable+0x25e/0x2a0
kernel_init+0x2e/0x170
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
Slab 0x0000037200010000 objects=32 used=30 fp=0x0000000000400640 flags=0x1ffff00000010200(slab|head|node=0|zone=0|
Object 0x0000000000400540 @offset=1344 fp=0x0000000000000000
Redzone 0000000000400500: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 0000000000400510: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 0000000000400520: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 0000000000400530: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 0000000000400540: 00 01 00 03 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object 0000000000400550: f3 86 81 f2 f4 82 f8 82 f0 f0 f0 f0 f0 f0 f0 f2 ................
Object 0000000000400560: 00 00 00 00 80 00 00 00 cc cc cc cc cc cc cc cc ................
Object 0000000000400570: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 0000000000400580: cc cc cc cc cc cc cc cc ........
Padding 00000000004005d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
Padding 00000000004005e4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
Padding 00000000004005f4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
CPU: 6 PID: 121030 Comm: 116-pai-crypto. Not tainted 6.3.0-20230221.rc0.git4.99b8246b2d71.300.fc37.s390x+debug #1
Hardware name: IBM 3931 A01 704 (z/VM 7.3.0)
Call Trace:
[<000000032aa034ec>] dump_stack_lvl+0xac/0x100
[<0000000329f5a6cc>] check_bytes_and_report+0x104/0x140
[<0000000329f5aa78>] check_object+0x370/0x3c0
[<0000000329f5ede6>] free_debug_processing+0x15e/0x348
[<0000000329f5f06a>] free_to_partial_list+0x9a/0x2f0
[<0000000329f5f4a4>] __slab_free+0x1e4/0x3a8
[<0000000329f61768>] __kmem_cache_free+0x308/0x358
[<000000032a91465c>] iucv_cpu_dead+0x6c/0x88
[<0000000329c2fc66>] cpuhp_invoke_callback+0x156/0x2f0
[<000000032aa062da>] _cpu_down.constprop.0+0x22a/0x5e0
[<0000000329c3243e>] cpu_device_down+0x4e/0x78
[<000000032a61dee0>] device_offline+0xc8/0x118
[<000000032a61e048>] online_store+0x60/0xe0
[<000000032a08b6b0>] kernfs_fop_write_iter+0x150/0x1e8
[<0000000329fab65c>] vfs_write+0x174/0x360
[<0000000329fab9fc>] ksys_write+0x74/0x100
[<000000032aa03a5a>] __do_syscall+0x1da/0x208
[<000000032aa177b2>] system_call+0x82/0xb0
INFO: lockdep is turned off.
FIX dma-kmalloc-64: Restoring kmalloc Redzone 0x0000000000400564-0x0000000000400567=0xcc
FIX dma-kmalloc-64: Object at 0x0000000000400540 not freed
Fixes: 2356f4cb19 ("[S390]: Rewrite of the IUCV base code, part 2")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://lore.kernel.org/r/20230315131435.4113889-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c ]
Packet length check needs to be located after size and align_count
calculation to prevent kernel panic in skb_pull() in case
rx_cmd_a & RX_CMD_A_RED evaluates to true.
Fixes: d8b228318935 ("net: usb: smsc75xx: Limit packet length to skb->len")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20230316110540.77531-1-szymon.heidrich@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8a2618e14f81604a9b6ad305d57e0c8da939cd65 ]
Commit f96a3d74554d ("ipv4: Fix incorrect route flushing when source
address is deleted") started to take the table ID field in the FIB info
structure into account when determining if two structures are identical
or not. This field is initialized using the 'fc_table' field in the
route configuration structure, which is not set when adding a route via
IOCTL.
The above can result in user space being able to install two identical
routes that only differ in the table ID field of their associated FIB
info.
Fix by initializing the table ID field in the route configuration
structure in the IOCTL path.
Before the fix:
# ip route add default via 192.0.2.2
# route add default gw 192.0.2.2
# ip -4 r show default
# default via 192.0.2.2 dev dummy10
# default via 192.0.2.2 dev dummy10
After the fix:
# ip route add default via 192.0.2.2
# route add default gw 192.0.2.2
SIOCADDRT: File exists
# ip -4 r show default
default via 192.0.2.2 dev dummy10
Audited the code paths to ensure there are no other paths that do not
properly initialize the route configuration structure when installing a
route.
Fixes: 5a56a0b3a4 ("net: Don't delete routes in different VRFs")
Fixes: f96a3d74554d ("ipv4: Fix incorrect route flushing when source address is deleted")
Reported-by: gaoxingwang <gaoxingwang1@huawei.com>
Link: https://lore.kernel.org/netdev/20230314144159.2354729-1-gaoxingwang1@huawei.com/
Tested-by: gaoxingwang <gaoxingwang1@huawei.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230315124009.4015212-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6030363199e3a6341afb467ddddbed56640cbf6a ]
In vdc_port_probe(), we should check the return value of mdesc_grab() as
it may return NULL, which can cause potential NPD bug.
Fixes: 43fdf27470 ("[SPARC64]: Abstract out mdesc accesses for better MD update handling.")
Signed-off-by: Liang He <windhl@126.com>
Link: https://lore.kernel.org/r/20230315062032.1741692-1-windhl@126.com
[axboe: style cleanup]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286 ]
An nvme target ->queue_response() operation implementation may free the
request passed as argument. Such implementation potentially could result
in a use after free of the request pointer when percpu_ref_put() is
called in nvmet_req_complete().
Avoid such problem by using a local variable to save the sq pointer
before calling __nvmet_req_complete(), thus avoiding dereferencing the
req pointer after that function call.
Fixes: a07b4970f4 ("nvmet: add a generic NVMe target")
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d8b228318935044dafe3a5bc07ee71a1f1424b8d ]
Packet length retrieved from skb data may be larger than
the actual socket buffer length (up to 9026 bytes). In such
case the cloned skb passed up the network stack will leak
kernel memory contents.
Fixes: d0cad87170 ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 ]
This bug influences both st_nci_i2c_remove and st_nci_spi_remove.
Take st_nci_i2c_remove as an example.
In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work
with llt_ndlc_sm_work.
When it calls ndlc_recv or timeout handler, it will finally call
schedule_work to start the work.
When we call st_nci_i2c_remove to remove the driver, there
may be a sequence as follows:
Fix it by finishing the work before cleanup in ndlc_remove
CPU0 CPU1
|llt_ndlc_sm_work
st_nci_i2c_remove |
ndlc_remove |
st_nci_remove |
nci_free_device|
kfree(ndev) |
//free ndlc->ndev |
|llt_ndlc_rcv_queue
|nci_recv_frame
|//use ndlc->ndev
Fixes: 35630df68d ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230312160837.2040857-1-zyytlz.wz@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c22c3bbf351e4ce905f082649cffa1ff893ea8c1 ]
If genphy_read_status fails then further access to the PHY may result
in unpredictable behavior. To prevent this bail out immediately if
genphy_read_status fails.
Fixes: 4223dbffed ("net: phy: smsc: Re-enable EDPD mode for LAN87xx")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/026aa4f2-36f5-1c10-ab9f-cdb17dda6ac4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1a9dc5610ef89d807acdcfbff93a558f341a44da ]
Previously we would divide total_left_rate by zero if num_vports
happened to be 1 because non_requested_count is calculated as
num_vports - req_count. Guard against this by validating num_vports at
the beginning and returning an error otherwise.
Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
Fixes: bcd197c81f ("qed: Add vport WFQ configuration APIs")
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230309201556.191392-1-d-tatianin@yandex-team.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 59a0b022aa249e3f5735d93de0849341722c4754 ]
For l3s mode, skb->dev is set to ipvlan interface in ipvlan_nf_input():
skb->dev = addr->master->dev
but, skb->skb_iif remain unchanged, this will cause socket lookup failed
if a target socket is bound to a interface, like the following example:
ip link add ipvlan0 link eth0 type ipvlan mode l3s
ip addr add dev ipvlan0 192.168.124.111/24
ip link set ipvlan0 up
ping -c 1 -I ipvlan0 8.8.8.8
100% packet loss
This is because there is no match sk in __raw_v4_lookup() as sk->sk_bound_dev_if != dif(skb->skb_iif).
Fix this by make skb->skb_iif track skb->dev in ipvlan_nf_input().
Fixes: c675e06a98 ("ipvlan: decouple l3s mode dependencies from other modes")
Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/29865b1f-6db7-c07a-de89-949d3721ea30@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 484b7059796e3bc1cb527caa61dfc60da649b4f6 ]
struct pn533_out_arg used as a temporary context for out_urb is not
initialized properly. Its uninitialized 'phy' field can be dereferenced in
error cases inside pn533_out_complete() callback function. It causes the
following failure:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc3-next-20230110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:pn533_out_complete.cold+0x15/0x44 drivers/nfc/pn533/usb.c:441
Call Trace:
<IRQ>
__usb_hcd_giveback_urb+0x2b6/0x5c0 drivers/usb/core/hcd.c:1671
usb_hcd_giveback_urb+0x384/0x430 drivers/usb/core/hcd.c:1754
dummy_timer+0x1203/0x32d0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1da/0x800 kernel/time/timer.c:1700
expire_timers+0x234/0x330 kernel/time/timer.c:1751
__run_timers kernel/time/timer.c:2022 [inline]
__run_timers kernel/time/timer.c:1995 [inline]
run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
__do_softirq+0x1fb/0xaf6 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
Initialize the field with the pn533_usb_phy currently used.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 9dab880d675b ("nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()")
Reported-by: syzbot+1e608ba4217c96d1952f@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230309165050.207390-1-pchelkin@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bced3f7db95ff2e6ca29dc4d1c9751ab5e736a09 ]
tcp_rtx_synack() now could be called in process context as explained in
0a375c822497 ("tcp: tcp_rtx_synack() can be called from process
context").
tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU
variables with preemption enabled. This causes the following BUG:
BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
<TASK>
dump_stack_lvl+0x10d/0x1a0
check_preemption_disabled+0x104/0x110
tcp_make_synack+0x841/0xac0
tcp_v6_send_synack+0x5c/0x450
tcp_rtx_synack+0xeb/0x1f0
inet_rtx_syn_ack+0x34/0x60
tcp_check_req+0x3af/0x9e0
tcp_rcv_state_process+0x59b/0x2030
tcp_v6_do_rcv+0x5f5/0x700
release_sock+0x3a/0xf0
tcp_sendmsg+0x33/0x40
____sys_sendmsg+0x2f2/0x490
__sys_sendmsg+0x184/0x230
do_syscall_64+0x3d/0x90
Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use
TCP_INC_STATS() which is safe to be called from context switch.
Fixes: 8336886f78 ("tcp: TCP Fast Open Server - support TFO listeners")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230308190745.780221-1-leitao@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2dde5c8d912efea43be94d6a83ac9cb74879fa12 ]
Commit 3be8828fc5 ("scsi: core: Avoid that ATA error handling can
trigger a kernel hang or oops") moved rcu to scsi_cmnd instead of
shost. Modify "shost->rcu" to "scmd->rcu" in a comment.
Link: https://lore.kernel.org/r/1620646526-193154-1-git-send-email-chenxiang66@hisilicon.com
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: be03df3d4bfe ("scsi: core: Fix a procfs host directory removal regression")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 493924519b1fe3faab13ee621a43b0d0939abab1 ]
`nft_redir_inet_type.maxattrs` was being set, presumably because of a
cut-and-paste error, to `NFTA_MASQ_MAX`, instead of `NFTA_REDIR_MAX`.
Fixes: 63ce3940f3 ("netfilter: nft_redir: add inet support")
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Greg Kroah-Hartman
Greg Kroah-Hartman
Lee Jones
Lukas Wunner
Sven Schnelle
Biju Das
John Harrison
Nikita Zhandarovich
Helge Deller
Chen Zhongjin
Paolo Bonzini
Steven Rostedt (Google)
Johan Hovold
Sherry Sun
Theodore Ts'o
Michael Karcher
Qu Huang
Baokun Li
Yifei Liu
Tobias Schramm
Linus Torvalds
Marcus Folkesson
Zheng Wang
Tony O'Brien
Liang He
Alexandra Winter
Szymon Heidrich
Ido Schimmel
Damien Le Moal
Heiner Kallweit
Eric Dumazet
Daniil Tatianin
Ivan Vecera
Jianguo Wu
Fedor Pchelkin
Breno Leitao
Bart Van Assche
Xiang Chen
Jeremy Sowden