mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-09 21:59:12 -04:00
907,854 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Greg Kroah-Hartman
|
e6bbe8cf21 |
Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
0f7dff11a8 |
This is the 5.4.297 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmiwZfcACgkQONu9yGCS
aT54xQ/7Bakgl/fkNhIOFy8BZtf4GX4drYUsyMFXzYKhmY+rsB41MuhgXEXnt29s
JGG9evsj2MzyL5sxR244F3W/zoH+KEELCLvY93/z6Tt++9r9XNVvX8cWsHKIx9iV
mcVrI0/IvQPnPpgeZoHSwakk86DzyB5Ck6ITCurTndVNx49wcqonqxdxDB79ChjB
GE3XPrSodkPDQFs3ESYa2STRFmOCxm3YmD06rUfOA8WWxHfCPSB+uNZwBHuD5wla
jS5Od20zdAvY+sex179zCSknJB4HBq8rKizIkMxeo84tivBodNbIb8Kf2Hy889ii
5pqIsF0jRmhV/ADO94OfBIcDB5+xoMkCUnqcSH3vsmaenfU7r93Godsl4Shii0z+
Wiw58LEZ/Ki1ZJEfgTvJw0A5sPF0F+06ySVcocUW1z4E8GuT/RKgjJA0BSu82fto
5T8GTJ2nrT1eZbAOiau0MU5jK72PPlFk2uEWD/kW6VYfelmfjGF/SYNy/JSGpivh
dOQkW5V1ZLKyVzVYXyqYFvnZTxDNYCm9qGgYOL6Wkr2Q6XM7QiSKhhGMEBWMpSXP
0xuhZ332a/xrLXdXRR0s04CWPXe5Nb1R2XvJ7EC3JMx/TQHSWGqrbDD+4LBgZWmQ
I6uSNV4IGaqQ83xx2ekSxa5HmbAhPhVvtY/0NhQzyKm7pFAY3WU=
=o4wf
-----END PGP SIGNATURE-----
Merge 5.4.297 into android11-5.4-lts
Changes in 5.4.297
USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
USB: serial: option: add Foxconn T99W640
USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
usb: gadget: configfs: Fix OOB read on empty string write
i2c: stm32: fix the device used for the DMA map
Input: xpad - set correct controller type for Acer NGR200
pch_uart: Fix dma_sync_sg_for_device() nents value
HID: core: ensure the allocated report buffer can contain the reserved report ID
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: do not bypass hid_hw_raw_request
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
af_packet: fix soft lockup issue caused by tpacket_snd()
dmaengine: nbpfaxi: Fix memory corruption in probe()
isofs: Verify inode mode when loading from disk
memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
mmc: bcm2835: Fix dma_unmap_sg() nents value
mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
mmc: sdhci_am654: Workaround for Errata i2312
soc: aspeed: lpc-snoop: Cleanup resources in stack-order
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
iio: adc: max1363: Reorder mode_list[] entries
iio: adc: stm32-adc: Fix race in installing chained IRQ handler
comedi: pcl812: Fix bit shift out of bounds
comedi: aio_iiro_16: Fix bit shift out of bounds
comedi: das16m1: Fix bit shift out of bounds
comedi: das6402: Fix bit shift out of bounds
comedi: Fix some signed shift left operations
comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
net: emaclite: Fix missing pointer increment in aligned_read()
net/sched: sch_qfq: Fix race condition on qfq_aggregate
usb: net: sierra: check for no status endpoint
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
Bluetooth: SMP: If an unallowed command is received consider it a failure
Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
usb: musb: fix gadget state on disconnect
usb: dwc3: qcom: Don't leave BCR asserted
ASoC: fsl_sai: Force a software reset when starting in consumer mode
virtio-net: ensure the received length does not exceed allocated size
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
power: supply: bq24190_charger: Fix runtime PM imbalance on error
power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
net_sched: sch_sfq: annotate data-races around q->perturb_period
net_sched: sch_sfq: handle bigger packets
net_sched: sch_sfq: don't allow 1 packet limit
net_sched: sch_sfq: use a temporary work area for validating configuration
net_sched: sch_sfq: move the limit validation
net_sched: sch_sfq: reject invalid perturb period
usb: hub: fix detection of high tier USB3 devices behind suspended hubs
usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
regulator: core: fix NULL dereference on unbind due to stale coupling data
RDMA/core: Rate limit GID cache warning messages
net: appletalk: fix kerneldoc warnings
net: appletalk: Fix use-after-free in AARP proxy probe
net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
i2c: qup: jump out of the loop in case of timeout
nilfs2: reject invalid file types when reading inodes
comedi: comedi_test: Fix possible deletion of uninitialized timers
ALSA: hda: Add missing NVIDIA HDA codec IDs
usb: chipidea: udc: add new API ci_hdrc_gadget_connect
usb: chipidea: udc: protect usb interrupt enable
usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
usb: chipidea: add USB PHY event
usb: phy: mxs: disconnect line when USB charger is attached
ethernet: intel: fix building with large NR_CPUS
ASoC: Intel: fix SND_SOC_SOF dependencies
hfsplus: remove mutex_lock check in hfsplus_free_extents
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
ARM: dts: vfxxx: Correctly use two tuples for timer address
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
vmci: Prevent the dispatching of uninitialized payloads
pps: fix poll support
Revert "vmci: Prevent the dispatching of uninitialized payloads"
usb: early: xhci-dbc: Fix early_ioremap leak
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
cpufreq: Init policy->rwsem before it may be possibly used
samples: mei: Fix building on musl libc
staging: nvec: Fix incorrect null termination of battery manufacturer
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
caif: reduce stack size, again
wifi: rtl818x: Kill URBs before clearing tx status queue
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
iwlwifi: Add missing check for alloc_ordered_workqueue
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
m68k: Don't unregister boot console needlessly
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
netfilter: nf_tables: adjust lockdep assertions handling
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
mwl8k: Add missing check after DMA map
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
can: kvaser_pciefd: Store device channel index
can: kvaser_usb: Assign netdev.dev_port based on device channel index
netfilter: xt_nfacct: don't assume acct name is null-terminated
selftests: rtnetlink.sh: remove esp4_offload after test
vrf: Drop existing dst reference in vrf_ip6_input_dst
PCI: rockchip-host: Fix "Unexpected Completion" log message
crypto: marvell/cesa - Fix engine load inaccuracy
mtd: fix possible integer overflow in erase_xfer()
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
pinctrl: sunxi: Fix memory leak on krealloc failure
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
perf tests bp_account: Fix leaked file descriptor
clk: sunxi-ng: v3s: Fix de clock definition
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
scsi: mvsas: Fix dma_unmap_sg() nents value
scsi: isci: Fix dma_unmap_sg() nents value
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
hwrng: mtk - handle devm_pm_runtime_enable errors
crypto: img-hash - Fix dma_unmap_sg() nents value
soundwire: stream: restore params when prepare ports fail
fs/orangefs: Allow 2 more characters in do_c_string()
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
dmaengine: nbpfaxi: Add missing check after DMA map
crypto: qat - fix seq_file position update in adf_ring_next()
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
jfs: fix metapage reference count leak in dbAllocCtl
mtd: rawnand: atmel: Fix dma_mapping_error() address
mtd: rawnand: atmel: set pmecc data setup time
bpf: Check flow_dissector ctx accesses are aligned
module: Restore the moduleparam prefix length check
rtc: ds1307: fix incorrect maximum clock rate handling
rtc: hym8563: fix incorrect maximum clock rate handling
rtc: pcf8563: fix incorrect maximum clock rate handling
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
f2fs: fix to avoid panic in f2fs_evict_inode
f2fs: fix to avoid out-of-boundary access in devs.path
usb: chipidea: udc: fix sleeping function called from invalid context
pci/hotplug/pnv-php: Improve error msg on power state change failure
pci/hotplug/pnv-php: Wrap warnings in macro
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
netpoll: prevent hanging NAPI when netcons gets enabled
pptp: ensure minimal skb length in pptp_xmit()
ipv6: reject malicious packets in ipv6_gso_segment()
net: drop UFO packets in udp_rcv_segment()
benet: fix BUG when creating VFs
smb: client: let recv_done() cleanup before notifying the callers.
pptp: fix pptp_xmit() error path
perf/core: Don't leak AUX buffer refcount on allocation failure
perf/core: Exit early on perf_mmap() fail
perf/core: Prevent VMA split of buffer mappings
net/packet: fix a race in packet_set_ring() and packet_notifier()
vsock: Do not allow binding to VMADDR_PORT_ANY
USB: serial: option: add Foxconn T99W709
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
usb: gadget : fix use-after-free in composite_dev_cleanup()
io_uring: don't use int for ABI
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
netlink: avoid infinite retry looping in netlink_unicast()
net: gianfar: fix device leak when querying time stamp info
net: dpaa: fix device leak when querying time stamp info
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
sunvdc: Balance device refcount in vdc_port_mpgroup_check
fs: Prevent file descriptor table allocations exceeding INT_MAX
Documentation: ACPI: Fix parent device references
ACPI: processor: perflib: Fix initial _PPC limit application
ACPI: processor: perflib: Move problematic pr->performance check
udp: also consider secpath when evaluating ipsec use for checksumming
netfilter: ctnetlink: fix refcount leak on table dump
sctp: linearize cloned gso packets in sctp_rcv
hfs: fix slab-out-of-bounds in hfs_bnode_read()
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
arm64: Handle KCOV __init vs inline mismatches
udf: Verify partition map count
drbd: add missing kref_get in handle_write_conflicts
hfs: fix not erasing deleted b-tree node issue
securityfs: don't pin dentries twice, once is enough...
usb: xhci: print xhci->xhc_state when queue_command failed
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
usb: xhci: Avoid showing warnings for dying controller
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
usb: xhci: Avoid showing errors during surprise removal
cpufreq: Exit governor when failed to start old governor
ARM: rockchip: fix kernel hang during smp initialization
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
gpio: tps65912: check the return value of regmap_update_bits()
ARM: tegra: Use I/O memcpy to write to IRAM
selftests: tracing: Use mutex_unlock for testing glob filter
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
PM: sleep: console: Fix the black screen issue
ACPI: processor: fix acpi_object initialization
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
usb: core: usb_submit_urb: downgrade type check
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
ASoC: codecs: rt5640: Retry DEVICE_ID verification
ktest.pl: Prevent recursion of default variable options
wifi: cfg80211: reject HTC bit for management frames
s390/time: Use monotonic clock in get_cycles()
be2net: Use correct byte order and format string for TCP seq and ack_seq
et131x: Add missing check after DMA map
net: ag71xx: Add missing check after DMA map
rcu: Protect ->defer_qs_iw_pending from data race
wifi: cfg80211: Fix interface type validation
net: ipv4: fix incorrect MTU in broadcast routes
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
wifi: iwlwifi: mvm: fix scan request validation
s390/stp: Remove udelay from stp_sync_clock()
(powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
net: fec: allow disable coalescing
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
netmem: fix skb_frag_address_safe with unreadable skbs
wifi: iwlegacy: Check rate_idx range after addition
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
net: ncsi: Fix buffer overflow in fetching version id
uapi: in6: restore visibility of most IPv6 socket options
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
vhost: fail early when __vhost_add_used() fails
cifs: Fix calling CIFSFindFirst() for root path without msearch
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
fs/orangefs: use snprintf() instead of sprintf()
watchdog: dw_wdt: Fix default timeout
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
scsi: bfa: Double-free fix
jfs: truncate good inode pages when hard link is 0
jfs: Regular file corruption check
jfs: upper bound check of tree index in dbAllocAG
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
scsi: mpt3sas: Correctly handle ATA device errors
pinctrl: stm32: Manage irq affinity settings
media: tc358743: Check I2C succeeded during probe
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
media: tc358743: Increase FIFO trigger level to 374
media: usb: hdpvr: disable zero-length read messages
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
media: uvcvideo: Fix bandwidth issue for Alcor camera
i3c: add missing include to internal header
PCI: pnv_php: Work around switches with broken presence detection
i3c: don't fail if GETHDRCAP is unsupported
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
kconfig: nconf: Ensure null termination where strncpy is used
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
kconfig: gconf: fix potential memory leak in renderer_edited()
kconfig: lxdialog: fix 'space' to (de)select options
ipmi: Fix strcpy source and destination the same
net: phy: smsc: add proper reset flags for LAN8710A
pNFS: Fix stripe mapping in block/scsi layout
pNFS: Fix disk addr range check in block/scsi layout
pNFS: Handle RPC size limit for layoutcommits
pNFS: Fix uninited ptr deref in block/scsi layout
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
scsi: lpfc: Remove redundant assignment to avoid memory leak
drm/amdgpu: fix incorrect vm flags to map bo
misc: rtsx: usb: Ensure mmc child device is active when card is present
comedi: fix race between polling and detaching
thunderbolt: Fix copy+paste error in match_service_id()
btrfs: fix log tree replay failure due to file with 0 links and extents
parisc: Makefile: fix a typo in palo.conf
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
media: uvcvideo: Do not mark valid metadata as invalid
serial: 8250: fix panic due to PSLVERR
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
m68k: Fix lost column on framebuffer debug console
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
usb: gadget: udc: renesas_usb3: fix device leak at unbind
usb: dwc3: meson-g12a: fix device leaks at unbind
vt: keyboard: Don't process Unicode characters in K_OFF mode
vt: defkeymap: Map keycodes above 127 to K_HOLE
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
ext4: check fast symlink for ea_inode correctly
ext4: fix fsmap end of range reporting with bigalloc
ext4: fix reserved gdt blocks handling in fsmap
ata: libata-scsi: Fix ata_to_sense_error() status handling
zynq_fpga: use sgtable-based scatterlist wrappers
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
pwm: imx-tpm: Reset counter if CMOD is 0
mtd: rawnand: fsmc: Add missing check after DMA map
PCI: endpoint: Fix configfs group list head handling
PCI: endpoint: Fix configfs group removal on driver teardown
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
soc/tegra: pmc: Ensure power-domains are in a known state
media: gspca: Add bounds checking to firmware parser
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
media: usbtv: Lock resolution while streaming
media: ov2659: Fix memory leaks in ov2659_probe()
media: venus: Add a check for packet size after reading from shared memory
memstick: Fix deadlock by moving removing flag earlier
squashfs: fix memory leak in squashfs_fill_super
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
fs/buffer: fix use-after-free when call bh_read() helper
move_mount: allow to add a mount into an existing group
use uniform permission checks for all mount propagation changes
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
ftrace: Also allocate and copy hash for reading of filter files
iio: proximity: isl29501: fix buffered read on big-endian systems
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
kbuild: Update assembler calls to use proper flags and language target
mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
kbuild: Add CLANG_FLAGS to as-instr
kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
kbuild: Add KBUILD_CPPFLAGS to as-option invocation
comedi: Fix initialization of data for instructions that write to subdevice
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
net: usbnet: Fix the wrong netif_carrier_on() call
ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
drm/sched: Remove optimization that causes hang when killing dependent jobs
mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
f2fs: fix to do sanity check on ino and xnid
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
x86/mce/amd: Add default names for MCA banks and blocks
usb: hub: avoid warm port reset during USB3 disconnect
usb: hub: Don't try to recover devices lost during warm reset.
tracing: Add down_write(trace_event_sem) when adding trace event
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
x86/fpu: Delay instruction pointer fixup until after warning
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
USB: cdc-acm: do not log successful probe on later errors
cdc-acm: fix race between initial clearing halt and open
usb: typec: fusb302: cache PD RX state
NFSv4: Fix nfs4_bitmap_copy_adjust()
NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
NFS: Fix the setting of capabilities when automounting a new filesystem
usb: musb: omap2430: fix device leak at unbind
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
media: v4l2-ctrls: always copy the controls on completion
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
pwm: mediatek: Implement .apply() callback
pwm: mediatek: Handle hardware enable and clock enable separately
pwm: mediatek: Fix duty and period setting
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
media: qcom: camss: cleanup media device allocated resource on error path
media: venus: protect against spurious interrupts during probe
f2fs: fix to avoid out-of-boundary access in dnode page
media: venus: hfi: explicitly release IRQ during teardown
btrfs: populate otime when logging an inode item
sch_drr: make drr_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_qfq: make qfq_qlen_notify() idempotent
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
mm: drop the assumption that VM_SHARED always implies writable
mm: update memfd seal write check to include F_SEAL_WRITE
mm: perform the mapping_map_writable() check after call_mmap()
net: sched: extract common action counters update code into function
net: sched: extract bstats update code into function
net: sched: extract qstats update code into functions
net: sched: don't expose action qstats to skb_tc_reinsert()
selftests: forwarding: tc_actions.sh: add matchall mirror test
net/sched: act_mirred: refactor the handle of xmit
net/sched: act_mirred: better wording on protection against excessive stack growth
act_mirred: use the backlog for nested calls to mirred ingress
Bluetooth: fix use-after-free in device_for_each_child()
cifs: Fix UAF in cifs_demultiplex_thread()
NFS: Fix up commit deadlocks
nfs: fix UAF in direct writes
usb: xhci: Fix slot_id resource race conflict
scsi: qla4xxx: Prevent a potential error pointer dereference
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
s390/hypfs: Enable limited access during lockdown
alloc_fdtable(): change calling conventions.
Linux 5.4.297
Change-Id: I31d1928fd98d4aebd14d5e4753dffcf88dd4c03b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Greg Kroah-Hartman
|
b2efed2e1d |
Merge android11-5.4 into android11-5.4-lts
This merges the android11-5.4 branch into the -lts branch, catching it up with the latest changes in there. It contains the following commits: * |
||
|
Greg Kroah-Hartman
|
4d9a721965 |
Merge tag 'android11-5.4.296_r00' into android11-5.4
This merges the android11-5.4.296_r00 tag into the android11-5.4 branch, catching it up with the latest LTS releases. It contains the following commits: * |
||
Greg Kroah-Hartman
|
c25f780e49 |
Linux 5.4.297
Link: https://lore.kernel.org/r/20250826110905.607690791@linuxfoundation.org Link: https://lore.kernel.org/r/20250827073826.377382421@linuxfoundation.org Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Al Viro
|
fa728ded21 |
alloc_fdtable(): change calling conventions.
[ Upstream commit 1d3b4bec3ce55e0c46cdce7d0402dbd6b4af3a3d ] First of all, tell it how many slots do we want, not which slot is wanted. It makes one caller (dup_fd()) more straightforward and doesn't harm another (expand_fdtable()). Furthermore, make it return ERR_PTR() on failure rather than returning NULL. Simplifies the callers. Simplify the size calculation, while we are at it - note that we always have slots_wanted greater than BITS_PER_LONG. What the rules boil down to is * use the smallest power of two large enough to give us that many slots * on 32bit skip 64 and 128 - the minimal capacity we want there is 256 slots (i.e. 1Kb fd array). * on 64bit don't skip anything, the minimal capacity is 128 - and we'll never be asked for 64 or less. 128 slots means 1Kb fd array, again. * on 128bit, if that ever happens, don't skip anything - we'll never be asked for 128 or less, so the fd array allocation will be at least 2Kb. Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Peter Oberparleiter
|
7a0208c5b4 |
s390/hypfs: Enable limited access during lockdown
[ Upstream commit 3868f910440c47cd5d158776be4ba4e2186beda7 ]
When kernel lockdown is active, debugfs_locked_down() blocks access to
hypfs files that register ioctl callbacks, even if the ioctl interface
is not required for a function. This unnecessarily breaks userspace
tools that only rely on read operations.
Resolve this by registering a minimal set of file operations during
lockdown, avoiding ioctl registration and preserving access for affected
tooling.
Note that this change restores hypfs functionality when lockdown is
active from early boot (e.g. via lockdown=integrity kernel parameter),
but does not apply to scenarios where lockdown is enabled dynamically
while Linux is running.
Tested-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Fixes:
|
||
|
Peter Oberparleiter
|
bb79734b8b |
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
[ Upstream commit fec7bdfe7f8694a0c39e6c3ec026ff61ca1058b9 ]
Currently, hypfs registers ioctl callbacks for all debugfs files,
despite only one file requiring them. This leads to unintended exposure
of unused interfaces to user space and can trigger side effects such as
restricted access when kernel lockdown is enabled.
Restrict ioctl registration to only those files that implement ioctl
functionality to avoid interface clutter and unnecessary access
restrictions.
Tested-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Fixes:
|
||
Takashi Iwai
|
de987b46c4 |
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
[ Upstream commit 8410fe81093ff231e964891e215b624dabb734b0 ]
The entry of the validators table for UAC3 feature unit is defined
with a wrong sub-type UAC_FEATURE (= 0x06) while it should have been
UAC3_FEATURE (= 0x07). This patch corrects the entry value.
Fixes:
|
||
William Liu
|
1fb7c8400d |
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
[ Upstream commit 2c2192e5f9c7c2892fe2363244d1387f62710d83 ]
The WARN_ON trigger based on !cl->leaf.q->q.qlen is unnecessary in
htb_activate. htb_dequeue_tree already accounts for that scenario.
Fixes:
|
||
|
William Liu
|
7689ab22de |
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
[ Upstream commit 15de71d06a400f7fdc15bf377a2552b0ec437cf5 ]
The following setup can trigger a WARNING in htb_activate due to
the condition: !cl->leaf.q->q.qlen
tc qdisc del dev lo root
tc qdisc add dev lo root handle 1: htb default 1
tc class add dev lo parent 1: classid 1:1 \
htb rate 64bit
tc qdisc add dev lo parent 1:1 handle f: \
cake memlimit 1b
ping -I lo -f -c1 -s64 -W0.001 127.0.0.1
This is because the low memlimit leads to a low buffer_limit, which
causes packet dropping. However, cake_enqueue still returns
NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an
empty child qdisc. We should return NET_XMIT_CN when packets are
dropped from the same tin and flow.
I do not believe return value of NET_XMIT_CN is necessary for packet
drops in the case of ack filtering, as that is meant to optimize
performance, not to signal congestion.
Fixes:
|
||
Jason Xing
|
c4f464cfc0 |
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
[ Upstream commit 4d4d9ef9dfee877d494e5418f68a1016ef08cad6 ]
Resolve the budget negative overflow which leads to returning true in
ixgbe_xmit_zc even when the budget of descs are thoroughly consumed.
Before this patch, when the budget is decreased to zero and finishes
sending the last allowed desc in ixgbe_xmit_zc, it will always turn back
and enter into the while() statement to see if it should keep processing
packets, but in the meantime it unexpectedly decreases the value again to
'unsigned int (0--)', namely, UINT_MAX. Finally, the ixgbe_xmit_zc returns
true, showing 'we complete cleaning the budget'. That also means
'clean_complete = true' in ixgbe_poll.
The true theory behind this is if that budget number of descs are consumed,
it implies that we might have more descs to be done. So we should return
false in ixgbe_xmit_zc to tell napi poll to find another chance to start
polling to handle the rest of descs. On the contrary, returning true here
means job done and we know we finish all the possible descs this time and
we don't intend to start a new napi poll.
It is apparently against our expectations. Please also see how
ixgbe_clean_tx_irq() handles the problem: it uses do..while() statement
to make sure the budget can be decreased to zero at most and the negative
overflow never happens.
The patch adds 'likely' because we rarely would not hit the loop condition
since the standard budget is 256.
Fixes:
|
||
Minhong He
|
89dfc9280e |
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
[ Upstream commit 84967deee9d9870b15bc4c3acb50f1d401807902 ]
The seg6_genl_sethmac() directly uses the algorithm ID provided by the
userspace without verifying whether it is an HMAC algorithm supported
by the system.
If an unsupported HMAC algorithm ID is configured, packets using SRv6 HMAC
will be dropped during encapsulation or decapsulation.
Fixes:
|
||
Dan Carpenter
|
6cd6e75cf9 |
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
[ Upstream commit 89f0addeee3cb2dc49837599330ed9c4612f05b0 ]
The "p" pointer is void so sizeof(*p) is 1. The intent was to check
sizeof(*cs_desc), which is 3, instead.
Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Dan Carpenter
|
d0225f41ee |
scsi: qla4xxx: Prevent a potential error pointer dereference
[ Upstream commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 ]
The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,
but qla4xxx_ep_connect() returns error pointers. Propagating the error
pointers will lead to an Oops in the caller, so change the error pointers
to NULL.
Fixes:
|
||
Weitao Wang
|
ef49d17eac |
usb: xhci: Fix slot_id resource race conflict
commit 2eb03376151bb8585caa23ed2673583107bb5193 upstream. xHC controller may immediately reuse a slot_id after it's disabled, giving it to a new enumerating device before the xhci driver freed all resources related to the disabled device. In such a scenario, device-A with slot_id equal to 1 is disconnecting while device-B is enumerating, device-B will fail to enumerate in the follow sequence. 1.[device-A] send disable slot command 2.[device-B] send enable slot command 3.[device-A] disable slot command completed and wakeup waiting thread 4.[device-B] enable slot command completed with slot_id equal to 1 and wakeup waiting thread 5.[device-B] driver checks that slot_id is still in use (by device-A) in xhci_alloc_virt_device, and fail to enumerate due to this conflict 6.[device-A] xhci->devs[slot_id] set to NULL in xhci_free_virt_device To fix driver's slot_id resources conflict, clear xhci->devs[slot_id] and xhci->dcbba->dev_context_ptrs[slot_id] pointers in the interrupt context when disable slot command completes successfully. Simultaneously, adjust function xhci_free_virt_device to accurately handle device release. [minor smatch warning and commit message fix -Mathias] Cc: stable@vger.kernel.org Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend") Signed-off-by: Weitao Wang <WeitaoWang-oc@zhaoxin.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20250819125844.2042452-2-mathias.nyman@linux.intel.com Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Josef Bacik
|
6cd3f13aaa |
nfs: fix UAF in direct writes
commit 17f46b803d4f23c66cacce81db35fef3adb8f2af upstream. In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. Signed-off-by: Josef Bacik <josef@toxicpanda.com> Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> [ chanho : Backports v5.4.y, commit 133a48abf6ec (NFS: Fix up commit deadlocks) is needed to use nfs_commit_end ] Signed-off-by: Chanho Min <chanho.min@lge.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Trond Myklebust
|
ee389fca75 |
NFS: Fix up commit deadlocks
commit 133a48abf6ecc535d7eddc6da1c3e4c972445882 upstream.
If O_DIRECT bumps the commit_info rpcs_out field, then that could lead
to fsync() hangs. The fix is to ensure that O_DIRECT calls
nfs_commit_end().
Fixes:
|
||
Zhang Xiaoxu
|
fe87e2d0e6 |
cifs: Fix UAF in cifs_demultiplex_thread()
commit d527f51331cace562393a8038d870b3e9916686f upstream.
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160
Read of size 4 at addr ffff88810103fc08 by task cifsd/923
CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45
...
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
print_report+0x171/0x472
kasan_report+0xad/0x130
kasan_check_range+0x145/0x1a0
smb2_is_network_name_deleted+0x27/0x160
cifs_demultiplex_thread.cold+0x172/0x5a4
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 923:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_slab_alloc+0x54/0x60
kmem_cache_alloc+0x147/0x320
mempool_alloc+0xe1/0x260
cifs_small_buf_get+0x24/0x60
allocate_buffers+0xa1/0x1c0
cifs_demultiplex_thread+0x199/0x10d0
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
Freed by task 921:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x143/0x1b0
kmem_cache_free+0xe3/0x4d0
cifs_small_buf_release+0x29/0x90
SMB2_negotiate+0x8b7/0x1c60
smb2_negotiate+0x51/0x70
cifs_negotiate_protocol+0xf0/0x160
cifs_get_smb_ses+0x5fa/0x13c0
mount_get_conns+0x7a/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback
1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is
executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the
waitter, then it can get the resp safely.
Fixes:
|
||
Dmitry Antipov
|
6894717a1e |
Bluetooth: fix use-after-free in device_for_each_child()
commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d upstream. Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly. Reported-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com Tested-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f Fixes: a85fb91e3d72 ("Bluetooth: Fix double free in hci_conn_cleanup") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> [ chanho: Backported from v5.10.y to v5.4.y. device_find_any_child() is not supported in v5.4.y, so changed to use device_find_child() with __match_any ] Signed-off-by: Chanho Min <chanho.min@lge.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Davide Caratti
|
6b1a3968fb |
act_mirred: use the backlog for nested calls to mirred ingress
[ Upstream commit ca22da2fbd693b54dc8e3b7b54ccc9f7e9ba3640 ] William reports kernel soft-lockups on some OVS topologies when TC mirred egress->ingress action is hit by local TCP traffic [1]. The same can also be reproduced with SCTP (thanks Xin for verifying), when client and server reach themselves through mirred egress to ingress, and one of the two peers sends a "heartbeat" packet (from within a timer). Enqueueing to backlog proved to fix this soft lockup; however, as Cong noticed [2], we should preserve - when possible - the current mirred behavior that counts as "overlimits" any eventual packet drop subsequent to the mirred forwarding action [3]. A compromise solution might use the backlog only when tcf_mirred_act() has a nest level greater than one: change tcf_mirred_forward() accordingly. Also, add a kselftest that can reproduce the lockup and verifies TC mirred ability to account for further packet drops after TC mirred egress->ingress (when the nest level is 1). [1] https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/Y0w%2FWWY60gqrtGLp@pop-os.localdomain/ [3] such behavior is not guaranteed: for example, if RPS or skb RX timestamping is enabled on the mirred target device, the kernel can defer receiving the skb and return NET_RX_SUCCESS inside tcf_mirred_forward(). Reported-by: William Zhao <wizhao@redhat.com> CC: Xin Long <lucien.xin@gmail.com> Signed-off-by: Davide Caratti <dcaratti@redhat.com> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> [ skulkarni: Adjusted patch for file 'tc_actions.sh' wrt the mainline commit ] Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Davide Caratti
|
cfae16e8f3 |
net/sched: act_mirred: better wording on protection against excessive stack growth
[ Upstream commit 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f ]
with commit
|
||
wenxu
|
02ca042304 |
net/sched: act_mirred: refactor the handle of xmit
[ Upstream commit fa6d639930ee5cd3f932cc314f3407f07a06582d ]
This one is prepare for the next patch.
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ skulkarni: Adjusted patch for file 'sch_generic.h' wrt the mainline commit ]
Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Jiri Pirko
|
7192eb73a0 |
selftests: forwarding: tc_actions.sh: add matchall mirror test
[ Upstream commit 075c8aa79d541ea08c67a2e6d955f6457e98c21c ]
Add test for matchall classifier with mirred egress mirror action.
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Vlad Buslov
|
4d6f20bf0f |
net: sched: don't expose action qstats to skb_tc_reinsert()
[ Upstream commit ef816f3c49c1c404ababc50e10d4cbe5109da678 ]
Previous commit introduced helper function for updating qstats and
refactored set of actions to use the helpers, instead of modifying qstats
directly. However, one of the affected action exposes its qstats to
skb_tc_reinsert(), which then modifies it.
Refactor skb_tc_reinsert() to return integer error code and don't increment
overlimit qstats in case of error, and use the returned error code in
tcf_mirred_act() to manually increment the overlimit counter with new
helper function.
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ skulkarni: Adjusted patch for file 'sch_generic.h' wrt the mainline commit ]
Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Vlad Buslov
|
b7b56a5f5c |
net: sched: extract qstats update code into functions
[ Upstream commit 26b537a88ca5b7399c7ab0656e06dbd9da9513c1 ]
Extract common code that increments cpu_qstats counters into standalone act
API functions. Change hardware offloaded actions that use percpu counter
allocation to use the new functions instead of accessing cpu_qstats
directly.
This commit doesn't change functionality.
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Vlad Buslov
|
dc15bd5634 |
net: sched: extract bstats update code into function
[ Upstream commit 5e1ad95b630e652d3467d1fd1f0b5e5ea2c441e2 ]
Extract common code that increments cpu_bstats counter into standalone act
API function. Change hardware offloaded actions that use percpu counter
allocation to use the new function instead of incrementing cpu_bstats
directly.
This commit doesn't change functionality.
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Vlad Buslov
|
306e2719c9 |
net: sched: extract common action counters update code into function
[ Upstream commit c8ecebd04cbb6badb46d42fe54282e7883ed63cc ]
Currently, all implementations of tc_action_ops->stats_update() callback
have almost exactly the same implementation of counters update
code (besides gact which also updates drop counter). In order to simplify
support for using both percpu-allocated and regular action counters
depending on run-time flag in following patches, extract action counters
update code into standalone function in act API.
This commit doesn't change functionality.
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Lorenzo Stoakes
|
f11d31371b |
mm: perform the mapping_map_writable() check after call_mmap()
[ Upstream commit 158978945f3173b8c1a88f8c5684a629736a57ac ] In order for a F_SEAL_WRITE sealed memfd mapping to have an opportunity to clear VM_MAYWRITE, we must be able to invoke the appropriate vm_ops->mmap() handler to do so. We would otherwise fail the mapping_map_writable() check before we had the opportunity to avoid it. This patch moves this check after the call_mmap() invocation. Only memfd actively denies write access causing a potential failure here (in memfd_add_seals()), so there should be no impact on non-memfd cases. This patch makes the userland-visible change that MAP_SHARED, PROT_READ mappings of an F_SEAL_WRITE sealed memfd mapping will now succeed. There is a delicate situation with cleanup paths assuming that a writable mapping must have occurred in circumstances where it may now not have. In order to ensure we do not accidentally mark a writable file unwritable by mistake, we explicitly track whether we have a writable mapping and unmap only if we do. [lstoakes@gmail.com: do not set writable_file_mapping in inappropriate case] Link: https://lkml.kernel.org/r/c9eb4cc6-7db4-4c2b-838d-43a0b319a4f0@lucifer.local Link: https://bugzilla.kernel.org/show_bug.cgi?id=217238 Link: https://lkml.kernel.org/r/55e413d20678a1bb4c7cce889062bbb07b0df892.1697116581.git.lstoakes@gmail.com Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Andy Lutomirski <luto@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Hugh Dickins <hughd@google.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Muchun Song <muchun.song@linux.dev> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: stable@vger.kernel.org [isaacmanjarres: added error handling to cleanup the work done by the mmap() callback and removed unused label.] Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Lorenzo Stoakes
|
55933e9538 |
mm: update memfd seal write check to include F_SEAL_WRITE
[ Upstream commit 28464bbb2ddc199433383994bcb9600c8034afa1 ] The seal_check_future_write() function is called by shmem_mmap() or hugetlbfs_file_mmap() to disallow any future writable mappings of an memfd sealed this way. The F_SEAL_WRITE flag is not checked here, as that is handled via the mapping->i_mmap_writable mechanism and so any attempt at a mapping would fail before this could be run. However we intend to change this, meaning this check can be performed for F_SEAL_WRITE mappings also. The logic here is equally applicable to both flags, so update this function to accommodate both and rename it accordingly. Link: https://lkml.kernel.org/r/913628168ce6cce77df7d13a63970bae06a526e0.1697116581.git.lstoakes@gmail.com Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Andy Lutomirski <luto@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Hugh Dickins <hughd@google.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Muchun Song <muchun.song@linux.dev> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: stable@vger.kernel.org Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Lorenzo Stoakes
|
6a8b539c3d |
mm: drop the assumption that VM_SHARED always implies writable
[ Upstream commit e8e17ee90eaf650c855adb0a3e5e965fd6692ff1 ]
Patch series "permit write-sealed memfd read-only shared mappings", v4.
The man page for fcntl() describing memfd file seals states the following
about F_SEAL_WRITE:-
Furthermore, trying to create new shared, writable memory-mappings via
mmap(2) will also fail with EPERM.
With emphasis on 'writable'. In turns out in fact that currently the
kernel simply disallows all new shared memory mappings for a memfd with
F_SEAL_WRITE applied, rendering this documentation inaccurate.
This matters because users are therefore unable to obtain a shared mapping
to a memfd after write sealing altogether, which limits their usefulness.
This was reported in the discussion thread [1] originating from a bug
report [2].
This is a product of both using the struct address_space->i_mmap_writable
atomic counter to determine whether writing may be permitted, and the
kernel adjusting this counter when any VM_SHARED mapping is performed and
more generally implicitly assuming VM_SHARED implies writable.
It seems sensible that we should only update this mapping if VM_MAYWRITE
is specified, i.e. whether it is possible that this mapping could at any
point be written to.
If we do so then all we need to do to permit write seals to function as
documented is to clear VM_MAYWRITE when mapping read-only. It turns out
this functionality already exists for F_SEAL_FUTURE_WRITE - we can
therefore simply adapt this logic to do the same for F_SEAL_WRITE.
We then hit a chicken and egg situation in mmap_region() where the check
for VM_MAYWRITE occurs before we are able to clear this flag. To work
around this, perform this check after we invoke call_mmap(), with careful
consideration of error paths.
Thanks to Andy Lutomirski for the suggestion!
[1]:https://lore.kernel.org/all/20230324133646.16101dfa666f253c4715d965@linux-foundation.org/
[2]:https://bugzilla.kernel.org/show_bug.cgi?id=217238
This patch (of 3):
There is a general assumption that VMAs with the VM_SHARED flag set are
writable. If the VM_MAYWRITE flag is not set, then this is simply not the
case.
Update those checks which affect the struct address_space->i_mmap_writable
field to explicitly test for this by introducing
[vma_]is_shared_maywrite() helper functions.
This remains entirely conservative, as the lack of VM_MAYWRITE guarantees
that the VMA cannot be written to.
Link: https://lkml.kernel.org/r/cover.1697116581.git.lstoakes@gmail.com
Link: https://lkml.kernel.org/r/d978aefefa83ec42d18dfa964ad180dbcde34795.1697116581.git.lstoakes@gmail.com
Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com>
Suggested-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Muchun Song <muchun.song@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Cong Wang
|
7a742a9506 |
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
commit 342debc12183b51773b3345ba267e9263bdfaaef upstream. After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequeue() and codel_qdisc_dequeue(). Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg> Fixes: |
||
|
Cong Wang
|
4f9cd311b7 |
sch_qfq: make qfq_qlen_notify() idempotent
commit 55f9eca4bfe30a15d8656f915922e8c98b7f0728 upstream. qfq_qlen_notify() always deletes its class from its active list with list_del_init() _and_ calls qfq_deactivate_agg() when the whole list becomes empty. To make it idempotent, just skip everything when it is not in the active list. Also change other list_del()'s to list_del_init() just to be extra safe. Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250403211033.166059-5-xiyou.wangcong@gmail.com Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Siddh Raman Pant <siddh.raman.pant@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Cong Wang
|
9a5fd5c2f4 |
sch_hfsc: make hfsc_qlen_notify() idempotent
commit 51eb3b65544c9efd6a1026889ee5fb5aa62da3bb upstream. hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it. 2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe. Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250403211033.166059-4-xiyou.wangcong@gmail.com Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Siddh Raman Pant <siddh.raman.pant@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Cong Wang
|
fcf09d75c3 |
sch_drr: make drr_qlen_notify() idempotent
commit df008598b3a00be02a8051fde89ca0fbc416bd55 upstream. drr_qlen_notify() always deletes the DRR class from its active list with list_del(), therefore, it is not idempotent and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life. Also change other list_del()'s to list_del_init() just to be extra safe. Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250403211033.166059-3-xiyou.wangcong@gmail.com Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Siddh Raman Pant <siddh.raman.pant@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Qu Wenruo
|
d5514a1d67 |
btrfs: populate otime when logging an inode item
[ Upstream commit 1ef94169db0958d6de39f9ea6e063ce887342e2d ]
[TEST FAILURE WITH EXPERIMENTAL FEATURES]
When running test case generic/508, the test case will fail with the new
btrfs shutdown support:
generic/508 - output mismatch (see /home/adam/xfstests/results//generic/508.out.bad)
# --- tests/generic/508.out 2022-05-11 11:25:30.806666664 +0930
# +++ /home/adam/xfstests/results//generic/508.out.bad 2025-07-02 14:53:22.401824212 +0930
# @@ -1,2 +1,6 @@
# QA output created by 508
# Silence is golden
# +Before:
# +After : stat.btime = Thu Jan 1 09:30:00 1970
# +Before:
# +After : stat.btime = Wed Jul 2 14:53:22 2025
# ...
# (Run 'diff -u /home/adam/xfstests/tests/generic/508.out /home/adam/xfstests/results//generic/508.out.bad' to see the entire diff)
Ran: generic/508
Failures: generic/508
Failed 1 of 1 tests
Please note that the test case requires shutdown support, thus the test
case will be skipped using the current upstream kernel, as it doesn't
have shutdown ioctl support.
[CAUSE]
The direct cause the 0 time stamp in the log tree:
leaf 30507008 items 2 free space 16057 generation 9 owner TREE_LOG
leaf 30507008 flags 0x1(WRITTEN) backref revision 1
checksum stored e522548d
checksum calced e522548d
fs uuid 57d45451-481e-43e4-aa93-289ad707a3a0
chunk uuid d52bd3fd-5163-4337-98a7-7986993ad398
item 0 key (257 INODE_ITEM 0) itemoff 16123 itemsize 160
generation 9 transid 9 size 0 nbytes 0
block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0
sequence 1 flags 0x0(none)
atime 1751432947.492000000 (2025-07-02 14:39:07)
ctime 1751432947.492000000 (2025-07-02 14:39:07)
mtime 1751432947.492000000 (2025-07-02 14:39:07)
otime 0.0 (1970-01-01 09:30:00) <<<
But the old fs tree has all the correct time stamp:
btrfs-progs v6.12
fs tree key (FS_TREE ROOT_ITEM 0)
leaf 30425088 items 2 free space 16061 generation 5 owner FS_TREE
leaf 30425088 flags 0x1(WRITTEN) backref revision 1
checksum stored 48f6c57e
checksum calced 48f6c57e
fs uuid 57d45451-481e-43e4-aa93-289ad707a3a0
chunk uuid d52bd3fd-5163-4337-98a7-7986993ad398
item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160
generation 3 transid 0 size 0 nbytes 16384
block group 0 mode 40755 links 1 uid 0 gid 0 rdev 0
sequence 0 flags 0x0(none)
atime 1751432947.0 (2025-07-02 14:39:07)
ctime 1751432947.0 (2025-07-02 14:39:07)
mtime 1751432947.0 (2025-07-02 14:39:07)
otime 1751432947.0 (2025-07-02 14:39:07) <<<
The root cause is that fill_inode_item() in tree-log.c is only
populating a/c/m time, not the otime (or btime in statx output).
Part of the reason is that, the vfs inode only has a/c/m time, no native
btime support yet.
[FIX]
Thankfully btrfs has its otime stored in btrfs_inode::i_otime_sec and
btrfs_inode::i_otime_nsec.
So what we really need is just fill the otime time stamp in
fill_inode_item() of tree-log.c
There is another fill_inode_item() in inode.c, which is doing the proper
otime population.
Fixes:
|
||
Jorge Ramirez-Ortiz
|
8226db2309 |
media: venus: hfi: explicitly release IRQ during teardown
[ Upstream commit 640803003cd903cea73dc6a86bf6963e238e2b3f ]
Ensure the IRQ is disabled - and all pending handlers completed - before
dismantling the interrupt routing and clearing related pointers.
This prevents any possibility of the interrupt triggering after the
handler context has been invalidated.
Fixes:
|
||
Chao Yu
|
ee4d13f540 |
f2fs: fix to avoid out-of-boundary access in dnode page
[ Upstream commit 77de19b6867f2740cdcb6c9c7e50d522b47847a4 ] As Jiaming Zhang reported: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data(). Cc: stable@kernel.org Reported-by: Jiaming Zhang <r772577952@gmail.com> Closes: https://groups.google.com/g/syzkaller/c/-ZnaaOOfO3M Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> [ replaced f2fs_err_ratelimited() with f2fs_err() ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Jorge Ramirez-Ortiz
|
18c2b2bd98 |
media: venus: protect against spurious interrupts during probe
[ Upstream commit 3200144a2fa4209dc084a19941b9b203b43580f0 ]
Make sure the interrupt handler is initialized before the interrupt is
registered.
If the IRQ is registered before hfi_create(), it's possible that an
interrupt fires before the handler setup is complete, leading to a NULL
dereference.
This error condition has been observed during system boot on Rb3Gen2.
Fixes:
|
||
Vladimir Zapolskiy
|
7e23a595f1 |
media: qcom: camss: cleanup media device allocated resource on error path
[ Upstream commit 69080ec3d0daba8a894025476c98ab16b5a505a4 ]
A call to media_device_init() requires media_device_cleanup() counterpart
to complete cleanup and release any allocated resources.
This has been done in the driver .remove() right from the beginning, but
error paths on .probe() shall also be fixed.
Fixes:
|
||
Ricardo Ribalda
|
6242f1a361 |
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
[ Upstream commit 377dc500d253f0b26732b2cb062e89668aef890a ]
The driver uses "whole" fps in all its calculations (e.g. in
load_per_instance()). Those calculation expect an fps bigger than 1, and
not big enough to overflow.
Clamp the value if the user provides a param that will result in an invalid
fps.
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
Fixes:
|
||
Imre Deak
|
2402adce8d |
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
[ Upstream commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f ] Reading DPCD registers has side-effects in general. In particular accessing registers outside of the link training register range (0x102-0x106, 0x202-0x207, 0x200c-0x200f, 0x2216) is explicitly forbidden by the DP v2.1 Standard, see 3.6.5.1 DPTX AUX Transaction Handling Mandates 3.6.7.4 128b/132b DP Link Layer LTTPR Link Training Mandates Based on my tests, accessing the DPCD_REV register during the link training of an UHBR TBT DP tunnel sink leads to link training failures. Solve the above by using the DP_LANE0_1_STATUS (0x202) register for the DPCD register access quirk. Cc: <stable@vger.kernel.org> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://lore.kernel.org/r/20250605082850.65136-2-imre.deak@intel.com [ Call to drm_dp_dpcd_access() instead of drm_dp_dpcd_probe() ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Uwe Kleine-König
|
e1fe95f933 |
pwm: mediatek: Fix duty and period setting
[ Upstream commit f21d136caf8171f94159d975ea4620c164431bd9 ]
The period generated by the hardware is
(PWMDWIDTH + 1) << CLKDIV) / freq
according to my tests with a signal analyser and also the documentation.
The current algorithm doesn't consider the `+ 1` part and so configures
slightly too high periods. The same issue exists for the duty cycle
setting. So subtract 1 from both the register values for period and
duty cycle. If period is 0, bail out, if duty_cycle is 0, just disable
the PWM which results in a constant low output.
Fixes:
|
||
|
Uwe Kleine-König
|
2c8e684df2 |
pwm: mediatek: Handle hardware enable and clock enable separately
[ Upstream commit 704d918341c378c5f9505dfdf32d315e256d3846 ] Stop handling the clocks in pwm_mediatek_enable() and pwm_mediatek_disable(). This is a preparing change for the next commit that requires that clocks and the enable bit are handled separately. Also move these two functions a bit further up in the source file to make them usable in pwm_mediatek_config(), which is needed in the next commit, too. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://lore.kernel.org/r/55c94fe2917ece152ee1e998f4675642a7716f13.1753717973.git.u.kleine-koenig@baylibre.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org> Stable-dep-of: f21d136caf81 ("pwm: mediatek: Fix duty and period setting") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Uwe Kleine-König
|
f070b3171e |
pwm: mediatek: Implement .apply() callback
[ Upstream commit 758de66f4bd2cac2b1d71db917c65c3d611d4e74 ]
To eventually get rid of all legacy drivers convert this driver to the
modern world implementing .apply().
This just pushed a variant of pwm_apply_legacy() into the driver that was
slightly simplified because the driver doesn't provide a .set_polarity()
callback.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Stable-dep-of: f21d136caf81 ("pwm: mediatek: Fix duty and period setting")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Gui-Dong Han
|
2964dbe631 |
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
[ Upstream commit 7af160aea26c7dc9e6734d19306128cce156ec40 ]
In the interrupt handler rain_interrupt(), the buffer full check on
rain->buf_len is performed before acquiring rain->buf_lock. This
creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as
rain->buf_len is concurrently accessed and modified in the work
handler rain_irq_work_handler() under the same lock.
Multiple interrupt invocations can race, with each reading buf_len
before it becomes full and then proceeding. This can lead to both
interrupts attempting to write to the buffer, incrementing buf_len
beyond its capacity (DATA_SIZE) and causing a buffer overflow.
Fix this bug by moving the spin_lock() to before the buffer full
check. This ensures that the check and the subsequent buffer modification
are performed atomically, preventing the race condition. An corresponding
spin_unlock() is added to the overflow path to correctly release the
lock.
This possible bug was found by an experimental static analysis tool
developed by our team.
Fixes:
|
||
Sakari Ailus
|
93c8931aef |
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
[ Upstream commit 5a0400aca5fa7c6b8ba456c311a460e733571c88 ]
It's a common pattern in drivers to free the control handler's resources
and then return the handler's error code on drivers' error handling paths.
Alas, the v4l2_ctrl_handler_free() function also zeroes the error field,
effectively indicating successful return to the caller.
There's no apparent need to touch the error field while releasing the
control handler's resources and cleaning up stale pointers. Not touching
the handler's error field is a more certain way to address this problem
than changing all the users, in which case the pattern would be likely to
re-emerge in new drivers.
Do just that, don't touch the control handler's error field in
v4l2_ctrl_handler_free().
Fixes:
|
||
Hans Verkuil
|
fad9206d7a |
media: v4l2-ctrls: always copy the controls on completion
[ Upstream commit c3bf5129f33923c92bf3bddaf4359b7b25ecb4ba ]
When v4l2_ctrl_request_complete() is called and there is no control
handler object found in the request, then create such an object so
that all controls at completion state can be stored and are available
to userspace.
Otherwise any attempt by userspace to read the completed request data
will fail.
If allocating the control handler object failed, then indicate that
by returning ENOMEM when attempting to get the controls from the
completed request instead of returning ENOENT.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 5a0400aca5fa ("media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Damien Le Moal
|
685ac66793 |
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
[ Upstream commit ed62a62a18bc144f73eadf866ae46842e8f6606e ]
Improve the description of the possible default SATA link power
management policies and add the missing description for policy 5.
No functional changes.
Fixes:
|
||
Bjorn Andersson
|
1096eb63ec |
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
[ Upstream commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef ]
When the MDT loader is used in remoteproc, the ELF header is sanitized
beforehand, but that's not necessary the case for other clients.
Validate the size of the firmware buffer to ensure that we don't read
past the end as we iterate over the header. e_phentsize and e_shentsize
are validated as well, to ensure that the assumptions about step size in
the traversal are valid.
Fixes:
|