android_kernel_samsung_sm8650

Author	SHA1	Message	Date
Carlos Llamas	5e5adb0e04	FROMLIST: binder: check offset alignment in binder_get_object() Commit `6d98eb95b4` ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit `7a67a39320` ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time. Fixes: `6d98eb95b4` ("binder: avoid potential data leakage when copying txn") Cc: <stable@vger.kernel.org> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 320661088 Link: https://lore.kernel.org/all/20240330190115.1877819-1-cmllamas@google.com/ Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: Iaddabaa28de7ba7b7d35dbb639d38ca79dbc5077 (cherry picked from commit `0c9784b747`) Signed-off-by: Lee Jones <joneslee@google.com>	2024-04-18 11:26:36 +01:00
chenweitao	337a4a7d36	ANDROID: ABI: Update oplus symbol list 1 function symbol(s) removed 'int __traceiter_android_vh_binder_detect_low_async_space_locked(void, int, size_t, int, bool)' 1 variable symbol(s) removed 'struct tracepoint __tracepoint_android_vh_binder_detect_low_async_space_locked' 1 function symbol(s) added 'int __traceiter_android_vh_binder_detect_low_async_space(void, int, size_t, int, bool)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_binder_detect_low_async_space' Bug: 333233535 Bug: 322915513 Change-Id: Ia61c8418ba3f109562d04a390329ee887c4fbe7b Signed-off-by: chenweitao <chenweitao@oppo.com>	2024-04-07 14:59:44 +08:00
chenweitao	6effd23bb8	ANDROID: vendor_hook: rename the the name of hooks Renamed trace_android_vh_binder_detect_low_async_space_locked to trace_android_vh_binder_detect_low_async_space. Because the orignal name is too long, which results to the compile-err of .ko that uses the symbol: ERROR: modpost: too long symbol "__tracepoint_android_vh_binder_detect_low_async_space_locked" There is not any users of the the orignal hooks so that it is safe to rename it. Bug: 333233535 Bug: 322915513 Change-Id: If45046efe8b2dba2c2ce0b9b41d2a794272f1887 Signed-off-by: chenweitao <chenweitao@oppo.com>	2024-04-07 14:59:10 +08:00
Giuliano Procida	77230df211	Revert "usb: dwc3: core: configure TX/RX threshold for DWC3_IP" This reverts commit `7932afa9bb`. It broke the Android kernel ABI and can be brought back in the future in an ABI-safe way if needed. Bug: 332277393 Change-Id: I10abcbf5237536b0ee382d3db16a5ebd82b3222c Signed-off-by: Giuliano Procida <gprocida@google.com>	2024-04-02 10:30:51 +00:00
Istvan Nador	bed1f46165	ANDROID: Update symbols list for open-dice.ko Cherry-picked to this branch to avoid build-break when enabling build of open-dice.ko in common-modules/virtual-device. There's no need to respin. Original commit message: Required to build open-dice.ko. Update generated with: tools/bazel run //common-modules/virtual-device:virtual_device_aarch64_abi_update_symbol_list Bug: 324290965 Test: tools/bazel run //common-modules/virtual-device:virtual_device_aarch64_dist Change-Id: Ib306c15d4acf9bd1e38499ab666fbf37eca44c5a Signed-off-by: Istvan Nador <istvannador@google.com> (cherry picked from commit `14e89262f0`)	2024-03-22 10:51:08 +00:00
Todd Kjos	3efaf503ab	ANDROID: Initialize android14-6.1-2024-03 Bug: 326193116 Signed-off-by: Todd Kjos <tkjos@google.com> Change-Id: Iaf42c0086d5c881cb410bdb349648bef6ee56aa7	2024-03-13 16:20:30 +00:00
Paul Chen	4c25eb8ea5	ANDROID: EXPORT raise_softirq and update the ABI symbol list In kernel 6.1 pending softirq won’t block turning off idle tick, so it will take longer to be handled. This is for power saving purposes but has extra delay then the 5.15 kernel. From above, it needs to export raise_softirq for external module to speed up the time sensitive event. Bug: 324080017 Test: build pass, raise_softirq can be used Change-Id: I675d5927d000ae5c372e6a88a1eda3101152e709 Signed-off-by: Paul Chen <chenpaul@google.com>	2024-03-13 16:18:09 +00:00
Pablo Neira Ayuso	a69447d296	UPSTREAM: netfilter: nf_tables: disallow timeout for anonymous sets commit e26d3009efda338f19016df4175f354a9bd0a4ab upstream. Never used from userspace, disallow these parameters. Bug: 329205828 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit b7be6c737a179a76901c872f6b4c1d00552d9a1b) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I3d8358a6dee3246e3ac56697dbb2be8fdc5f716f	2024-03-13 16:16:20 +00:00
Richard Chang	4a85f45e4e	BACKPORT: FROMGIT: mm: add alloc_contig_migrate_range allocation statistics alloc_contig_migrate_range has every information to be able to understand big contiguous allocation latency. For example, how many pages are migrated, how many times they were needed to unmap from page tables. This patch adds the trace event to collect the allocation statistics. In the field, it was quite useful to understand CMA allocation latency. [akpm@linux-foundation.org: a/trace_mm_alloc_config_migrate_range_info_enabled/trace_mm_alloc_contig_migrate_range_info_enabled] Link: https://lkml.kernel.org/r/20240228051127.2859472-1-richardycc@google.com Signed-off-by: Richard Chang <richardycc@google.com> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org. Cc: Martin Liu <liumartin@google.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Minchan Kim <minchan@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 315897534 (cherry picked from commit c8b36003121834cb77fcaf8a1ce0a454d7a97891 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-stable) [richardycc: slight modification for android change `0de2f42977`] Change-Id: If6c3cd106201fd13683d1dd5afdfa62a48a4dd3b Signed-off-by: Richard Chang <richardycc@google.com>	2024-03-13 16:15:27 +00:00
Charan Teja Kalla	e2903ba04e	FROMLIST: iommu: Avoid races around default domain allocations This fix is applicable for LTS kernel, 6.1.y. In latest kernels, this race issue is fixed by the patch series [1] and [2]. The right thing to do here would have been propagating these changes from latest kernel to the stable branch, 6.1.y. However, these changes seems too intrusive to be picked for stable branches. Hence, the fix proposed can be taken as an alternative instead of backporting the patch series. [1] https://lore.kernel.org/all/0-v8-81230027b2fa+9d-iommu_all_defdom_jgg@nvidia.com/ [2] https://lore.kernel.org/all/0-v5-1b99ae392328+44574-iommu_err_unwind_jgg@nvidia.com/ Issue: A race condition is observed when arm_smmu_device_probe and modprobe of client devices happens in parallel. This results in the allocation of a new default domain for the iommu group even though it was previously allocated and the respective iova domain(iovad) was initialized. However, for this newly allocated default domain, iovad will not be initialized. As a result, for devices requesting dma allocations, this uninitialized iovad will be used, thereby causing NULL pointer dereference issue. Flow: - During arm_smmu_device_probe, bus_iommu_probe() will be called as part of iommu_device_register(). This results in the device probe, __iommu_probe_device(). - When the modprobe of the client device happens in parallel, it sets up the DMA configuration for the device using of_dma_configure_id(), which inturn calls iommu_probe_device(). Later, default domain is allocated and attached using iommu_alloc_default_domain() and __iommu_attach_device() respectively. It then ends up initializing a mapping domain(IOVA domain) and rcaches for the device via arch_setup_dma_ops()->iommu_setup_dma_ops(). - Now, in the bus_iommu_probe() path, it again tries to allocate a default domain via probe_alloc_default_domain(). This results in allocating a new default domain(along with IOVA domain) via __iommu_domain_alloc(). However, this newly allocated IOVA domain will not be initialized. - Now, when the same client device tries dma allocations via iommu_dma_alloc(), it ends up accessing the rcaches of the newly allocated IOVA domain, which is not initialized. This results into NULL pointer dereferencing. Fix this issue by adding a check in probe_alloc_default_domain() to see if the iommu_group already has a default domain allocated and initialized. Adding a check in iommu_group_alloc_default_domain would not allow changing the default domain for an iommu group, via, iommu_change_dev_def_domain. As per the suggestions from upstream review for patch [3], the check for default domain was moved and duplicated into the callers, thereby restricting it only to the probe paths. [3] https://lore.kernel.org/all/e605b38a2d40b1e7589e10110c6d3ece35f6af4e.1705571894.git.quic_nprakash@quicinc.com/ Bug: 317188933 Link: https://lore.kernel.org/all/cbf1295589bd90083ad6f75a7fbced01f327c047.1708680521.git.quic_nprakash@quicinc.com/ Change-Id: I060d5b796911b1a597495d003e83cff0fd8b7625 Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com> Co-developed-by: Nikhil V <quic_nprakash@quicinc.com> Signed-off-by: Nikhil V <quic_nprakash@quicinc.com>	2024-03-13 16:02:40 +00:00
Eric Biggers	65d457fae4	ANDROID: fips140 - fix integrity check by unapplying dynamic SCS Since the kernel now has dynamic Shadow Call Stack (SCS) enabled, on CPUs that don't support Pointer Authentication Codes (PAC) the kernel runtime-patches paciasp and autiasp instructions into instructions that push and pop from the shadow call stack. This includes instructions in loaded modules. This broke the fips140 integrity check which needs to know how to undo all text changes made by the module loader in order to re-create the original text. Fix this by updating fips140.ko to undo the dynamic SCS patching. Bug: 188620248 Change-Id: I992bcd6c34b3340c6489b40a125715e1304cb445 Signed-off-by: Eric Biggers <ebiggers@google.com>	2024-03-13 14:09:58 +00:00
Eric Biggers	1616e03be1	ANDROID: fips140 - add option for debugging the integrity check There now have been two times where I've had to debug the fips140 integrity check failing due to a new type of runtime code patching. Debugging such issues requires dumping the text and rodata actually used for the integrity check and comparing them with the originals. Add a kconfig option to make this easier. Similar to CRYPTO_FIPS140_MOD_EVAL_TESTING, the production build won't use this. Bug: 188620248 Change-Id: I392de466ff31f999d65997dbc610e23e9eeca49d Signed-off-by: Eric Biggers <ebiggers@google.com>	2024-03-13 14:09:58 +00:00
Jaegeuk Kim	fd3551098b	BACKPORT: f2fs: split initial and dynamic conditions for extent_cache Let's allocate the extent_cache tree without dynamic conditions to avoid a missing condition causing a panic as below. # create a file w/ a compressed flag # disable the compression # panic while updating extent_cache F2FS-fs (dm-64): Swapfile: last extent is not aligned to section F2FS-fs (dm-64): Swapfile (3) is not align to section: 1) creat(), 2) ioctl(F2FS_IOC_SET_PIN_FILE), 3) fallocate(2097152 * N) Adding 124996k swap on ./swap-file. Priority:0 extents:2 across:17179494468k ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write out/common/include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_try_cmpxchg_acquire out/common/include/asm-generic/atomic-instrumented.h:705 [inline] BUG: KASAN: null-ptr-deref in queued_write_lock out/common/include/asm-generic/qrwlock.h:92 [inline] BUG: KASAN: null-ptr-deref in __raw_write_lock out/common/include/linux/rwlock_api_smp.h:211 [inline] BUG: KASAN: null-ptr-deref in _raw_write_lock+0x5a/0x110 out/common/kernel/locking/spinlock.c:295 Write of size 4 at addr 0000000000000030 by task syz-executor154/3327 CPU: 0 PID: 3327 Comm: syz-executor154 Tainted: G O 5.10.185 #1 Hardware name: emulation qemu-x86/qemu-x86, BIOS 2023.01-21885-gb3cc1cd24d 01/01/2023 Call Trace: __dump_stack out/common/lib/dump_stack.c:77 [inline] dump_stack_lvl+0x17e/0x1c4 out/common/lib/dump_stack.c:118 __kasan_report+0x16c/0x260 out/common/mm/kasan/report.c:415 kasan_report+0x51/0x70 out/common/mm/kasan/report.c:428 kasan_check_range+0x2f3/0x340 out/common/mm/kasan/generic.c:186 __kasan_check_write+0x14/0x20 out/common/mm/kasan/shadow.c:37 instrument_atomic_read_write out/common/include/linux/instrumented.h:101 [inline] atomic_try_cmpxchg_acquire out/common/include/asm-generic/atomic-instrumented.h:705 [inline] queued_write_lock out/common/include/asm-generic/qrwlock.h:92 [inline] __raw_write_lock out/common/include/linux/rwlock_api_smp.h:211 [inline] _raw_write_lock+0x5a/0x110 out/common/kernel/locking/spinlock.c:295 __drop_extent_tree+0xdf/0x2f0 out/common/fs/f2fs/extent_cache.c:1155 f2fs_drop_extent_tree+0x17/0x30 out/common/fs/f2fs/extent_cache.c:1172 f2fs_insert_range out/common/fs/f2fs/file.c:1600 [inline] f2fs_fallocate+0x19fd/0x1f40 out/common/fs/f2fs/file.c:1764 vfs_fallocate+0x514/0x9b0 out/common/fs/open.c:310 ksys_fallocate out/common/fs/open.c:333 [inline] __do_sys_fallocate out/common/fs/open.c:341 [inline] __se_sys_fallocate out/common/fs/open.c:339 [inline] __x64_sys_fallocate+0xb8/0x100 out/common/fs/open.c:339 do_syscall_64+0x35/0x50 out/common/arch/x86/entry/common.c:46 Bug: 323236756 Cc: stable@vger.kernel.org Fixes: 72840cccc0a1 ("f2fs: allocate the extent_cache by default") Reported-and-tested-by: syzbot+d342e330a37b48c094b7@syzkaller.appspotmail.com Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit f803982190f0265fd36cf84670aa6daefc2b0768) Change-Id: I584b9e37a4790baf5f6613778365b90f128bb765	2024-03-13 08:50:38 +00:00
Jia-Shiuan Chen	e897dadaf3	ANDROID: Update the ABI symbol list Adding the following symbols: - ww_mutex_lock - ww_mutex_unlock Bug: 329016610 Change-Id: Ieca294bb7c9aae6cf10fed76dd225914b804af42 Signed-off-by: Jia-Shiuan Chen <chenjs@google.com>	2024-03-12 17:30:24 +00:00
RD Babiera	bb197cebd5	UPSTREAM: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group The DisplayPort driver's sysfs nodes may be present to the userspace before typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns NULL in those cases. Remove manual sysfs node creation in favor of adding attribute group as default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is not used here otherwise the path to the sysfs nodes is no longer compliant with the ABI. Fixes: `0e3bb7d689` ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable@vger.kernel.org Signed-off-by: RD Babiera <rdbabiera@google.com> Link: https://lore.kernel.org/r/20240229001101.3889432-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 313517804 (cherry picked from commit 165376f6b23e9a779850e750fb2eb06622e5a531) Signed-off-by: RD Babiera <rdbabiera@google.com> (cherry picked from https://android-review.googlesource.com/q/commit:884fea555f0af00dee9fefefa5bb38eb4ed251b5) Merged-In: I13aaa956ff2b37e29eb0d90bbac0b7e1ac969b80 Change-Id: I13aaa956ff2b37e29eb0d90bbac0b7e1ac969b80	2024-03-11 21:26:50 +00:00
Paolo Abeni	981ffd6df1	UPSTREAM: epoll: use refcount to reduce ep_mutex contention We are observing huge contention on the epmutex during an http connection/rate test: 83.17% 0.25% nginx [kernel.kallsyms] [k] entry_SYSCALL_64_after_hwframe [...] \|--66.96%--__fput \|--60.04%--eventpoll_release_file \|--58.41%--__mutex_lock.isra.6 \|--56.56%--osq_lock The application is multi-threaded, creates a new epoll entry for each incoming connection, and does not delete it before the connection shutdown - that is, before the connection's fd close(). Many different threads compete frequently for the epmutex lock, affecting the overall performance. To reduce the contention this patch introduces explicit reference counting for the eventpoll struct. Each registered event acquires a reference, and references are released at ep_remove() time. The eventpoll struct is released by whoever - among EP file close() and and the monitored file close() drops its last reference. Additionally, this introduces a new 'dying' flag to prevent races between the EP file close() and the monitored file close(). ep_eventpoll_release() marks, under f_lock spinlock, each epitem as dying before removing it, while EP file close() does not touch dying epitems. The above is needed as both close operations could run concurrently and drop the EP reference acquired via the epitem entry. Without the above flag, the monitored file close() could reach the EP struct via the epitem list while the epitem is still listed and then try to put it after its disposal. An alternative could be avoiding touching the references acquired via the epitems at EP file close() time, but that could leave the EP struct alive for potentially unlimited time after EP file close(), with nasty side effects. With all the above in place, we can drop the epmutex usage at disposal time. Overall this produces a significant performance improvement in the mentioned connection/rate scenario: the mutex operations disappear from the topmost offenders in the perf report, and the measured connections/rate grows by ~60%. To make the change more readable this additionally renames ep_free() to ep_clear_and_put(), and moves the actual memory cleanup in a separate ep_free() helper. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Co-developed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Xiumei Mu <xmu@redhiat.com> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Carlos Maiolino <cmaiolino@redhat.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Eric Biggers <ebiggers@kernel.org> Cc: Jacob Keller <jacob.e.keller@intel.com> Cc: Jens Axboe <axboe@kernel.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Link: https://lkml.kernel.org/r/4a57788dcaf28f5eb4f8dfddcc3a8b172a7357bb.1679504153.git.pabeni@redhat.com Bug: 329052712 Change-Id: I78254b584f6fb1c20a1e11b7033d93a7c9fd65fb (cherry picked from commit 58c9b016e12855286370dfb704c08498edbc857a) Signed-off-by: Pradeep P V K <quic_pragalla@quicinc.com>	2024-03-11 18:40:30 +00:00
Wei Liu	457946c233	ANDROID: GKI: Update oplus symbol list 3 function symbol(s) added 'function int neigh_xmit(int fam, struct net_device , const void , struct sk_buff )' 'function int netif_receive_skb_core(struct sk_buff skb)' 'function int __rtnl_link_register(struct rtnl_link_ops *ops)' Bug: 328569318 Change-Id: I0868f7e9239396645371a005957f9f79078780f7 Signed-off-by: Wei Liu <liuwei.a@oppo.com>	2024-03-11 17:34:02 +00:00
lipeifeng	2fd940bf34	ANDROID: uid_sys_stat: fix data-error of cputime and io 'commit b6115e14010 ("ANDROID: uid_sys_stat: split the global lock uid_lock to the fine-grained locks for each hlist in hash_table.")' The above patch split the global lock to per-uid lock to reduce lock competition. But result in data-error from uid_cputime_show and uid_io_show in some cases. E.g, if thread1 and thread2 read /proc/uid_cputime/show_uid_stat at the same time, thread2 maybe operate in partA and zero active_stime and active_utime of uid_entry when thread1 is between partB and partC, which would cause thread1 show the error data. static int uid_cputime_show(struct seq_file m, void v) { ... /partA/ for (bkt = 0, uid_entry = NULL; uid_entry == NULL && bkt < HASH_SIZE(hash_table); bkt++) { lock_uid_by_bkt(bkt); hlist_for_each_entry(uid_entry, &hash_table[bkt], hash) { uid_entry->active_stime = 0; uid_entry->active_utime = 0; } unlock_uid_by_bkt(bkt); } rcu_read_lock(); /* partB / do_each_thread(temp, task) { ... lock_uid(uid); if (!(task->flags & PF_EXITING)) { task_cputime_adjusted(task, &utime, &stime); uid_entry->active_utime += utime; uid_entry->active_stime += stime; } unlock_uid(uid); } while_each_thread(temp, task); rcu_read_unlock(); for (bkt = 0, uid_entry = NULL; uid_entry == NULL && bkt < HASH_SIZE(hash_table); bkt++) { lock_uid_by_bkt(bkt); hlist_for_each_entry(uid_entry, &hash_table[bkt], hash) { u64 total_utime = uid_entry->utime + uid_entry->active_utime; u64 total_stime = uid_entry->stime + uid_entry->active_stime; / partC */ seq_printf(m, "%d: %llu %llu\n", uid_entry->uid, ktime_to_us(total_utime), ktime_to_us(total_stime)); } unlock_uid_by_bkt(bkt); } The patch ensures that the calculation and seq_printf of each uid_entry is within the uid_lock range, in order to accurate data. Bug: 278138377 Change-Id: Iaa2ccd95c4b4b333f04b2ba18d7699d94017394e Signed-off-by: lipeifeng <lipeifeng@oppo.com> (cherry picked from commit ea35d2bd073214e84be242287a2e91741c6588ed)	2024-03-08 23:30:44 +00:00
Richard Chang	5f66e7c904	ANDROID: Update the ABI symbol list Adding the following symbols: - __traceiter_cma_alloc_finish - __traceiter_cma_alloc_start - __tracepoint_cma_alloc_finish - __tracepoint_cma_alloc_start Bug: 315897033 Change-Id: I089ebe0549ebdaf5b633d413e6a0abf66b2b5789 Signed-off-by: Richard Chang <richardycc@google.com>	2024-03-08 04:13:52 +00:00
Richard Chang	8bd9771065	ANDROID: vendor_hooks: Export cma_alloc trace points For cma_alloc latency measurement. Bug: 315897033 Change-Id: I5941c0e0017728dc2139d5fad073f8b58f4efa29 Signed-off-by: Richard Chang <richardycc@google.com>	2024-03-08 04:04:18 +00:00
Hang Wei	9219a44e00	ANDROID: gki_defconfig: Enable CONFIG_ARM_SCMI_TRANSPORT_VIRTIO Enable this config to add scmi-virtio transport procotol Bug: 326840729 Change-Id: I006afe8686eb4b7db0aa2baa93db44a1518d700c Signed-off-by: Hang Wei <hang01.wei@samsung.com>	2024-03-07 22:12:10 +00:00
Todd Kjos	6bad1052c2	Revert "Merge tag 'android14-6.1.75_r00' into android14-6.1" This reverts commit `1dbafe61e3`. Reason for revert: Too early. Needs to wait until 2024-03-27 Change-Id: I769b944bd089aa2278659ec87f7ba4ac4e74ee4a Signed-off-by: Todd Kjos <tkjos@google.com>	2024-03-07 21:18:27 +00:00
Sabrina Dubroca	ecb45e2a73	UPSTREAM: net: tls: fix use-after-free with partial reads and async decrypt [ Upstream commit 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f ] tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-after-free in process_rx_list when we try to read from the partially-read skb. Bug: 326214405 Fixes: `fd31f3996a` ("tls: rx: decrypt into a fresh skb") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit d684763534b969cca1022e2a28645c7cc91f7fa5) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ifdd765d0af082523d1432436b6f6d2c094c48dca	2024-03-07 13:41:50 +00:00
Greg Kroah-Hartman	1dbafe61e3	Merge tag 'android14-6.1.75_r00' into android14-6.1 This merges up to the 6.1.75 LTS release into the android14-6.1 branch. Included in here are the following commits: * `6644fcfcbc` ANDROID: Fix CRC error with iommu_* functions * `c84ac52917` Revert "bpf: add percpu stats for bpf_map elements insertions/deletions" * `0125855f7e` Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()" * `329c931b9d` Revert "bpf: Defer the free of inner map when necessary" * `c16bb76a0c` Merge 6.1.75 into android14-6.1-lts \|\ \| * `883d1a9562` Linux 6.1.75 \| * `cfa4683828` Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" \| * `f854bff46a` arm64: dts: armada-3720-turris-mox: set irq type for RTC \| * `17062a768c` Revert "KEYS: encrypted: Add check for strsep" \| * `b1cc57f976` riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping \| * `9025ee1079` block: Remove special-casing of compound pages \| * `2c46871ac4` i2c: s3c24xx: fix transferring more than one message in polling mode \| * `63892860b0` i2c: s3c24xx: fix read transfers in polling mode \| * `380540bb06` ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work \| * `8f7f03e8cd` selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes \| * `13e6065fed` mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure \| * `31944f4264` loop: fix the the direct I/O support check when used on top of block devices \| * `f2cc7d90a8` ethtool: netlink: Add missing ethnl_ops_begin/complete \| * `7809296dc1` kdb: Fix a potential buffer overflow in kdb_local() \| * `50ee63b800` ipvs: avoid stat macros calls from preemptible context \| * `4a45e7e7d2` netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description \| * `b56bce52f9` netfilter: nf_tables: skip dead set elements in netlink dump \| * `9cb084df01` netfilter: nf_tables: do not allow mismatch field size and set key length \| * `7ae19ee81c` netfilter: bridge: replace physindev with physinif in nf_bridge_info \| * `754ca18ed3` netfilter: propagate net to nf_bridge_get_physindev \| * `3f1f505277` netfilter: nf_queue: remove excess nf_bridge variable \| * `52d01a40b7` netfilter: nfnetlink_log: use proper helper for fetching physinif \| * `dfa01315c3` netfilter: nft_limit: do not ignore unsupported flags \| * `f00f11aae1` netfilter: nf_tables: reject invalid set policy \| * `2f32d518a1` mptcp: relax check on MPC passive fallback \| * `4631c2dd69` LoongArch: BPF: Prevent out-of-bounds memory access \| * `ca65da8da1` net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe \| * `4108b86e32` bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS \| * `f1ec1b6c5c` net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls \| * `359fadf5f7` drm/amdkfd: fixes for HMM mem allocation \| * `81b86a10b8` drm/amdkfd: Use resource_size() helper function \| * `1c3aa875db` dt-bindings: gpio: xilinx: Fix node address in gpio \| * `24e00f0fa9` net: ravb: Fix dma_addr_t truncation in error case \| * `615501d41b` udp: annotate data-races around up->pending \| * `33cf52b6e5` block: ensure we hold a queue reference when using queue limits \| * `fdf3df297f` mptcp: refine opt_mp_capable determination \| * `c0749c8770` mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() \| * `51e4cb032d` mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() \| * `081273082d` mptcp: strict validation before using mp_opt->hmac \| * `67feafe7a3` mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN \| * `cb183a586e` net: phy: micrel: populate .soft_reset for KSZ9131 \| * `ecf0ebf0e6` amt: do not use overwrapped cb area \| * `c96da963de` net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames \| * `ee1dc3bf86` net: qualcomm: rmnet: fix global oob in rmnet_policy \| * `93eb80c5c9` s390/pci: fix max size calculation in zpci_memcpy_toio() \| * `cad471227a` ASoC: mediatek: sof-common: Add NULL check for normal_link string \| * `69f0bebe91` PCI: mediatek-gen3: Fix translation window size calculation \| * `94667790e5` PCI: keystone: Fix race condition when initializing PHYs \| * `11923a8df8` nvmet-tcp: Fix the H2C expected PDU len calculation \| * `fb711858e6` nvme: trace: avoid memcpy overflow warning \| * `cac037db24` nvmet: re-fix tracing strncpy() warning \| * `e92fe6f51b` serial: imx: Correct clock error message in function probe() \| * `938b88a2d9` usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer \| * `9d4fa5fe2b` apparmor: avoid crash when parsed profile name is empty \| * `3a46101871` cxl/region: fix x9 interleave typo \| * `16cbe4bad8` perf env: Avoid recursively taking env->bpf_progs.lock \| * `83ccd15717` nvmet-tcp: fix a crash in nvmet_req_complete() \| * `2871aa4070` nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length \| * `8ed3eb92a5` vdpa: Fix an error handling path in eni_vdpa_probe() \| * `b2cb99d26e` spmi: mtk-pmif: Serialize PMIF status check and command submission \| * `28a45e15c8` usb: cdc-acm: return correct error code on unsupported break \| * `8fd48981a7` tty: use 'if' in send_break() instead of 'goto' \| * `50608b54ad` tty: don't check for signal_pending() in send_break() \| * `6f0cd560ff` tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK \| * `8e426f2499` tty: change tty_write_lock()'s ndelay parameter to bool \| * `ed863a4d48` perf genelf: Set ELF program header addresses properly \| * `4cb5213213` perf hisi-ptt: Fix one memory leakage in hisi_ptt_process_auxtrace_event() \| * `8f02951cee` perf header: Fix one memory leakage in perf_event__fprintf_event_update() \| * `eeeb3861c2` iio: adc: ad9467: fix scale setting \| * `e2b405b985` iio: adc: ad9467: don't ignore error codes \| * `89398709ae` iio: adc: ad9467: fix reset gpio handling \| * `f33bdf21e1` selftests/sgx: Skip non X86_64 platform \| * `bf92b82101` selftests/sgx: Include memory clobber for inline asm in test enclave \| * `2cfae256a1` selftests/sgx: Fix uninitialized pointer dereferences in encl_get_entry \| * `eb41e7e8b4` selftests/sgx: Fix uninitialized pointer dereference in error path \| * `63ee7be01a` serial: imx: fix tx statemachine deadlock \| * `3f9ec4227e` software node: Let args be NULL in software_node_get_reference_args \| * `893c3ca250` acpi: property: Let args be NULL in __acpi_node_get_property_reference \| * `76be69716c` base/node.c: initialize the accessor list before registering \| * `d5ef7480d6` libapi: Add missing linux/types.h header to get the __u64 type on io.h \| * `d74173bda2` serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed \| * `e6fce099c9` power: supply: bq256xx: fix some problem in bq256xx_hw_init \| * `ddd3fe99b4` power: supply: cw2015: correct time_to_empty units in sysfs \| * `559e25126c` MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() \| * `2504864be6` MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() \| * `69e9a6944d` riscv: Fixed wrong register in XIP_FIXUP_FLASH_OFFSET macro \| * `add57b5298` riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC \| * `b4f4d42765` riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings \| * `d2ebb8143b` riscv: Fix module_alloc() that did not reset the linear mapping permissions \| * `890cfe5337` riscv: Check if the code to patch lies in the exit section \| * `9ad0ab0bbc` mips: Fix incorrect max_low_pfn adjustment \| * `1961a29b89` mips: dmi: Fix early remap on MIPS32 \| * `e341194063` mfd: intel-lpss: Fix the fractional clock divider flags \| * `7fdc6c187e` leds: aw2013: Select missing dependency REGMAP_I2C \| * `527e8c5f3d` mfd: syscon: Fix null pointer dereference in of_syscon_register() \| * `ac3b65cbc6` ARM: 9330/1: davinci: also select PINCTRL \| * `d2ba8eea74` serial: sc16is7xx: set safe default SPI clock frequency \| * `4f61154a68` serial: sc16is7xx: add check for unsupported SPI modes during probe \| * `f09b277f73` HID: wacom: Correct behavior when processing some confidence == false touches \| * `710bd46860` iio: adc: ad7091r: Pass iio_dev to event handler \| * `dba788e25f` KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache \| * `8a4f6a176a` KVM: arm64: vgic-v4: Restore pending state on host userspace write \| * `455ebc1910` x86/kvm: Do not try to disable kvmclock if it was not enabled \| * `88f4dd8b9f` PCI: mediatek: Clear interrupt status before dispatching handler \| * `0c883bc9fa` PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support \| * `d3c08d1015` PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg() \| * `970c0899a4` cxl/port: Fix decoder initialization when nr_targets > interleave_ways \| * `23f9749108` Revert "net: rtnetlink: Enslave device before bringing it up" \| * `f2ddfc7d3a` wifi: mwifiex: configure BSSID consistently when starting AP \| * `54e1864b13` wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors \| * `0075a5d69d` wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code \| * `debfa60412` wifi: mt76: fix broken precal loading from MTD for mt7915 \| * `1edce43f47` iommu/dma: Trace bounce buffer usage when mapping buffers \| * `cc7e8482c6` iommu/arm-smmu-qcom: Add missing GMU entry to match table \| * `516ecb2436` LoongArch: Fix and simplify fcsr initialization on execve() \| * `6cc9c0af0a` bpf: Fix re-attachment branch in bpf_tracing_prog_attach \| * `96860d9ad4` Bluetooth: Fix atomicity violation in {min,max}_key_size_set \| * `7c02ca5542` rootfs: Fix support for rootfstype= when root= is given \| * `f5c29a3a7e` md/raid1: Use blk_opf_t for read and write operations \| * `7b85554c7c` pwm: Fix out-of-bounds access in of_pwm_single_xlate() \| * `00e29df1b4` pwm: jz4740: Don't use dev_err_probe() in .request() \| * `a372f1d01b` netfilter: nf_tables: check if catch-all set element is active in next generation \| * `c6350b5cb7` block: Fix iterating over an empty bio with bio_for_each_folio_all \| * `ef31cc8779` block: add check that partition length needs to be aligned with block size \| * `0c8d252d0a` drm/amd: Enable PCIe PME from D3 \| * `f49a30a24f` scsi: mpi3mr: Block PEL Enable Command on Controller Reset and Unrecoverable State \| * `546e981eea` scsi: mpi3mr: Refresh sdev queue depth after controller reset \| * `3378333263` scsi: target: core: add missing file_{start,end}_write() \| * `01644b8616` scsi: ufs: core: Simplify power management during async scan \| * `81f444f228` fbdev: flush deferred IO before closing \| * `ccbee2843e` fbdev: flush deferred work in fb_deferred_io_fsync() \| * `d6cc8dd231` io_uring/rw: ensure io->bytes_done is always initialized \| * `c866866c79` ksmbd: only v2 leases handle the directory \| * `380965e48e` ksmbd: fix UAF issue in ksmbd_tcp_new_connection() \| * `6eb8015492` ksmbd: validate mech token in session setup \| * `0914dc8041` ALSA: hda/realtek: Enable headset mic on Lenovo M70 Gen5 \| * `5648a0087f` ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on HP ZBook \| * `3253abcd9b` ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx \| * `29f6eccbcf` ALSA: oxygen: Fix right channel of capture volume mixer \| * `104f95698c` drm/vmwgfx: Keep a gem reference to user bos in surfaces \| * `5a4087a907` drm/vmwgfx: Fix possible invalid drm gem put calls \| * `a71776bbd8` serial: omap: do not override settings for RS485 support \| * `b5a2232ba8` serial: 8250_exar: Set missing rs485_supported flag \| * `36b0710502` serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock \| * `d5f13c1d01` serial: core, imx: do not set RS485 enabled if it is not supported \| * `dac0dd3d80` serial: 8250_bcm2835aux: Restore clock error handling \| * `15000d6f29` serial: core: make sure RS485 cannot be enabled when it is not supported \| * `f790bd27a7` serial: core: fix sanitizing check for RTS settings \| * `974a0a6944` usb: mon: Fix atomicity violation in mon_bin_vma_fault \| * `206e2ddeb7` usb: typec: class: fix typec_altmode_put_partner to put plugs \| * `d0320b9ac6` Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" \| * `097cdc78c6` usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled \| * `45c766231e` usb: cdns3: fix iso transfer error when mult is not zero \| * `3f2bf7cac0` usb: cdns3: fix uvc failure work since sg support enabled \| * `e894b1b038` usb: chipidea: wait controller resume finished for wakeup irq \| * `3450197e9a` Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" \| * `598f9d5a3b` Revert "usb: dwc3: Soft reset phy on probe for host" \| * `d5c4a04205` usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart \| * `789eade47f` usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() \| * `c952654e1a` tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug \| * `9ccf64e763` powerpc/64s: Increase default stack size to 32KB \| * `7ac029af00` clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings \| * `6696f76c32` binder: fix race between mmput() and do_exit() \| * `437360133c` xen-netback: don't produce zero-size SKB frags \| * `3ed5f55599` Input: atkbd - use ab83 as id when skipping the getid command \| * `45e565b55b` mips/smp: Call rcutree_report_cpu_starting() earlier \| * `16e1d4fa13` binder: fix unused alloc->free_async_space \| * `c5255d1229` binder: fix async space check for 0-sized buffers \| * `66b3578797` keys, dns: Fix size check of V1 server-list header \| * `60a9a5fca6` selftests/bpf: Add assert for user stacks in test_task_stack \| * `3590da14e1` of: unittest: Fix of_count_phandle_with_args() expected value message \| * `581ade6be5` fbdev: imxfb: fix left margin setting \| * `b9d760dae5` of: Fix double free in of_parse_phandle_with_args_map \| * `676af10d0c` ksmbd: validate the zero field of packet header \| * `222618b737` kselftest/alsa - mixer-test: Fix the print format specifier warning \| * `b77ae4f8c1` kselftest/alsa - mixer-test: fix the number of parameters to ksft_exit_fail_msg() \| * `74416a207f` drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init \| * `4525525cb7` drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c \| * `a9f68a23ca` IB/iser: Prevent invalidating wrong MR \| * `96dc4d204a` mmc: sdhci_omap: Fix TI SoC dependencies \| * `5aa65e5f20` mmc: sdhci_am654: Fix TI SoC dependencies \| * `d8d8897d65` ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() \| * `cda7762bea` ALSA: scarlett2: Add missing error checks to _ctl_get() \| `be0b1be4ac` ALSA: scarlett2: Allow passing any output to line_out_remap() \| * `be96acd3ea` ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() \| * `6232b7505c` ALSA: scarlett2: Add missing error check to scarlett2_config_save() \| * `74341edb7d` ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] \| * `40fe0903fa` pwm: stm32: Fix enable count for clk in .probe() \| * `0d554b420c` pwm: stm32: Use hweight32 in stm32_pwm_detect_channels \| * `ade959ed67` pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable \| * `c4b1f10f14` clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw \| * `6d98d24917` accel/habanalabs: fix information leak in sec_attest_info() \| * `7ac0adc7df` drm/mediatek: dp: Add phy_mtk_dp module as pre-dependency \| * `f930dbdc95` clk: si5341: fix an error code problem in si5341_output_clk_set_rate \| * `24961a5dc7` watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused \| * `6317445623` watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling \| * `3bde94e858` watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO \| * `06b854238e` watchdog: set cdev owner before adding \| * `c249ef9d09` drivers: clk: zynqmp: update divider round rate logic \| * `b61ca9c34c` drivers: clk: zynqmp: calculate closest mux rate \| * `74aeef7e43` clk: qcom: videocc-sm8150: Add missing PLL config property \| * `52d741c95d` clk: qcom: videocc-sm8150: Update the videocc resets \| * `52e2ebc064` dt-bindings: clock: Update the videocc resets for sm8150 \| * `4f31f357e5` f2fs: fix to check return value of f2fs_recover_xattr_data \| * `2c6537c58b` drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table \| * `4e26e2d485` gpu/drm/radeon: fix two memleaks in radeon_vm_init \| * `35fa2394d2` drivers/amd/pm: fix a use-after-free in kv_parse_power_table \| * `f957a1be64` drm/amd/pm: fix a double-free in si_dpm_init \| * `591e77fedc` drm/amdgpu/debugfs: fix error code when smc register accessors are NULL \| * `3ec6ce0651` drm/mediatek: Fix underrun in VDO1 when switches off the layer \| * `518efe60bb` drm/mediatek: Return error if MDP RDMA failed to enable the clock \| * `aa3e61cf89` drm/msm/dpu: Drop enable and frame_count parameters from dpu_hw_setup_misr() \| * `08d7e291af` drm/msm/dpu: Set input_sel bit for INTF \| * `9570ae0e1d` clk: renesas: rzg2l: Check reset monitor registers \| * `3e1dd6a1b4` clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset() \| * `2db7760422` media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() \| * `74e3f165d3` media: dvbdev: drop refcount on error path in dvb_device_open() \| * `4d6e15a5ea` f2fs: fix to update iostat correctly in f2fs_filemap_fault() \| * `8835766027` f2fs: fix to check compress file in f2fs_move_file_range() \| * `9bfd5ea715` f2fs: fix to wait on block writeback for post_read case \| * `e67911d2ca` drm/panel: st7701: Fix AVCL calculation \| * `bb17cc851e` media: rkisp1: Fix media device memory leak \| * `690b7c356f` media: dt-bindings: media: rkisp1: Fix the port description for the parallel interface \| * `438193dcc2` media: imx-mipi-csis: Fix clock handling in remove() \| * `df2adafa62` clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config \| * `40a156cf08` RDMA/hns: Fix memory leak in free_mr_init() \| * `dada3fdb4e` media: cx231xx: fix a memleak in cx231xx_init_isoc \| * `b075ed8dcc` drm/bridge: tc358767: Fix return value on error case \| * `9a3b226370` drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable \| * `60c23f9aeb` drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table \| * `0f19543097` drm/radeon/dpm: fix a memleak in sumo_parse_power_table \| * `c4ff554081` drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() \| * `048cbfd605` drm/panfrost: Ignore core_mask for poweroff and disable PWRTRANS irq \| * `c32ee7286f` ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch \| * `7682ef5c14` drm/drv: propagate errors from drm_modeset_register_all() \| * `19b01c6c19` drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks \| * `b234ecad20` drm/msm/mdp4: flush vblank event on disable \| * `982eb772e1` ASoC: cs35l34: Fix GPIO name and drop legacy include \| * `940484c055` ASoC: cs35l33: Fix GPIO name and drop legacy include \| * `2da8e20346` drm/tidss: Fix dss reset \| * `553574c023` drm/tidss: Check for K2G in in dispc_softreset() \| * `f099c742ca` drm/tidss: Return error value from from softreset \| * `10a437c604` drm/tidss: Move reset to the end of dispc_init() \| * `da72ff8def` drm/radeon: check return value of radeon_ring_lock() \| * `e6667551ed` drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() \| * `9ac2845a2e` drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() \| * `f0145860c2` f2fs: fix to avoid dirent corruption \| * `4bab3ad44d` drm/bridge: Fix typo in post_disable() description \| * `dab1227007` media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls \| * `563f34c24c` media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls \| * `32b4b2dde3` media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the crash of multi-core JPEG devices \| * `f211621deb` media: mtk-jpegdec: export jpeg decoder functions \| * `30773ea47d` media: pvrusb2: fix use after free on context disconnection \| * `4019c80968` drm/tilcdc: Fix irq free on unload \| * `81f1bd8596` drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function \| * `37b400c803` drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer \| * `dbea48e916` drm/panel-elida-kd35t133: hold panel in reset for unprepare \| * `019bba28d1` RDMA/hns: Fix inappropriate err code for unsupported operations \| * `a867b891f9` RDMA/usnic: Silence uninitialized symbol smatch warnings \| * `d260b65b2b` drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off() \| * `8578a795ba` Revert "drm/omapdrm: Annotate dma-fence critical section in commit path" \| * `3e6bf96561` Revert "drm/tidss: Annotate dma-fence critical section in commit path" \| * `544d223d71` ARM: davinci: always select CONFIG_CPU_ARM926T \| * `62a1fedeb1` ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() \| * `1b481cb536` mlxbf_gige: Enable the GigE port in mlxbf_gige_open \| * `7ad5e7a35c` mlxbf_gige: Fix intermittent no ip issue \| * `0b5b831122` net/sched: act_ct: fix skb leak and crash on ooo frags \| * `b91d31de9a` sctp: fix busy polling \| * `9233a88f4b` sctp: support MSG_ERRQUEUE flag in recvmsg() \| * `3c0bd2b066` bpf: sockmap, fix proto update hook to avoid dup calls \| * `6e9429f9c6` null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS \| * `a623d31805` block: make BLK_DEF_MAX_SECTORS unsigned \| * `33f93ce22e` Bluetooth: btmtkuart: fix recv_buf() return value \| * `81f3b6ea31` Bluetooth: Fix bogus check for re-auth no supported with non-ssp \| * `55c88a7efb` netfilter: nf_tables: mark newset as dead on transaction abort \| * `68aebba59e` wifi: iwlwifi: mvm: send TX path flush in rfkill \| * `6cc82456e3` wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request \| * `8915946cde` wifi: rtlwifi: rtl8192se: using calculate_bit_shift() \| * `62badccc7c` wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() \| * `a277e8e9fe` wifi: rtlwifi: rtl8192de: using calculate_bit_shift() \| * `b716c8483c` wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() \| * `d938e470b2` wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() \| * `35fb6b7574` wifi: rtlwifi: rtl8192c: using calculate_bit_shift() \| * `937f65a125` wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() \| * `dd9e3d9513` wifi: rtlwifi: add calculate_bit_shift() \| * `ce9b43e58c` arm64: dts: qcom: ipq6018: Fix up indentation \| * `20fb17328b` arm64: dts: qcom: ipq6018: Pad addresses to 8 hex digits \| * `ba71baee6e` arm64: dts: qcom: ipq6018: Use lowercase hex \| * `cb65c2caa1` arm64: dts: qcom: ipq6018: improve pcie phy pcs reg table \| * `45d8d80cda` arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK \| * `ab23e4ef89` arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent \| * `e765363ecf` block: add check of 'minors' and 'first_minor' in device_add_disk() \| * `a4529948df` arm64: dts: qcom: sm8150-hdk: fix SS USB regulators \| * `bf5e9d28a8` soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration \| * `aaf0fc13be` dma-mapping: clear dev->dma_mem to NULL after freeing it \| * `542da27eac` virtio/vsock: fix logic which reduces credit update messages \| * `f69365e3a7` ipmr: support IP_PKTINFO on cache report IGMP msg \| * `0c867561ce` selftests/net: fix grep checking for fib_nexthop_multiprefix \| * `c458be3909` ARM: dts: stm32: don't mix SCMI and non-SCMI board compatibles \| * `fdbe94c524` scsi: hisi_sas: Correct the number of global debugfs registers \| * `6491d9ea93` scsi: hisi_sas: Rollback some operations if FLR failed \| * `3d5a4fa56d` scsi: hisi_sas: Replace with standard error code return value \| * `35657d1ba8` arm64: dts: imx8mm: Reduce GPU to nominal speed \| * `a4210a686a` arm64: dts: renesas: white-hawk-cpu: Fix missing serial console pin control \| * `9f5b79cf12` block: Set memalloc_noio to false on device_add_disk() error path \| * `4196b45370` selftests/bpf: Relax time_tai test for equal timestamps in tai_forward \| * `0c9318d49e` wifi: mt76: mt7921: fix country count limitation for CLC \| * `fe002eeda4` arm64: dts: mediatek: mt8183: correct MDP3 DMA-related nodes \| * `9c91f58498` dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with generic names \| * `ba5e58dacf` arm64: dts: hisilicon: hikey970-pmic: fix regulator cells properties \| * `b1d4d54d32` bpf: Fix verification of indirect var-off stack access \| * `4054b2b1e6` wifi: mt76: mt7921s: fix workqueue problem causes STA association fail \| * `4486b2e5db` arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types \| * `361b4175dd` arm64: dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent \| * `a16a476b5c` arm64: dts: qcom: sc7280: Fix up GPU SIDs \| * `9e1dafa5c3` arm64: dts: qcom: sm8350: Fix DMA0 address \| * `1623432c6a` arm64: dts: qcom: sdm845-db845c: correct LED panic indicator \| * `773c09af31` arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator \| * `9435bbc8d9` scsi: fnic: Return error if vmalloc() failed \| * `fc3e3c50a0` bpf: fix check for attempt to corrupt spilled pointer \| * `50e9fbddcb` selftests/net: specify the interface when do arping \| * `62fca83303` bpf: Defer the free of inner map when necessary \| * `e05b322c82` bpf: Add map and need_defer parameters to .map_fd_put_ptr() \| * `a6fb03a9c9` bpf: add percpu stats for bpf_map elements insertions/deletions \| * `1010882619` rcu-tasks: Provide rcu_trace_implies_rcu_gp() \| * `db44bac18a` arm64: dts: qcom: sm6350: Make watchdog bark interrupt edge triggered \| * `8e335e7759` arm64: dts: qcom: sc8280xp: Make watchdog bark interrupt edge triggered \| * `66cdbc4e80` arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered \| * `385f30d448` arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered \| * `5e8267cbc0` arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered \| * `bc9a45a06a` arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered \| * `30d0c5fe2c` arm64: dts: qcom: sc7280: Mark some nodes as 'reserved' \| * `0200f1b6ba` arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered \| * `22529f0ac2` ARM: dts: qcom: sdx65: correct SPMI node name \| * `be1f34b93f` bpf: enforce precision of R0 on callback return \| * `f9f2d957a8` md: synchronize flush io with array reconfiguration \| * `b21a16909b` selftests/bpf: Fix erroneous bitmask operation \| * `ff9935181e` arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type \| * `e9e59f3ee5` arm64: dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes \| * `436785a207` wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior \| * `6824ed5d5a` firmware: meson_sm: populate platform devices from sm device tree data \| * `00ac00ce8d` firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() \| * `ac7c503bd5` net/ncsi: Fix netlink major/minor version numbers \| * `12db013dc9` ARM: dts: qcom: apq8064: correct XOADC register address \| * `638f381ab2` wifi: libertas: stop selecting wext \| * `7dd918d877` wifi: ath11k: Defer on rproc_get failure \| * `799a914e48` bpf: Add crosstask check to __bpf_get_stack \| * `1959a560ac` bpf, lpm: Fix check prefixlen before walking trie \| * `cd1896b922` wifi: rtw88: fix RX filter in FIF_ALLMULTI flag \| * `fdd9364163` wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async() \| * `a058f0c432` pNFS: Fix the pnfs block driver's calculation of layoutget size \| * `b10370b1ea` SUNRPC: fix _xprt_switch_find_current_entry logic \| * `19f28fa8be` NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT \| * `83f2d54ca3` blocklayoutdriver: Fix reference leak of pnfs_device_node \| * `23ba22557a` csky: fix arch_jump_label_transform_static override \| * `4df0c942d0` crypto: scomp - fix req->dst buffer overflow \| * `490adf8be7` crypto: sahara - do not resize req->src when doing hash operations \| * `eae15c43be` crypto: sahara - fix processing hash requests with req->nbytes < sg->length \| * `6fc9576795` crypto: sahara - improve error handling in sahara_sha_process() \| * `5834cafc1d` crypto: sahara - fix wait_for_completion_timeout() error handling \| * `8b355e0478` crypto: sahara - fix ahash reqsize \| * `a75ba66b69` crypto: sahara - handle zero-length aes requests \| * `0545801b30` crypto: sahara - avoid skcipher fallback code duplication \| * `635308e604` crypto: virtio - Wait for tasklet to complete on device remove \| * `d69d7804cf` gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump \| * `caae86077d` fs: indicate request originates from old mount API \| * `9c285df949` erofs: fix memory leak on short-lived bounced pages \| * `48dcfc42ce` pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() \| * `d7e4268a51` crypto: hisilicon/zip - save capability registers in probe process \| * `a384d7dc4e` crypto: hisilicon/sec2 - save capability registers in probe process \| * `fc6b944de1` crypto: hisilicon/hpre - save capability registers in probe process \| * `4705731fc5` crypto: hisilicon/qm - add a function to set qm algs \| * `11d7a33905` crypto: hisilicon/zip - add zip comp high perf mode configuration \| * `6412f039ac` crypto: hisilicon/qm - save capability registers in qm init process \| * `d1f82d7210` crypto: sahara - fix error handling in sahara_hw_descriptor_create() \| * `435303ad8a` crypto: sahara - fix processing requests with cryptlen < sg->length \| * `e7e8fbfe6d` crypto: sahara - fix ahash selftest failure \| * `1f91280362` crypto: sahara - fix cbc selftest failure \| * `eecf2e1e0c` crypto: sahara - remove FLAGS_NEW_KEY logic \| * `4c0ac81a17` crypto: safexcel - Add error handling for dma_map_sg() calls \| * `d5d4dfc73b` crypto: af_alg - Disallow multiple in-flight AIO requests \| * `f3a11fdd02` crypto: ccp - fix memleak in ccp_init_dm_workarea \| * `baa79033e1` crypto: sa2ul - Return crypto_aead_setkey to transfer the error \| * `ae4747dab2` crypto: virtio - Handle dataq logic with tasklet \| * `e973b045c1` selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket \| * `5389407bba` mtd: Fix gluebi NULL pointer dereference caused by ftl notifier \| * `030a1147ed` kunit: debugfs: Fix unchecked dereference in debugfs_print_results() \| * `b841208b7e` ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error \| * `b412c486a3` ACPI: LPSS: Fix the fractional clock divider flags \| * `5980041cba` spi: sh-msiof: Enforce fixed DTDL for R-Car H3 \| * `ea6b597fca` efivarfs: Free s_fs_info on unmount \| * `d4a9aa7db5` efivarfs: force RO when remounting if SetVariable is not supported \| * `321b3a5592` calipso: fix memory leak in netlbl_calipso_add_pass() \| * `71f47a52ba` cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() \| * `04fc66dd2b` cpufreq: Use of_property_present() for testing DT property presence \| * `79de65ac39` of: Add of_property_present() helper \| * `426710a2bc` platform/x86/intel/vsec: Fix xa_alloc memory leak \| * `0ff5cd92bb` platform/x86/intel/vsec: Use mutex for ida_alloc() and ida_free() \| * `1fa4a1e125` platform/x86/intel/vsec: Support private data \| * `3c48b2a7ce` platform/x86/intel/vsec: Enhance and Export intel_vsec_add_aux() \| * `c25f1555e0` KEYS: encrypted: Add check for strsep \| * `72222dfd76` ACPI: LPIT: Avoid u32 multiplication overflow \| * `2124c5bc22` ACPI: video: check for error while searching for backlight device parent \| * `08f7142e22` mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response \| * `a35ab02c85` spi: spi-zynqmp-gqspi: fix driver kconfig dependencies \| * `a2da3f9b1a` powerpc/imc-pmu: Add a null pointer check in update_events_in_group() \| * `f152a6bfd1` powerpc/powernv: Add a null pointer check in opal_powercap_init() \| * `9a523e1da6` powerpc/powernv: Add a null pointer check in opal_event_init() \| * `ed8d023cfa` powerpc/powernv: Add a null pointer check to scom_debug_init_one() \| * `327d4f2d66` selftests/powerpc: Fix error handling in FPU/VMX preemption tests \| * `026fd977dc` powerpc/pseries/memhp: Fix access beyond end of drmem array \| * `63df75d383` powerpc/44x: select I2C for CURRITUCK \| * `2fc51c4b7d` powerpc: add crtsavres.o to always-y instead of extra-y \| * `16b88e68b8` powerpc: remove checks for binutils older than 2.25 \| * `9dbac9fdae` EDAC/thunderx: Fix possible out-of-bounds string access \| * `c9275305d6` x86/mce/inject: Clear test status value \| * `0be645792c` x86/lib: Fix overflow when counting digits * \| `6e04c1ccf7` Merge branch 'android14-6.1' into branch 'android14-6.1-lts' * \| `c0f972f028` UPSTREAM: drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks * \| `8fe0623347` UPSTREAM: drm/msm/dsi: Enable runtime PM * \| `c3a1a1e97e` Merge branch 'android14-6.1' into branch 'android14-6.1-lts' * \| `48159eff53` Merge 6.1.74 into android14-6.1-lts \|\\| \| * `8fd7f44624` Linux 6.1.74 \| * `a31690d3dd` scripts/decode_stacktrace.sh: optionally use LLVM utilities \| * `5e67191818` coresight: etm4x: Fix width of CCITMIN field \| * `d08e756e25` PCI: Add ACS quirk for more Zhaoxin Root Ports \| * `41e3e3d813` leds: ledtrig-tty: Free allocated ttyname buffer on deactivate \| * `419602d08b` parport: parport_serial: Add Brainboxes device IDs and geometry \| * `3936b54a8d` parport: parport_serial: Add Brainboxes BAR details \| * `17a8519cb3` uio: Fix use-after-free in uio_open \| * `08af2ceb83` binder: fix comment on binder_alloc_new_buf() return value \| * `35a3e8ceaf` binder: fix trivial typo of binder_free_buf_locked() \| * `9fa04c93f2` binder: fix use-after-free in shinker's callback \| * `ee14fd2c8b` binder: use EPOLLERR from eventpoll.h \| * `bed0acf330` Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" \| * `e377a3346f` ksmbd: free ppace array on error in parse_dacl \| * `09d84f37f8` ksmbd: don't allow O_TRUNC open on read-only share \| * `c24fc060ab` bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25 \| * `0d242f739c` btf, scripts: Exclude Rust CUs with pahole \| * `b976593219` ASoC: SOF: Intel: hda-codec: Delay the codec device registration \| * `dcf95b26be` ACPI: resource: Add another DMI match for the TongFang GMxXGxx \| * `5816a82caf` ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx \| * `9d588f3b6f` drm/crtc: fix uninitialized variable use \| * `809ebacd22` ARM: sun9i: smp: fix return code check of of_property_match_string \| * `0ce688d88a` net: qrtr: ns: Return 0 if server port is not present \| * `1e1b2f34e9` virtio_blk: fix snprintf truncation compiler warning \| * `9efdc0081c` ida: Fix crash in ida_free when the bitmap is empty \| * `24f3fec911` pinctrl: cy8c95x0: Fix get_pincfg \| * `a54e7741cc` pinctrl: cy8c95x0: Fix typo \| * `75e94701c0` drm/amd/display: get dprefclk ss info from integration info table \| * `426ab60bd2` i2c: rk3x: fix potential spinlock recursion on poll \| * `5411e32927` smb: client: fix potential OOB in smb2_dump_detail() \| * `da7ba20a71` HID: nintendo: Prevent divide-by-zero on code \| * `87e2739656` dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM \| * `d0085e100f` ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models \| * `2b055dc11e` ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk \| * `8840d3491a` ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 \| * `a63ab09a07` platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems \| * `44521a5dc4` HID: nintendo: fix initializer element is not constant error \| * `3910d7a441` kselftest: alsa: fixed a print formatting warning \| * `2a36b4e5e6` Input: xpad - add Razer Wolverine V2 support \| * `31fbbc809c` wifi: iwlwifi: pcie: avoid a NULL pointer dereference \| * `05d268e2e4` ARC: fix spare error \| * `372a93921e` s390/scm: fix virtual vs physical address confusion \| * `626b0c0ab3` Input: i8042 - add nomux quirk for Acer P459-G2-M \| * `30fe4c4135` Input: atkbd - skip ATKBD_CMD_GETID in translated mode \| * `b6ef44cb6a` reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning \| * `c5d9fd8c5a` Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 \| * `b0407f68d9` ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI \| * `07787918c6` tracing: Fix uaf issue when open the hist or hist_debug file \| * `851865caac` MIPS: dts: loongson: drop incorrect dwmac fallback compatible \| * `708579592c` stmmac: dwmac-loongson: drop useless check for compatible fallback \| * `e75c3db904` tracing: Add size check when printing trace_marker output \| * `7d885c1717` tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing \| * `3ac74ed58f` jbd2: fix soft lockup in journal_finish_inode_data_buffers() \| * `bb0e510b74` platform/x86: intel-vbtn: Fix missing tablet-mode-switch events \| * `f379394a78` neighbour: Don't let neigh_forced_gc() disable preemption for long \| * `9b5044e17e` drm/crtc: Fix uninit-value bug in drm_mode_setcrtc \| * `28c9fced8d` jbd2: increase the journal IO's priority \| * `6b15330693` jbd2: correct the printing of write_flags in jbd2_write_superblock() \| * `c84f9a5ecb` clk: rockchip: rk3128: Fix HCLK_OTG gate register \| * `3fe5fbc3a5` clk: rockchip: rk3568: Add PLL rate for 292.5MHz \| * `c3597996a3` LoongArch: Preserve syscall nr across execve() \| * `c73cc2310a` hwmon: (corsair-psu) Fix probe when built-in \| * `53442204b1` drm/exynos: fix a wrong error checking \| * `1502a9a595` drm/exynos: fix a potential error pointer dereference \| * `92decec3ca` drm/amdgpu: Add NULL checks for function pointers \| * `5337fb3eba` arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru \| * `ce97686124` nvme: prevent potential spectre v1 gadget \| * `df2bd52354` nvme: introduce helper function to get ctrl state \| * `a50562146d` ASoC: ops: add correct range check for limiting volume \| * `01a7727ab7` ASoC: da7219: Support low DC impedance headset \| * `a7d15ac085` net/tg3: fix race condition in tg3_reset_task() \| * `c342afc146` ASoC: hdac_hda: Conditionally register dais for HDMI and Analog \| * `0f37e198c3` ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 \| * `2fff601a1d` nouveau/tu102: flush all pdbs on vmm flush \| * `94d2a9da31` ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available \| * `1613195bf3` ASoC: rt5650: add mutex to avoid the jack detection failure \| * `b45e21b529` ASoC: cs43130: Fix incorrect frame delay configuration \| * `0c7833f758` ASoC: cs43130: Fix the position of const qualifier \| * `b0c9af3d31` ASoC: Intel: Skylake: mem leak in skl register function \| * `7c09cf8095` ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 \| * `522f69ba6b` ASoC: Intel: Skylake: Fix mem leak in few functions \| * `9f1429c5aa` arm64: dts: rockchip: fix rk356x pcie msg interrupt name \| * `3996699d1f` ASoC: wm8974: Correct boost mixer inputs \| * `63360763bf` hwtracing: hisi_ptt: Don't try to attach a task \| * `2e3fc2a45a` hwtracing: hisi_ptt: Handle the interrupt in hardirq context \| * `319c5186d6` nvme-core: check for too small lba shift \| * `f84b0c6445` blk-mq: don't count completed flush data request as inflight in case of quiesce \| * `366d2101fc` smb: client, common: fix fortify warnings \| * `53a37135f7` drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer \| * `d551c77727` drm/amd/display: update dcn315 lpddr pstate latency \| * `3c781fbb4f` nvme-core: fix a memory leak in nvme_ns_info_from_identify() \| * `a37096b079` ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format \| * `08f6de7b3f` debugfs: fix automount d_fsdata usage \| * `d1d138c043` wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap \| * `0c880e1e38` wifi: avoid offset calculation on NULL pointer \| * `dd9465b108` wifi: cfg80211: lock wiphy mutex for rfkill poll \| * `91edb0cd1b` mptcp: fix uninit-value in mptcp_incoming_options \| * `9038962130` ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro \| * `9436ae696a` pinctrl: lochnagar: Don't build on MIPS \| * `5de9e9dd18` f2fs: explicitly null-terminate the xattr list * \| `8284d64954` Revert "ipv6: remove max_size check inline with ipv4" * \| `9b95c4490c` Merge "Merge 6.1.73 into android14-6.1-lts" into android14-6.1-lts \|\ \ \| * \| `a856aee341` Merge 6.1.73 into android14-6.1-lts \| \|\\| \| \| * `fec3b1451d` Linux 6.1.73 \| \| * `f9ee31dc7f` cifs: fix flushing folio regression for 6.1 backport \| \| * `0f22c8a6ef` ipv6: remove max_size check inline with ipv4 \| \| * `b2c545c398` Revert "nfsd: separate nfsd_last_thread() from nfsd_put()" \| \| * `db5f2f4db8` Revert "nfsd: call nfsd_last_thread() before final nfsd_put()" * \| \| `1eda34ffd5` ANDROID: db845c: Enable device tree overlay support \|/ / * \| `732ef8a408` Merge branch 'android14-6.1' into branch 'android14-6.1-lts' * \| `7aa979acec` Revert "splice, net: Add a splice_eof op to file-ops and socket-ops" * \| `a272a3f824` Revert "ipv4, ipv6: Use splice_eof() to flush" * \| `f901cbd38f` Revert "udp: introduce udp->udp_flags" * \| `cef6c6be87` Revert "udp: move udp->no_check6_tx to udp->udp_flags" * \| `8806a26646` Revert "udp: move udp->no_check6_rx to udp->udp_flags" * \| `7b70acfd8e` Revert "udp: move udp->gro_enabled to udp->udp_flags" * \| `583a8f8204` Revert "udp: move udp->accept_udp_{l4\|fraglist} to udp->udp_flags" * \| `cdf5cfe6d1` Revert "udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO" * \| `f9f95b82b2` Revert "udp: annotate data-races around udp->encap_type" * \| `acd1add3c8` Revert "bpf, sockmap: af_unix stream sockets need to hold ref for pair sock" * \| `190985b1db` Revert "bpf: decouple prune and jump points" * \| `eba57b3513` Revert "bpf: remove unnecessary prune and jump points" * \| `9212bbf98b` Revert "bpf: Remove unused insn_cnt argument from visit_[func_call_]insn()" * \| `797e6a76ea` Revert "bpf: clean up visit_insn()'s instruction processing" * \| `c7b298c1b5` Revert "bpf: Support new 32bit offset jmp instruction" * \| `1699079678` Revert "bpf: handle ldimm64 properly in check_cfg()" * \| `63ca0ed629` Revert "bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4" * \| `e1b12db2de` Merge 6.1.72 into android14-6.1-lts \|\\| \| * `7c58bfa711` Linux 6.1.72 \| * `2dbe25ae06` Revert "interconnect: qcom: sm8250: Enable sync_state" \| * `f73a374c19` smb3: Replace smb2pdu 1-element arrays with flex-arrays \| * `ec162546a7` media: qcom: camss: Comment CSID dt_id field \| * `a5c3f2b4ce` bpf: syzkaller found null ptr deref in unix_bpf proto add \| * `15db682980` bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4 \| * `7cbdf36eab` net/sched: act_ct: Always fill offloading tuple iifidx \| * `2be4e8ac2d` net/sched: act_ct: additional checks for outdated flows \| * `87318b7e37` f2fs: compress: fix to assign compress_level for lz4 correctly \| * `397f719037` genirq/affinity: Only build SMP-only helper functions on SMP kernels \| * `28c9222e29` mmc: sdhci-sprd: Fix eMMC init failure after hw reset \| * `2813a434d4` mmc: core: Cancel delayed work before releasing host \| * `575e127041` mmc: rpmb: fixes pause retune on all RPMB partitions. \| * `9c5efaa09b` mmc: meson-mx-sdhc: Fix initialization frozen issue \| * `48e1d426f4` drm/amd/display: add nv12 bounding box \| * `11c3510d1d` drm/amdgpu: skip gpu_info fw loading on navi12 \| * `dafdeb7b91` mm: fix unmap_mapping_range high bits shift bug \| * `08038069c2` i2c: core: Fix atomic xfer check for non-preempt config \| * `53b42cb33f` x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect \| * `d1db1ef5e6` firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards \| * `09a44d994b` ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() \| * `820a7802f2` btrfs: mark the len field in struct btrfs_ordered_sum as unsigned \| * `ab220f4f5c` btrfs: fix qgroup_free_reserved_data int overflow \| * `0f74dde5be` octeontx2-af: Support variable number of lmacs \| * `7d3912613d` octeontx2-af: Fix pause frame configuration \| * `a29b15cc68` net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table \| * `2bb4ecb334` netfilter: flowtable: GC pushes back packets to classic path \| * `df01de08b4` net/sched: act_ct: Fix promotion of offloaded unreplied tuple \| * `87466a3745` net/sched: act_ct: offload UDP NEW connections \| * `8b160f2fba` netfilter: flowtable: cache info of last offload \| * `c29a7656f8` netfilter: flowtable: allow unidirectional rules \| * `e681f711e9` net: sched: call tcf_ct_params_free to free params in tcf_ct_init \| * `d49bf9c1ce` mm/memory_hotplug: fix error handling in add_memory_resource() \| * `4666f003af` mm/memory_hotplug: add missing mem_hotplug_lock \| * `a576780a2a` lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly \| * `f33b27f5c3` genirq/affinity: Move group_cpus_evenly() into lib/ \| * `617ba3735d` genirq/affinity: Rename irq_build_affinity_masks as group_cpus_evenly \| * `aeeb4e4e49` genirq/affinity: Don't pass irq_affinity_desc array to irq_build_affinity_masks \| * `9e84d7bb15` genirq/affinity: Pass affinity managed mask array to irq_build_affinity_masks \| * `a1dcd17947` genirq/affinity: Remove the 'firstvec' parameter from irq_build_affinity_masks \| * `f4fe76467e` ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 \| * `aee609302d` firmware: arm_scmi: Fix frequency truncation by promoting multiplier type \| * `90d1f74c3c` bpf, sockmap: af_unix stream sockets need to hold ref for pair sock \| * `5ff1682fec` ethtool: don't propagate EOPNOTSUPP from dumps \| * `e570b15087` dpaa2-eth: recycle the RX buffer only after all processing done \| * `5b8938fc7d` net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats \| * `e88275ce7e` smb: client: fix missing mode bits for SMB symlinks \| * `bf223fd4d9` block: update the stable_writes flag in bdev_add \| * `a8e4300ae5` filemap: add a per-mapping stable writes flag \| * `d0eafc7631` mm, netfs, fscache: stop read optimisation when folio removed from pagecache \| * `bceff380f3` mm: merge folio_has_private()/filemap_release_folio() call pairs \| * `8b6b3ecf0c` memory-failure: convert truncate_error_page() to use folio \| * `a6f440f3b9` khugepage: replace try_to_release_page() with filemap_release_folio() \| * `4c78612e5f` ext4: convert move_extent_per_page() to use folios \| * `b92a8f591c` media: qcom: camss: Fix set CSI2_RX_CFG1_VC_MODE when VC is greater than 3 \| * `710f70555d` media: camss: sm8250: Virtual channels for CSID \| * `c96a4f9360` selftests: mptcp: set FAILING_LINKS in run_tests \| * `4b85e920af` selftests: mptcp: fix fastclose with csum failure \| * `336d1ee07e` f2fs: set the default compress_level on ioctl \| * `1ff3f5ef28` f2fs: assign default compression level \| * `55d3f41e55` f2fs: convert to use bitmap API \| * `84a8d913fb` f2fs: clean up i_compress_flag and i_compress_level usage \| * `2c14f49916` s390/cpumf: support user space events for counting \| * `a1a1e5ce88` s390/mm: add missing arch_set_page_dat() call to vmem_crst_alloc() \| * `31051f722d` net/mlx5: Increase size of irq name buffer \| * `b5c8e0ff76` blk-mq: make sure active queue usage is held for bio_integrity_prep() \| * `803fb6109f` bpf: fix precision backtracking instruction iteration \| * `b08acd5c46` bpf: handle ldimm64 properly in check_cfg() \| * `2c795ce090` bpf: Support new 32bit offset jmp instruction \| * `b1c780ed3c` bpf: clean up visit_insn()'s instruction processing \| * `97bb6dab01` bpf: Remove unused insn_cnt argument from visit_[func_call_]insn() \| * `8266c47d04` bpf: remove unnecessary prune and jump points \| * `743f3548d3` bpf: decouple prune and jump points \| * `eb4f2e1788` fbdev: imsttfb: fix double free in probe() \| * `f2a79f3651` fbdev: imsttfb: Release framebuffer and dealloc cmap on error path \| * `51a1b94302` arm64: dts: qcom: sdm845: Fix PSCI power domain names \| * `5db8b93cbe` arm64: dts: qcom: sdm845: align RPMh regulator nodes with bindings \| * `343bb27e31` wifi: iwlwifi: yoyo: swap cdb and jacket bits values \| * `158b71f3a9` udp: annotate data-races around udp->encap_type \| * `8d929b6c11` udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO \| * `b680a907d1` udp: move udp->accept_udp_{l4\|fraglist} to udp->udp_flags \| * `753886c0b9` udp: move udp->gro_enabled to udp->udp_flags \| * `a01cff15cc` udp: move udp->no_check6_rx to udp->udp_flags \| * `50e41aa9ea` udp: move udp->no_check6_tx to udp->udp_flags \| * `e2a4392b61` udp: introduce udp->udp_flags \| * `2489502fb1` ipv4, ipv6: Use splice_eof() to flush \| * `4713b7c756` splice, net: Add a splice_eof op to file-ops and socket-ops \| * `ac8c69e448` udp: Convert udp_sendpage() to use MSG_SPLICE_PAGES \| * `6bcc79a4e7` net: Declare MSG_SPLICE_PAGES internal sendmsg() flag \| * `89b51e70e5` bpf, x86: save/restore regs with BPF_DW size \| * `4ee461c5dc` bpf, x86: Simplify the parsing logic of structure parameters \| * `605c8d8f99` bpf, x64: Fix tailcall infinite loop \| * `5573fdbc34` srcu: Fix callbacks acceleration mishandling \| * `abc3e3fb71` cpu/SMT: Make SMT control more robust against enumeration failures \| * `482fa21635` cpu/SMT: Create topology_smt_thread_allowed() \| * `a364c18553` selftests: secretmem: floor the memory size to the multiple of page_size \| * `c38c5cfd3e` net: Implement missing SO_TIMESTAMPING_NEW cmsg support \| * `14937f47a4` bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() \| * `55fbcd83aa` net: ravb: Wait for operating mode to be applied \| * `8a09b0f01c` asix: Add check for usbnet_get_endpoints \| * `db9c4a1f37` octeontx2-af: Re-enable MAC TX in otx2_stop processing \| * `b67e7d78e4` octeontx2-af: Always configure NIX TX link credits based on max frame size \| * `84c3833a93` net/smc: fix invalid link access in dumping SMC-R connections \| * `0af75845ff` net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues \| * `9b05042922` igc: Fix hicredit calculation \| * `7663226274` i40e: Restore VF MSI-X state during PCI reset \| * `5735f529e3` ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux \| * `8719838c12` ASoC: meson: g12a-toacodec: Fix event generation \| * `5de3c8496e` ASoC: meson: g12a-tohdmitx: Validate written enum values \| * `95b4d4093a` ASoC: meson: g12a-toacodec: Validate written enum values \| * `2f3b6e8600` i40e: fix use-after-free in i40e_aqc_add_filters() \| * `72fa661778` net: Save and restore msg_namelen in sock_sendmsg \| * `81f8a995eb` netfilter: nft_immediate: drop chain reference counter on error \| * `bb1bf97fa1` net: bcmgenet: Fix FCS generation for fragmented skbuffs \| * `e75715e1c2` sfc: fix a double-free bug in efx_probe_filters \| * `725d44e49f` ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init \| * `85f6fae44b` selftests: bonding: do not set port down when adding to bond \| * `3edd66bd4e` net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) \| * `ac5fde92b5` net: annotate data-races around sk->sk_bind_phc \| * `c48fcb4f49` net: annotate data-races around sk->sk_tsflags \| * `5d586f7ca0` net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps \| * `b2130366a9` can: raw: add support for SO_MARK \| * `633a49e34b` r8169: Fix PCI error on system resume \| * `565460e180` net: sched: em_text: fix possible memory leak in em_text_destroy() \| * `ac5cbe931c` mlxbf_gige: fix receive packet race condition \| * `6d7f454927` ASoC: mediatek: mt8186: fix AUD_PAD_TOP register and offset \| * `811604fb02` ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable \| * `c3a37dc156` igc: Check VLAN EtherType mask \| * `6edff0b838` igc: Check VLAN TCI mask \| * `d27b98f4ae` igc: Report VLAN EtherType matching back to user \| * `e76d1913f6` i40e: Fix filter input checks to prevent config with invalid values \| * `188c9970d0` ice: Shut down VSI with "link-down-on-close" enabled \| * `83b80170b7` ice: Fix link_down_on_close message \| * `f3f6a23e05` drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern \| * `6cf7235bc1` octeontx2-af: Fix marking couple of structure as __packed \| * `a4b0a9b80a` nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local \| * `282e3fb612` netfilter: nf_tables: set transport offset from mac header for netdev/egress \| * `9487cc4c90` netfilter: use skb_ip_totlen and iph_totlen \| * `5f523f1beb` drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer \| * `3da4868907` wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ \| * `493d556278` KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL \| * `3152a7d361` cifs: do not depend on release_iface for maintaining iface_list \| * `5982a625fc` cifs: cifs_chan_is_iface_active should be called with chan_lock held \| * `4afcb82518` drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE \| * `b9c370b61d` Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()" \| * `af9a530765` mptcp: prevent tcp diag from closing listener subflows \| * `105063f7f4` ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 \| * `0fa3cf2d15` ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook \| * `beda900d3a` ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series \| * `9539e3b56e` block: Don't invalidate pagecache for invalid falloc modes \| * `079eefaecf` keys, dns: Fix missing size check of V1 server-list header * \| `efec95a6ee` Revert "device property: Allow const parameter to dev_fwnode()" * \| `8eac30b25e` Merge 6.1.71 into android14-6.1-lts \|\\| \| * `38fb82ecd1` Linux 6.1.71 \| * `74c4c7d57c` Revert "platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe" \| * `7709b16bdb` tracing/kprobes: Fix symbol counting logic by looking at modules as well \| * `9dd295341d` kallsyms: Make module_kallsyms_on_each_symbol generally available \| * `29cb165771` device property: Allow const parameter to dev_fwnode() \| * `e7b0437217` spi: Constify spi parameters of chip select APIs \| * `f9a01938e0` NFSD: fix possible oops when nfsd/pool_stats is closed. \| * `899ac41804` ring-buffer: Fix slowpath of interrupted event \| * `0105571f80` netfilter: nf_tables: skip set commit for deleted/destroyed sets \| * `4768430d5a` ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() \| * `f33c4e4cab` tracing: Fix blocked reader of snapshot buffer \| * `09640899e6` ring-buffer: Fix wake ups when buffer_percent is set to 100 \| * `4ee9d9291b` mm/memory-failure: check the mapcount of the precise page \| * `fb21c9780a` mm/memory-failure: cast index to loff_t before shifting it \| * `be72d197b2` mm: migrate high-order folios in swap cache correctly \| * `a8df791470` mm/filemap: avoid buffered read/write race to read inconsistent data \| * `b954b92ef0` platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe \| * `7a3bbbadac` ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() \| * `b9c5f0fd5c` block: renumber QUEUE_FLAG_HW_WC \| * `e21b5fc5b8` spi: atmel: Fix clock issue when using devices with different polarities \| * `025cf65f68` spi: Add APIs in spi core to set/get spi->chip_select and spi->cs_gpiod \| * `64a4eb2982` spi: Reintroduce spi_set_cs_timing() \| * `95e21657ff` linux/export: Ensure natural alignment of kcrctab array \| * `bb4f791cb2` nfsd: call nfsd_last_thread() before final nfsd_put() \| * `03d68ffc48` nfsd: separate nfsd_last_thread() from nfsd_put() \| * `481561a431` iio: imu: adis16475: add spi_device_id table \| * `027eaeaf32` spi: Introduce spi_get_device_match_data() helper \| * `457a219c84` usb: fotg210-hcd: delete an incorrect bounds test \| * `119127273b` ARM: dts: Fix occasional boot hang for am3 usb \| * `98235bc13a` ksmbd: fix wrong allocation size update in smb2_open() \| * `04b8e04f8f` ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() \| * `34f7d5b5c9` ksmbd: lazy v2 lease break on smb2_write() \| * `500c7a5e9a` ksmbd: send v2 lease break notification for directory \| * `1993959460` ksmbd: downgrade RWH lease caching state to RH for directory \| * `2fcb46df34` ksmbd: set v2 lease capability \| * `3eddc811a7` ksmbd: set epoch in create context v2 lease \| * `52a32eafd0` ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error \| * `0bc46c2370` ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId \| * `d9aa5c1908` ksmbd: release interim response after sending status pending response \| * `013bf453af` ksmbd: move oplock handling after unlock parent dir \| * `20dd92c237` ksmbd: separately allocate ci per dentry \| * `d5651972e5` ksmbd: fix possible deadlock in smb2_open \| * `aabc944ebf` ksmbd: prevent memory leak on error return \| * `b4a269bb89` ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() \| * `699ad8d03c` ksmbd: no need to wait for binded connection termination at logoff \| * `3cf4455081` ksmbd: add support for surrogate pair conversion \| * `d26e024a5e` ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() \| * `5113f72225` ksmbd: fix recursive locking in vfs helpers \| * `42e56982be` ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() \| * `533e6dc446` ksmbd: reorganize ksmbd_iov_pin_rsp() \| * `1d95c5a541` ksmbd: Remove unused field in ksmbd_user struct \| * `5929e98f3b` ksmbd: fix potential double free on smb2_read_pipe() error path \| * `a7aae713ea` ksmbd: fix Null pointer dereferences in ksmbd_update_fstate() \| * `943cebf9ea` ksmbd: fix wrong error response status by using set_smb2_rsp_status() \| * `7b58ee8d0b` ksmbd: fix race condition between tree conn lookup and disconnect \| * `0090f0bfc2` ksmbd: fix race condition from parallel smb2 lock requests \| * `6584ca894f` ksmbd: fix race condition from parallel smb2 logoff requests \| * `b3a843caed` ksmbd: fix race condition with fp \| * `7345f5dbf6` ksmbd: check iov vector index in ksmbd_conn_write() \| * `8beae8a0a0` ksmbd: return invalid parameter error response if smb2 request is invalid \| * `e523a26c05` ksmbd: fix passing freed memory 'aux_payload_buf' \| * `b4b3fd1a95` ksmbd: remove unneeded mark_inode_dirty in set_info_sec() \| * `1ee419e08f` ksmbd: remove experimental warning \| * `83b01f7330` ksmbd: add missing calling smb2_set_err_rsp() on error \| * `422c0cd016` ksmbd: Fix one kernel-doc comment \| * `c20105a897` ksmbd: fix `force create mode' and `force directory mode' \| * `f8cf1ebb7d` ksmbd: fix wrong interim response on compound \| * `9f297df20d` ksmbd: add support for read compound \| * `673e60c691` ksmbd: switch to use kmemdup_nul() helper \| * `0a9b91f45e` ksmbd: check if a mount point is crossed during path lookup \| * `d782f42eed` ksmbd: Fix unsigned expression compared with zero \| * `48cc493840` ksmbd: Replace one-element array with flexible-array member \| * `63fbfd212c` ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect() \| * `e7ab53bd81` ksmbd: Replace the ternary conditional operator with min() \| * `143da652ce` ksmbd: use kvzalloc instead of kvmalloc \| * `de43cdaa88` ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void \| * `deb79f20be` ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked() \| * `fe7977b872` ksmbd: use kzalloc() instead of __GFP_ZERO \| * `294a275f37` ksmbd: remove unused ksmbd_tree_conn_share function \| * `b069977b2b` ksmbd: add mnt_want_write to ksmbd vfs functions \| * `13a5045011` ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR() \| * `1524884c3e` ksmbd: call putname after using the last component \| * `30a1344198` ksmbd: fix uninitialized pointer read in smb2_create_link() \| * `6d4e21e369` ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename() \| * `6927ffe747` ksmbd: fix racy issue from using ->d_parent and ->d_name \| * `6e99fbb429` fs: introduce lock_rename_child() helper \| * `965eb86507` ksmbd: remove unused compression negotiate ctx packing \| * `49d9f6ad1e` ksmbd: avoid duplicate negotiate ctx offset increments \| * `2182d96ec0` ksmbd: set NegotiateContextCount once instead of every inc \| * `8d271ef5e5` ksmbd: delete asynchronous work from list \| * `4ef3fd2f85` ksmbd: remove unused is_char_allowed function \| * `226aaaa593` ksmbd: Fix parameter name and comment mismatch \| * `e8c49f9364` ksmbd: Fix spelling mistake "excceed" -> "exceeded" \| * `ada8bcc48a` ksmbd: update Kconfig to note Kerberos support and fix indentation \| * `5c0306b0ab` ksmbd: Remove duplicated codes \| * `b6502c34cf` ksmbd: fix typo, syncronous->synchronous \| * `052b41ef2a` ksmbd: Implements sess->rpc_handle_list as xarray \| * `264547e13f` ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs \| * `87ffbb9e24` ksmbd: Fix resource leak in smb2_lock() \| * `d847b75883` ksmbd: use F_SETLK when unlocking a file \| * `343d667dee` ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption for this share \| * `ab69d3e8f7` ksmbd: replace one-element arrays with flexible-array members * \| `1e63881f5c` Merge 6.1.70 into android14-6.1-lts \|\\| \| * `a507f147e6` Linux 6.1.70 \| * `a413b88cdb` loop: deprecate autoloading callback loop_probe() \| * `75c27bdb21` wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x) \| * `15577a98ef` wifi: cfg80211: fix CQM for non-range use \| * `706448f716` fuse: share lookup state between submount and its parent \| * `ec7b81b0ab` mm/damon/core: make damon_start() waits until kdamond_fn() starts \| * `41f4ff9fe2` x86/alternatives: Sync core before enabling interrupts \| * `425379154b` KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy \| * `5dfacfd0fc` KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() \| * `3a0fd93cd9` KVM: arm64: vgic: Simplify kvm_vgic_destroy() \| * `3339028dd0` thunderbolt: Fix memory leak in margining_port_remove() \| * `69b6596c6e` lib/vsprintf: Fix %pfwf when current node refcount == 0 \| * `2dd6f22860` gpio: dwapb: mask/unmask IRQ when disable/enale it \| * `ab1c3f91d1` bus: ti-sysc: Flush posted write only after srst_udelay \| * `cd9f9ef59d` pinctrl: starfive: jh7100: ignore disabled device tree nodes \| * `7f7efa30fa` dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() \| * `33b976a0f2` tracing / synthetic: Disable events after testing in synth_event_gen_test_init() \| * `d2b549d310` scsi: core: Always send batch on reset or error handling command \| * `72e472a91c` Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" \| * `4258274bac` selftests: mptcp: join: fix subflow_send_ack lookup \| * `a8555c86f5` ublk: move ublk_cancel_dev() out of ub->mutex \| * `1c250f2c5f` ubifs: fix possible dereference after free \| * `3c42cc437d` btrfs: zoned: no longer count fresh BG region as zone unusable \| * `b09a676176` Revert "drm/amd/display: Do not set DRR on pipe commit" \| * `93da3d8af9` dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client \| * `e9779fac68` loop: do not enforce max_loop hard limit by (new) default \| * `600043e185` RISC-V: Fix do_notify_resume / do_work_pending prototype \| * `764c6790dd` 9p: prevent read overrun in protocol dump tracepoint \| * `7d09c84df5` drm/i915: Reject async flips with bigjoiner \| * `c60e10d154` smb: client: fix OOB in smbCalcSize() \| * `bef4315f19` smb: client: fix OOB in SMB2_query_info_init() \| * `71fe685b6a` smb: client: fix potential OOB in cifs_dump_detail() \| * `277832a306` smb: client: fix OOB in cifsd when receiving compounded resps \| * `3f6da21047` dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp \| * `1092525155` net: ks8851: Fix TX stall caused by TX buffer overrun \| * `e9df9f0891` net: rfkill: gpio: set GPIO direction \| * `805611157d` net: 9p: avoid freeing uninit memory in p9pdu_vreadf \| * `4c775b4cd8` Input: soc_button_array - add mapping for airplane mode button \| * `5df2b49e7e` net: usb: ax88179_178a: avoid failed operations when device is disconnected \| * `0f7bffd40a` Bluetooth: Add more enc key size check \| * `39347d6450` Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE \| * `e14a7ebafe` Bluetooth: L2CAP: Send reject on command corrupted request \| * `37f71e2c9f` Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg \| * `470896ecbc` Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent \| * `d36d945f94` ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA \| * `9599a5e34c` USB: serial: option: add Quectel RM500Q R13 firmware support \| * `a91fb450df` USB: serial: option: add Foxconn T99W265 with new baseline \| * `73b6b6ab03` USB: serial: option: add Quectel EG912Y module support \| * `9b968a7086` USB: serial: ftdi_sio: update Actisense PIDs constant names \| * `db57ef0dd4` wifi: cfg80211: fix certs build to not depend on file order \| * `ec350809cd` wifi: cfg80211: Add my certificate \| * `228d9960ae` usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 \| * `82f913724b` ALSA: usb-audio: Increase delay in MOTU M quirk \| * `01bc94b581` iio: triggered-buffer: prevent possible freeing of wrong buffer \| * `c508a99fbc` iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() \| * `1b670b0eee` iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table \| * `1fe4c93fc7` scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() \| * `66ccf5f743` Input: ipaq-micro-keys - add error handling for devm_kmemdup \| * `3637f6bdfe` interconnect: qcom: sm8250: Enable sync_state \| * `90aa62722d` iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw \| * `50d60bfc96` interconnect: Treat xlate() returning NULL node as an error \| * `900c1b3c62` drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original \| * `de4349bdf9` drm/i915/mtl: Add MTL for remapping CCS FBs \| * `52c1a67dd3` drm/i915/dpt: Only do the POT stride remap when using DPT \| * `7afe810945` drm/i915: Fix intel_atomic_setup_scalers() plane_state handling \| * `b097184f80` drm/i915: Relocate intel_atomic_setup_scalers() \| * `99767368b7` drm/i915/mtl: limit second scaler vertical scaling in ver >= 14 \| * `387e807759` nvme-pci: fix sleeping function called from interrupt context \| * `b506833ee8` gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() \| * `6eb51df9e7` pinctrl: at91-pio4: use dedicated lock class for IRQ \| * `903bb0c7b8` x86/xen: add CPU dependencies for 32-bit build \| * `2550d96aa2` i2c: aspeed: Handle the coalesced stop conditions with the start conditions. \| * `5c11f63799` ASoC: fsl_sai: Fix channel swap issue on i.MX8MP \| * `264d8c9b7f` ASoC: hdmi-codec: fix missing report for jack initial status \| * `9b4c95a63e` afs: Fix use-after-free due to get/remove race in volume tree \| * `17605162e2` afs: Fix overwriting of result of DNS query \| * `791d5409cd` keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry \| * `3e617c7e39` net: check dev->gso_max_size in gso_features_check() \| * `087b96adc6` afs: Fix dynamic root lookup DNS check \| * `9c6ea7abe3` afs: Fix the dynamic root's d_delete to always delete unused dentries \| * `a70c2dd741` net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() \| * `ea03196ebc` net: mana: select PAGE_POOL \| * `a1986c429c` Bluetooth: hci_event: shut up a false-positive warning \| * `fc64715105` Bluetooth: Fix deadlock in vhci_send_frame \| * `3e0d158579` net/rose: fix races in rose_kill_by_device() \| * `51e28c37d9` ethernet: atheros: fix a memleak in atl1e_setup_ring_resources \| * `6707baabe4` net: sched: ife: fix potential use-after-free \| * `31edab1222` net: Return error from sk_stream_wait_connect() if sk_wait_event() fails \| * `9d00421e14` octeontx2-pf: Fix graceful exit during PFC configuration failure \| * `b0cee29402` net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above \| * `72b8de75b3` net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors \| * `18b4a5e0c3` net/mlx5e: Correct snprintf truncation handling for fw_version buffer \| * `94c8485b44` net/mlx5: Fix fw tracer first block check \| * `1750f55d85` net/mlx5e: fix a potential double-free in fs_udp_create_groups \| * `01877daaef` net/mlx5e: Fix a race in command alloc flow \| * `f3739647a7` net/mlx5: Re-organize mlx5_cmd struct \| * `148ec770c6` net/mlx5: Prevent high-rate FW commands from populating all slots \| * `bd6e091629` net/mlx5: Introduce and use opcode getter in command interface \| * `0f5de95fa2` net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() \| * `31037cfcef` Revert "net/mlx5e: fix double free of encap_header" \| * `8a84413505` Revert "net/mlx5e: fix double free of encap_header in update funcs" \| * `2f635af7d6` wifi: mac80211: mesh_plink: fix matches_local logic \| * `7a07af00aa` wifi: mac80211: mesh: check element parsing succeeded \| * `40ba7f9ab8` wifi: mac80211: check if the existing link config remains unchanged \| * `e90da1c7c6` wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock \| * `912652366f` s390/vx: fix save/restore of fpu kernel context \| * `0a6e700c3d` reset: Fix crash when freeing non-existent optional resets \| * `930a61fd79` ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init \| * `228a00a77d` ARM: dts: dra7: Fix DRA7 L3 NoC node register size \| * `913463f8e6` drm/amd/display: fix hw rotated modes when PSR-SU is enabled \| * `a4f48f77bb` HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] \| * `413bef367b` HID: i2c-hid: acpi: Unify ACPI ID tables format \| * `57a6b0a464` bpf: Fix prog_array_map_poke_run map poke update \| * `4768f82272` kasan: disable kasan_non_canonical_hook() for HW tags * \| `0b58f24c02` Reapply "kasan: print the original fault addr when access invalid shadow" * \| `1ac76d45aa` ANDROID: GKI: fix crc issue in include/net/addrconf.h * \| `9b8f2430b3` Revert "cred: switch to using atomic_long_t" * \| `d3d46ac25c` Merge 6.1.69 into android14-6.1-lts \|\\| \| * `4aa6747d93` Linux 6.1.69 \| * `325556d46b` r8152: fix the autosuspend doesn't work \| * `4c2ad8e39c` r8152: remove rtl_vendor_mode function \| * `1d82735f4b` r8152: avoid to change cfg for all devices \| * `9b3d3a7f3c` net: tls, update curr on splice as well \| * `869aee35cf` ring-buffer: Have rb_time_cmpxchg() set the msb counter too \| * `c425a772fc` ring-buffer: Do not try to put back write_stamp \| * `b15cf14869` ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs \| * `edbc03d671` ring-buffer: Fix writing to the buffer with max_data_size \| * `6d98d594a5` ring-buffer: Have saved event hold the entire event \| * `7888b607a9` ring-buffer: Do not update before stamp when switching sub-buffers \| * `7043c4610c` tracing: Update snapshot buffer on resize if it is allocated \| * `31785cf817` ring-buffer: Fix memory leak of free page \| * `8c3b77ad4e` smb: client: fix OOB in smb2_query_reparse_point() \| * `d8541c50c6` smb: client: fix NULL deref in asn1_ber_decoder() \| * `9f528a8e68` smb: client: fix OOB in receive_encrypted_standard() \| * `7b0faa541f` drm/i915: Fix remapped stride with CCS on ADL+ \| * `2090771791` drm/amd/display: Disable PSR-SU on Parade 0803 TCON again \| * `a9e2de1943` drm/amdgpu: fix tear down order in amdgpu_vm_pt_free \| * `730b3322b8` btrfs: don't clear qgroup reserved bit in release_folio \| * `9b670e1b64` btrfs: free qgroup reserve when ORDERED_IOERR is set \| * `da9b7c651c` mm/shmem: fix race in shmem_undo_range w/THP \| * `8ec07b0620` mm/mglru: fix underprotected page cache \| * `40f3ad769e` dmaengine: stm32-dma: avoid bitfield overflow assertion \| * `78b2ba39be` drm/amdgpu/sdma5.2: add begin/end_use ring callbacks \| * `6a1472d9be` team: Fix use-after-free when an option instance allocation fails \| * `b01af92818` arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify \| * `0b071a3266` ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS \| * `f2955dd3e9` soundwire: stream: fix NULL pointer dereference for multi_link \| * `56f762659a` btrfs: do not allow non subvolume root targets for snapshot \| * `557f7ad064` perf: Fix perf_event_validate_size() lockdep splat \| * `a684235d30` HID: hid-asus: add const to read-only outgoing usb buffer \| * `2b9e16bc1c` arm64: add dependency between vmlinuz.efi and Image \| * `6cb0c71c6e` net: usb: qmi_wwan: claim interface 4 for ZTE MF290 \| * `f7ce765744` asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation \| * `fba6e958ca` HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad \| * `8f0c858585` HID: hid-asus: reset the backlight brightness level on resume \| * `de78e4bdcb` nbd: pass nbd_sock to nbd_read_reply() instead of index \| * `d482bb5663` HID: add ALWAYS_POLL quirk for Apple kb \| * `541b183be9` HID: glorious: fix Glorious Model I HID report \| * `42b4ab97be` platform/x86: intel_telemetry: Fix kernel doc descriptions \| * `355170a7ec` LoongArch: Implement constant timer shutdown interface \| * `adb6a90754` LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi \| * `943cde1f3d` selftests/bpf: fix bpf_loop_bench for new callback verification scheme \| * `1b40f23e70` nvme: catch errors from nvme_configure_metadata() \| * `6cb3741c45` nvme-auth: set explanation code for failure2 msgs \| * `83bb13bf6c` nbd: fold nbd config initialization into nbd_alloc_config() \| * `02a4b14d17` bcache: avoid NULL checking to c->root in run_cache_set() \| * `3d3f72efc7` bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() \| * `bc17ec4215` bcache: remove redundant assignment to variable cur_idx \| * `be0e2a28e0` bcache: avoid oversize memory allocation by small stripe_size \| * `94070fd668` blk-cgroup: bypass blkcg_deactivate_policy after destroying \| * `e52d0eb48e` blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" \| * `5fb6772cb5` stmmac: dwmac-loongson: Add architecture dependency \| * `82c386d736` usb: aqc111: check packet for fixup for true limit \| * `d6c02295c8` x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM \| * `ae818b2a2e` drm/mediatek: Add spinlock for setting vblank event in atomic_begin \| * `73c240e1ec` ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE \| * `0c196180b5` PCI: loongson: Limit MRRS to 256 \| * `56d1891594` Revert "PCI: acpiphp: Reassign resources on bridge if necessary" \| * `1ec80b9d43` ALSA: hda/realtek: Apply mute LED quirk for HP15-db \| * `eeeb91216a` ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants \| * `82413e9e42` ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB \| * `0dc6a06c48` fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() \| * `36e2497ac7` cred: switch to using atomic_long_t \| * `a51f71cd4f` net: atlantic: fix double free in ring reinit logic \| * `1646b2929d` appletalk: Fix Use-After-Free in atalk_ioctl \| * `d835299dde` net: stmmac: Handle disabled MDIO busses from devicetree \| * `9aac81639e` dpaa2-switch: do not ask for MDB, VLAN and FDB replay \| * `a81c7069af` dpaa2-switch: fix size of the dma_unmap \| * `9a23be1e58` vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() \| * `2027dd67c3` sign-file: Fix incorrect return values check \| * `918991db7d` stmmac: dwmac-loongson: Make sure MDIO is initialized before use \| * `63387fe87f` net: ena: Fix XDP redirection error \| * `2664b56420` net: ena: Fix xdp drops handling due to multibuf packets \| * `e312eed27a` net: ena: Destroy correct number of xdp queues upon failure \| * `55a43bae08` net: Remove acked SYN flag from packet in the transmit queue correctly \| * `9bb392ee53` qed: Fix a potential use-after-free in qed_cxt_tables_alloc \| * `112792ad36` iavf: Handle ntuple on/off based on new state machines for flow director \| * `11c314a5a4` iavf: Introduce new state machines for flow director \| * `01540ee236` net/rose: Fix Use-After-Free in rose_ioctl \| * `2de2a6cbe1` atm: Fix Use-After-Free in do_vcc_ioctl \| * `3a76dcab2e` octeontx2-af: Update RSS algorithm index \| * `d0f0786f8c` octeontx2-pf: Fix promisc mcam entry action \| * `34b630626a` octeontx2-af: fix a use-after-free in rvu_nix_register_reporters \| * `e4ce3dc7a0` net: fec: correct queue selection \| * `a00dbc6dec` net: vlan: introduce skb_vlan_eth_hdr() \| * `7cfbb8bea3` atm: solos-pci: Fix potential deadlock on &tx_queue_lock \| * `35c63d366f` atm: solos-pci: Fix potential deadlock on &cli_queue_lock \| * `525904a157` bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic \| * `ac61251741` bnxt_en: Fix wrong return value check in bnxt_close_nic() \| * `8217f9362c` bnxt_en: Save ring error counters across reset \| * `53cacb8cdc` bnxt_en: Clear resource reservation during resume \| * `ab410db6e9` qca_spi: Fix reset behavior \| * `7e177e5a40` qca_debug: Fix ethtool -G iface tx behavior \| * `2127142c17` qca_debug: Prevent crash on TX ring changes \| * `0da41ddfb2` net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX \| * `514232495a` net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work \| * `1e8396aab2` HID: lenovo: Restrict detection of patched firmware only to USB cptkbd \| * `e0cda159c8` afs: Fix refcount underflow from error handling race \| * `a7e6477cc3` ksmbd: fix memory leak in smb2_lock() \| * `8925ab33b3` ext4: fix warning in ext4_dio_write_end_io() \| * `1c077acf24` powerpc/ftrace: Fix stack teardown in ftrace_no_trace \| * `34ae53cccf` r8152: add vendor/device ID pair for ASUS USB-C2500 \| * `cac1218b32` r8152: add vendor/device ID pair for D-Link DUB-E250 \| * `893597cbab` r8152: add USB device driver for config selection \| * `b80d0c6e5b` perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery table * `bb47960a9d` Merge branch 'android14-6.1' into branch 'android14-6.1-lts' Change-Id: I73d22764ee8804a28bb2fdcbeba633da3e0daaf3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-03-07 09:28:03 +00:00
Kisung Lee	95805f9e46	ANDROID: GKI: add GKI symbol list for Exynosauto SoC This patch add GKI symbol list for Exynosauto SoC. We need to add 2 functions symbol to support our vdriver. 2 function symbol(s) added 'unsigned long devm_get_free_pages(struct device, gfp_t, unsigned int)' 'int kill_pid(struct pid, int, int)' Bug: 326148350 Signed-off-by: Kisung Lee <kiisung.lee@samsung.com> Change-Id: Ia8dca21f474b41bf206ad0333e5b0b2649f96ae6	2024-03-06 14:43:14 +00:00
RD Babiera	23c8963806	UPSTREAM: usb: typec: class: fix typec_altmode_put_partner to put plugs usb: typec: class: fix typec_altmode_put_partner to put plugs When typec_altmode_put_partner is called by a plug altmode upon release, the port altmode the plug belongs to will not remove its reference to the plug. The check to see if the altmode being released is a plug evaluates against the released altmode's partner instead of the calling altmode, so change adev in typec_altmode_put_partner to properly refer to the altmode being released. Because typec_altmode_set_partner calls get_device() on the port altmode, add partner_adev that points to the port altmode in typec_put_partner to call put_device() on. typec_altmode_set_partner is not called for port altmodes, so add a check in typec_altmode_release to prevent typec_altmode_put_partner() calls on port altmode release. Fixes: `8a37d87d72` ("usb: typec: Bus type for alternate modes") Cc: <stable@vger.kernel.org> Co-developed-by: Christian A. Ehrhardt <lk@c--e.de> Signed-off-by: Christian A. Ehrhardt <lk@c--e.de> Signed-off-by: RD Babiera <rdbabiera@google.com> Tested-by: Christian A. Ehrhardt <lk@c--e.de> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20240103181754.2492492-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 324496488 (cherry picked from commit 5962ded777d689cd8bf04454273e32228d7fb71f) Change-Id: I688a333753b2e8069c0437a6d9dea30bf029c92c Signed-off-by: RD Babiera <rdbabiera@google.com>	2024-03-05 17:52:48 +00:00
RD Babiera	3b7cd7d0e0	UPSTREAM: Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" This reverts commit b17b7fe6dd5c6ff74b38b0758ca799cdbb79e26e. That commit messed up the reference counting, so it needs to be rethought. Fixes: b17b7fe6dd5c ("usb: typec: class: fix typec_altmode_put_partner to put plugs") Cc: stable@vger.kernel.org Cc: RD Babiera <rdbabiera@google.com> Reported-by: Chris Bainbridge <chris.bainbridge@gmail.com> Closes: https://lore.kernel.org/lkml/CAP-bSRb3SXpgo_BEdqZB-p1K5625fMegRZ17ZkPE1J8ZYgEHDg@mail.gmail.com/ Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Bug: 324496488 (cherry picked from commit 9c6b789e954fae73c548f39332bcc56bdf0d4373) Change-Id: I2755a5e44dd1970d60e5d996dd7fc6d88f79684a Signed-off-by: RD Babiera <rdbabiera@google.com>	2024-03-05 17:52:48 +00:00
Seiya Wang	8b964b55a6	ANDROID: GKI: Update symbol list for mtk 1 function symbol(s) added 'int regmap_test_bits(struct regmap*, unsigned int, unsigned int)' Bug: 328166456 Signed-off-by: Seiya Wang <seiya.wang@mediatek.com> Change-Id: Iadaaceb73982056fadf80e5c596fa843b3eaa8b1	2024-03-05 10:10:35 +00:00
Wei Liu	945b0c8ac4	ANDROID: GKI: Update oplus symbol list 2 function symbol(s) added 'int xt_register_match(struct xt_match)' 'void xt_unregister_match(struct xt_match)' Bug: 323695727 Change-Id: I8f51ceccbe5f2cfd14b44f9e402db26ca424d0fe Signed-off-by: Wei Liu <liuwei.a@oppo.com>	2024-03-04 22:01:36 +00:00
Chao Yu	9698f7e8e7	FROMGIT: f2fs: introduce FAULT_BLKADDR_CONSISTENCE We will encounter below inconsistent status when FAULT_BLKADDR type fault injection is on. Info: checkpoint state = d6 : nat_bits crc fsck compacted_summary orphan_inodes sudden-power-off [ASSERT] (fsck_chk_inode_blk:1254) --> ino: 0x1c100 has i_blocks: 000000c0, but has 191 blocks [FIX] (fsck_chk_inode_blk:1260) --> [0x1c100] i_blocks=0x000000c0 -> 0xbf [FIX] (fsck_chk_inode_blk:1269) --> [0x1c100] i_compr_blocks=0x00000026 -> 0x27 [ASSERT] (fsck_chk_inode_blk:1254) --> ino: 0x1cadb has i_blocks: 0000002f, but has 46 blocks [FIX] (fsck_chk_inode_blk:1260) --> [0x1cadb] i_blocks=0x0000002f -> 0x2e [FIX] (fsck_chk_inode_blk:1269) --> [0x1cadb] i_compr_blocks=0x00000011 -> 0x12 [ASSERT] (fsck_chk_inode_blk:1254) --> ino: 0x1c62c has i_blocks: 00000002, but has 1 blocks [FIX] (fsck_chk_inode_blk:1260) --> [0x1c62c] i_blocks=0x00000002 -> 0x1 After we inject fault into f2fs_is_valid_blkaddr() during truncation, a) it missed to increase @nr_free or @valid_blocks b) it can cause in blkaddr leak in truncated dnode Which may cause inconsistent status. This patch separates FAULT_BLKADDR_CONSISTENCE from FAULT_BLKADDR, and rename FAULT_BLKADDR to FAULT_BLKADDR_VALIDITY so that we can: a) use FAULT_BLKADDR_CONSISTENCE in f2fs_truncate_data_blocks_range() to simulate inconsistent issue independently, then it can verify fsck repair flow. b) FAULT_BLKADDR_VALIDITY fault will not cause any inconsistent status, we can just use it to check error path handling in kernel side. Reviewed-by: Daeho Jeong <daehojeong@google.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Bug: 313549450 (cherry picked from commit c7115e094ca820bb72e0c89f158d16bc48c6fa04 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Change-Id: Ifd6527aa2e48d883ae4063bfce1a404ccfbdaa48 Signed-off-by: Daeho Jeong <daehojeong@google.com>	2024-03-04 18:26:14 +00:00
Chao Yu	cc322f7dee	FROMGIT: f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic verify_blkaddr() will trigger panic once we inject fault into f2fs_is_valid_blkaddr(), fix to remove this unnecessary f2fs_bug_on(). Fixes: 18792e64c86d ("f2fs: support fault injection for f2fs_is_valid_blkaddr()") Reviewed-by: Daeho Jeong <daehojeong@google.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Bug: 313549450 (cherry picked from commit b896e302f79678451a94769ddd9e52e954c64fbb https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Change-Id: Ibffad271c17efd219099f07aab54ac080cae4fba Signed-off-by: Daeho Jeong <daehojeong@google.com>	2024-03-04 18:26:14 +00:00
Chao Yu	33d3b7311b	FROMGIT: f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode In reserve_compress_blocks(), we update blkaddrs of dnode in prior to inc_valid_block_count(), it may cause inconsistent status bewteen i_blocks and blkaddrs once inc_valid_block_count() fails. To fix this issue, it needs to reverse their invoking order. Fixes: `c75488fb4d` ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS") Reviewed-by: Daeho Jeong <daehojeong@google.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Bug: 313549450 (cherry picked from commit 54607494875edd636aff3c21ace3ad9a7da758a9 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Change-Id: I74a5d1d47246d39b1ed0131c714c6a2a2bfab6cf Signed-off-by: Daeho Jeong <daehojeong@google.com>	2024-03-04 18:26:14 +00:00
Sheng Yong	ba28d24cea	FROMGIT: f2fs: compress: fix to check unreleased compressed cluster Compressed cluster may not be released due to we can fail in release_compress_blocks(), fix to handle reserved compressed cluster correctly in reserve_compress_blocks(). Fixes: `4c8ff7095b` ("f2fs: support data compression") Signed-off-by: Sheng Yong <shengyong@oppo.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Bug: 313549450 (cherry picked from commit eb8fbaa53374e0a2d4381190abfe708481517bbb https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Change-Id: I2a4223efb548a921a8f28f45798709743e38e899 Signed-off-by: Daeho Jeong <daehojeong@google.com>	2024-03-04 18:26:14 +00:00
Chao Yu	0c3d1c94c4	FROMGIT: f2fs: compress: fix to cover normal cluster write with cp_rwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data will be corrupted if partial blocks were persisted before CP & SPOR, due to cluster metadata wasn't updated atomically. Fixes: `4c8ff7095b` ("f2fs: support data compression") Reviewed-by: Daeho Jeong <daehojeong@google.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Bug: 313549450 (cherry picked from commit fd244524c2cf07b5f4c3fe8abd6a99225c76544b https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Change-Id: I231eef3eb7ee5a105ad929718a6d1d67f4950dd2 Signed-off-by: Daeho Jeong <daehojeong@google.com>	2024-03-04 18:26:14 +00:00
Chao Yu	02a1ce0cf2	FROMGIT: f2fs: compress: fix to guarantee persisting compressed blocks by CP If data block in compressed cluster is not persisted with metadata during checkpoint, after SPOR, the data may be corrupted, let's guarantee to write compressed page by checkpoint. Fixes: `4c8ff7095b` ("f2fs: support data compression") Reviewed-by: Daeho Jeong <daehojeong@google.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Bug: 313549450 (cherry picked from commit 8a430dd49e9cb021372b0ad91e60aeef9c6ced00 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Change-Id: Ie52d0bc7d89ec3111f1f6e8140555358620e875c Signed-off-by: Daeho Jeong <daehojeong@google.com>	2024-03-04 18:26:14 +00:00
Eric Biggers	139e9a0f9d	ANDROID: remove LTO check from build.config.gki.aarch64.fips140 Don't check the "LTO" variable in build.config.gki.aarch64.fips140, since fips140.ko no longer depends on LTO. Also, Kleaf doesn't set the "LTO" variable anyway; it was specific to build.sh. Bug: 188620248 Change-Id: I213faa4c8c1a23898c08da121b0a5dc602b7218a Signed-off-by: Eric Biggers <ebiggers@google.com>	2024-03-04 11:19:25 +00:00
Eric Biggers	e61a6ec29a	ANDROID: add symbol list for fips140 module Add the missing fips140_abi build target. Then, create the fips140 symbol list by running the following command: tools/bazel run //common:fips140_abi_update_symbol_list Then, update the stg file by running: tools/bazel run //common:kernel_aarch64_abi_dist tools/bazel run //common:kernel_aarch64_abi_update_symbol_list tools/bazel run //common:kernel_aarch64_abi_update INFO: 36 function symbol(s) added 'int __traceiter_android_vh_aes_decrypt(void, const struct crypto_aes_ctx, u8, const u8, int)' 'int __traceiter_android_vh_aes_encrypt(void, const struct crypto_aes_ctx, u8, const u8, int)' 'int __traceiter_android_vh_aes_expandkey(void, struct crypto_aes_ctx, const u8, unsigned int, int)' 'int __traceiter_android_vh_sha256(void, const u8, unsigned int, u8, int)' 'int aead_register_instance(struct crypto_template, struct aead_instance)' 'int ahash_register_instance(struct crypto_template, struct ahash_instance)' 'struct crypto_rng* crypto_alloc_rng(const char, u32, u32)' 'const char crypto_attr_alg_name(struct rtattr)' 'int crypto_check_attr_type(struct rtattr, u32, u32)' 'int crypto_cipher_setkey(struct crypto_cipher, const u8, unsigned int)' 'void crypto_drop_spawn(struct crypto_spawn)' 'struct crypto_sync_skcipher crypto_get_default_null_skcipher()' 'int crypto_grab_aead(struct crypto_aead_spawn, struct crypto_instance, const char, u32, u32)' 'int crypto_grab_ahash(struct crypto_ahash_spawn, struct crypto_instance, const char, u32, u32)' 'int crypto_grab_shash(struct crypto_shash_spawn, struct crypto_instance, const char, u32, u32)' 'int crypto_grab_skcipher(struct crypto_skcipher_spawn, struct crypto_instance, const char, u32, u32)' 'int crypto_grab_spawn(struct crypto_spawn, struct crypto_instance, const char, u32, u32)' 'int crypto_inst_setname(struct crypto_instance, const char, struct crypto_alg)' 'void crypto_put_default_null_skcipher()' 'int crypto_register_aeads(struct aead_alg, int)' 'int crypto_register_ahashes(struct ahash_alg, int)' 'int crypto_register_algs(struct crypto_alg, int)' 'int crypto_register_shashes(struct shash_alg, int)' 'int crypto_register_skciphers(struct skcipher_alg, int)' 'int crypto_register_templates(struct crypto_template, int)' 'void crypto_remove_spawns(struct crypto_alg, struct list_head, struct crypto_alg)' 'int crypto_rng_reset(struct crypto_rng, const u8, unsigned int)' 'bool crypto_shash_alg_has_setkey(struct shash_alg)' 'struct crypto_tfm* crypto_spawn_tfm(struct crypto_spawn, u32, u32)' 'void crypto_spawn_tfm2(struct crypto_spawn)' 'void crypto_unregister_shashes(struct shash_alg, int)' 'void crypto_unregister_skciphers(struct skcipher_alg, int)' 'void crypto_unregister_templates(struct crypto_template, int)' 'bool rng_is_initialized()' 'void shash_free_singlespawn_instance(struct shash_instance)' 'int shash_register_instance(struct crypto_template, struct shash_instance*)' 6 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_aes_decrypt' 'struct tracepoint __tracepoint_android_vh_aes_encrypt' 'struct tracepoint __tracepoint_android_vh_aes_expandkey' 'struct tracepoint __tracepoint_android_vh_sha256' 'struct list_head crypto_alg_list' 'struct rw_semaphore crypto_alg_sem' Bug: 188620248 Change-Id: I95931f8f3710a4f0a5b642e1c9f7299b72616972 Signed-off-by: Eric Biggers <ebiggers@google.com>	2024-03-04 11:16:37 +00:00
Andre Ding	09ca5740fb	ANDROID: abi_gki_aarch64_qcom: Update symbol list Symbols updated to QCOM abi symbol list for Toshiba EMAC: clk_unregister_fixed_rate get_phy_device __hw_addr_sync_dev netdev_features_change pcie_capability_read_dword phy_device_free phy_device_register phy_loopback phy_lookup_setting phy_restart_aneg Bug: 325987248 Change-Id: I0f4a1070283f2e9c98df4de9da0660e572a7826e Signed-off-by: Andre Ding <quic_shuangxi@quicinc.com>	2024-03-01 14:01:47 +08:00
Dongyun Liu	0832777c62	ANDROID: GKI: Update symbol list for transsion 18 function symbol(s) added 'int __traceiter_android_rvh_delayacct_init(void , void )' 'int __traceiter_android_rvh_delayacct_tsk_free(void , struct task_struct )' 'int __traceiter_android_rvh_delayacct_tsk_init(void , struct task_struct )' 'int __traceiter_android_vh_delayacct_add_tsk(void , struct taskstats , struct task_struct , int )' 'int __traceiter_android_vh_delayacct_blkio_end(void , struct task_struct )' 'int __traceiter_android_vh_delayacct_blkio_start(void , void )' 'int __traceiter_android_vh_delayacct_blkio_ticks(void , struct task_struct , __u64 )' 'int __traceiter_android_vh_delayacct_freepages_end(void , void )' 'int __traceiter_android_vh_delayacct_freepages_start(void , void )' 'int __traceiter_android_vh_delayacct_thrashing_end(void , bool )' 'int __traceiter_android_vh_delayacct_thrashing_start(void , bool )' 'int __traceiter_android_vh_delayacct_swapin_start(void , void )' 'int __traceiter_android_vh_delayacct_swapin_end(void , void )' 'int __traceiter_android_vh_delayacct_compact_start(void , void )' 'int __traceiter_android_vh_delayacct_compact_end(void , void )' 'int __traceiter_android_vh_delayacct_wpcopy_start(void , void )' 'int __traceiter_android_vh_delayacct_wpcopy_end(void , void *) 'void set_delayacct_enabled(bool)' 17 variable symbol(s) added 'struct tracepoint __tracepoint_android_rvh_delayacct_init' 'struct tracepoint __tracepoint_android_rvh_delayacct_tsk_free' 'struct tracepoint __tracepoint_android_rvh_delayacct_tsk_init' 'struct tracepoint __tracepoint_android_vh_delayacct_add_tsk' 'struct tracepoint __tracepoint_android_vh_delayacct_blkio_end' 'struct tracepoint __tracepoint_android_vh_delayacct_blkio_start' 'struct tracepoint __tracepoint_android_vh_delayacct_blkio_ticks' 'struct tracepoint __tracepoint_android_vh_delayacct_freepages_end' 'struct tracepoint __tracepoint_android_vh_delayacct_freepages_start' 'struct tracepoint __tracepoint_android_vh_delayacct_thrashing_end' 'struct tracepoint __tracepoint_android_vh_delayacct_thrashing_start' 'struct tracepoint __tracepoint_android_vh_delayacct_swapin_start' 'struct tracepoint __tracepoint_android_vh_delayacct_swapin_end' 'struct tracepoint __tracepoint_android_vh_delayacct_compact_start' 'struct tracepoint __tracepoint_android_vh_delayacct_compact_end' 'struct tracepoint __tracepoint_android_vh_delayacct_wpcopy_start' 'struct tracepoint __tracepoint_android_vh_delayacct_wpcopy_end' Bug: 327566572 Bug: 310129610 Bug: 314931189 Change-Id: I82b8eb372d6a9193f70d8e2ddb1a2ef2b9b6e4e4 Signed-off-by: Dongyun Liu <dongyun.liu@transsion.com> (cherry picked from commit 34d95b5fde142fadf010bf1156228c09ec951cce) (cherry picked from commit ab6f88aebe2fc11299ab6da38ff960cdf785b050)	2024-02-29 21:10:10 +00:00
Dongyun Liu	35bb2c8c5f	ANDROID: Add vendor_hooks to workaround CONFIG_TASK_DELAY_ACCT CONFIG_TASK_DELAY_ACCT cannot be enabled since `struct task_struct` is KMI frozen. Instead, use vendor hooks to allow delay accounting to be implemented in a vendor module. Bug: 327566572 Bug: 310129610 Bug: 314931189 Change-Id: If814d7834889fe162aba3dd97e935289127ca3ae Signed-off-by: Dongyun Liu <dongyun.liu@transsion.com> (cherry picked from commit bb57557246d39dba8a66df7f43983fe1ec71bff6) (cherry picked from commit 896cff873452d9a3853c489bb2a173a1e290ca95)	2024-02-29 21:10:10 +00:00
Bart Van Assche	70fdaa07de	Revert "ANDROID: Build null_blk and scsi_debug as kernel modules" Revert commit `9b476ebe99` in preparation of making this a Pixel-specific change. A disadvantage of building null_blk and scsi_debug as kernel modules for all vendors is that this causes these kernel modules to be loaded by the init process during boot and there is no vendor-independent mechanism for preventing kernel modules to be loaded. Bug: 323406846 Change-Id: I6e7bcdd9fd06194bbc134ee52251b6ae9a3c1477 Signed-off-by: Bart Van Assche <bvanassche@google.com>	2024-02-29 10:22:01 -08:00
Greg Kroah-Hartman	30edcedb44	Revert "interconnect: Fix locking for runpm vs reclaim" This reverts commit `ee42bfc791` which is commit af42269c3523492d71ebbe11fefae2653e9cdc78 upstream. It is reported to cause crashes, so revert it for now. Bug: 326555421 Change-Id: I2fb3626c306e0444f4e0eb42a95488e688942ba9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-02-29 10:43:15 +00:00
xiaofeng	4289e1348e	ANDROID: GKI: Update symbol list for xiaomi 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_rvh_update_cpus_allowed' Bug: 323765868 Change-Id: I5c97bea49cee20e2c2b22aa4d1627bdff226ce4a Signed-off-by: xiaofeng <xiaofeng5@xiaomi.com>	2024-02-28 18:04:33 +00:00
Sai Harshini Nimmala	77277e4ba4	ANDROID: sched/cpuset: Add vendor hook to change tasks affinity Vendors might want to change tasks affinity settings when they are moving from one cpuset into the other. Add vendor hook to give control to vendor to implement what they need. This reverts commit a42f6e7d0aa0("Revert "ANDROID: sched/cpuset: Add vendor hook to change tasks affinity"") to effectively bring back the original change. Bug: 323765868 Change-Id: I47c1ee0dabda491732932c653bd80e95ee550791 Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org> Signed-off-by: Sai Harshini Nimmala <quic_snimmala@quicinc.com>	2024-02-28 18:04:33 +00:00
lfc	18c75fa402	ANDROID: ABI: Update oplus symbol list INFO: 1 function symbol(s) added 'int __traceiter_android_vh_binder_buffer_release(void, struct binder_proc, struct binder_thread, struct binder_buffer, bool)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_binder_buffer_release' Bug: 327307900 Change-Id: I6bca73bc3edb2d1deadc38daec96baa486f15929 Signed-off-by: Fuchun Liao <lfc@oppo.com>	2024-02-28 17:37:25 +00:00
Fuchun Liao	56e0cf4e39	ANDROID: binder: Add vendor hook to fix priority restore When cpu loading is high, the task maybe preempted after restoring the sched priority in trace_android_vh_binder_free_buf(). This means that node->has_async_transaction can't be cleared immediately and the work isn't added to the proc->todo queue as soon as possible. To fix this we add a new hook trace_android_vh_binder_buffer_release() to restore the priority after node->has_async_transaction has been updated and the node->work has been added to the proc->todo queue. Note: the old trace_android_vh_binder_free_buf() hook is kept to avoid breaking KMI but is not extrictly needed. Bug: 327307900 Fixes: 0eb66ec39ca8 ("ANDROID: vendor_hooks: Add hooks for binder") Change-Id: I8126c79c9c68faa3ce0cd87ce83e2591bd61d5dd Signed-off-by: Fuchun Liao <lfc@oppo.com> [cmllamas: fix-up commit log and variable naming] Signed-off-by: Carlos Llamas <cmllamas@google.com>	2024-02-28 17:37:25 +00:00
Greg Kroah-Hartman	c73814520d	Revert "interconnect: Teach lockdep about icc_bw_lock order" This reverts commit `0db211ec0f` which is commit 13619170303878e1dae86d9a58b039475c957fcf upstream. It is reported to cause crashes, so revert it for now. Bug: 326555421 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3dd7744a9b706a959cbed3a793be668147dfcb9a	2024-02-28 17:12:32 +00:00
Yan Zhai	c38ea4a131	BACKPORT: gso: fix dodgy bit handling for GSO_UDP_L4 Commit 1fd54773c267 ("udp: allow header check for dodgy GSO_UDP_L4 packets.") checks DODGY bit for UDP, but for packets that can be fed directly to the device after gso_segs reset, it actually falls through to fragmentation: https://lore.kernel.org/all/CAJPywTKDdjtwkLVUW6LRA2FU912qcDmQOQGt2WaDo28KzYDg+A@mail.gmail.com/ This change restores the expected behavior of GSO_UDP_L4 packets. Fixes: 1fd54773c267 ("udp: allow header check for dodgy GSO_UDP_L4 packets.") Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com> Change-Id: Id7ff0fac79fb0b4fabb62b09a905f27a5e8cfea7 (cherry picked from commit 9840036786d90cea11a90d1f30b6dc003b34ee67) [lena: Resolved conflict in net/ipv6/udp_offload.c ] Signed-off-by: Yan Zhai <yan@cloudflare.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2024-02-28 16:37:55 +00:00
chenweitao	34cf02fef9	ANDROID: ABI: Update oplus symbol list 1 function symbol(s) added 'int __traceiter_android_vh_copy_process(void, struct task_struct, int, int)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_copy_process' Bug: 325765508 Change-Id: I0642034f53faacd597a8233390f9a90dfe428791 Signed-off-by: chenweitao <chenweitao@oppo.com>	2024-02-28 11:27:13 +00:00
chenweitao	763647877c	ANDROID: vendor_hooks: Add hook for trace_android_vh_copy_process Add hook for trace_android_vh_copy_process, which gives the vendor a chance to monitor the total thread count of the system and the thread count under a particular process Bug: 325765508 Change-Id: Ibeb8aa571d44997ac10623321cd00d1686bde033 Signed-off-by: chenweitao <chenweitao@oppo.com>	2024-02-28 11:27:13 +00:00

1 2 3 4 5 ...

1158887 Commits