8014 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	ee4c9c95ff	Merge 6.1.34 into android14-6.1-lts ... Changes in 6.1.34 scsi: megaraid_sas: Add flexible array member for SGLs net: sfp: fix state loss when updating state_hw_mask spi: mt65xx: make sure operations completed before unloading platform/surface: aggregator: Allow completion work-items to be executed in parallel platform/surface: aggregator_tabletsw: Add support for book mode in KIP subsystem spi: qup: Request DMA before enabling clocks afs: Fix setting of mtime when creating a file/dir/symlink wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready() neighbour: fix unaligned access to pneigh_entry net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294 bpf: Fix UAF in task local storage bpf: Fix elem_size not being set for inner maps net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT net: enetc: correct the statistics of rx bytes net: enetc: correct rx_bytes statistics of XDP net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values drm/i915: Explain the magic numbers for AUX SYNC/precharge length drm/i915: Use 18 fast wake AUX sync len Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER Bluetooth: Fix l2cap_disconnect_req deadlock Bluetooth: ISO: don't try to remove CIG if there are bound CIS left Bluetooth: L2CAP: Add missing checks for invalid DCID wifi: mac80211: use correct iftype HE cap wifi: cfg80211: reject bad AP MLD address wifi: mac80211: mlme: fix non-inheritence element wifi: mac80211: don't translate beacon/presp addrs qed/qede: Fix scheduling while atomic wifi: cfg80211: fix locking in sched scan stop work selftests/bpf: Verify optval=NULL case selftests/bpf: Fix sockopt_sk selftest netfilter: nft_bitwise: fix register tracking netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper netfilter: ipset: Add schedule point in call_ad(). netfilter: nf_tables: out-of-bound check in chain blob ipv6: rpl: Fix Route of Death. tcp: gso: really support BIG TCP rfs: annotate lockless accesses to sk->sk_rxhash rfs: annotate lockless accesses to RFS sock flow table net: sched: add rcu annotations around qdisc->qdisc_sleeping drm/i915/selftests: Stop using kthread_stop() drm/i915/selftests: Add some missing error propagation net: sched: move rtm_tca_policy declaration to include file net: sched: act_police: fix sparse errors in tcf_police_dump() net: sched: fix possible refcount leak in tc_chain_tmplt_add() bpf: Add extra path pointer check to d_path helper drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() net: bcmgenet: Fix EEE implementation bnxt_en: Don't issue AP reset during ethtool's reset operation bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Skip firmware fatal error recovery if chip is not accessible bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks batman-adv: Broken sync while rescheduling delayed work Input: xpad - delete a Razer DeathAdder mouse VID/PID entry Input: psmouse - fix OOB access in Elantech protocol Input: fix open count when closing inhibited device ALSA: hda: Fix kctl->id initialization ALSA: ymfpci: Fix kctl->id initialization ALSA: gus: Fix kctl->id initialization ALSA: cmipci: Fix kctl->id initialization ALSA: hda/realtek: Add quirk for Clevo NS50AU ALSA: ice1712,ice1724: fix the kcontrol->id initialization ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 ALSA: hda/realtek: Add Lenovo P3 Tower platform ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 drm/i915/gt: Use the correct error value when kernel_context() fails drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs drm/amdgpu: fix xclk freq on CHIP_STONEY drm/amdgpu: change reserved vram info print drm/amd/pm: Fix power context allocation in SMU13 drm/amd/display: Reduce sdp bw after urgent to 90% wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif() can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket can: j1939: change j1939_netdev_lock type to mutex can: j1939: avoid possible use-after-free when j1939_can_rx_register fails mptcp: only send RM_ADDR in nl_cmd_remove mptcp: add address into userspace pm list mptcp: update userspace pm infos selftests: mptcp: update userspace pm addr tests selftests: mptcp: update userspace pm subflow tests ceph: fix use-after-free bug for inodes when flushing capsnaps s390/dasd: Use correct lock while counting channel queue length Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk Bluetooth: fix debugfs registration Bluetooth: hci_qca: fix debugfs registration tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta' rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting rbd: get snapshot context after exclusive lock is ensured to be held virtio_net: use control_buf for coalesce params soc: qcom: icc-bwmon: fix incorrect error code passed to dev_err_probe() pinctrl: meson-axg: add missing GPIOA_18 gpio group usb: usbfs: Enforce page requirements for mmap usb: usbfs: Use consistent mmap functions mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM mm: page_table_check: Ensure user pages are not slab pages arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes ARM: at91: pm: fix imbalanced reference counter for ethernet devices ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc ASoC: codecs: wsa883x: do not set can_multi_write flag ASoC: codecs: wsa881x: do not set can_multi_write flag arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void ASoC: mediatek: mt8195: fix use-after-free in driver remove path ASoC: simple-card-utils: fix PCM constraint error check blk-mq: fix blk_mq_hw_ctx active request accounting arm64: dts: imx8mn-beacon: Fix SPI CS pinmux i2c: mv64xxx: Fix reading invalid status value in atomic mode firmware: arm_ffa: Set handle field to zero in memory descriptor gpio: sim: fix memory corruption when adding named lines and unnamed hogs i2c: sprd: Delete i2c adapter in .remove's error path riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable eeprom: at24: also select REGMAP soundwire: stream: Add missing clear of alloc_slave_rt riscv: fix kprobe __user string arg print fault issue vduse: avoid empty string for dev name vhost: support PACKED when setting-getting vring_base vhost_vdpa: support PACKED when setting-getting vring_base ksmbd: fix out-of-bound read in deassemble_neg_contexts() ksmbd: fix out-of-bound read in parse_lease_state() ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" ext4: only check dquot_initialize_needed() when debugging wifi: rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS wifi: rtw88: correct PS calculation for SUPPORTS_DYNAMIC_PS Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" Linux 6.1.34 Note, commit 898c9a0ee7 ("bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready()") is merged away in this merge, due to missing dependencies, it will come back in later. Change-Id: I8e57d0914e6114822a8941a4663525d85377ca8a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-14 19:49:28 +00:00
Greg Kroah-Hartman	2a77668d45	This is the 6.1.33 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmSC5VIACgkQONu9yGCS aT5RPhAAiVFNzTuQT4DtPzXUzl9hpNtdtZPVa/z28+SbOZyf2YgyDGXLHvnGbJ/2 8DWDV9uSsxdX2InNqzD/IbRSiHjXprpDssthq3Qr5aPH7FO76uICWndrCk0dhZsK kI/+J7BqS1vgtaxsZeo/IHmMQJ5oEzx/JzvcyK5po0rykNDCxWNnh8cK4YtFOVtk eRD8cPWXvJGn88pdPPlQuS75MKBGcAUZLodN//tP+x2bcWzocaTZUCEHL36eLcVc 0CxPykCpFOcLFLIJWQ+pY2/HR2ynTBxYoaXsTpscR+FKbS+Lz9B6PUoXCvqaV2/e lriLjg22lbqxBbBhEk5NLBVozajtU/gNq6pptp/EnZahwjjyavuToZviWf8NWfs0 2u+zQlolinCKnm+8o18dRn24kI7LbUSD2w+V8FydSQNHMikvu/xHgDdLgzmj2XAf ZIAkHdGjRzKL2euDPrp28D5vPfCqDjqT2wUE2vUsc+Ax4k6ewFCPs3cweWD8hoFS fAjTC3Q/oNp6eEbWuWJPxl+DW/tD3ezRGeqrRCXQwubcgwB5iaS5ItdCCfG/lfiJ PNHf4kpg4FlyBf8aPD+R3QA6KOuS1owNNk3cx72zHs8zPusosHWj9hDrXeYVn06G gj1SIoC+jC/L5nbYH9WFLnKm9+EQ28lcp9j7f1PdlDhkcJmzBRY= =Qjnb -----END PGP SIGNATURE----- Merge 6.1.33 into android14-6.1-lts Changes in 6.1.33 RDMA/bnxt_re: Fix the page_size used during the MR creation phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value RDMA/efa: Fix unsupported page sizes in device RDMA/hns: Fix timeout attr in query qp for HIP08 RDMA/hns: Fix base address table allocation RDMA/hns: Modify the value of long message loopback slice dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() RDMA/bnxt_re: Fix a possible memory leak RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx iommu/rockchip: Fix unwind goto issue iommu/amd: Don't block updates to GATag if guest mode is on iommu/amd: Handle GALog overflows iommu/amd: Fix up merge conflict resolution nfsd: make a copy of struct iattr before calling notify_change dmaengine: pl330: rename _start to prevent build error riscv: Fix unused variable warning when BUILTIN_DTB is set net/mlx5: Drain health before unregistering devlink net/mlx5: SF, Drain health before removing device net/mlx5: fw_tracer, Fix event handling net/mlx5e: Don't attach netdev profile while handling internal error net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure netrom: fix info-leak in nr_write_internal() af_packet: Fix data-races of pkt_sk(sk)->num. tls: improve lockless access safety of tls_err_abort() amd-xgbe: fix the false linkup in xgbe_phy_status perf ftrace latency: Remove unnecessary "--" from --use-nsec option mtd: rawnand: ingenic: fix empty stub helper definitions RDMA/irdma: Prevent QP use after free RDMA/irdma: Fix Local Invalidate fencing af_packet: do not use READ_ONCE() in packet_bind() tcp: deny tcp_disconnect() when threads are waiting tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set net/smc: Scan from current RMB list when no position specified net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK net/sched: sch_ingress: Only create under TC_H_INGRESS net/sched: sch_clsact: Only create under TC_H_CLSACT net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs net/sched: Prohibit regrafting ingress or clsact Qdiscs net: sched: fix NULL pointer dereference in mq_attach net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report udp6: Fix race condition in udp6_sendmsg & connect nfsd: fix double fget() bug in __write_ports_addfd() nvme: fix the name of Zone Append for verbose logging net/mlx5e: Fix error handling in mlx5e_refresh_tirs net/mlx5: Read embedded cpu after init bit cleared iommu/mediatek: Flush IOTLB completely only if domain has been attached net/sched: flower: fix possible OOB write in fl_set_geneve_opt() tcp: fix mishandling when the sack compression is deferred. net: dsa: mv88e6xxx: Increase wait after reset deactivation mtd: rawnand: marvell: ensure timing values are written mtd: rawnand: marvell: don't set the NAND frequency select rtnetlink: call validate_linkmsg in rtnl_create_link mptcp: avoid unneeded __mptcp_nmpc_socket() usage mptcp: add annotations around msk->subflow accesses mptcp: avoid unneeded address copy mptcp: simplify subflow_syn_recv_sock() mptcp: consolidate passive msk socket initialization mptcp: fix data race around msk->first access mptcp: add annotations around sk->sk_shutdown accesses drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" watchdog: menz069_wdt: fix watchdog initialisation ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs. ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet drm/amdgpu: Use the default reset when loading or reloading the driver mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() drm/ast: Fix ARM compatibility btrfs: abort transaction when sibling keys check fails for leaves ARM: 9295/1: unwind:fix unwind abort for uleb128 case hwmon: (k10temp) Add PCI ID for family 19, model 78h media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield platform/mellanox: fix potential race in mlxbf-tmfifo driver gfs2: Don't deref jdesc in evict drm/amdgpu: set gfx9 onwards APU atomics support to be true fbdev: imsttfb: Fix use after free bug in imsttfb_probe fbdev: modedb: Add 1920x1080 at 60 Hz video mode fbdev: stifb: Fix info entry in sti_struct on error path nbd: Fix debugfs_create_dir error checking block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G nvme-pci: add quirk for missing secondary temperature thresholds ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12 ASoC: dwc: limit the number of overrun messages um: harddog: fix modular build xfrm: Check if_id in inbound policy/secpath match ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V ASoC: ssm2602: Add workaround for playback distortions media: dvb_demux: fix a bug for the continuity counter media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address media: netup_unidvb: fix irq init by register it at the end of probe media: dvb_ca_en50221: fix a size write bug media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table media: dvb-core: Fix use-after-free due on race condition at dvb_net media: dvb-core: Fix use-after-free due to race at dvb_register_device() media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions ASoC: SOF: pcm: fix pm_runtime imbalance in error handling ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling ASoC: SOF: pm: save io region state in case of errors in resume s390/pkey: zeroize key blobs s390/topology: honour nr_cpu_ids when adding CPUs ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value ARM: dts: stm32: add pin map for CAN controller on stm32f7 arm64/mm: mark private VM_FAULT_X defines as vm_fault_t arm64: vdso: Pass (void *) to virt_to_page() wifi: mac80211: simplify chanctx allocation wifi: mac80211: consider reserved chanctx for mindef wifi: mac80211: recalc chanctx mindef before assigning wifi: iwlwifi: mvm: Add locking to the rate read flow scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed wifi: b43: fix incorrect __packed annotation net: wwan: t7xx: Ensure init is completed before system sleep netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk nvme: do not let the user delete a ctrl before a complete initialization ALSA: oss: avoid missing-prototype warnings drm/msm: Be more shouty if per-process pgtables aren't working atm: hide unused procfs functions ceph: silence smatch warning in reconnect_caps_cb() drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged ublk: fix AB-BA lockdep warning nvme-pci: Add quirk for Teamgroup MP33 SSD block: Deny writable memory mapping if block is read-only KVM: arm64: vgic: Fix a circular locking issue KVM: arm64: vgic: Wrap vgic_its_create() with config_lock KVM: arm64: vgic: Fix locking comment media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug media: uvcvideo: Don't expose unsupported formats to userspace iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method iio: adc: mxs-lradc: fix the order of two cleanup operations HID: google: add jewel USB id HID: wacom: avoid integer overflow in wacom_intuos_inout() iio: imu: inv_icm42600: fix timestamp reset dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value iio: light: vcnl4035: fixed chip ID check iio: adc: stm32-adc: skip adc-channels setup if none is present iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag iio: dac: mcp4725: Fix i2c_master_send() return value handling iio: addac: ad74413: fix resistance input processing iio: adc: ad7192: Change "shorted" channels to differential iio: adc: stm32-adc: skip adc-diff-channels setup if none is present iio: dac: build ad5758 driver when AD5758 is selected net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM usb: gadget: f_fs: Add unbind event before functionfs_unbind md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() misc: fastrpc: return -EPIPE to invocations on device removal misc: fastrpc: reject new invocations during device removal scsi: stex: Fix gcc 13 warnings ata: libata-scsi: Use correct device no in ata_find_dev() drm/amdgpu: enable tmz by default for GC 11.0.1 drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 drm/amd/pm: reverse mclk and fclk clocks levels for vangogh drm/amd/pm: resolve reboot exception for si oland drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp drm/amd/pm: reverse mclk and fclk clocks levels for renoir x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case") mmc: vub300: fix invalid response handling mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds phy: qcom-qmp-combo: fix init-count imbalance phy: qcom-qmp-pcie-msm8996: fix init-count imbalance block: fix revalidate performance regression powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall iommu/amd: Fix domain flush size when syncing iotlb tpm, tpm_tis: correct tpm_tis_flags enumeration values riscv: perf: Fix callchain parse error with kernel tracepoint events io_uring: undeprecate epoll_ctl support selinux: don't use make's grouped targets feature yet mtdchar: mark bits of ioctl handler noinline tracing/timerlat: Always wakeup the timerlat thread tracing/histograms: Allow variables to have some modifiers tracing/probe: trace_probe_primary_from_call(): checked list_first_entry selftests: mptcp: connect: skip if MPTCP is not supported selftests: mptcp: pm nl: skip if MPTCP is not supported selftests: mptcp: join: skip if MPTCP is not supported selftests: mptcp: sockopt: skip if MPTCP is not supported selftests: mptcp: userspace pm: skip if MPTCP is not supported mptcp: fix connect timeout handling mptcp: fix active subflow finalization ext4: add EA_INODE checking to ext4_iget() ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() ext4: disallow ea_inodes with extended attributes ext4: add lockdep annotations for i_data_sem for ea_inode's fbcon: Fix null-ptr-deref in soft_cursor serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() serial: cpm_uart: Fix a COMPILE_TEST dependency powerpc/xmon: Use KSYM_NAME_LEN in array size test_firmware: fix a memory leak with reqs buffer test_firmware: fix the memory leak of the allocated firmware buffer KVM: arm64: Populate fault info for watchpoint KVM: x86: Account fastpath-only VM-Exits in vCPU stats ksmbd: fix credit count leakage ksmbd: fix UAF issue from opinfo->conn ksmbd: fix incorrect AllocationSize set in smb2_get_info ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate ksmbd: fix multiple out-of-bounds read during context decoding KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() fs/ntfs3: Validate MFT flags before replaying logs regmap: Account for register length when chunking tpm, tpm_tis: Request threaded interrupt handler iommu/amd/pgtbl_v2: Fix domain max address drm/amd/display: Have Payload Properly Created After Resume xfs: verify buffer contents when we skip log replay tls: rx: strp: don't use GFP_KERNEL in softirq context arm64: efi: Use SMBIOS processor version to key off Ampere quirk selftests: mptcp: diag: skip if MPTCP is not supported selftests: mptcp: simult flows: skip if MPTCP is not supported selftests: mptcp: join: avoid using 'cmp --bytes' ext4: enable the lazy init thread when remounting read/write Linux 6.1.33 Note, the following commits were reverted from this merge, due to conflicts with other KVM patches. If they are needed later, they can be brought back in a way that enables them to actually build properly: bafe94ac99 ("KVM: arm64: vgic: Fix locking comment") 150a5f74a5 ("KVM: arm64: vgic: Wrap vgic_its_create() with config_lock") 4129d71e5b ("KVM: arm64: vgic: Fix a circular locking issue") Change-Id: I3c4183fbe22b22914ee8985bd6add545abded9d0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-14 19:17:01 +00:00
Ben Hutchings	d4925800a4	lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() ... [ Upstream commit 7c5d4801ecf0564c860033d89726b99723c55146 ] irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. So we need to clear the pointer to our glue structure in rmap before doing that, not after. Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj array entries") Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/ZHo0vwquhOy3FaXc@decadent.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-06-14 11:15:22 +02:00
Greg Kroah-Hartman	03c3264a15	Merge 6.1.31 into android14-6.1-lts ... Changes in 6.1.31 usb: dwc3: fix gadget mode suspend interrupt handler issue tpm, tpm_tis: Avoid cache incoherency in test for interrupts tpm, tpm_tis: Only handle supported interrupts tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume tpm, tpm_tis: startup chip before testing for interrupts tpm: Re-enable TPM chip boostrapping non-tpm_tis TPM drivers tpm: Prevent hwrng from activating during resume watchdog: sp5100_tco: Immediately trigger upon starting. drm/amd/amdgpu: update mes11 api def drm/amdgpu/mes11: enable reg active poll skbuff: Proactively round up to kmalloc bucket size platform/x86: hp-wmi: Fix cast to smaller integer type warning net: dsa: mv88e6xxx: Add RGMII delay to 88E6320 drm/amd/display: hpd rx irq not working with eDP interface ocfs2: Switch to security_inode_init_security() arm64: Also reset KASAN tag if page is not PG_mte_tagged x86/mm: Avoid incomplete Global INVLPG flushes platform/x86/intel/ifs: Annotate work queue on stack so object debug does not complain ALSA: hda/ca0132: add quirk for EVGA X299 DARK ALSA: hda: Fix unhandled register update during auto-suspend period ALSA: hda/realtek: Enable headset onLenovo M70/M90 SUNRPC: Don't change task->tk_status after the call to rpc_exit_task mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works mmc: block: ensure error propagation for non-blk power: supply: axp288_fuel_gauge: Fix external_power_changed race power: supply: bq25890: Fix external_power_changed race ASoC: rt5682: Disable jack detection interrupt during suspend net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize m68k: Move signal frame following exception on 68020/030 xtensa: fix signal delivery to FDPIC process xtensa: add __bswap{si,di}2 helpers parisc: Use num_present_cpus() in alternative patching code parisc: Handle kgdb breakpoints only in kernel context parisc: Fix flush_dcache_page() for usage from irq context parisc: Allow to reboot machine after system halt parisc: Enable LOCKDEP support parisc: Handle kprobes breakpoints only in kernel context gpio: mockup: Fix mode of debugfs files btrfs: use nofs when cleaning up aborted transactions dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type drm/mgag200: Fix gamma lut not initialized. drm/radeon: reintroduce radeon_dp_work_func content drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7 drm/amd/pm: Fix output of pp_od_clk_voltage Revert "binder_alloc: add missing mmap_lock calls when using the VMA" Revert "android: binder: stop saving a pointer to the VMA" binder: add lockless binder_alloc_(set|get)_vma() binder: fix UAF caused by faulty buffer cleanup binder: fix UAF of alloc->vma in race with munmap() selftests/memfd: Fix unknown type name build failure drm/amd/amdgpu: limit one queue per gang perf/x86/uncore: Correct the number of CHAs on SPR x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable irqchip/mips-gic: Use raw spinlock for gic_lock debugobjects: Don't wake up kswapd from fill_pool() fbdev: udlfb: Fix endpoint check net: fix stack overflow when LRO is disabled for virtual interfaces udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). USB: core: Add routines for endpoint checks in old drivers USB: sisusbvga: Add endpoint checks media: radio-shark: Add endpoint checks ASoC: lpass: Fix for KASAN use_after_free out of bounds net: fix skb leak in __skb_tstamp_tx() drm: fix drmm_mutex_init() selftests: fib_tests: mute cleanup error message octeontx2-pf: Fix TSOv6 offload bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps lan966x: Fix unloading/loading of the driver ipv6: Fix out-of-bounds access in ipv6_find_tlv() cifs: mapchars mount option ignored power: supply: leds: Fix blink to LED on transition power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() power: supply: bq27xxx: Move bq27xxx_battery_update() down power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize power: supply: bq25890: Call power_supply_changed() after updating input current or voltage power: supply: bq24190: Call power_supply_changed() after updating input current power: supply: sbs-charger: Fix INHIBITED bit for Status reg optee: fix uninited async notif value firmware: arm_ffa: Check if ffa_driver remove is present before executing firmware: arm_ffa: Fix FFA device names for logical partitions fs: fix undefined behavior in bit shift for SB_NOUSER regulator: pca9450: Fix BUCK2 enable_mask platform/x86: ISST: Remove 8 socket limit coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator x86/pci/xen: populate MSI sysfs entries xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() x86/show_trace_log_lvl: Ensure stack pointer is aligned, again ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg ASoC: Intel: avs: Fix declaration of enum avs_channel_config ASoC: Intel: avs: Access path components under lock cxl: Wait Memory_Info_Valid before access memory related info sctp: fix an issue that plpmtu can never go to complete state forcedeth: Fix an error handling path in nv_probe() platform/mellanox: mlxbf-pmc: fix sscanf() error checking net/mlx5e: Fix SQ wake logic in ptp napi_poll context net/mlx5e: Fix deadlock in tc route query code net/mlx5e: Use correct encap attribute during invalidation net/mlx5e: do as little as possible in napi poll when budget is 0 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs net/mlx5: Handle pairing of E-switch via uplink un/load APIs net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE net/mlx5: Fix error message when failing to allocate device memory net/mlx5: Collect command failures data only for known commands net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device net/mlx5: Devcom, serialize devcom registration arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors regulator: mt6359: add read check for PMIC MT6359 net/smc: Reset connection when trying to use SMCRv2 fails. 3c589_cs: Fix an error handling path in tc589_probe() net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE Linux 6.1.31 Change-Id: I1043b7dd190672829baaf093f690e70a07c7a6dd Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-13 20:43:51 +00:00
Peng Zhang	c3f3dc31f9	UPSTREAM: maple_tree: make maple state reusable after mas_empty_area() ... Make mas->min and mas->max point to a node range instead of a leaf entry range. This allows mas to still be usable after mas_empty_area() returns. Users would get unexpected results from other operations on the maple state after calling the affected function. For example, x86 MAP_32BIT mmap() acts as if there is no suitable gap when there should be one. Link: https://lkml.kernel.org/r/20230505145829.74574-1-zhangpeng.00@bytedance.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang <zhangpeng.00@bytedance.com> Reported-by: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com> Reported-by: Tad <support@spotco.us> Reported-by: Michael Keyes <mgkeyes@vigovproductions.net> Link: https://lore.kernel.org/linux-mm/32f156ba80010fd97dbaf0a0cdfc84366608624d.camel@intel.com/ Link: https://lore.kernel.org/linux-mm/e6108286ac025c268964a7ead3aab9899f9bc6e9.camel@spotco.us/ Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Tested-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 0257d9908d38c0b1669af4bb1bc4dbca1f273fe6) Bug: 281094761 Change-Id: I381313fa2e84cafbcb9da5ea25fd01e3a868b6d1 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-13 00:53:45 +00:00
Greg Kroah-Hartman	26c1cc6858	This is the 6.1.30 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRuPHsACgkQONu9yGCS aT6USxAAx2uklTRE3mmIS9qytOjb8Z3gsA8LVaaQ3f25CWNiuverNj0mFyNtI9KX 84ZBS/G8aHA6z0dtdyMupHznHehQp7pVo0LOeVMz2bR+CjkpRQei2NimG8bGRcFK W6c40w99lD9dYpaal3yajs+k+LF3BktmBNc0SynCjjyEy4YA5RbWOhtGX6P4VRqs sPXcmmAHsqDPLfqsgsHiBNsiw+dCP7jY1a17rTxz1g49/4zS6BEGtxxpU4UZNbph rKrX0sgF8UM15IfdFc0CiOXhAcL7QQfUbucJ/94180gclF4j6QqAMueAr6mLWkFd Pj7vLn/KD2wA2dzTBekHZ9SYp31xcXomkzfdLoMMnazfy3RL4sO7WhJks0k0T2En 3LIlsRZx/C2ztf3SLq2z2Bw/ExaefrydLI9cWJBi7CQ5yUVO15edcv40W4pxoMOL xFDZhCksC+JNc74HPYKTmg+SJQsxtYeLrwb6zW43aJByY+rls70crfhdS5fORvmH G8qDS2PCNAqpulxyxQtYxiIcRiM4SqPskves+3nu7gBFGfsv2AJU1gNCorIpZuW8 DS2jrMwPv7gH+eUvqrnrtdA+Vk4TYWslg0mPlVNavX98i9/dC9Vjss3yXCYh7Q6u 0+BpSBLtKM4pahaMgKpYv/V/r+GKvIt7Npki8o/bs1nuykF04aw= =hAQM -----END PGP SIGNATURE----- Merge 6.1.30 into android14-6.1-lts Changes in 6.1.30 drm/fbdev-generic: prohibit potential out-of-bounds access drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings net: skb_partial_csum_set() fix against transport header magic value net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend tick/broadcast: Make broadcast device replacement work correctly linux/dim: Do nothing if no time delta between samples net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). net: phy: bcm7xx: Correct read from expansion register netfilter: nf_tables: always release netdev hooks from notifier netfilter: conntrack: fix possible bug_on with enable_hooks=1 bonding: fix send_peer_notif overflow netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: deal with most data-races in sk_wait_event() net: add vlan_get_protocol_and_depth() helper tcp: add annotations around sk->sk_shutdown accesses gve: Remove the code of clearing PBA bit ipvlan:Fix out-of-bounds caused by unclear skb->cb net: mscc: ocelot: fix stat counter register values net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. drm/i915/guc: Don't capture Gen8 regs on Xe devices drm/i915: Fix NULL ptr deref by checking new_crtc_state drm/i915/dp: prevent potential div-by-zero drm/i915: Expand force_probe to block probe of devices as well. drm/i915: taint kernel when force probing unsupported devices fbdev: arcfb: Fix error handling in arcfb_probe() ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set ext4: allow ext4_get_group_info() to fail refscale: Move shutdown from wait_event() to wait_event_idle() selftests: cgroup: Add 'malloc' failures checks in test_memcontrol rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access open: return EINVAL for O_DIRECTORY | O_CREAT fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/displayid: add displayid_get_header() and check bounds better drm/amd/display: populate subvp cmd info only for the top pipe drm/amd/display: Correct DML calculation to align HW formula platform/x86: x86-android-tablets: Add Acer Iconia One 7 B1-750 data drm/amd/display: Enable HostVM based on rIOMMU active drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores arm64: dts: qcom: msm8996: Add missing DWC3 quirks media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish media: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() drm/rockchip: dw_hdmi: cleanup drm encoder during unbind memstick: r592: Fix UAF bug in r592_remove due to race condition arm64: dts: imx8mq-librem5: Remove dis_u3_susphy_quirk from usb_dwc3_0 firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers drm/amd/display: fixed dcn30+ underflow issue remoteproc: stm32_rproc: Add mutex protection for workqueue drm/tegra: Avoid potential 32-bit integer overflow drm/msm/dp: Clean up handling of DP AUX interrupts ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects arm64: dts: qcom: sdm845-polaris: Drop inexistent properties irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 ACPI: video: Remove desktops without backlight DMI quirks drm/amd/display: Correct DML calculation to follow HW SPEC drm/amd: Fix an out of bounds error in BIOS parser drm/amdgpu: Fix sdma v4 sw fini error media: Prefer designated initializers over memset for subdev pad ops media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup wifi: ath: Silence memcpy run-time false positive warning bpf: Annotate data races in bpf_local_storage wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery bnxt: avoid overflow in bnxt_get_nvram_directory() net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping netdev: Enforce index cap in netdev_get_tx_queue scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check scsi: ufs: ufs-pci: Add support for Intel Lunar Lake ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() crypto: jitter - permanent and intermittent health errors f2fs: Fix system crash due to lack of free space in LFS f2fs: fix to drop all dirty pages during umount() if cp_error is set f2fs: fix to check readonly condition correctly samples/bpf: Fix fout leak in hbm's run_bpf_prog bpf: Add preempt_count_{sub,add} into btf id deny list md: fix soft lockup in status_resync wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: add a new PCI device ID for BZ device wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf wifi: iwlwifi: mvm: fix ptk_pn memory leak block, bfq: Fix division by zero error on zero wsum wifi: ath11k: Ignore frags from uninitialized peer in dp. wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO null_blk: Always check queue mode setting from configfs wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace wifi: ath11k: Fix SKB corruption in REO destination ring nbd: fix incomplete validation of ioctl arg ipvs: Update width of source for ip_vs_sync_conn_options Bluetooth: btusb: Add new PID/VID 04ca:3801 for MT7663 Bluetooth: Add new quirk for broken local ext features page 2 Bluetooth: btrtl: add support for the RTL8723CS Bluetooth: Improve support for Actions Semi ATS2851 based devices Bluetooth: btrtl: check for NULL in btrtl_set_quirks() Bluetooth: btintel: Add LE States quirk support Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851 Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp Bluetooth: btrtl: Add the support for RTL8851B staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: apple: Set the tilde quirk flag on the Geyser 4 and later staging: axis-fifo: initialize timeouts in init only ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A42) HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 usb: typec: ucsi: acpi: add quirk for ASUS Zenbook UM325 ALSA: hda: LNL: add HD Audio PCI ID ASoC: amd: Add Dell G15 5525 to quirks list ASoC: amd: yc: Add ThinkBook 14 G5+ ARP to quirks list for acp6x HID: apple: Set the tilde quirk flag on the Geyser 3 HID: Ignore battery for ELAN touchscreen on ROG Flow X13 GV301RA HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation lkdtm/stackleak: Fix noinstr violation recordmcount: Fix memory leaks in the uwrite function soundwire: dmi-quirks: add remapping for Intel 'Rooks County' NUC M15 phy: st: miphy28lp: use _poll_timeout functions for waits soundwire: qcom: gracefully handle too many ports in DT soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow mfd: intel_soc_pmic_chtwc: Add Lenovo Yoga Book X90F to intel_cht_wc_models mfd: dln2: Fix memory leak in dln2_probe() mfd: intel-lpss: Add Intel Meteor Lake PCH-S LPSS PCI IDs parisc: Replace regular spinlock with spin_trylock on panic path platform/x86: Move existing HP drivers to a new hp subdir platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs xfrm: don't check the default policy if the policy allows the packet Revert "Fix XFRM-I support for nested ESP tunnels" drm/msm/dp: unregister audio driver during unbind drm/msm/dpu: Assign missing writeback log_mask drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header drm/msm/dpu: Remove duplicate register defines from INTF dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi platform: Provide a remove callback that returns no value ASoC: fsl_micfil: Fix error handler with pm_runtime_enable cpupower: Make TSC read per CPU for Mperf monitor xfrm: Reject optional tunnel/BEET mode templates in outbound policies af_key: Reject optional tunnel/BEET mode templates in outbound policies drm/msm: Fix submit error-path leaks selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test net: fec: Better handle pm_runtime_get() failing in .remove() net: phy: dp83867: add w/a for packet errors seen with short cables ALSA: firewire-digi00x: prevent potential use after free wifi: mt76: connac: fix stats->tx_bytes calculation ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 sfc: disable RXFCS and RXALL features by default vsock: avoid to close connected socket after the timeout tcp: fix possible sk_priority leak in tcp_v4_send_reset() serial: arc_uart: fix of_iomap leak in `arc_serial_probe` serial: 8250_bcm7271: balance clk_enable calls serial: 8250_bcm7271: fix leak in `brcmuart_probe` erspan: get the proto with the md version for collect_md net: dsa: rzn1-a5psw: enable management frames for CPU port net: dsa: rzn1-a5psw: fix STP states handling net: dsa: rzn1-a5psw: disable learning for standalone ports net: hns3: fix output information incomplete for dumping tx queue info with debugfs net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout net: hns3: fix reset timeout when enable full VF media: netup_unidvb: fix use-after-free at del_timer() SUNRPC: double free xprt_ctxt while still in use SUNRPC: always free ctxt when freeing deferred request SUNRPC: Fix trace_svc_register() call site ASoC: mediatek: mt8186: Fix use-after-free in driver remove path ASoC: SOF: topology: Fix logic for copying tuples drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() virtio-net: Maintain reverse cleanup order virtio_net: Fix error unwinding of XDP initialization tipc: add tipc_bearer_min_mtu to calculate min mtu tipc: do not update mtu if msg_max is too small in mtu negotiation tipc: check the bearer min mtu properly when setting it by netlink s390/cio: include subchannels without devices also for evaluation can: dev: fix missing CAN XL support in can_put_echo_skb() net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close ice: introduce clear_reset_state operation ice: Fix ice VF reset during iavf initialization wifi: cfg80211: Drop entries with invalid BSSIDs in RNR wifi: mac80211: fortify the spinlock against deadlock by interrupt wifi: mac80211: fix min center freq offset tracing wifi: mac80211: Abort running color change when stopping the AP wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock wifi: iwlwifi: fw: fix DBGI dump wifi: iwlwifi: fix OEM's name in the ppag approved list wifi: iwlwifi: mvm: fix OEM's name in the tas approved list wifi: iwlwifi: mvm: don't trust firmware n_channels scsi: storvsc: Don't pass unused PFNs to Hyper-V host net: tun: rebuild error handling in tun_get_user tun: Fix memory leak for detached NAPI queue. cassini: Fix a memory leak in the error handling path of cas_init_one() net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() net: wwan: iosm: fix NULL pointer dereference when removing device net: pcs: xpcs: fix C73 AN not getting enabled net: selftests: Fix optstring netfilter: nf_tables: fix nft_trans type confusion netfilter: nft_set_rbtree: fix null deref on element insertion bridge: always declare tunnel functions ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show Revert "usb: gadget: udc: core: Prevent redundant calls to pullup" Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started" xhci-pci: Only run d3cold avoidance quirk for s2idle xhci: Fix incorrect tracking of free space on transfer rings ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add quirk for Clevo L140AU ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops ALSA: hda/realtek: Fix mute and micmute LEDs for yet another HP laptop can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path wifi: rtw88: use work to update rate to avoid RCU warning SMB3: Close all deferred handles of inode in case of handle lease break SMB3: drop reference to cfile before sending oplock break ksmbd: smb2: Allow messages padded to 8byte boundary ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix wrong UserName check in session_user ksmbd: fix global-out-of-bounds in smb2_find_context_vals KVM: Fix vcpu_array[0] races statfs: enforce statfs[64] structure initialization maple_tree: make maple state reusable after mas_empty_area() mm: fix zswap writeback race condition serial: Add support for Advantech PCI-1611U card serial: 8250_exar: Add support for USR298x PCI Modems serial: qcom-geni: fix enabling deactivated interrupt thunderbolt: Clear registers properly when auto clear isn't in use vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF ceph: force updating the msg pointer in non-split case drm/amd/pm: fix possible power mode mismatch between driver and PMFW drm/amdgpu/gmc11: implement get_vbios_fb_size() drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well drm/amdgpu: refine get gpu clock counter method drm/amdgpu/gfx11: update gpu_clock_counter logic dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries powerpc/iommu: DMA address offset is incorrectly calculated with 2MB TCEs powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() s390/dasd: fix command reject error on ESE devices s390/crypto: use vector instructions only if available for ChaCha20 s390/qdio: fix do_sqbs() inline assembly constraint arm64: mte: Do not set PG_mte_tagged if tags were not initialized rethook: use preempt_{disable, enable}_notrace in rethook_trampoline_handler rethook, fprobe: do not trace rethook related functions remoteproc: imx_dsp_rproc: Fix kernel test robot sparse warning crypto: testmgr - fix RNG performance in fuzz tests drm/amdgpu: declare firmware for new MES 11.0.4 drm/amd/amdgpu: introduce gc_*_mes_2.bin v2 drm/amdgpu: reserve the old gc_11_0_*_mes.bin Linux 6.1.30 Change-Id: I411885affcf017410aab34bf3fba2dde96df6593 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-12 20:48:03 +00:00
Greg Kroah-Hartman	ef75a88787	Merge 6.1.28 into android14-6.1-lts ... Changes in 6.1.28 ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15 ASoC: Intel: soc-acpi: add table for Intel 'Rooks County' NUC M15 ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm x86/hyperv: Block root partition functionality in a Confidential VM ASoC: amd: yc: Add DMI entries to support Victus by HP Laptop 16-e1xxx (8A22) iio: adc: palmas_gpadc: fix NULL dereference on rmmod ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 ASoC: da7213.c: add missing pm_runtime_disable() net: wwan: t7xx: do not compile with -Werror selftests mount: Fix mount_setattr_test builds failed scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) net: sfp: add quirk enabling 2500Base-x for HG MXPD-483II platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle quirk list wifi: ath11k: reduce the MHI timeout to 20s tracing: Error if a trace event has an array for a __field() asm-generic/io.h: suppress endianness warnings for readq() and writeq() x86/cpu: Add model number for Intel Arrow Lake processor wireguard: timers: cast enum limits members to int in prints wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset ASoC: amd: fix ACP version typo mistake ASoC: amd: ps: update the acp clock source. arm64: Always load shadow stack pointer directly from the task struct arm64: Stash shadow stack pointer in the task struct on interrupt powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU PCI: kirin: Select REGMAP_MMIO PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock PCI: qcom: Fix the incorrect register usage in v2.7.0 config phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes IMA: allow/fix UML builds usb: gadget: udc: core: Invoke usb_gadget_connect only when started usb: gadget: udc: core: Prevent redundant calls to pullup usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive USB: dwc3: fix runtime pm imbalance on probe errors USB: dwc3: fix runtime pm imbalance on unbind hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write hwmon: (adt7475) Use device_property APIs when configuring polarity tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site posix-cpu-timers: Implement the missing timer_wait_running callback media: ov8856: Do not check for for module version blk-stat: fix QUEUE_FLAG_STATS clear blk-crypto: don't use struct request_queue for public interfaces blk-crypto: add a blk_crypto_config_supported_natively helper blk-crypto: move internal only declarations to blk-crypto-internal.h blk-crypto: Add a missing include directive blk-mq: release crypto keyslot before reporting I/O complete blk-crypto: make blk_crypto_evict_key() return void blk-crypto: make blk_crypto_evict_key() more robust staging: iio: resolver: ads1210: fix config mode tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH xhci: fix debugfs register accesses while suspended serial: fix TIOCSRS485 locking serial: 8250: Fix serial8250_tx_empty() race with DMA Tx serial: max310x: fix IO data corruption in batched operations tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem fs: fix sysctls.c built MIPS: fw: Allow firmware to pass a empty env ipmi:ssif: Add send_retries increment ipmi: fix SSIF not responding under certain cond. iio: addac: stx104: Fix race condition when converting analog-to-digital iio: addac: stx104: Fix race condition for stx104_write_raw() kheaders: Use array declaration instead of char wifi: mt76: add missing locking to protect against concurrent rx/status calls pwm: meson: Fix axg ao mux parents pwm: meson: Fix g12a ao clk81 name soundwire: qcom: correct setting ignore bit on v1.5.1 pinctrl: qcom: lpass-lpi: set output value before enabling output ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus ring-buffer: Sync IRQ works before buffer destruction crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON() crypto: safexcel - Cleanup ring IRQ workqueues on load failure crypto: arm64/aes-neonbs - fix crash with CFI enabled crypto: ccp - Don't initialize CCP for PSP 0x1649 rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed reiserfs: Add security prefix to xattr name in reiserfs_security_write() KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON KVM: arm64: Avoid lock inversion when setting the VM register width KVM: arm64: Use config_lock to protect data ordered against KVM_RUN KVM: arm64: Use config_lock to protect vgic state KVM: arm64: vgic: Don't acquire its_lock before config_lock relayfs: fix out-of-bounds access in relay_file_read drm/amd/display: Remove stutter only configurations drm/amd/display: limit timing for single dimm memory drm/amd/display: fix PSR-SU/DSC interoperability support drm/amd/display: fix a divided-by-zero error KVM: RISC-V: Retry fault if vma_lookup() results become invalid ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: fix memleak in session setup ksmbd: not allow guest user on multichannel ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ACPI: video: Remove acpi_backlight=video quirk for Lenovo ThinkPad W530 i2c: omap: Fix standard mode false ACK readings riscv: mm: remove redundant parameter of create_fdt_early_page_table tracing: Fix permissions for the buffer_percent file swsmu/amdgpu_smu: Fix the wrong if-condition drm/amd/pm: re-enable the gfx imu when smu resume iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE RISC-V: Align SBI probe implementation with spec Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" ubifs: Fix memleak when insert_old_idx() failed ubi: Fix return value overwrite issue in try_write_vid_and_data() ubifs: Free memory for tmpfile name ubifs: Fix memory leak in do_rename ceph: fix potential use-after-free bug when trimming caps xfs: don't consider future format versions valid cxl/hdm: Fail upon detecting 0-sized decoders bus: mhi: host: Remove duplicate ee check for syserr bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state bus: mhi: host: Range check CHDBOFF and ERDBOFF ASoC: dt-bindings: qcom,lpass-rx-macro: correct minItems for clocks kunit: improve KTAP compliance of KUnit test output kunit: fix bug in the order of lines in debugfs logs rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem selftests/resctrl: Move ->setup() call outside of test specific branches selftests/resctrl: Allow ->setup() to return errors selftests/resctrl: Check for return value after write_schemata() selinux: fix Makefile dependencies of flask.h selinux: ensure av_permissions.h is built when needed tpm, tpm_tis: Do not skip reset of original interrupt vector tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed tpm, tpm_tis: Claim locality before writing interrupt registers tpm, tpm: Implement usage counter for locality tpm, tpm_tis: Claim locality when interrupts are reenabled on resume erofs: stop parsing non-compact HEAD index if clusterofs is invalid erofs: initialize packed inode after root inode is assigned erofs: fix potential overflow calculating xattr_isize drm/rockchip: Drop unbalanced obj unref drm/i915/dg2: Drop one PCI ID drm/vgem: add missing mutex_destroy drm/probe-helper: Cancel previous job before starting new one drm/amdgpu: register a vga_switcheroo client for MacBooks with apple-gmux tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table arm64: dts: renesas: r9a07g044: Update IRQ numbers for SSI channels arm64: dts: renesas: r9a07g054: Update IRQ numbers for SSI channels arm64: dts: renesas: r9a07g043: Introduce SOC_PERIPHERAL_IRQ() macro to specify interrupt property arm64: dts: renesas: r9a07g043: Update IRQ numbers for SSI channels drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources EDAC/skx: Fix overflows on the DRAM row address mapping arrays ARM: dts: qcom-apq8064: Fix opp table child name regulator: core: Shorten off-on-delay-us for always-on/boot-on by time since booted arm64: dts: ti: k3-am62-main: Fix GPIO numbers in DT arm64: dts: ti: k3-am62a7-sk: Fix DDR size to full 4GB arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name arm64: dts: qcom: sc7280: fix EUD port properties arm64: dts: qcom: sdm845: correct dynamic power coefficients arm64: dts: qcom: sdm845: Fix the PCI I/O port range arm64: dts: qcom: msm8998: Fix the PCI I/O port range arm64: dts: qcom: sc7280: Fix the PCI I/O port range arm64: dts: qcom: ipq8074: Fix the PCI I/O port range arm64: dts: qcom: ipq6018: Fix the PCI I/O port range arm64: dts: qcom: msm8996: Fix the PCI I/O port range arm64: dts: qcom: sm8250: Fix the PCI I/O port range arm64: dts: qcom: sm8150: Fix the PCI I/O port range arm64: dts: qcom: sm8450: Fix the PCI I/O port range ARM: dts: qcom: ipq4019: Fix the PCI I/O port range ARM: dts: qcom: ipq8064: Fix the PCI I/O port range ARM: dts: qcom: sdx55: Fix the unit address of PCIe EP node x86/MCE/AMD: Use an u64 for bank_map media: bdisp: Add missing check for create_workqueue media: platform: mtk-mdp3: Add missing check and free for ida_alloc media: amphion: decoder implement display delay enable media: av7110: prevent underflow in write_ts_to_decoder() firmware: qcom_scm: Clear download bit during reboot drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 media: max9286: Free control handler arm64: dts: ti: k3-am625: Correct L2 cache size to 512KB arm64: dts: ti: k3-am62a7: Correct L2 cache size to 512KB drm/msm/adreno: drop bogus pm_runtime_set_active() drm: msm: adreno: Disable preemption on Adreno 510 virt/coco/sev-guest: Double-buffer messages arm64: dts: qcom: sm8350-microsoft-surface: fix USB dual-role mode property drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence known override-init warnings ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data arm64: dts: qcom: sm8450: fix pcie1 gpios properties name drm: rcar-du: Fix a NULL vs IS_ERR() bug ARM: dts: gta04: fix excess dma channel usage firmware: arm_scmi: Fix xfers allocation on Rx channel perf/arm-cmn: Move overlapping wp_combine field ARM: dts: stm32: fix spi1 pin assignment on stm32mp15 arm64: dts: apple: t8103: Disable unused PCIe ports cpufreq: mediatek: fix passing zero to 'PTR_ERR' cpufreq: mediatek: fix KP caused by handler usage after regulator_put/clk_put cpufreq: mediatek: raise proc/sram max voltage for MT8516 cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623 cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos arm64: dts: mediatek: mt8192-asurada: Fix voltage constraint for Vgpu ACPI: VIOT: Initialize the correct IOMMU fwspec drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() drm/mediatek: dp: Change the aux retries times when receiving AUX_DEFER mailbox: mpfs: switch to txdone_poll soc: bcm: brcmstb: biuctrl: fix of_iomap leak soc: renesas: renesas-soc: Release 'chipid' from ioremap() gpu: host1x: Fix potential double free if IOMMU is disabled gpu: host1x: Fix memory leak of device names arm64: dts: qcom: sc7280-herobrine-villager: correct trackpad supply arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply arm64: dts: qcom: sc7180-trogdor-pazquel: correct trackpad supply arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 regulator arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from PMI8994 regulator arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator drm/ttm: optimize pool allocations a bit v2 drm/ttm/pool: Fix ttm_pool_alloc error path regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() regulator: core: Avoid lockdep reports when resolving supplies x86/apic: Fix atomic update of offset in reserve_eilvt_offset() arm64: dts: qcom: msm8994-angler: Fix cont_splash_mem mapping arm64: dts: qcom: msm8994-angler: removed clash with smem_region arm64: dts: sc7180: Rename qspi data12 as data23 arm64: dts: sc7280: Rename qspi data12 as data23 media: mediatek: vcodec: Use 4K frame size when supported by stateful decoder media: mediatek: vcodec: Make MM21 the default capture format media: mediatek: vcodec: Force capture queue format to MM21 media: mediatek: vcodec: add params to record lat and core lat_buf count media: mediatek: vcodec: using each instance lat_buf count replace core ready list media: mediatek: vcodec: move lat_buf to the top of core list media: mediatek: vcodec: add core decode done event media: mediatek: vcodec: remove unused lat_buf media: mediatek: vcodec: making sure queue_work successfully media: mediatek: vcodec: change lat thread decode error condition media: cedrus: fix use after free bug in cedrus_remove due to race condition media: rkvdec: fix use after free bug in rkvdec_remove platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe platform/x86/amd: pmc: Don't try to read SMU version on Picasso platform/x86/amd: pmc: Hide SMU version and program attributes for Picasso platform/x86/amd: pmc: Don't dump data after resume from s0i3 on picasso platform/x86/amd: pmc: Move idlemask check into `amd_pmc_idlemask_read` platform/x86/amd: pmc: Utilize SMN index 0 for driver probe platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init media: dm1105: Fix use after free bug in dm1105_remove due to race condition media: saa7134: fix use after free bug in saa7134_finidev due to race condition media: platform: mtk-mdp3: fix potential frame size overflow in mdp_try_fmt_mplane() media: rcar_fdp1: Fix refcount leak in probe and remove function media: v4l: async: Return async sub-devices to subnotifier list media: hi846: Fix memleak in hi846_init_controls() drm/amd/display: Fix potential null dereference media: rc: gpio-ir-recv: Fix support for wake-up media: venus: dec: Fix handling of the start cmd media: venus: dec: Fix capture formats enumeration order regulator: stm32-pwr: fix of_iomap leak x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step perf/arm-cmn: Fix port detection for CMN-700 media: mediatek: vcodec: fix decoder disable pm crash media: mediatek: vcodec: add remove function for decoder platform driver debugobject: Prevent init race with static objects drm/i915: Make intel_get_crtc_new_encoder() less oopsy tick/common: Align tick period with the HZ tick. ACPI: bus: Ensure that notify handlers are not running after removal cpufreq: use correct unit when verify cur freq rpmsg: glink: Propagate TX failures in intentless mode as well hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() wifi: ath6kl: minor fix for allocation size wifi: ath9k: hif_usb: fix memory leak of remain_skbs wifi: ath11k: Use platform_get_irq() to get the interrupt wifi: ath5k: Use platform_get_irq() to get the interrupt wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() wifi: ath11k: fix SAC bug on peer addition with sta band migration wifi: brcmfmac: support CQM RSSI notification with older firmware wifi: ath6kl: reduce WARN to dev_dbg() in callback tools: bpftool: Remove invalid \' json escape wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() bpf: take into account liveness when propagating precision bpf: fix precision propagation verbose logging crypto: qat - fix concurrency issue when device state changes scm: fix MSG_CTRUNC setting condition for SO_PASSSEC wifi: ath11k: fix deinitialization of firmware resources selftests/bpf: Fix a fd leak in an error path in network_helpers.c bpf: Remove misleading spec_v1 check on var-offset stack read net: pcs: xpcs: remove double-read of link state when using AN vlan: partially enable SIOCSHWTSTAMP in container net/packet: annotate accesses to po->xmit net/packet: convert po->origdev to an atomic flag net/packet: convert po->auxdata to an atomic flag libbpf: Fix ld_imm64 copy logic for ksym in light skeleton. net: dsa: qca8k: remove assignment of an_enabled in pcs_get_state() netfilter: keep conntrack reference until IPsecv6 policy checks are done bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation scsi: target: core: Change the way target_xcopy_do_work() sets restiction on max I/O scsi: target: Move sess cmd counter to new struct scsi: target: Move cmd counter allocation scsi: target: Pass in cmd counter to use during cmd setup scsi: target: iscsit: isert: Alloc per conn cmd counter scsi: target: iscsit: Stop/wait on cmds during conn close scsi: target: Fix multiple LUN_RESET handling scsi: target: iscsit: Fix TAS handling during conn cleanup scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS net: sunhme: Fix uninitialized return code f2fs: handle dqget error in f2fs_transfer_project_quota() f2fs: fix uninitialized skipped_gc_rwsem f2fs: apply zone capacity to all zone type f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() f2fs: fix scheduling while atomic in decompression path crypto: caam - Clear some memory in instantiate_rng crypto: sa2ul - Select CRYPTO_DES wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() scsi: libsas: Add sas_ata_device_link_abort() scsi: hisi_sas: Handle NCQ error when IPTT is valid wifi: rt2x00: Fix memory leak when handling surveys f2fs: fix iostat lock protection net: qrtr: correct types of trace event parameters selftests: xsk: Use correct UMEM size in testapp_invalid_desc selftests: xsk: Disable IPv6 on VETH1 selftests: xsk: Deflakify STATS_RX_DROPPED test selftests/bpf: Wait for receive in cg_storage_multi test bpftool: Fix bug for long instructions in program CFG dumps crypto: drbg - Only fail when jent is unavailable in FIPS mode xsk: Fix unaligned descriptor validation f2fs: fix to avoid use-after-free for cached IPU bio wifi: iwlwifi: fix duplicate entry in iwl_dev_info_table bpf/btf: Fix is_int_ptr() scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() net: ethernet: stmmac: dwmac-rk: rework optional clock handling net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling wifi: ath11k: fix writing to unintended memory region bpf, sockmap: fix deadlocks in the sockhash and sockmap nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() nvmet: fix Identify Namespace handling nvmet: fix Identify Controller handling nvmet: fix Identify Active Namespace ID list handling nvmet: fix I/O Command Set specific Identify Controller nvme: fix async event trace event nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" selftests/bpf: Use read_perf_max_sample_freq() in perf_event_stackmap selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach blk-mq: don't plug for head insertions in blk_execute_rq_nowait wifi: iwlwifi: debug: fix crash in __iwl_err() wifi: iwlwifi: trans: don't trigger d3 interrupt twice wifi: iwlwifi: mvm: don't set CHECKSUM_COMPLETE for unsupported protocols bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap f2fs: fix to check return value of f2fs_do_truncate_blocks() f2fs: fix to check return value of inc_valid_block_count() md/raid10: fix task hung in raid10d md/raid10: fix leak of 'r10bio->remaining' for recovery md/raid10: fix memleak for 'conf->bio_split' md/raid10: fix memleak of md thread md/raid10: don't call bio_start_io_acct twice for bio which experienced read error wifi: iwlwifi: mvm: don't drop unencrypted MCAST frames wifi: iwlwifi: yoyo: skip dump correctly on hw error wifi: iwlwifi: yoyo: Fix possible division by zero wifi: iwlwifi: mvm: initialize seq variable wifi: iwlwifi: fw: move memset before early return jdb2: Don't refuse invalidation of already invalidated buffers io_uring/rsrc: use nospec'ed indexes wifi: iwlwifi: make the loop for card preparation effective wifi: mt76: mt7915: expose device tree match table wifi: mt76: handle failure of vzalloc in mt7615_coredump_work wifi: mt76: add flexible polling wait-interval support wifi: mt76: mt7921e: fix probe timeout after reboot wifi: mt76: fix 6GHz high channel not be scanned mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data wifi: mt76: mt7921: fix missing unwind goto in `mt7921u_probe` wifi: mt76: mt7921e: improve reliability of dma reset wifi: mt76: mt7921e: stop chip reset worker in unregister hook wifi: mt76: connac: fix txd multicast rate setting wifi: iwlwifi: mvm: check firmware response size netfilter: conntrack: restore IPS_CONFIRMED out of nf_conntrack_hash_check_insert() netfilter: conntrack: fix wrong ct->timeout value wifi: iwlwifi: fw: fix memory leak in debugfs ixgbe: Allow flow hash to be set via ethtool ixgbe: Enable setting RSS table to default values net/mlx5e: Don't clone flow post action attributes second time net/mlx5: E-switch, Create per vport table based on devlink encap mode net/mlx5: E-switch, Don't destroy indirect table in split rule net/mlx5e: Fix error flow in representor failing to add vport rx rule net/mlx5: Remove "recovery" arg from mlx5_load_one() function net/mlx5: Suspend auxiliary devices only in case of PCI device suspend Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() function" net/mlx5: Use recovery timeout on sync reset flow net/mlx5e: Nullify table pointer when failing to create net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports bpf: Fix race between btf_put and btf_idr walk. bpf: Don't EFAULT for getsockopt with optval=NULL netfilter: nf_tables: don't write table validation state without mutex net: dpaa: Fix uninitialized variable in dpaa_stop() net/sched: sch_fq: fix integer overflow of "credit" ipv4: Fix potential uninit variable access bug in __ip_make_skb() Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" netlink: Use copy_to_user() for optval in netlink_getsockopt(). net: amd: Fix link leak when verifying config failed tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it ASoC: cs35l41: Only disable internal boost drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler() drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler() pstore: Revert pmsg_lock back to a normal mutex usb: host: xhci-rcar: remove leftover quirk handling usb: dwc3: gadget: Change condition for processing suspend event serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted fpga: bridge: fix kernel-doc parameter description iio: light: max44009: add missing OF device matching serial: 8250_bcm7271: Fix arbitration handling spi: atmel-quadspi: Don't leak clk enable count in pm resume spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() spi: imx: Don't skip cleanup in remove's error path usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE PCI: imx6: Install the fault handler only on compatible match ASoC: es8316: Handle optional IRQ assignment linux/vt_buffer.h: allow either builtin or modular for macros spi: qup: Don't skip cleanup in remove's error path interconnect: qcom: rpm: drop bogus pm domain attach spi: fsl-spi: Fix CPM/QE mode Litte Endian vmci_host: fix a race condition in vmci_host_poll() causing GPF of: Fix modalias string generation PCI/EDR: Clear Device Status after EDR error recovery ia64: mm/contig: fix section mismatch warning/error ia64: salinfo: placate defined-but-not-used warning scripts/gdb: bail early if there are no clocks scripts/gdb: bail early if there are no generic PD HID: amd_sfh: Correct the structure fields HID: amd_sfh: Correct the sensor enable and disable command HID: amd_sfh: Fix illuminance value HID: amd_sfh: Add support for shutdown operation HID: amd_sfh: Correct the stop all command HID: amd_sfh: Increase sensor command timeout for SFH1.1 HID: amd_sfh: Handle "no sensors" enabled for SFH1.1 cacheinfo: Check sib_leaf in cache_leaves_are_shared() coresight: etm_pmu: Set the module field drm/panel: novatek-nt35950: Improve error handling ASoC: fsl_mqs: move of_node_put() to the correct location PCI/PM: Extend D3hot delay for NVIDIA HDA controllers drm/panel: novatek-nt35950: Only unregister DSI1 if it exists spi: cadence-quadspi: fix suspend-resume implementations i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path scripts/gdb: raise error with reduced debugging information uapi/linux/const.h: prefer ISO-friendly __typeof__ sh: sq: Fix incorrect element size for allocating bitmap buffer usb: gadget: tegra-xudc: Fix crash in vbus_draw usb: chipidea: fix missing goto in `ci_hdrc_probe` usb: mtu3: fix kernel panic at qmu transfer done irq handler firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe tty: serial: fsl_lpuart: adjust buffer length to the intended size serial: 8250: Add missing wakeup event reporting spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS staging: rtl8192e: Fix W_DISABLE# does not work after stop/start spmi: Add a check for remove callback when removing a SPMI driver virtio_ring: don't update event idx on get_buf fbdev: mmp: Fix deferred clk handling in mmphw_probe() selftests/powerpc/pmu: Fix sample field check in the mmcra_thresh_marked_sample_test macintosh/windfarm_smu_sat: Add missing of_node_put() powerpc/perf: Properly detect mpc7450 family powerpc/mpc512x: fix resource printk format warning powerpc/wii: fix resource printk format warnings powerpc/sysdev/tsi108: fix resource printk format warnings macintosh: via-pmu-led: requires ATA to be set powerpc/rtas: use memmove for potentially overlapping buffer copy sched/fair: Fix inaccurate tally of ttwu_move_affine perf/core: Fix hardlockup failure caused by perf throttle Revert "objtool: Support addition to set CFA base" riscv: Fix ptdump when KASAN is enabled sched/rt: Fix bad task migration for rt tasks tracing/user_events: Ensure write index cannot be negative clk: at91: clk-sam9x60-pll: fix return value check IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init RDMA/siw: Fix potential page_array out of range access clk: mediatek: mt2712: Add error handling to clk_mt2712_apmixed_probe() clk: mediatek: Consistently use GATE_MTK() macro clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag clk: mediatek: mt8135: Properly use CLK_IS_CRITICAL flag RDMA/rdmavt: Delete unnecessary NULL check clk: qcom: gcc-qcm2290: Fix up gcc_sdcc2_apps_clk_src workqueue: Fix hung time report of worker pools rtc: omap: include header for omap_rtc_power_off_program prototype RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time rtc: k3: handle errors while enabling wake irq RDMA/erdma: Use fixed hardware page size fs/ntfs3: Fix memory leak if ntfs_read_mft failed fs/ntfs3: Add check for kmemdup fs/ntfs3: Fix OOB read in indx_insert_into_buffer fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() iommu/mediatek: Set dma_mask for PGTABLE_PA_35_EN power: supply: generic-adc-battery: fix unit scaling clk: add missing of_node_put() in "assigned-clocks" property parsing RDMA/siw: Remove namespace check from siw_netdev_event() clk: qcom: gcc-sm6115: Mark RCGs shared where applicable power: supply: rk817: Fix low SOC bugs RDMA/cm: Trace icm_send_rej event before the cm state is reset RDMA/srpt: Add a check for valid 'mad_agent' pointer IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests clk: imx: fracn-gppll: fix the rate table clk: imx: fracn-gppll: disable hardware select control clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease iommu/amd: Set page size bitmap during V2 domain allocation clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling clk: qcom: dispcc-qcm2290: get rid of test clock clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup swiotlb: fix debugfs reporting of reserved memory pools RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR RDMA/mlx5: Fix flow counter query via DEVX SUNRPC: remove the maximum number of retries in call_bind_status RDMA/mlx5: Use correct device num_ports when modify DC clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails openrisc: Properly store r31 to pt_regs on unhandled exceptions timekeeping: Fix references to nonexistent ktime_get_fast_ns() SMB3: Add missing locks to protect deferred close file list SMB3: Close deferred file handles in case of handle lease break ext4: fix i_disksize exceeding i_size problem in paritally written case ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration pinctrl: renesas: r8a779f0: Fix tsn1_avtp_pps pin group pinctrl: renesas: r8a779g0: Fix Group 4/5 pin functions pinctrl: renesas: r8a779g0: Fix Group 6/7 pin functions pinctrl: renesas: r8a779g0: Fix ERROROUTC function names leds: TI_LMU_COMMON: select REGMAP instead of depending on it pinctrl: ralink: reintroduce ralink,rt2880-pinmux compatible string dmaengine: mv_xor_v2: Fix an error code. leds: tca6507: Fix error handling of using fwnode_property_read_string pwm: mtk-disp: Disable shadow registers before setting backlight values pwm: mtk-disp: Configure double buffering before reading in .get_state() soundwire: cadence: rename sdw_cdns_dai_dma_data as sdw_cdns_dai_runtime soundwire: intel: don't save hw_params for use in prepare phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select() dma: gpi: remove spurious unlock in gpi_ch_init dmaengine: dw-edma: Fix to change for continuous transfer dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing dmaengine: at_xdmac: do not enable all cyclic channels pinctrl-bcm2835.c: fix race condition when setting gpio dir thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe mfd: tqmx86: Do not access I2C_DETECT register through io_base mfd: tqmx86: Specify IO port register range more precisely mfd: tqmx86: Correct board names for TQMxE39x mfd: ocelot-spi: Fix unsupported bulk read mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE hte: tegra: fix 'struct of_device_id' build error hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini PM: hibernate: Turn snapshot_test into global variable PM: hibernate: Do not get block device exclusively in test_resume mode afs: Fix updating of i_size with dv jump from server afs: Fix getattr to report server i_size on dirs, not local size afs: Avoid endless loop if file is larger than expected parisc: Fix argument pointer in real64_call_asm() parisc: Ensure page alignment in flush functions ALSA: usb-audio: Add quirk for Pioneer DDJ-800 ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6 ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41 ALSA: hda/realtek: support HP Pavilion Aero 13-be0xxx Mute LED ALSA: hda/realtek: Fix mute and micmute LEDs for an HP laptop nilfs2: do not write dirty data after degenerating to read-only nilfs2: fix infinite loop in nilfs_mdt_get_block() mm: do not reclaim private data from pinned page drbd: correctly submit flush bio on barrier md/raid10: fix null-ptr-deref in raid10_sync_request md/raid5: Improve performance for sequential IO kasan: hw_tags: avoid invalid virt_to_page() mtd: core: provide unique name for nvmem device, take two mtd: core: fix nvmem error reporting mtd: core: fix error path for nvmem provider mtd: spi-nor: core: Update flash's current address mode when changing address mode mailbox: zynqmp: Fix IPI isr handling kcsan: Avoid READ_ONCE() in read_instrumented_memory() mailbox: zynqmp: Fix typo in IPI documentation wifi: rtl8xxxu: RTL8192EU always needs full init wifi: rtw89: fix potential race condition between napi_init and napi_enable clk: microchip: fix potential UAF in auxdev release callback clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent scripts/gdb: fix lx-timerlist for Python3 btrfs: scrub: reject unsupported scrub flags s390/dasd: fix hanging blockdevice after request requeue ia64: fix an addr to taddr in huge_pte_offset() mm/mempolicy: correctly update prev when policy is equal on mbind vhost_vdpa: fix unmap process in no-batch mode dm verity: fix error handling for check_at_most_once on FEC dm clone: call kmem_cache_destroy() in dm_clone_init() error path dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path dm flakey: fix a crash with invalid table line dm ioctl: fix nested locking in table_clear() to remove deadlock concern dm: don't lock fs when the map is NULL in process of resume blk-iocost: avoid 64-bit division in ioc_timer_fn cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname cifs: protect session status check in smb2_reconnect() thunderbolt: Use correct type in tb_port_is_clx_enabled() prototype bonding (gcc13): synchronize bond_{a,t}lb_xmit() types wifi: ath11k: synchronize ath11k_mac_he_gi_to_nl80211_he_gi()'s return type perf auxtrace: Fix address filter entire kernel size perf intel-pt: Fix CYC timestamps after standalone CBR block/blk-iocost (gcc13): keep large values in a new enum sfc (gcc13): synchronize ef100_enqueue_skb()'s return type i40e: Remove unused i40e status codes i40e: Remove string printing for i40e_status i40e: use int for i40e_status drm/amd/display (gcc13): fix enum mismatch debugobject: Ensure pool refill (again) scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() netfilter: nf_tables: deactivate anonymous set from preparation phase Linux 6.1.28 Change-Id: I61b5133e2d051cc2aa39b8c7c1be3fc25da40210 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-09 20:20:52 +00:00
Mirsad Goran Todorovac	0659aee089	test_firmware: fix the memory leak of the allocated firmware buffer ... commit 48e156023059e57a8fc68b498439832f7600ffff upstream. The following kernel memory leak was noticed after running tools/testing/selftests/firmware/fw_run_tests.sh: [root@pc-mtodorov firmware]# cat /sys/kernel/debug/kmemleak . . . unreferenced object 0xffff955389bc3400 (size 1024): comm "test_firmware-0", pid 5451, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c334b400 (size 1024): comm "test_firmware-1", pid 5452, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c334f000 (size 1024): comm "test_firmware-2", pid 5453, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c3348400 (size 1024): comm "test_firmware-3", pid 5454, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 [root@pc-mtodorov firmware]# Note that the size 1024 corresponds to the size of the test firmware buffer. The actual number of the buffers leaked is around 70-110, depending on the test run. The cause of the leak is the following: request_partial_firmware_into_buf() and request_firmware_into_buf() provided firmware buffer isn't released on release_firmware(), we have allocated it and we are responsible for deallocating it manually. This is introduced in a number of context where previously only release_firmware() was called, which was insufficient. Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Fixes: 7feebfa487 ("test_firmware: add support for request_firmware_into_buf") Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Dan Carpenter <error27@gmail.com> Cc: Takashi Iwai <tiwai@suse.de> Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Russ Weight <russell.h.weight@intel.com> Cc: Tianfei zhang <tianfei.zhang@intel.com> Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Zhengchao Shao <shaozhengchao@huawei.com> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: linux-kernel@vger.kernel.org Cc: Kees Cook <keescook@chromium.org> Cc: Scott Branden <sbranden@broadcom.com> Cc: Luis R. Rodriguez <mcgrof@kernel.org> Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Link: https://lore.kernel.org/r/20230509084746.48259-3-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-09 10:34:27 +02:00
Mirsad Goran Todorovac	eef67dfdc0	test_firmware: fix a memory leak with reqs buffer ... commit be37bed754ed90b2655382f93f9724b3c1aae847 upstream. Dan Carpenter spotted that test_fw_config->reqs will be leaked if trigger_batched_requests_store() is called two or more times. The same appears with trigger_batched_requests_async_store(). This bug wasn't trigger by the tests, but observed by Dan's visual inspection of the code. The recommended workaround was to return -EBUSY if test_fw_config->reqs is already allocated. Fixes: 7feebfa487 ("test_firmware: add support for request_firmware_into_buf") Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Russ Weight <russell.h.weight@intel.com> Cc: Tianfei Zhang <tianfei.zhang@intel.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Suggested-by: Dan Carpenter <error27@gmail.com> Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Link: https://lore.kernel.org/r/20230509084746.48259-2-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-09 10:34:27 +02:00
Liam R. Howlett	86d9de0898	FROMGIT: maple_tree: clear up index and last setting in single entry tree ... When there is a single entry tree (range of 0-0 pointing to an entry), then ensure the limit is either 0-0 or 1-oo, depending on where the user walks. Ensure the correct node setting as well; either MAS_ROOT or MAS_NONE. Link: https://lkml.kernel.org/r/20230518145544.1722059-33-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit c0b1bdd9011ef34b654fe62f2607bff0eb1ef0a8 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: I22a41c01e525fde88774b509cd5cbc60f56f6dc5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	9288f53a31	FROMGIT: maple_tree: add mas_prev_range() and mas_find_range_rev interface ... Some users of the maple tree may want to move to the previous range regardless of the value stored there. Add this interface as well as the 'find' variant to support walking to the first value, then iterating over the previous ranges. Link: https://lkml.kernel.org/r/20230518145544.1722059-32-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit b8194567d8703df2ec488d5ace46b7435c936ba8 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: Ic0507e00818c94f43ed3d760422dfc4d52de5981 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	c4f5714056	FROMGIT: maple_tree: introduce mas_prev_slot() interface ... Sometimes the user needs to revert to the previous slot, regardless of if it is empty or not. Add an interface to go to the previous slot. Since there can't be two consecutive NULLs in the tree, the mas_prev() function can be implemented by calling mas_prev_slot() a maximum of 2 times. Change the underlying interface to use mas_prev_slot() to align the code. Link: https://lkml.kernel.org/r/20230518145544.1722059-31-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 20ea986f0b783cf38e7fbcc6887b24c28b02c189 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: Ib5a677ee01f5d9b88cd9dede943d70c14f0ffb96 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	dbc16cc86a	FROMGIT: maple_tree: relocate mas_rewalk() and mas_rewalk_if_dead() ... These functions need to move for future use. Link: https://lkml.kernel.org/r/20230518145544.1722059-30-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 0cfc564131d7a63bdddb539a36a4374485df95e4 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: I6b60f2c67ad00e83a14b959c0006d6191cf57b31 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	b83cfb2dc4	FROMGIT: maple_tree: add mas_next_range() and mas_find_range() interfaces ... Some users of the maple tree may want to move to the next range in the tree, even if it stores a NULL. This family of function provides that functionality by advancing one slot at a time and returning the result, while mas_contiguous() will iterate over the range and stop on encountering the first NULL. Link: https://lkml.kernel.org/r/20230518145544.1722059-29-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 727a78967bc89accbce230f7bc3eeba3c49ceb3f git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: Ie7b6d058f5e0cd3a011c3506d79f66d423b3a60b Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	84719794e0	FROMGIT: maple_tree: introduce mas_next_slot() interface ... Sometimes, during a tree walk, the user needs the next slot regardless of if it is empty or not. Add an interface to get the next slot. Since there are no consecutive NULLs allowed in the tree, the mas_next() function can only advance two slots at most. So use the new mas_next_slot() interface to align both implementations. Use this method for mas_find() as well. Link: https://lkml.kernel.org/r/20230518145544.1722059-28-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit d0e70747bdb8f9cfc9ff48474e83171587ad94c1 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: I9efc69267859c26aae1b776d103dff584f1961ea Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	c5c507cfec	FROMGIT: maple_tree: try harder to keep active node with mas_prev() ... Keep a reference to the node when possible with mas_prev(). This will avoid re-walking the tree. In keeping a reference to the node, keep the last/index accurate to the range being referenced. This means the limit may be within the range, but the range may extend outside of the limit. Also fix the single entry tree to respect the range (of 0), or set the node to MAS_NONE in the case of shifting beyond 0. Link: https://lkml.kernel.org/r/20230518145544.1722059-25-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 20e9433710317ab0278c1d76821e213fb2d11e19 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: If0b40925884dac6e334474249098d03175ba6dd6 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	cb6d9fa6ad	FROMGIT: maple_tree: try harder to keep active node after mas_next() ... Clean up the mas_next() call to try and keep a node reference when possible. This will avoid re-walking the tree in most cases. Also clean up the single entry tree handling to ensure index/last are consistent with what one would expect. (returning NULL with limit of 1-oo). Link: https://lkml.kernel.org/r/20230518145544.1722059-24-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit f7741cbb138e4cd8586e45806313561cec44f9b6 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: I61c7e9e1575b5f5400f9fc2eec08ae4a1eaefa5e Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	133fbad5bd	FROMLIST: BACKPORT: maple_tree: Refine mas_preallocate() node calculations ... Calculate the number of nodes based on the pending write action instead of assuming the worst case. This addresses a performance regression introduced in platforms that have longer allocation timing. Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Link: https://lore.kernel.org/lkml/20230601021605.2823123-14-Liam.Howlett@oracle.com/ [surenb: adjust node_size calculation, allow to store a slot when possible] Bug: 274059236 Change-Id: I1db402fb463ee1e391081d2d81c34619f15713ac Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	ce9ebd83aa	ANDROID: maple_tree: Move mas_wr_modify node size calculation to mas_wr_node_size() ... Create a new function to get the size of the mas_wr_node_size() since it will be used elsewhere soon. Drop the incrementing of the node size if this is the left-most node. Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Link: d781921bc8 [surenb: due to the differences with upstream kernel where the node size can be obtained using mas_wr_new_end() function, this patch is not applicable upstream. The patch was obtained from the author's tree] Bug: 274059236 Change-Id: I9f0b5238294d0842b4c2717437ed7288b17c7617 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	b6734cb2ce	FROMLIST: BACKPORT: maple_tree: Move mas_wr_end_piv() below mas_wr_extend_null() ... Relocate it and call mas_wr_extend_null() from within mas_wr_end_piv(). Extending the NULL may affect the end pivot value so call mas_wr_endtend_null() from within mas_wr_end_piv() to keep it all together. Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Link: https://lore.kernel.org/lkml/20230601021605.2823123-12-Liam.Howlett@oracle.com/ [surenb: moved additional wr_mas->end_piv assignment missing in later kernel versions] Bug: 274059236 Change-Id: I55c5843273e7a679aef918e66d4b4ed034d493da Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Liam R. Howlett	c3118993c9	FROMGIT: maple_tree: avoid unnecessary ascending ... The maple tree node limits are implied by the parent. When walking up the tree, the limit may not be known until a slot that does not have implied limits are encountered. However, if the node is the left-most or right-most node, the walking up to find that limit can be skipped. This commit also fixes the debug/testing code that was not setting the limit on walking down the tree as that optimization is not compatible with this change. Link: https://lkml.kernel.org/r/20230518145544.1722059-4-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reviewed-by: Peng Zhang <zhangpeng.00@bytedance.com> Cc: David Binderman <dcb314@hotmail.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Vernon Yang <vernon2gm@gmail.com> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 0f4e7f5fc2122534ae0573b37224ddfa367fa7ac git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm mm-unstable) Bug: 274059236 Change-Id: I4a5e852906692b27ea598fdf38eba8e1a69355d9 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-06 20:05:25 +00:00
Tetsuo Handa	d7fff52c99	debugobjects: Don't wake up kswapd from fill_pool() ... commit eb799279fb1f9c63c520fe8c1c41cb9154252db6 upstream. syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation. Fixes: 3ac7fe5a4a ("infrastructure to debug (dynamic) objects") Reported-by: syzbot <syzbot+fe0c72f0ccbb93786380@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/6577e1fa-b6ee-f2be-2414-a2b51b1c5e30@I-love.SAKURA.ne.jp Closes: https://syzkaller.appspot.com/bug?extid=fe0c72f0ccbb93786380 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-30 14:03:20 +01:00
Liujie Xie	573ba7b6e6	ANDROID: vendor_hooks: Add hooks for memory when debug ... Add vendors hooks for recording memory used Vendor modules allocate and manages the memory itself. These memories might not be included in kernel memory statistics. Also, detailed references and vendor-specific information are managed only inside modules. When various problems such as memory leaks occurs, these information should be showed in real-time. Bug: 182443489 Bug: 234407991 Bug: 277799025 Signed-off-by: Liujie Xie <xieliujie@oppo.com> Change-Id: I62d8bb2b6650d8b187b433f97eb833ef0b784df1 Signed-off-by: Hyesoo Yu <hyesoo.yu@samsung.com>	2023-05-25 21:06:40 +00:00
Peng Zhang	254ee53028	maple_tree: make maple state reusable after mas_empty_area() ... commit 0257d9908d38c0b1669af4bb1bc4dbca1f273fe6 upstream. Make mas->min and mas->max point to a node range instead of a leaf entry range. This allows mas to still be usable after mas_empty_area() returns. Users would get unexpected results from other operations on the maple state after calling the affected function. For example, x86 MAP_32BIT mmap() acts as if there is no suitable gap when there should be one. Link: https://lkml.kernel.org/r/20230505145829.74574-1-zhangpeng.00@bytedance.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang <zhangpeng.00@bytedance.com> Reported-by: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com> Reported-by: Tad <support@spotco.us> Reported-by: Michael Keyes <mgkeyes@vigovproductions.net> Link: https://lore.kernel.org/linux-mm/32f156ba80010fd97dbaf0a0cdfc84366608624d.camel@intel.com/ Link: https://lore.kernel.org/linux-mm/e6108286ac025c268964a7ead3aab9899f9bc6e9.camel@spotco.us/ Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Tested-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-24 17:32:51 +01:00
Eli Cohen	c9115f49cf	lib: cpu_rmap: Avoid use after free on rmap->obj array entries ... [ Upstream commit 4e0473f1060aa49621d40a113afde24818101d37 ] When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free. Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap(). The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix. Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Eli Cohen <elic@nvidia.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-24 17:32:37 +01:00
Roy Novich	9e916db758	linux/dim: Do nothing if no time delta between samples ... [ Upstream commit 162bd18eb55adf464a0fa2b4144b8d61c75ff7c2 ] Add return value for dim_calc_stats. This is an indication for the caller if curr_stats was assigned by the function. Avoid using curr_stats uninitialized over {rdma/net}_dim, when no time delta between samples. Coverity reported this potential use of an uninitialized variable. Fixes: 4c4dbb4a73 ("net/mlx5e: Move dynamic interrupt coalescing code to include/linux") Fixes: cb3c7fd4f8 ("net/mlx5e: Support adaptive RX coalescing") Signed-off-by: Roy Novich <royno@nvidia.com> Reviewed-by: Aya Levin <ayal@nvidia.com> Reviewed-by: Saeed Mahameed <saeedm@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Link: https://lore.kernel.org/r/20230507135743.138993-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-24 17:32:31 +01:00
Kees Cook	467d3baa5d	BACKPORT: overflow: Introduce overflows_type() and castable_to_type() ... Implement a robust overflows_type() macro to test if a variable or constant value would overflow another variable or type. This can be used as a constant expression for static_assert() (which requires a constant expression[1][2]) when used on constant values. This must be constructed manually, since __builtin_add_overflow() does not produce a constant expression[3]. Additionally adds castable_to_type(), similar to __same_type(), but for checking if a constant value would overflow if cast to a given type. Add unit tests for overflows_type(), __same_type(), and castable_to_type() to the existing KUnit "overflow" test: [16:03:33] ================== overflow (21 subtests) ================== ... [16:03:33] [PASSED] overflows_type_test [16:03:33] [PASSED] same_type_test [16:03:33] [PASSED] castable_to_type_test [16:03:33] ==================== [PASSED] overflow ===================== [16:03:33] ============================================================ [16:03:33] Testing complete. Ran 21 tests: passed: 21 [16:03:33] Elapsed time: 24.022s total, 0.002s configuring, 22.598s building, 0.767s running [1] https://en.cppreference.com/w/c/language/_Static_assert [2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions [3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html 6.56 Built-in Functions to Perform Arithmetic with Overflow Checking Built-in Function: bool __builtin_add_overflow (type1 a, type2 b, Cc: Luc Van Oostenryck <luc.vanoostenryck@gmail.com> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: Tom Rix <trix@redhat.com> Cc: Daniel Latypov <dlatypov@google.com> Cc: Vitor Massaru Iha <vitor@massaru.org> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Cc: linux-hardening@vger.kernel.org Cc: llvm@lists.linux.dev Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20221024201125.1416422-1-gwan-gyeong.mun@intel.com Bug: 279506910 (cherry picked from commit 4b21d25bf519c9487935a664886956bb18f04f6d) Change-Id: I20aff9de6b82a2f5203367d30555f904681a5b7b Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>	2023-05-16 20:35:28 +00:00
Greg Kroah-Hartman	c4cafbd0d4	Merge a3a93b4683 ("memstick: fix memory leak if card device is never registered") into android14-6.1 ... Steps on the way to 6.1.26 Change-Id: I068fdd73b1a29b954bef6931c144aa707d446482 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-05-16 12:06:36 +00:00
Thomas Gleixner	6dc7e36334	debugobject: Ensure pool refill (again) ... commit 0af462f19e635ad522f28981238334620881badc upstream. The recent fix to ensure atomicity of lookup and allocation inadvertently broke the pool refill mechanism. Prior to that change debug_objects_activate() and debug_objecs_assert_init() invoked debug_objecs_init() to set up the tracking object for statically initialized objects. That's not longer the case and debug_objecs_init() is now the only place which does pool refills. Depending on the number of statically initialized objects this can be enough to actually deplete the pool, which was observed by Ido via a debugobjects OOM warning. Restore the old behaviour by adding explicit refill opportunities to debug_objects_activate() and debug_objecs_assert_init(). Fixes: 63a759694eed ("debugobject: Prevent init race with static objects") Reported-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: Ido Schimmel <idosch@nvidia.com> Link: https://lore.kernel.org/r/871qk05a9d.ffs@tglx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-11 23:03:42 +09:00
Thomas Gleixner	fc2b20c092	debugobject: Prevent init race with static objects ... [ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ] Statically initialized objects are usually not initialized via the init() function of the subsystem. They are special cased and the subsystem provides a function to validate whether an object which is not yet tracked by debugobjects is statically initialized. This means the object is started to be tracked on first use, e.g. activation. This works perfectly fine, unless there are two concurrent operations on that object. Schspa decoded the problem: T0 T1 debug_object_assert_init(addr) lock_hash_bucket() obj = lookup_object(addr); if (!obj) { unlock_hash_bucket(); - > preemption lock_subsytem_object(addr); activate_object(addr) lock_hash_bucket(); obj = lookup_object(addr); if (!obj) { unlock_hash_bucket(); if (is_static_object(addr)) init_and_track(addr); lock_hash_bucket(); obj = lookup_object(addr); obj->state = ACTIVATED; unlock_hash_bucket(); subsys function modifies content of addr, so static object detection does not longer work. unlock_subsytem_object(addr); if (is_static_object(addr)) <- Fails debugobject emits a warning and invokes the fixup function which reinitializes the already active object in the worst case. This race exists forever, but was never observed until mod_timer() got a debug_object_assert_init() added which is outside of the timer base lock held section right at the beginning of the function to cover the lockless early exit points too. Rework the code so that the lookup, the static object check and the tracking object association happens atomically under the hash bucket lock. This prevents the issue completely as all callers are serialized on the hash bucket lock and therefore cannot observe inconsistent state. Fixes: 3ac7fe5a4a ("infrastructure to debug (dynamic) objects") Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com Debugged-by: Schspa Shi <schspa@gmail.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462 Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:16 +09:00
Rae Moar	05f437eba0	kunit: fix bug in the order of lines in debugfs logs ... [ Upstream commit f9a301c3317daa921375da0aec82462ddf019928 ] Fix bug in debugfs logs that causes an incorrect order of lines in the debugfs log. Currently, the test counts lines that show the number of tests passed, failed, and skipped, as well as any suite diagnostic lines, appear prior to the individual results, which is a bug. Ensure the order of printing for the debugfs log is correct. Additionally, add a KTAP header to so the debugfs logs can be valid KTAP. This is an example of a log prior to these fixes: KTAP version 1 # Subtest: kunit_status 1..2 # kunit_status: pass:2 fail:0 skip:0 total:2 # Totals: pass:2 fail:0 skip:0 total:2 ok 1 kunit_status_set_failure_test ok 2 kunit_status_mark_skipped_test ok 1 kunit_status Note the two lines with stats are out of order. This is the same debugfs log after the fixes (in combination with the third patch to remove the extra line): KTAP version 1 1..1 KTAP version 1 # Subtest: kunit_status 1..2 ok 1 kunit_status_set_failure_test ok 2 kunit_status_mark_skipped_test # kunit_status: pass:2 fail:0 skip:0 total:2 # Totals: pass:2 fail:0 skip:0 total:2 ok 1 kunit_status Signed-off-by: Rae Moar <rmoar@google.com> Reviewed-by: David Gow <davidgow@google.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:05 +09:00
Rae Moar	9ad3b38677	kunit: improve KTAP compliance of KUnit test output ... [ Upstream commit 6c738b52316c58ae8a87abf0907f87a7b5e7a109 ] Change KUnit test output to better comply with KTAP v1 specifications found here: https://kernel.org/doc/html/latest/dev-tools/ktap.html. 1) Use "KTAP version 1" instead of "TAP version 14" as test output header 2) Remove '-' between test number and test name on test result lines 2) Add KTAP version lines to each subtest header as well Note that the new KUnit output still includes the “# Subtest” line now located after the KTAP version line. This does not completely match the KTAP v1 spec but since it is classified as a diagnostic line, it is not expected to be disruptive or break any existing parsers. This “# Subtest” line comes from the TAP 14 spec (https://testanything.org/tap-version-14-specification.html) and it is used to define the test name before the results. Original output: TAP version 14 1..1 # Subtest: kunit-test-suite 1..3 ok 1 - kunit_test_1 ok 2 - kunit_test_2 ok 3 - kunit_test_3 # kunit-test-suite: pass:3 fail:0 skip:0 total:3 # Totals: pass:3 fail:0 skip:0 total:3 ok 1 - kunit-test-suite New output: KTAP version 1 1..1 KTAP version 1 # Subtest: kunit-test-suite 1..3 ok 1 kunit_test_1 ok 2 kunit_test_2 ok 3 kunit_test_3 # kunit-test-suite: pass:3 fail:0 skip:0 total:3 # Totals: pass:3 fail:0 skip:0 total:3 ok 1 kunit-test-suite Signed-off-by: Rae Moar <rmoar@google.com> Reviewed-by: Daniel Latypov <dlatypov@google.com> Reviewed-by: David Gow <davidgow@google.com> Tested-by: Anders Roxell <anders.roxell@linaro.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Stable-dep-of: f9a301c3317d ("kunit: fix bug in the order of lines in debugfs logs") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:05 +09:00
Greg Kroah-Hartman	55e4f0c551	This is the 6.1.25 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRBFW0ACgkQONu9yGCS aT7Jew//Ytw9+JQ71LT1TuJnQ1GayJOL1BW5hgxoYgnBFasWDwsGA9rzHs6KHqHb 0Vjk7MX7VZB+6zWakOxY5CFVM33J4fS7wY8WE2bj8X3QQhD/J0HQDMdELvSBi3qF 7xI6sghEQEwOuwAj2+CBqm/q7rA5FTnO1QgJuk/AKJ6PHGRiQeZ7q1zGpFvSaj7S cyKvY99RsjnUN+PYk4LE2+u/6DVCqiWYVDQrdjalb9zsrXg4+nmPH6ZJzZX8+bbM eM0xAR675V8TXqDi+8bj7tWmiS52XyjYF3Q/bu9BmU67DqslH9FFyVQxhgTHUZpN qWXkojEU2djIc3qt7T/bpZS/vD8Kg3Px1CgyIRN8Y5SlZfhZyqVdTZ4AQCtJuLQJ wDIdQCLlGzzDNFvbD+LdfJSjZt7Ig1sM/HwtPZhUA9yF0FN1XV3dcESzCOeI0/S7 ohRh8cs1sidnxrbvVwiVNENSqbJD7G9/9vVjIfyfcnt57q+fs6xCBhpOyNoVOp74 I5i6ALMcVZoAB50vDjnoGZsSRe9W2AmOV6UMIkVCvRCWYFqBpgVftMTAACNyljni UlXmO7aDQj+nbHD/auclFtU02oHQbk62FSrwoWMFS090zWztQqUhgRY7Qnl13yCM poEvrKlskXhvunsNtdVmI5O3N2GANWKgGwkyFIiXvgxKkw1qpUo= =zeN9 -----END PGP SIGNATURE----- Merge 6.1.25 into android14-6.1 Changes in 6.1.25 Revert "pinctrl: amd: Disable and mask interrupts on resume" drm/amd/display: Pass the right info to drm_dp_remove_payload ALSA: emu10k1: fix capture interrupt handler unlinking ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard ALSA: i2c/cs8427: fix iec958 mixer control deactivation ALSA: hda: patch_realtek: add quirk for Asus N7601ZM ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() ALSA: emu10k1: don't create old pass-through playback device on Audigy ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards ALSA: hda/hdmi: disable KAE for Intel DG2 Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Bluetooth: Fix race condition in hidp_session_thread bluetooth: btbcm: Fix logic error in forming the board name. Bluetooth: Free potentially unfreed SCO connection Bluetooth: hci_conn: Fix possible UAF btrfs: restore the thread_pool= behavior in remount for the end I/O workqueues btrfs: fix fast csum implementation detection fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace mtdblock: tolerate corrected bit-flips mtd: rawnand: meson: fix bitmask for length in command word mtd: rawnand: stm32_fmc2: remove unsupported EDO mode mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min KVM: arm64: PMU: Restore the guest's EL0 event counting after migration fbcon: Fix error paths in set_con2fb_map fbcon: set_con2fb_map needs to set con2fb_map! drm/i915/dsi: fix DSS CTL register offsets for TGL+ clk: sprd: set max_register according to mapping range RDMA/irdma: Do not generate SW completions for NOPs RDMA/irdma: Fix memory leak of PBLE objects RDMA/irdma: Increase iWARP CM default rexmit count RDMA/irdma: Add ipv4 check to irdma_find_listener() IB/mlx5: Add support for 400G_8X lane speed RDMA/erdma: Update default EQ depth to 4096 and max_send_wr to 8192 RDMA/erdma: Inline mtt entries into WQE if supported RDMA/erdma: Defer probing if netdevice can not be found clk: rs9: Fix suspend/resume RDMA/cma: Allow UD qp_type to join multicast only bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp LoongArch, bpf: Fix jit to skip speculation barrier opcode dmaengine: apple-admac: Handle 'global' interrupt flags dmaengine: apple-admac: Set src_addr_widths capability dmaengine: apple-admac: Fix 'current_tx' not getting freed 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition bpf, arm64: Fixed a BTI error on returning to patched function KVM: arm64: Initialise hypervisor copies of host symbols unconditionally KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs niu: Fix missing unwind goto in niu_alloc_channels() tcp: restrict net.ipv4.tcp_app_win bonding: fix ns validation on backup slaves iavf: refactor VLAN filter states iavf: remove active_cvlans and active_svlans bitmaps net: openvswitch: fix race on port output Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure Bluetooth: Fix printing errors if LE Connection times out Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt Bluetooth: Set ISO Data Path on broadcast sink drm/armada: Fix a potential double free in an error handling path qlcnic: check pci_reset_function result net: wwan: iosm: Fix error handling path in ipc_pcie_probe() cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() sctp: fix a potential overflow in sctp_ifwdtsn_skip RDMA/core: Fix GID entry ref leak when create_ah fails selftests: openvswitch: adjust datapath NL message declaration udp6: fix potential access to stale information net: macb: fix a memory corruption in extended buffer descriptor mode skbuff: Fix a race between coalescing and releasing SKBs libbpf: Fix single-line struct definition output in btf_dump ARM: 9290/1: uaccess: Fix KASAN false-positives ARM: dts: qcom: apq8026-lg-lenok: add missing reserved memory power: supply: rk817: Fix unsigned comparison with less than zero power: supply: cros_usbpd: reclassify "default case!" as debug power: supply: axp288_fuel_gauge: Added check for negative values selftests/bpf: Fix progs/find_vma_fail1.c build error. wifi: mwifiex: mark OF related data as maybe unused i2c: imx-lpi2c: clean rx/tx buffers upon new message i2c: hisi: Avoid redundant interrupts efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L block: ublk_drv: mark device as LIVE before adding disk ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F hwmon: (peci/cputemp) Fix miscalculated DTS for SKX hwmon: (xgene) Fix ioremap and memremap leak verify_pefile: relax wrapper length check asymmetric_keys: log on fatal failures in PE/pkcs7 nvme: send Identify with CNS 06h only to I/O controllers wifi: iwlwifi: mvm: fix mvmtxq->stopped handling wifi: iwlwifi: mvm: protect TXQ list manipulation drm/amdgpu: add mes resume when do gfx post soft reset drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs drm/amdgpu/gfx: set cg flags to enter/exit safe mode ACPI: resource: Add Medion S17413 to IRQ override quirk x86/hyperv: Move VMCB enlightenment definitions to hyperv-tlfs.h KVM: selftests: Move "struct hv_enlightenments" to x86_64/svm.h KVM: SVM: Add a proper field for Hyper-V VMCB enlightenments x86/hyperv: KVM: Rename "hv_enlightenments" to "hv_vmcb_enlightenments" KVM: SVM: Flush Hyper-V TLB when required tracing: Add trace_array_puts() to write into instance tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance maple_tree: fix write memory barrier of nodes once dead for RCU mode ksmbd: avoid out of bounds access in decode_preauth_ctxt() riscv: add icache flush for nommu sigreturn trampoline HID: intel-ish-hid: Fix kernel panic during warm reset net: sfp: initialize sfp->i2c_block_size at sfp allocation net: phy: nxp-c45-tja11xx: add remove callback net: phy: nxp-c45-tja11xx: fix unsigned long multiplication overflow scsi: ses: Handle enclosure with just a primary component gracefully x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot cgroup: fix display of forceidle time at root cgroup/cpuset: Fix partition root's cpuset.cpus update bug cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings drm/amd/pm: correct SMU13.0.7 max shader clock reporting mptcp: use mptcp_schedule_work instead of open-coding it mptcp: stricter state check in mptcp_worker ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size ubi: Fix deadlock caused by recursively holding work_sem i2c: mchp-pci1xxxx: Update Timing registers powerpc/papr_scm: Update the NUMA distance table for the target node sched/fair: Fix imbalance overflow x86/rtc: Remove __init for runtime functions i2c: ocores: generate stop condition after timeout in polling mode cifs: fix negotiate context parsing nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD cgroup/cpuset: Skip spread flags update on v2 cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods Linux 6.1.25 Change-Id: Ib4d2c49ea9bacb8d8dbdb7b3a4eecce937016427 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-26 13:13:19 +00:00
Peng Zhang	a1176791ab	maple_tree: fix a potential memory leak, OOB access, or other unpredictable bug ... commit 1f5f12ece722aacea1769fb644f27790ede339dc upstream. In mas_alloc_nodes(), "node->node_count = 0" means to initialize the node_count field of the new node, but the node may not be a new node. It may be a node that existed before and node_count has a value, setting it to 0 will cause a memory leak. At this time, mas->alloc->total will be greater than the actual number of nodes in the linked list, which may cause many other errors. For example, out-of-bounds access in mas_pop_node(), and mas_pop_node() may return addresses that should not be used. Fix it by initializing node_count only for new nodes. Also, by the way, an if-else statement was removed to simplify the code. Link: https://lkml.kernel.org/r/20230411041005.26205-1-zhangpeng.00@bytedance.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang <zhangpeng.00@bytedance.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-26 14:28:39 +02:00
Liam R. Howlett	66f13a1acf	maple_tree: fix mas_empty_area() search ... commit 06e8fd999334bcd76b4d72d7b9206d4aea89764e upstream. The internal function of mas_awalk() was incorrectly skipping the last entry in a node, which could potentially be NULL. This is only a problem for the left-most node in the tree - otherwise that NULL would not exist. Fix mas_awalk() by using the metadata to obtain the end of the node for the loop and the logical pivot as apposed to the raw pivot value. Link: https://lkml.kernel.org/r/20230414145728.4067069-2-Liam.Howlett@oracle.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-26 14:28:39 +02:00
Liam R. Howlett	c51b9ef3f5	maple_tree: make maple state reusable after mas_empty_area_rev() ... commit fad8e4291da5e3243e086622df63cb952db444d8 upstream. Stop using maple state min/max for the range by passing through pointers for those values. This will allow the maple state to be reused without resetting. Also add some logic to fail out early on searching with invalid arguments. Link: https://lkml.kernel.org/r/20230414145728.4067069-1-Liam.Howlett@oracle.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-26 14:28:38 +02:00
Greg Kroah-Hartman	0fff48d6fe	Merge 6.1.24 into android14-6.1 ... Changes in 6.1.24 dm cache: Add some documentation to dm-cache-background-tracker.h dm integrity: Remove bi_sector that's only used by commented debug code dm: change "unsigned" to "unsigned int" dm: fix improper splitting for abnormal bios KVM: arm64: PMU: Align chained counter implementation with architecture pseudocode KVM: arm64: PMU: Distinguish between 64bit counter and 64bit overflow KVM: arm64: PMU: Sanitise PMCR_EL0.LP on first vcpu run KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU gpio: GPIO_REGMAP: select REGMAP instead of depending on it Drivers: vmbus: Check for channel allocation before looking up relids ASoC: SOF: ipc4: Ensure DSP is in D0I0 during sof_ipc4_set_get_data() pwm: Make .get_state() callback return an error code pwm: hibvt: Explicitly set .polarity in .get_state() pwm: cros-ec: Explicitly set .polarity in .get_state() pwm: iqs620a: Explicitly set .polarity in .get_state() pwm: sprd: Explicitly set .polarity in .get_state() pwm: meson: Explicitly set .polarity in .get_state() ASoC: codecs: lpass: fix the order or clks turn off during suspend KVM: s390: pv: fix external interruption loop not always detected wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap() wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta net: qrtr: Fix a refcount bug in qrtr_recvmsg() net: phylink: add phylink_expects_phy() method net: stmmac: check if MAC needs to attach to a PHY net: stmmac: remove redundant fixup to support fixed-link mode l2tp: generate correct module alias strings wifi: brcmfmac: Fix SDIO suspend/resume regression NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL nfsd: call op_release, even when op_func returns an error icmp: guard against too small mtu ALSA: hda/hdmi: Preserve the previous PCM device upon re-enablement net: don't let netpoll invoke NAPI if in xmit context net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit sctp: check send stream number after wait_for_sndbuf net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT ipv6: Fix an uninit variable access bug in __ip6_make_skb() platform/x86: think-lmi: Fix memory leak when showing current settings platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings platform/x86: think-lmi: Clean up display of current_value on Thinkstation gpio: davinci: Do not clear the bank intr enable bit in save_context gpio: davinci: Add irq chip flag to skip set wake net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe net: stmmac: fix up RX flow hash indirection table when setting channels sunrpc: only free unix grouplist after RCU settles NFSD: callback request does not use correct credential for AUTH_SYS ice: fix wrong fallback logic for FDIR ice: Reset FDIR counter in FDIR init stage raw: use net_hash_mix() in hash function raw: Fix NULL deref in raw_get_next(). ping: Fix potentail NULL deref for /proc/net/icmp. ethtool: reset #lanes when lanes is omitted netlink: annotate lockless accesses to nlk->max_recvmsg_len gve: Secure enough bytes in the first TX desc for all TCP pkts arm64: compat: Work around uninitialized variable warning net: stmmac: check fwnode for phy device before scanning for phy cxl/pci: Fix CDAT retrieval on big endian cxl/pci: Handle truncated CDAT header cxl/pci: Handle truncated CDAT entries cxl/pci: Handle excessive CDAT length PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS=y PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y usb: xhci: tegra: fix sleep in atomic call xhci: Free the command allocated for setting LPM if we return early xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu usb: cdnsp: Fixes error: uninitialized symbol 'len' usb: dwc3: pci: add support for the Intel Meteor Lake-S USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs usb: typec: altmodes/displayport: Fix configure initial pin assignment USB: serial: option: add Telit FE990 compositions USB: serial: option: add Quectel RM500U-CN modem drivers: iio: adc: ltc2497: fix LSB shift iio: adis16480: select CONFIG_CRC32 iio: adc: qcom-spmi-adc5: Fix the channel name iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip iio: dac: cio-dac: Fix max DAC write value check for 12-bit iio: buffer: correctly return bytes written in output buffers iio: buffer: make sure O_NONBLOCK is respected iio: light: cm32181: Unregister second I2C client if present tty: serial: sh-sci: Fix transmit end interrupt handler tty: serial: sh-sci: Fix Rx on RZ/G2L SCI tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() nilfs2: fix sysfs interface lifetime dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs serial: 8250: Prevent starting up DMA Rx on THRI interrupt ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ALSA: hda/realtek: Add quirk for Clevo X370SNW ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook x86/acpi/boot: Correct acpi_is_processor_usable() check x86/ACPI/boot: Use FADT version to check support for online capable KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode mm: kfence: fix PG_slab and memcg_data clearing mm: kfence: fix handling discontiguous page coresight: etm4x: Do not access TRCIDR1 for identification coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug counter: 104-quad-8: Fix race condition between FLAG and CNTR reads counter: 104-quad-8: Fix Synapse action reported for Index signals blk-mq: directly poll requests iio: adc: ad7791: fix IRQ flags io_uring: fix return value when removing provided buffers io_uring: fix memory leak when removing provided buffers scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() nvme: fix discard support without oncs cifs: sanitize paths in cifs_update_super_prepath. block: ublk: make sure that block size is set correctly block: don't set GD_NEED_PART_SCAN if scan partition failed perf/core: Fix the same task check in perf_event_set_output ftrace: Mark get_lock_parent_ip() __always_inline ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() fs: drop peer group ids under namespace lock can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access can: isotp: fix race between isotp_sendsmg() and isotp_release() can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type() ACPI: video: Make acpi_backlight=video work independent from GPU driver ACPI: video: Add acpi_backlight=video quirk for Apple iMac14,1 and iMac14,2 ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530 net: stmmac: Add queue reset into stmmac_xdp_open() function tracing/synthetic: Fix races on freeing last_cmd tracing/timerlat: Notify new max thread latency tracing/osnoise: Fix notify new tracing_max_latency tracing: Free error logs of tracing instances ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() tracing/synthetic: Make lastcmd_mutex static zsmalloc: document freeable stats mm: vmalloc: avoid warn_alloc noise caused by fatal signal wifi: mt76: ignore key disable commands ublk: read any SQE values upfront drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path drm/nouveau/disp: Support more modes by checking with lower bpc drm/i915: Fix context runtime accounting drm/i915: fix race condition UAF in i915_perf_add_config_ioctl ring-buffer: Fix race while reader and writer are on the same page mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() mm/hugetlb: fix uffd wr-protection for CoW optimization path maple_tree: fix get wrong data_end in mtree_lookup_walk() maple_tree: fix a potential concurrency bug in RCU mode blk-throttle: Fix that bps of child could exceed bps limited in parent drm/amd/display: Clear MST topology if it fails to resume drm/amdgpu: for S0ix, skip SDMA 5.x+ suspend/resume drm/amdgpu: skip psp suspend for IMU enabled ASICs mode2 reset drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload() drm/i915/dp_mst: Fix payload removal during output disabling drm/bridge: lt9611: Fix PLL being unable to lock drm/i915: Use _MMIO_PIPE() for SKL_BOTTOM_COLOR drm/i915: Split icl_color_commit_noarm() from skl_color_commit_noarm() mm: take a page reference when removing device exclusive entries maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk() maple_tree: fix potential rcu issue maple_tree: reduce user error potential maple_tree: fix handle of invalidated state in mas_wr_store_setup() maple_tree: fix mas_prev() and mas_find() state handling maple_tree: be more cautious about dead nodes maple_tree: refine ma_state init from mas_start() maple_tree: detect dead nodes in mas_start() maple_tree: fix freeing of nodes in rcu mode maple_tree: remove extra smp_wmb() from mas_dead_leaves() maple_tree: add smp_rmb() to dead node detection maple_tree: add RCU lock checking to rcu callback functions mm: enable maple tree RCU mode by default. bpftool: Print newline before '}' for struct with padding only fields Linux 6.1.24 Change-Id: I475408e1166927565c7788e7095bdf2cb236c4b2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-22 08:52:25 +00:00
Liam R. Howlett	2128f7c00f	maple_tree: fix write memory barrier of nodes once dead for RCU mode ... [ Upstream commit c13af03de46ba27674dd9fb31a17c0d480081139 ] During the development of the maple tree, the strategy of freeing multiple nodes changed and, in the process, the pivots were reused to store pointers to dead nodes. To ensure the readers see accurate pivots, the writers need to mark the nodes as dead and call smp_wmb() to ensure any readers can identify the node as dead before using the pivot values. There were two places where the old method of marking the node as dead without smp_wmb() were being used, which resulted in RCU readers seeing the wrong pivot value before seeing the node was dead. Fix this race condition by using mte_set_node_dead() which has the smp_wmb() call to ensure the race is closed. Add a WARN_ON() to the ma_free_rcu() call to ensure all nodes being freed are marked as dead to ensure there are no other call paths besides the two updated paths. This is necessary for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-6-surenb@google.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Suren Baghdasaryan <surenb@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-20 12:35:12 +02:00
Liam R. Howlett	9b6627bc36	maple_tree: add RCU lock checking to rcu callback functions ... commit 790e1fa86b340c2bd4a327e01c161f7a1ad885f6 upstream. Dereferencing RCU objects within the RCU callback without the RCU check has caused lockdep to complain. Fix the RCU dereferencing by using the RCU callback lock to ensure the operation is safe. Also stop creating a new lock to use for dereferencing during destruction of the tree or subtree. Instead, pass through a pointer to the tree that has the lock that is held for RCU dereferencing checking. It also does not make sense to use the maple state in the freeing scenario as the tree walk is a special case where the tree no longer has the normal encodings and parent pointers. Link: https://lkml.kernel.org/r/20230227173632.3292573-8-surenb@google.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Cc: stable@vger.kernel.org Reported-by: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:40 +02:00
Liam R. Howlett	a29025a1b6	maple_tree: add smp_rmb() to dead node detection ... commit 0a2b18d948838e16912b3b627b504ab062b7d02a upstream. Add an smp_rmb() before reading the parent pointer to ensure that anything read from the node prior to the parent pointer hasn't been reordered ahead of this check. The is necessary for RCU mode. Link: https://lkml.kernel.org/r/20230227173632.3292573-7-surenb@google.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Cc: stable@vger.kernel.org Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:40 +02:00
Liam R. Howlett	d3af5f8a50	maple_tree: remove extra smp_wmb() from mas_dead_leaves() ... commit 8372f4d83f96f35915106093cde4565836587123 upstream. The call to mte_set_dead_node() before the smp_wmb() already calls smp_wmb() so this is not needed. This is an optimization for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-5-surenb@google.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Cc: stable@vger.kernel.org Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	cc2f2507f3	maple_tree: fix freeing of nodes in rcu mode ... commit 2e5b4921f8efc9e845f4f04741797d16f36847eb upstream. The walk to destroy the nodes was not always setting the node type and would result in a destroy method potentially using the values as nodes. Avoid this by setting the correct node types. This is necessary for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-4-surenb@google.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	5f7c591264	maple_tree: detect dead nodes in mas_start() ... commit a7b92d59c885018cb7bb88539892278e4fd64b29 upstream. When initially starting a search, the root node may already be in the process of being replaced in RCU mode. Detect and restart the walk if this is the case. This is necessary for RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-3-surenb@google.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	3825e4495b	maple_tree: refine ma_state init from mas_start() ... commit 46b345848261009477552d654cb2f65000c30e4d upstream. If mas->node is an MAS_START, there are three cases, and they all assign different values to mas->node and mas->offset. So there is no need to set them to a default value before updating. Update them directly to make them easier to understand and for better readability. Link: https://lkml.kernel.org/r/20221221060058.609003-7-vernon2gm@gmail.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Vernon Yang <vernon2gm@gmail.com> Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	64cb480523	maple_tree: be more cautious about dead nodes ... commit 39d0bd86c499ecd6abae42a9b7112056c5560691 upstream. ma_pivots() and ma_data_end() may be called with a dead node. Ensure to that the node isn't dead before using the returned values. This is necessary for RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-1-surenb@google.com Link: https://lkml.kernel.org/r/20230227173632.3292573-2-surenb@google.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Cc: <Stable@vger.kernel.org> Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	0a0372d1d2	maple_tree: fix mas_prev() and mas_find() state handling ... commit 17dc622c7b0f94e49bed030726df4db12ecaa6b5 upstream. When mas_prev() does not find anything, set the state to MAS_NONE. Handle the MAS_NONE in mas_find() like a MAS_START. Link: https://lkml.kernel.org/r/20230120162650.984577-7-Liam.Howlett@oracle.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: <syzbot+502859d610c661e56545@syzkaller.appspotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	19d8f782e3	maple_tree: fix handle of invalidated state in mas_wr_store_setup() ... commit 1202700c3f8cc5f7e4646c3cf05ee6f7c8bc6ccf upstream. If an invalidated maple state is encountered during write, reset the maple state to MAS_START. This will result in a re-walk of the tree to the correct location for the write. Link: https://lore.kernel.org/all/20230107020126.1627-1-sj@kernel.org/ Link: https://lkml.kernel.org/r/20230120162650.984577-6-Liam.Howlett@oracle.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: SeongJae Park <sj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:39 +02:00
Liam R. Howlett	2c9bc4903b	maple_tree: reduce user error potential ... commit 50e81c82ad947045c7ed26ddc9acb17276b653b6 upstream. When iterating, a user may operate on the tree and cause the maple state to be altered and left in an unintuitive state. Detect this scenario and correct it by setting to the limit and invalidating the state. Link: https://lkml.kernel.org/r/20230120162650.984577-4-Liam.Howlett@oracle.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:38 +02:00
Liam R. Howlett	f41e9e6927	maple_tree: fix potential rcu issue ... commit 65be6f058b0eba98dc6c6f197ea9f62c9b6a519f upstream. Ensure the node isn't dead after reading the node end. Link: https://lkml.kernel.org/r/20230120162650.984577-3-Liam.Howlett@oracle.com Cc: <Stable@vger.kernel.org> Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:38 +02:00
Liam R. Howlett	edc5a4e880	maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk() ... commit 541e06b772c1aaffb3b6a245ccface36d7107af2 upstream. Preallocations are common in the VMA code to avoid allocating under certain locking conditions. The preallocations must also cover the worst-case scenario. Removing the GFP_ZERO flag from the kmem_cache_alloc() (and bulk variant) calls will reduce the amount of time spent zeroing memory that may not be used. Only zero out the necessary area to keep track of the allocations in the maple state. Zero the entire node prior to using it in the tree. This required internal changes to node counting on allocation, so the test code is also updated. This restores some micro-benchmark performance: up to +9% in mmtests mmap1 by my testing +10% to +20% in mmap, mmapaddr, mmapmany tests reported by Red Hat Link: https://bugzilla.redhat.com/show_bug.cgi?id=2149636 Link: https://lkml.kernel.org/r/20230105160427.2988454-1-Liam.Howlett@oracle.com Cc: stable@vger.kernel.org Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com> Reported-by: Jirka Hladky <jhladky@redhat.com> Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:38 +02:00
Peng Zhang	240bb94f35	maple_tree: fix a potential concurrency bug in RCU mode ... commit c45ea315a602d45569b08b93e9ab30f6a63a38aa upstream. There is a concurrency bug that may cause the wrong value to be loaded when a CPU is modifying the maple tree. CPU1: mtree_insert_range() mas_insert() mas_store_root() ... mas_root_expand() ... rcu_assign_pointer(mas->tree->ma_root, mte_mk_root(mas->node)); ma_set_meta(node, maple_leaf_64, 0, slot); <---IP CPU2: mtree_load() mtree_lookup_walk() ma_data_end(); When CPU1 is about to execute the instruction pointed to by IP, the ma_data_end() executed by CPU2 may return the wrong end position, which will cause the value loaded by mtree_load() to be wrong. An example of triggering the bug: Add mdelay(100) between rcu_assign_pointer() and ma_set_meta() in mas_root_expand(). static DEFINE_MTREE(tree); int work(void *p) { unsigned long val; for (int i = 0 ; i< 30; ++i) { val = (unsigned long)mtree_load(&tree, 8); mdelay(5); pr_info("%lu",val); } return 0; } mt_init_flags(&tree, MT_FLAGS_USE_RCU); mtree_insert(&tree, 0, (void*)12345, GFP_KERNEL); run_thread(work) mtree_insert(&tree, 1, (void*)56789, GFP_KERNEL); In RCU mode, mtree_load() should always return the value before or after the data structure is modified, and in this example mtree_load(&tree, 8) may return 56789 which is not expected, it should always return NULL. Fix it by put ma_set_meta() before rcu_assign_pointer(). Link: https://lkml.kernel.org/r/20230314124203.91572-4-zhangpeng.00@bytedance.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang <zhangpeng.00@bytedance.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:36 +02:00
Peng Zhang	4f5760757f	maple_tree: fix get wrong data_end in mtree_lookup_walk() ... commit ec07967d7523adb3670f9dfee0232e3bc868f3de upstream. if (likely(offset > end)) max = pivots[offset]; The above code should be changed to if (likely(offset < end)), which is correct. This affects the correctness of ma_data_end(). Now it seems that the final result will not be wrong, but it is best to change it. This patch does not change the code as above, because it simplifies the code by the way. Link: https://lkml.kernel.org/r/20230314124203.91572-1-zhangpeng.00@bytedance.com Link: https://lkml.kernel.org/r/20230314124203.91572-2-zhangpeng.00@bytedance.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang <zhangpeng.00@bytedance.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:55:36 +02:00
Greg Kroah-Hartman	a0f3313ef9	This is the 6.1.23 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQumsIACgkQONu9yGCS aT4yfBAAwaDPXomEa+DY6pkQEE7WPVtIkeO+sQIo7bWHunTDilTLRFeDUJ4THydT CnhhlGsBUt8KGeWgSR6hHeTl/c+b+AcBan5k5BBufUGrsDn/XV8QIEyKWhbLIEja qWehpogs7BJLg2dFRqTfHQEOhLht1jCmC99tfEozEG4zRudmdS3Z2DbRypfEHshc oGOC1Jzg4MLPfB+lCwKNrVMBlR2n/73P7mTUCu/Dc9+DUbm+GtqvsPuGT2LxVyY7 kkNgGzvdxQQCqtK5X6zyoU61gepsobf6c6kHjBucn8mhaYURT5ndfV9VqLWkDYE7 71iH0oY5fg2NgbMtQpbA10MokjijFp46I4QxzG/RVl2ZN2pbCFNm5aNIBCwBbF2k lN6hwJc1nbTi696o29o1osm+yju3347HCAWC8s+DAszXiquihiUeJBwuCfa1c+Gy GhdATa3nNQ/8D0gWULr/kl7DvlgpSpYrbEQGVG2gH6tdsAZt2iKYUtGLFjvDN+fw CoMpq2OZTX5afM7AxTX00f5lGmbXhD+T9a+pS9AXhPqKcGv1tt0Gso8dn7cpWpj5 LxhIE9dK5F1/tI+wPE+8t80CukqQHfoCQ24YO8mfUKmlInwjGd1Hque+ihKJo7ZW W5CXlZJJVvpVk9BxMNaYHKfSE+U6G7hYabEAzJXR3fz9vGfoTII= =rz/i -----END PGP SIGNATURE----- Merge 6.1.23 into android14-6.1 Changes in 6.1.23 thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers cifs: update ip_addr for ses only for primary chan setup cifs: prevent data race in cifs_reconnect_tcon() cifs: avoid race conditions with parallel reconnects zonefs: Reorganize code zonefs: Simplify IO error handling zonefs: Reduce struct zonefs_inode_info size zonefs: Separate zone information from inode information zonefs: Fix error message in zonefs_file_dio_append() fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY kernel: kcsan: kcsan_test: build without structleak plugin kcsan: avoid passing -g for test btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING btrfs: zoned: count fresh BG region as zone unusable net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action riscv: ftrace: Fixup panic by disabling preemption ARM: dts: aspeed: p10bmc: Update battery node name drm/msm/dpu: Refactor sc7280_pp location drm/msm/dpu: correct sm8250 and sm8350 scaler drm/msm/disp/dpu: fix sc7280_pp base offset tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API tty: serial: fsl_lpuart: fix race on RX DMA shutdown tracing: Add .percent suffix option to histogram values tracing: Add .graph suffix option to histogram value tracing: Do not let histogram values have some modifiers net: mscc: ocelot: fix stats region batching arm64: efi: Set NX compat flag in PE/COFF header cifs: fix missing unload_nls() in smb2_reconnect() xfrm: Zero padding when dumping algos and encap ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds ASoC: Intel: avs: max98357a: Explicitly define codec format ASoC: Intel: avs: da7219: Explicitly define codec format ASoC: Intel: avs: ssm4567: Remove nau8825 bits ASoC: Intel: avs: nau8825: Adjust clock control zstd: Fix definition of assert() ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 ASoC: SOF: ipc3: Check for upper size limit for the received message ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit ASoC: SOF: Intel: pci-tng: revert invalid bar size setting ASoC: SOF: IPC4: update gain ipc msg definition to align with fw md: avoid signed overflow in slot_store() x86/PVH: obtain VGA console info in Dom0 drm/amdkfd: Fix BO offset for multi-VMA page migration drm/amdkfd: fix a potential double free in pqm_create_queue drm/amdkfd: fix potential kgd_mem UAFs net: hsr: Don't log netdev_err message on unknown prp dst node ALSA: asihpi: check pao in control_message() ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() fbdev: tgafb: Fix potential divide by zero ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range sched_getaffinity: don't assume 'cpumask_size()' is fully initialized nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 drm/amdkfd: Fixed kfd_process cleanup on module exit. net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites fbdev: nvidia: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: au1200fb: Fix potential divide by zero tools/power turbostat: Fix /dev/cpu_dma_latency warnings tools/power turbostat: fix decoding of HWP_STATUS tracing: Fix wrong return in kprobe_event_gen_test.c btrfs: fix uninitialized variable warning in btrfs_update_block_group btrfs: use temporary variable for space_info in btrfs_update_block_group mtd: rawnand: meson: initialize struct with zeroes mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() riscv/kvm: Fix VM hang in case of timer delta being zero. mips: bmips: BCM6358: disable RAC flush for TP1 ALSA: usb-audio: Fix recursive locking at XRUN during syncing PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled platform/x86: think-lmi: add missing type attribute platform/x86: think-lmi: use correct possible_values delimiters platform/x86: think-lmi: only display possible_values if available platform/x86: think-lmi: Add possible_values for ThinkStation platform/surface: aggregator: Add missing fwnode_handle_put() mtd: rawnand: meson: invalidate cache on polling ECC bit SUNRPC: fix shutdown of NFS TCP client socket sfc: ef10: don't overwrite offload features at NIC reset scsi: megaraid_sas: Fix crash after a double completion scsi: mpt3sas: Don't print sense pool info twice net: dsa: realtek: fix out-of-bounds access ptp_qoriq: fix memory leak in probe() net: dsa: microchip: ksz8: fix ksz8_fdb_dump() net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024 entries net: dsa: microchip: ksz8: fix offset for the timestamp filed net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost entry from empty dynamic MAC table. net: dsa: microchip: ksz8863_smi: fix bulk access net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID r8169: fix RTL8168H and RTL8107E rx crc error regulator: Handle deferred clk net/net_failover: fix txq exceeding warning net: stmmac: don't reject VLANs when IFF_PROMISC is set drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write s390/vfio-ap: fix memory leak in vfio_ap device driver ACPI: bus: Rework system-level device notification handling loop: LOOP_CONFIGURE: send uevents for partitions net: mvpp2: classifier flow fix fragmentation flags net: mvpp2: parser fix QinQ net: mvpp2: parser fix PPPoE smsc911x: avoid PHY being resumed when interface is not up ice: Fix ice_cfg_rdma_fltr() to only update relevant fields ice: add profile conflict check for AVF FDIR ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() ALSA: ymfpci: Create card with device-managed snd_devm_card_new() ALSA: ymfpci: Fix BUG_ON in probe function net: ipa: compute DMA pool size properly i40e: fix registers dump after run ethtool adapter self test bnxt_en: Fix reporting of test result in ethtool selftest bnxt_en: Fix typo in PCI id to device description string mapping bnxt_en: Add missing 200G link speed reporting net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only net: ethernet: mtk_eth_soc: fix flow block refcounting logic net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting a flow pinctrl: ocelot: Fix alt mode for ocelot Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON iommu/vt-d: Allow zero SAGAW if second-stage not supported Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix Input: alps - fix compatibility with -funsigned-char Input: focaltech - use explicitly signed char type cifs: prevent infinite recursion in CIFSGetDFSRefer() cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL Input: i8042 - add quirk for Fujitsu Lifebook A574/H Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table btrfs: fix deadlock when aborting transaction during relocation with scrub btrfs: fix race between quota disable and quota assign ioctls btrfs: scan device in non-exclusive mode zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space block/io_uring: pass in issue_flags for uring_cmd task_work handling io_uring/poll: clear single/double poll flags on poll arming io_uring/rsrc: fix rogue rsrc node grabbing io_uring: fix poll/netmsg alloc caches vmxnet3: use gro callback when UPT is enabled zonefs: Always invalidate last cached page on append write dm: fix __send_duplicate_bios() to always allow for splitting IO can: j1939: prevent deadlock by moving j1939_sk_errqueue() xen/netback: don't do grant copy across page boundary net: phy: dp83869: fix default value for tx-/rx-internal-delay modpost: Fix processing of CRCs on 32-bit build machines pinctrl: amd: Disable and mask interrupts on resume pinctrl: at91-pio4: fix domain name assignment platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled powerpc/64s: Fix __pte_needs_flush() false positive warning NFSv4: Fix hangs when recovering open state after a server reboot ALSA: hda/conexant: Partial revert of a quirk for Lenovo ALSA: usb-audio: Fix regression on detection of Roland VS-100 ALSA: hda/realtek: Add quirks for some Clevo laptops ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z xtensa: fix KASAN report for show_stack rcu: Fix rcu_torture_read ftrace event dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support s390/uaccess: add missing earlyclobber annotations to __clear_user() s390: reintroduce expoline dependence to scripts drm/etnaviv: fix reference leak when mmaping imported buffer drm/amdgpu: allow more APUs to do mode2 reset when go to S4 drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub drm/amd/display: Take FEC Overhead into Timeslot Calculation drm/i915/gem: Flush lmem contents after construction drm/i915/dpt: Treat the DPT BO as a framebuffer drm/i915: Disable DC states for all commits drm/i915: Move CSC load back into .color_commit_arm() when PSR is enabled on skl/glk KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the current value KVM: arm64: Disable interrupts while walking userspace PTs net: dsa: mv88e6xxx: read FID when handling ATU violations net: dsa: mv88e6xxx: replace ATU violation prints with trace points net: dsa: mv88e6xxx: replace VTU violation prints with trace points selftests/bpf: Test btf dump for struct with padding only fields libbpf: Fix BTF-to-C converter's padding logic selftests/bpf: Add few corner cases to test padding handling of btf_dump libbpf: Fix btf_dump's packed struct determination usb: ucsi: Fix ucsi->connector race drm/amdkfd: Get prange->offset after svm_range_vram_node_new hsr: ratelimit only when errors are printed x86/PVH: avoid 32-bit build warning when obtaining VGA console info Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*" Linux 6.1.23 Change-Id: I15af3697170567c4678bcc9c2380d80e7cef5bc9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-06 14:14:07 +00:00
Jonathan Neuschäfer	78b342f0cd	zstd: Fix definition of assert() ... [ Upstream commit 6906598f1ce93761716d780b6e3f171e13f0f4ce ] assert(x) should emit a warning if x is false. WARN_ON(x) emits a warning if x is true. Thus, assert(x) should be defined as WARN_ON(!x) rather than WARN_ON(x). Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net> Signed-off-by: Nick Terrell <terrelln@fb.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:38 +02:00
Greg Kroah-Hartman	db50ac4d0a	Merge 6.1.22 into android14-6.1 ... Changes in 6.1.22 interconnect: qcom: osm-l3: fix icc_onecell_data allocation interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output perf: fix perf_event_context->time tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr drm/amd/display: Include virtual signal to set k1 and k2 values drm/amd/display: fix k1 k2 divider programming for phantom streams drm/amd/display: Remove OTG DIV register write for Virtual signals. mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets mptcp: fix UaF in listener shutdown drm/amd/display: Fix DP MST sinks removal issue arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes NFS: Fix /proc/PID/io read_bytes for buffered reads xsk: Add missing overflow check in xdp_umem_reg iavf: fix inverted Rx hash condition leading to disabled hash iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: do not track VLAN 0 filters intel/igbvf: free irq on the error path in igbvf_request_msix() igbvf: Regard vf reset nack as success igc: fix the validation logic for taprio's gate list i2c: imx-lpi2c: check only for enabled interrupt flags i2c: mxs: ensure that DMA buffers are safe for DMA i2c: hisi: Only use the completion interrupt to finish the transfer scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() nfsd: don't replace page in rq_pages if it's a continuation of last page net: dsa: b53: mmap: fix device tree support net: usb: smsc95xx: Limit packet length to skb->len efi/libstub: smbios: Use length member instead of record struct size qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info xirc2ps_cs: Fix use after free bug in xirc2ps_detach net: phy: Ensure state transitions are processed from phy_stop() net: mdio: fix owner field for mdio buses registered using device-tree net: mdio: fix owner field for mdio buses registered using ACPI net: stmmac: Fix for mismatched host/device DMA address width thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function mlxsw: core_thermal: Fix fan speed in maximum cooling state drm/i915: Print return value on error drm/i915/fbdev: lock the fbdev obj before vma pin drm/i915/guc: Rename GuC register state capture node to be more obvious drm/i915/guc: Fix missing ecodes drm/i915/gt: perform uc late init after probe error injection net: qcom/emac: Fix use after free bug in emac_remove due to race condition net: usb: lan78xx: Limit packet length to skb->len net/ps3_gelic_net: Fix RX sk_buff length net/ps3_gelic_net: Use dma_mapping_error octeontx2-vf: Add missing free for alloc_percpu bootconfig: Fix testcase to increase max node keys: Do not cache key in task struct if key is requested from kernel thread ice: check if VF exists before mode check iavf: fix hang on reboot with ice i40e: fix flow director packet filter programming bpf: Adjust insufficient default bpf_jit_limit net/mlx5e: Set uplink rep as NETNS_LOCAL net/mlx5e: Block entering switchdev mode with ns inconsistency net/mlx5: Fix steering rules cleanup net/mlx5e: Overcome slow response for first macsec ASO WQE net/mlx5: Read the TC mapping of all priorities on ETS query net/mlx5: E-Switch, Fix an Oops in error handling code net: dsa: tag_brcm: legacy: fix daisy-chained switches atm: idt77252: fix kmemleak when rmmod idt77252 erspan: do not use skb_mac_header() in ndo_start_xmit() net/sonic: use dma_mapping_error() for error check nvme-tcp: fix nvme_tcp_term_pdu to match spec mlxsw: spectrum_fid: Fix incorrect local port type hvc/xen: prevent concurrent accesses to the shared ring ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES ksmbd: fix possible refcount leak in smb2_open() Bluetooth: hci_sync: Resume adv with no RPA when active scan Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet Bluetooth: btusb: Remove detection of ISO packets over bulk Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Bluetooth: Remove "Power-on" check from Mesh feature gve: Cache link_speed value from device net: asix: fix modprobe "sysfs: cannot create duplicate filename" net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case net: mdio: thunder: Add missing fwnode_handle_put() drm/amd/display: Set dcn32 caps.seamless_odm Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: mgmt: Fix MGMT add advmon with RSSI command Bluetooth: HCI: Fix global-out-of-bounds platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl entry: Fix noinstr warning in __enter_from_user_mode() perf/x86/amd/core: Always clear status for idx entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up hwmon: fix potential sensor registration fail if of_node is missing hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs scsi: qla2xxx: Synchronize the IOCB count to be in order scsi: qla2xxx: Perform lockless command completion in abort path smb3: lower default deferred close timeout to address perf regression smb3: fix unusable share after force unmount failure uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Add quirk to disable CLx thunderbolt: Fix memory leak in margining thunderbolt: Disable interrupt auto clear for rings thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Use const qualifier for `ring_interrupt_index` thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) ACPI: x86: Drop quirk for HP Elitebook ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable riscv: Bump COMMAND_LINE_SIZE value to 1024 drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded ca8210: fix mac_len negative array access HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse HID: intel-ish-hid: ipc: Fix potential use-after-free in work function m68k: mm: Fix systems with memory at end of 32-bit address space m68k: Only force 030 bus error if PC not in exception table selftests/bpf: check that modifier resolves after pointer scsi: target: iscsi: Fix an error message in iscsi_check_key() scsi: qla2xxx: Add option to disable FC2 Target support scsi: hisi_sas: Check devm_add_action() return value scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() scsi: lpfc: Avoid usage of list iterator variable after loop scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled scsi: mpi3mr: Wait for diagnostic save during controller init scsi: mpi3mr: NVMe command size greater than 8K fails scsi: mpi3mr: Bad drive in topology results kernel crash scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file platform/x86: int3472: Add GPIOs to Surface Go 3 Board data net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 net: usb: qmi_wwan: add Telit 0x1080 composition drm/amd/display: Update clock table to include highest clock setting sh: sanitize the flags on sigreturn drm/amdgpu: Fix call trace warning and hang when removing amdgpu device drm/amd: Fix initialization mistake for NBIO 7.3.0 net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress cifs: lock chan_lock outside match_session cifs: append path to open_enter trace event cifs: do not poll server interfaces too regularly cifs: empty interface list when server doesn't support query interfaces cifs: dump pending mids for all channels in DebugData cifs: print session id while listing open files cifs: fix dentry lookups in directory handle cache x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() selftests/x86/amx: Add a ptrace test scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host" usb: dwc2: fix a devres leak in hw_enable upon suspend resume usb: gadget: u_audio: don't let userspace block driver unbind btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile Bluetooth: Fix race condition in hci_cmd_sync_clear efi: sysfb_efi: Fix DMI quirks not working for simpledrm mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP fscrypt: destroy keyring after security_sb_delete() fsverity: Remove WQ_UNBOUND from fsverity read workqueue lockd: set file_lock start and end when decoding nlm4 testargs arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name igb: revert rtnl_lock() that causes deadlock dm thin: fix deadlock when swapping to thin device usb: typec: tcpm: fix create duplicate source-capabilities file usb: typec: tcpm: fix warning when handle discover_identity message usb: cdns3: Fix issue with using incorrect PCI device function usb: cdnsp: Fixes issue with redundant Status Stage usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: chipidea: core: fix possible concurrent when switch role usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() usb: ucsi_acpi: Increase the command completion timeout mm: kfence: fix using kfence_metadata without initialization in show_object() kfence: avoid passing -g for test io_uring/net: avoid sending -ECONNABORTED on repeated connection requests io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare" test_maple_tree: add more testing for mas_empty_area() maple_tree: fix mas_skip_node() end slot detection ksmbd: fix wrong signingkey creation when encryption is AES256 ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION ksmbd: don't terminate inactive sessions after a few seconds ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount wifi: mac80211: fix qos on mesh interfaces nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk drm/meson: fix missing component unbind on bind errors drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi drm/i915/active: Fix missing debug object activation drm/i915: Preserve crtc_state->inherited during state clearing drm/amdgpu: skip ASIC reset for APUs when go to S4 drm/amdgpu: reposition the gpu reset checking for reuse riscv: mm: Fix incorrect ASID argument when flushing TLB riscv: Handle zicsr/zifencei issues between clang and binutils tee: amdtee: fix race condition in amdtee_open_session firmware: arm_scmi: Fix device node validation for mailbox transport arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers soc: qcom: llcc: Fix slice configuration values for SC8280XP mm/ksm: fix race with VMA iteration and mm_struct teardown bus: imx-weim: fix branch condition evaluates to a garbage value i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() dm stats: check for and propagate alloc_percpu failure dm crypt: add cond_resched() to dmcrypt_write() dm crypt: avoid accessing uninitialized tasklet sched/fair: sanitize vruntime of entity being placed sched/fair: Sanitize vruntime of entity being migrated drm/amdkfd: introduce dummy cache info for property asic drm/amdkfd: Fix the warning of array-index-out-of-bounds drm/amdkfd: add GC 11.0.4 KFD support drm/amdkfd: Fix the memory overrun Linux 6.1.22 Change-Id: Id13b4655dbfb59c29a0b8953e5e0cda3703f1879 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-31 08:15:39 +00:00
Greg Kroah-Hartman	f61c12dabf	Revert "Revert "sbitmap: Try each queue to wake up at least one waiter"" ... This reverts commit 77bcc673f6. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: I0737d8ce7f08323128fa61389169e5e692b56351 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-30 12:23:02 +01:00
Greg Kroah-Hartman	7b05fba131	Revert "Revert "sbitmap: Advance the queue index before waking up a queue"" ... This reverts commit 1e993e7647. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: I7b6c62480765cfa9751874641092b2a52229ea84 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-30 12:23:02 +01:00
Greg Kroah-Hartman	d774f1e1f0	Revert "Revert "sbitmap: correct wake_batch recalculation to avoid potential IO hung"" ... This reverts commit f12f3bc9c7. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: Idfe61bf8ce3a83c66c31769b845572454f0f196b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-30 11:16:06 +00:00
Greg Kroah-Hartman	02fb5b0cc5	Revert "Revert "sbitmap: Use single per-bitmap counting to wake up queued tags"" ... This reverts commit 8ec4245b45. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: I82776674a83f38800e3144d025631e4256cc53f4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-30 11:11:05 +00:00
Liam R. Howlett	0608b3da04	maple_tree: fix mas_skip_node() end slot detection ... commit 0fa99fdfe1b38da396d0b2d1496a823bcd0ebea0 upstream. Patch series "Fix mas_skip_node() for mas_empty_area()", v2. mas_empty_area() was incorrectly returning an error when there was room. The issue was tracked down to mas_skip_node() using the incorrect end-of-slot count. Instead of using the nodes hard limit, the limit of data should be used. mas_skip_node() was also setting the min and max to that of the child node, which was unnecessary. Within these limits being set, there was also a bug that corrupted the maple state's max if the offset was set to the maximum node pivot. The bug was without consequence unless there was a sufficient gap in the next child node which would cause an error to be returned. This patch set fixes these errors by removing the limit setting from mas_skip_node() and uses the mas_data_end() for slot limits, and adds tests for all failures discovered. This patch (of 2): mas_skip_node() is used to move the maple state to the node with a higher limit. It does this by walking up the tree and increasing the slot count. Since slot count may not be able to be increased, it may need to walk up multiple times to find room to walk right to a higher limit node. The limit of slots that was being used was the node limit and not the last location of data in the node. This would cause the maple state to be shifted outside actual data and enter an error state, thus returning -EBUSY. The result of the incorrect error state means that mas_awalk() would return an error instead of finding the allocation space. The fix is to use mas_data_end() in mas_skip_node() to detect the nodes data end point and continue walking the tree up until it is safe to move to a node with a higher limit. The walk up the tree also sets the maple state limits so remove the buggy code from mas_skip_node(). Setting the limits had the unfortunate side effect of triggering another bug if the parent node was full and the there was no suitable gap in the second last child, but room in the next child. mas_skip_node() may also be passed a maple state in an error state from mas_anode_descend() when no allocations are available. Return on such an error state immediately. Link: https://lkml.kernel.org/r/20230307180247.2220303-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20230307180247.2220303-2-Liam.Howlett@oracle.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: Snild Dolkow <snild@sony.com> Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.com/ Tested-by: Snild Dolkow <snild@sony.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-30 12:49:26 +02:00
Liam R. Howlett	94f6b92bad	test_maple_tree: add more testing for mas_empty_area() ... commit 4bd6dded6318dc8e2514d74868c1f8fb38b61a60 upstream. Test robust filling of an entire area of the tree, then test one beyond. This is to test the walking back up the tree at the end of nodes and error condition. Test inspired by the reproducer code provided by Snild Dolkow. The last test in the function tests for the case of a corrupted maple state caused by the incorrect limits set during mas_skip_node(). There needs to be a gap in the second last child and last child, but the search must rule out the second last child's gap. This would avoid correcting the maple state to the correct max limit and return an error. Link: https://lkml.kernel.org/r/20230307180247.2220303-3-Liam.Howlett@oracle.com Cc: Snild Dolkow <snild@sony.com> Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.com/ Fixes: e15e06a839 ("lib/test_maple_tree: add testing for maple tree") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-30 12:49:26 +02:00
Greg Kroah-Hartman	73bffa9caf	Revert "Revert "kobject: modify kobject_get_path() to take a const *"" ... This reverts commit e7db10fe57. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: Ifc79e504dbf17466a88ac76162ed77dcb5c13d19 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-30 10:37:08 +00:00
Greg Kroah-Hartman	5b483d8a04	Merge changes I95ce33fb,I03723a9f,I4b1cf7f1,I6e17c9b3,I446172f8, ... into android14-6.1 ... * changes: Merge 6.1.17 into android14-6.1 ANDROID: update abi definition due to io_uring changes. UPSTREAM: Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done" UPSTREAM: Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()" Revert "kobject: modify kobject_get_path() to take a const *" Revert "wait: Return number of exclusive waiters awaken" Revert "sbitmap: Use single per-bitmap counting to wake up queued tags" Revert "sbitmap: correct wake_batch recalculation to avoid potential IO hung" Revert "sbitmap: Advance the queue index before waking up a queue" Revert "sbitmap: Try each queue to wake up at least one waiter" Revert "HID: retain initial quirks set up when creating HID devices" Merge 6.1.16 into android14-6.1	2023-03-14 17:38:04 +00:00
Sangmoon Kim	e74b4da791	ANDROID: bug: add vendor hook for bug trap ... Add hook to gather data of bug trap and summarize it with other information. Bug: 273189923 Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com> Change-Id: I1f347c20629786f9bf0b9c50c7f96b50b4360504 (cherry picked from commit ba7e9d1a771d6e5a07bb242a720e6c95cc98fb0f)	2023-03-13 20:34:25 +00:00
Greg Kroah-Hartman	e7db10fe57	Revert "kobject: modify kobject_get_path() to take a const *" ... This reverts commit f3ffd86915 which is 33a0a1e3b3d17445832177981dc7a1c6a5b009f8 upstream. It messes with the CRC for kobject_get_path(). It will be reverted at the next ABI break. Bug: 161946584 Change-Id: I446172f8ab446dce5eedeb1a1bd3b9a5c36acd23 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 18:51:56 +00:00
Greg Kroah-Hartman	8ec4245b45	Revert "sbitmap: Use single per-bitmap counting to wake up queued tags" ... This reverts commit 0f312961c7. It breaks the ABI right now, but will be brought back at the next ABI break as it will be needed for Android systems. Bug: 161946584 Change-Id: Ieeaa94a3768a2b1cd8dcfc97f23e2e1b3404dc57 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 18:51:55 +00:00
Greg Kroah-Hartman	f12f3bc9c7	Revert "sbitmap: correct wake_batch recalculation to avoid potential IO hung" ... This reverts commit 3e5ddf2b84. It breaks the ABI right now, but will be brought back at the next ABI break as it will be needed for Android systems. Bug: 161946584 Change-Id: I5e56927a0be96aba6946f57eefbc9d64e9e1d393 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 18:51:55 +00:00
Greg Kroah-Hartman	1e993e7647	Revert "sbitmap: Advance the queue index before waking up a queue" ... This reverts commit 12815a7d8f. It breaks the ABI right now, but will be brought back at the next ABI break as it will be needed for Android systems. Bug: 161946584 Change-Id: Iacc5897c44dddd97f5f396a6558628e5c12f8bcf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 18:51:55 +00:00
Greg Kroah-Hartman	77bcc673f6	Revert "sbitmap: Try each queue to wake up at least one waiter" ... This reverts commit ff9571a4de. It breaks the ABI right now, but will be brought back at the next ABI break as it will be needed for Android systems. Bug: 161946584 Change-Id: I484106fa249e20cf12d748f005c3481947efd735 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 18:51:55 +00:00
Greg Kroah-Hartman	2cb73a87e4	Merge 6.1.16 into android14-6.1 ... Changes in 6.1.16 HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers powerpc/mm: Rearrange if-else block to avoid clang warning ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller" ARM: OMAP2+: Fix memory leak in realtime_counter_init() arm64: dts: qcom: qcs404: use symbol names for PCIe resets arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k arm64: dts: qcom: sm6350: Fix up the ramoops node arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down) arm64: dts: imx8m: Align SoC unique ID node unit address ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC arm64: dts: qcom: sc7180: correct SPMI bus address cells arm64: dts: qcom: sc7280: correct SPMI bus address cells arm64: dts: qcom: sc8280xp: correct SPMI bus address cells arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names arm64: dts: meson-gx: Fix Ethernet MAC address unit name arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* arm64: dts: ti: k3-am62: Enable SPI nodes at the board level arm64: dts: ti: k3-am62-main: Fix clocks for McSPI arm64: tegra: Fix duplicate regulator on Jetson TX1 arm64: dts: msm8992-bullhead: add memory hole region arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges arm64: dts: qcom: ipq8074: fix Gen3 PCIe node arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names arm64: dts: meson: remove CPU opps below 1GHz for G12A boards ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken ARM: bcm2835_defconfig: Enable the framebuffer ARM: s3c: fix s3c64xx_set_timer_source prototype arm64: dts: ti: k3-j7200: Fix wakeup pinmux range ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB controller node arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc node name arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip locking/rwsem: Disable preemption in all down_read*() and up_read() code paths arm64: dts: renesas: beacon-renesom: Fix gpio expander reference arm64: dts: meson: radxa-zero: allow usb otg mode arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference ublk_drv: remove nr_aborted_queues from ublk_device ublk_drv: don't probe partitions if the ubq daemon isn't trusted ARM: dts: imx7s: correct iomuxc gpr mux controller cells sbitmap: remove redundant check in __sbitmap_queue_get_batch sbitmap: Use single per-bitmap counting to wake up queued tags sbitmap: correct wake_batch recalculation to avoid potential IO hung arm64: dts: mt8195: Fix CPU map for single-cluster SoC arm64: dts: mt8192: Fix CPU map for single-cluster SoC arm64: dts: mt8186: Fix CPU map for single-cluster SoC arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node arm64: dts: mediatek: mt8186: Fix watchdog compatible arm64: dts: mediatek: mt8195: Fix watchdog compatible arm64: dts: mediatek: mt7986: Fix watchdog compatible ARM: dts: stm32: Update part number NVMEM description on stm32mp131 blk-mq: avoid sleep in blk_mq_alloc_request_hctx blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: Fix potential io hung for shared sbitmap per tagset blk-mq: correct stale comment of .get_budget arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC arm64: dts: qcom: sm8350: drop incorrect cells from serial arm64: dts: qcom: sm8450: drop incorrect cells from serial arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions arm64: dts: qcom: msm8953: correct TLMM gpio-ranges arm64: dts: qcom: msm8992-*: Fix up comments arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators s390/dasd: Fix potential memleak in dasd_eckd_init() sched/rt: pick_next_rt_entity(): check list_entry perf/x86/intel/ds: Fix the conversion from TSC to perf time x86/perf/zhaoxin: Add stepping check for ZXC KEYS: asymmetric: Fix ECDSA use via keyctl uapi block: ublk: check IO buffer based on flag need_get_data arm64: dts: qcom: pmk8350: Specify PBS register for PON arm64: dts: qcom: pmk8350: Use the correct PON compatible erofs: relinquish volume with mutex held block: sync mixed merged request's failfast with 1st bio's block: Fix io statistics for cgroup in throttle path block: bio-integrity: Copy flags when bio_integrity_payload is cloned block: use proper return value from bio_failfast() wifi: mt76: mt7915: add missing of_node_put() wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host wifi: mt76: mt7915: check return value before accessing free_block_num wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr() wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read() wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans() wifi: rsi: Fix memory leak in rsi_coex_attach() wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: rtw89: 8852c: rfk: correct DACK setting wifi: rtw89: 8852c: rfk: correct DPK settings wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() libbpf: Fix btf__align_of() by taking into account field offsets wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: ipw2200: fix memory leak in ipw_wdev_init() wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() libbpf: Fix invalid return address register in s390 crypto: x86/ghash - fix unaligned access in ghash_setkey() ACPICA: Drop port I/O validation for some regions genirq: Fix the return type of kstat_cpu_irqs_sum() rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() lib/mpi: Fix buffer overrun when SG is too long crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 platform/chrome: cros_ec_typec: Update port DP VDO ACPICA: nsrepair: handle cases without a return value correctly selftests/xsk: print correct payload for packet dump selftests/xsk: print correct error codes when exiting arm64/cpufeature: Fix field sign for DIT hwcap detection kselftest/arm64: Fix syscall-abi for systems without 128 bit SME workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex s390/early: fix sclp_early_sccb variable lifetime s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue() x86/signal: Fix the value returned by strict_sas_size() thermal/drivers/tsens: Drop msm8976-specific defines thermal/drivers/tsens: Sort out msm8976 vs msm8956 data thermal/drivers/tsens: fix slope values for msm8939 thermal/drivers/tsens: limit num_sensors to 9 for msm8939 wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie() wifi: rtw89: Add missing check for alloc_workqueue wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU wifi: orinoco: check return value of hermes_write_wordrec() thermal/drivers/imx_sc_thermal: Drop empty platform remove function thermal/drivers/imx_sc_thermal: Fix the loop condition wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() ACPI: battery: Fix missing NUL-termination with large strings selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m crypto: ccp - Failure on re-initialization due to duplicate sysfs filename crypto: essiv - Handle EBUSY correctly crypto: seqiv - Handle EBUSY correctly powercap: fix possible name leak in powercap_register_zone() x86/microcode: Add a parameter to microcode_check() to store CPU capabilities x86/microcode: Check CPU capabilities after late microcode update correctly x86/microcode: Adjust late loading result reporting message selftests/bpf: Use consistent build-id type for liburandom_read.so selftests/bpf: Fix vmtest static compilation error crypto: xts - Handle EBUSY correctly leds: led-class: Add missing put_device() to led_put() s390/bpf: Add expoline to tail calls wifi: iwlwifi: mei: fix compilation errors in rfkill() kselftest/arm64: Fix enumeration of systems without 128 bit SME can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses selftests/bpf: Initialize tc in xdp_synproxy crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware bpftool: profile online CPUs instead of possible wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit wifi: mt76: mt7915: fix WED TxS reporting wifi: mt76: add memory barrier to SDIO queue kick wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read net/mlx5: Enhance debug print in page allocation failure irqchip: Fix refcount leak in platform_irqchip_probe irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe s390/mem_detect: fix detect_memory() error handling s390/vmem: fix empty page tables cleanup under KASAN s390/boot: cleanup decompressor header files s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails s390/boot: fix mem_detect extended area allocation net: add sock_init_data_uid() tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid OPP: fix error checking in opp_migrate_dentry() cpufreq: davinci: Fix clk use after free Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds Bluetooth: L2CAP: Fix potential user-after-free Bluetooth: hci_qca: get wakeup status from serdev device handle net: ipa: generic command param fix s390: vfio-ap: tighten the NIB validity check s390/ap: fix status returned by ap_aqic() s390/ap: fix status returned by ap_qact() libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() xen/grant-dma-iommu: Implement a dummy probe_device() callback rds: rds_rm_zerocopy_callback() correct order for list_add_tail() crypto: rsa-pkcs1pad - Use akcipher_request_complete m68k: /proc/hardware should depend on PROC_FS RISC-V: time: initialize hrtimer based broadcast clock event device clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use wifi: iwl3945: Add missing check for create_singlethread_workqueue wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() selftests/bpf: Fix out-of-srctree build ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models ACPI: resource: Do IRQ override on all TongFang GMxRGxx crypto: octeontx2 - Fix objects shared between several modules crypto: crypto4xx - Call dma_unmap_page when done wifi: mac80211: move color collision detection report in a delayed work wifi: mac80211: make rate u32 in sta_set_rate_info_rx() wifi: mac80211: fix non-MLO station association wifi: mac80211: Don't translate MLD addresses for multicast wifi: mac80211: avoid u32_encode_bits() warning wifi: mac80211: fix off-by-one link setting tools/lib/thermal: Fix thermal_sampling_exit() thermal/drivers/hisi: Drop second sensor hi3660 selftests/bpf: Fix map_kptr test. wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() bpf: Zeroing allocated object from slab in bpf memory allocator selftests/bpf: Fix xdp_do_redirect on s390x can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error can: esd_usb: Make use of can_change_state() and relocate checking skb for NULL xsk: check IFF_UP earlier in Tx path LoongArch, bpf: Use 4 instructions for function address in JIT bpf: Fix global subprog context argument resolution logic irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() net/smc: fix application data exception selftests/net: Interpret UDP_GRO cmsg data as an int value l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() net: bcmgenet: fix MoCA LED control net: lan966x: Fix possible deadlock inside PTP net/mlx4_en: Introduce flexible array to silence overflow warning selftest: fib_tests: Always cleanup before exit sefltests: netdevsim: wait for devlink instance after netns removal drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/bridge: megachips: Fix error handling in i2c_register_driver() drm/vkms: Fix memory leak in vkms_init() drm/vkms: Fix null-ptr-deref in vkms_release() drm/vc4: dpi: Fix format mapping for RGB565 drm: tidss: Fix pixel format definition gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() drm/vc4: drop all currently held locks if deadlock happens hwmon: (ftsteutates) Fix scaling of measurements drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init() drm/msm/hdmi: Add missing check for alloc_ordered_workqueue pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups drm/vc4: hvs: Set AXI panic modes drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4 drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5 drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 drm/vc4: hdmi: Correct interlaced timings again drm/msm: clean event_thread->worker in case of an error drm/panel-edp: fix name for IVO product id 854b scsi: qla2xxx: Fix exchange oversubscription scsi: qla2xxx: Fix exchange oversubscription for management commands scsi: qla2xxx: edif: Fix clang warning ASoC: fsl_sai: initialize is_dsp_mode flag drm/bridge: tc358767: Set default CLRSIPO count drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() ALSA: hda/ca0132: minor fix for allocation size drm/amdgpu: Use the sched from entity for amdgpu_cs trace drm/msm/gem: Add check for kmalloc drm/msm/dpu: Disallow unallocated resources to be returned drm/bridge: lt9611: fix sleep mode setup drm/bridge: lt9611: fix HPD reenablement drm/bridge: lt9611: fix polarity programming drm/bridge: lt9611: fix programming of video modes drm/bridge: lt9611: fix clock calculation drm/bridge: lt9611: pass a pointer to the of node regulator: tps65219: use IS_ERR() to detect an error pointer drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags drm/msm/dsi: Allow 2 CTRLs on v2.5.0 scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096 drm/msm/dpu: sc7180: add missing WB2 clock control drm/msm: use strscpy instead of strncpy drm/msm/dpu: Add check for cstate drm/msm/dpu: Add check for pstates drm/msm/mdp5: Add check for kzalloc habanalabs: bugs fixes in timestamps buff alloc pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() pinctrl: mediatek: Initialize variable pullen and pullup to zero pinctrl: mediatek: Initialize variable *buf to zero gpu: host1x: Fix mask for syncpoint increment register gpu: host1x: Don't skip assigning syncpoints to channels drm/tegra: firewall: Check for is_addr_reg existence in IMM check pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: Drop unbalanced obj unref drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc drm/mediatek: Clean dangling pointer on bind error path ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-ccorr gpio: vf610: connect GPIO label to dev name ASoC: topology: Properly access value coming from topology file spi: dw_bt1: fix MUX_MMIO dependencies ASoC: mchp-spdifrx: fix controls which rely on rsr register ASoC: mchp-spdifrx: fix return value in case completion times out ASoC: mchp-spdifrx: fix controls that works with completion mechanism ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() dm: improve shrinker debug names regmap: apply reg_base and reg_downshift for single register ops ASoC: rsnd: fixup #endif position ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() ASoC: dt-bindings: meson: fix gx-card codec node regex regulator: tps65219: use generic set_bypass() hwmon: (asus-ec-sensors) add missing mutex path hwmon: (ltc2945) Handle error case in ltc2945_value_store ALSA: hda: Fix the control element identification for multiple codecs drm/amdgpu: fix enum odm_combine_mode mismatch scsi: mpt3sas: Fix a memory leak scsi: aic94xx: Add missing check for dma_map_single() HID: multitouch: Add quirks for flipped axes HID: retain initial quirks set up when creating HID devices ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared ASoC: qcom: q6apm-dai: fix race condition while updating the position pointer ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag ASoC: codecs: lpass: register mclk after runtime pm ASoC: codecs: lpass: fix incorrect mclk rate drm/amd/display: don't call dc_interrupt_set() for disabled crtcs HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support spi: bcm63xx-hsspi: Fix multi-bit mode setting hwmon: (mlxreg-fan) Return zero speed for broken fan ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init dm: remove flush_scheduled_work() during local_exit() nfs4trace: fix state manager flag printing NFS: fix disabling of swap spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared HID: bigben: use spinlock to protect concurrent accesses HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to safely schedule workers hid: bigben_probe(): validate report count ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() NFSD: enhance inter-server copy cleanup NFSD: fix leaked reference count of nfsd4_ssc_umount_item nfsd: fix race to check ls_layouts nfsd: clean up potential nfsd_file refcount leaks in COPY codepath NFSD: fix problems with cleanup on errors in nfsd4_copy nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open nfsd: don't fsync nfsd_files on last close NFSD: copy the whole verifier in nfsd_copy_write_verifier cifs: Fix lost destroy smbd connection when MR allocate failed cifs: Fix warning and UAF when destroy the MR list cifs: use tcon allocation functions even for dummy tcon gfs2: jdata writepage fix perf llvm: Fix inadvertent file creation leds: led-core: Fix refcount leak in of_led_get() leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest() leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver tools/tracing/rtla: osnoise_hist: use total duration for average calculation perf inject: Use perf_data__read() for auxtrace perf intel-pt: Do not try to queue auxtrace data on pipe perf test bpf: Skip test if kernel-debuginfo is not present perf tools: Fix auto-complete on aarch64 sparc: allow PM configs for sparc32 COMPILE_TEST selftests: find echo binary to use -ne options selftests/ftrace: Fix bash specific "==" operator selftests: use printf instead of echo -ne perf record: Fix segfault with --overwrite and --max-size printf: fix errname.c list perf tests stat_all_metrics: Change true workload to sleep workload for system wide check objtool: add UACCESS exceptions for __tsan_volatile_read/write mfd: cs5535: Don't build on UML mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 RDMA/erdma: Fix refcount leak in erdma_mmap dmaengine: HISI_DMA should depend on ARCH_HISI RDMA/hns: Fix refcount leak in hns_roce_mmap iio: light: tsl2563: Do not hardcode interrupt trigger type usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() i2c: designware: fix i2c_dw_clk_rate() return size to be u32 soundwire: cadence: Don't overflow the command FIFOs driver core: fix potential null-ptr-deref in device_add() kobject: modify kobject_get_path() to take a const * kobject: Fix slab-out-of-bounds in fill_kobj_path() alpha/boot/tools/objstrip: fix the check for ELF header media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX media: uvcvideo: Refactor power_line_frequency_controls_limited coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR coresight: cti: Prevent negative values of enable count coresight: cti: Add PM runtime call in enable_store usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count PCI/IOV: Enlarge virtfn sysfs name buffer PCI: switchtec: Return -EFAULT for copy_to_user() errors PCI: endpoint: pci-epf-vntb: Clean up kernel_doc warning PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc hwtracing: hisi_ptt: Only add the supported devices to the filters list tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" eeprom: idt_89hpesx: Fix error handling in idt_init() applicom: Fix PCI device refcount leak in applicom_init() firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() firmware: stratix10-svc: fix error handle while alloc/add device failed VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF mei: pxp: Use correct macros to initialize uuid_le misc/mei/hdcp: Use correct macros to initialize uuid_le misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe() driver core: fix resource leak in device_add() driver core: location: Free struct acpi_pld_info *pld before return false drivers: base: transport_class: fix possible memory leak drivers: base: transport_class: fix resource leak when transport_add_device() fails firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle fotg210-udc: Add missing completion handler dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers fpga: microchip-spi: move SPI I/O buffers out of stack fpga: microchip-spi: rewrite status polling in a time measurable way usb: early: xhci-dbc: Fix a potential out-of-bound memory access tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case RDMA/cxgb4: add null-ptr-check after ip_dev_find() usb: musb: mediatek: don't unregister something that wasn't registered usb: gadget: configfs: Restrict symlink creation is UDC already binded phy: mediatek: remove temporary variable @mask_ PCI: mt7621: Delay phy ports initialization iommu: dart: Add suspend/resume support iommu: dart: Support >64 stream IDs iommu/dart: Fix apple_dart_device_group for PCI groups iommu/vt-d: Set No Execute Enable bit in PASID table entry power: supply: remove faulty cooling logic RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() usb: max-3421: Fix setting of I/O pins RDMA/irdma: Cap MSIX used to online CPUs + 1 serial: fsl_lpuart: fix RS485 RTS polariy inverse issue tty: serial: imx: Handle RS485 DE signal active high tty: serial: imx: disable Ageing Timer interrupt request irq driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links driver core: fw_devlink: Don't purge child fwnode's consumer links driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle driver core: fw_devlink: Consolidate device link flag computation driver core: fw_devlink: Improve check for fwnode with no device/driver driver core: fw_devlink: Make cycle detection more robust mtd: mtdpart: Don't create platform device that'll never probe usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev dmaengine: dw-edma: Fix readq_ch() return value truncation PCI: Fix dropping valid root bus resources with .end = zero phy: rockchip-typec: fix tcphy_get_mode error case PCI: qcom: Fix host-init error handling iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() iommu: Fix error unwind in iommu_group_alloc() iommu/amd: Do not identity map v2 capable device when snp is enabled dmaengine: sf-pdma: pdma_desc memory leak fix dmaengine: dw-axi-dmac: Do not dereference NULL structure dmaengine: ptdma: check for null desc before calling pt_cmd_callback iommu/vt-d: Fix error handling in sva enable/disable paths iommu/vt-d: Allow to use flush-queue when first level is default RDMA/rxe: cleanup some error handling in rxe_verbs.c RDMA/rxe: Fix missing memory barriers in rxe_queue.h IB/hfi1: Fix math bugs in hfi1_can_pin_pages() IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use" remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers media: ti: cal: fix possible memory leak in cal_ctx_create() media: platform: ti: Add missing check for devm_regulator_get media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in imx7_csi_init() powerpc: Remove linker flag from KBUILD_AFLAGS s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 builddeb: clean generated package content media: max9286: Fix memleak in max9286_v4l2_register() media: ov2740: Fix memleak in ov2740_init_controls() media: ov5675: Fix memleak in ov5675_init_controls() media: ov5640: Fix soft reset sequence and timings media: ov5640: Handle delays when no reset_gpio set media: mc: Get media_device directly from pad media: i2c: ov772x: Fix memleak in ov772x_probe() media: i2c: imx219: Split common registers from mode tables media: i2c: imx219: Fix binning for RAW8 capture media: platform: mtk-mdp3: Fix return value check in mdp_probe() media: camss: csiphy-3ph: avoid undefined behavior media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config media: platform: mtk-mdp3: fix Kconfig dependencies media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data media: v4l2-jpeg: ignore the unknown APP14 marker media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399 media: imx-jpeg: Apply clk_bulk api instead of operating specific clk media: amphion: correct the unspecified color space media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: atomisp: Only set default_run_mode on first open of a stream/asd media: i2c: ov7670: 0 instead of -EINVAL was returned media: usb: siano: Fix use after free bugs caused by do_submit_urb media: saa7134: Use video_unregister_device for radio_dev rpmsg: glink: Avoid infinite loop on intent for missing channel rpmsg: glink: Release driver_override ARM: OMAP2+: omap4-common: Fix refcount leak bug arm64: dts: qcom: msm8996: Add additional A2NoC clocks udf: Define EFSCORRUPTED error code context_tracking: Fix noinstr vs KASAN exit: Detect and fix irq disabled state in oops ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected blk-iocost: fix divide by 0 error in calc_lcoefs() blk-cgroup: dropping parent refcount after pd_free_fn() is done blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy() trace/blktrace: fix memory leak with using debugfs_lookup() btrfs: scrub: improve tree block error reporting arm64: zynqmp: Enable hs termination flag for USB dwc3 controller cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads cpuidle: drivers: firmware: psci: Dont instrument suspend code cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG perf/x86/intel/uncore: Add Meteor Lake support wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() wifi: ath11k: fix monitor mode bringup crash wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug rcu-tasks: Handle queue-shrink/callback-enqueue race condition wifi: ath11k: debugfs: fix to work with multiple PCI devices thermal: intel: Fix unsigned comparison with less than zero timers: Prevent union confusion from unexpected restart_syscall() x86/bugs: Reset speculation control settings on init bpftool: Always disable stack protection for BPF objects wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds wifi: mt7601u: fix an integer underflow inet: fix fast path in __inet_hash_connect() ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB ice: add missing checks for PF vsi type ACPI: Don't build ACPICA with '-Os' bpf, docs: Fix modulo zero, division by zero, overflow, and underflow thermal: intel: intel_pch: Add support for Wellsburg PCH clocksource: Suspend the watchdog temporarily when high read latency detected crypto: hisilicon: Wipe entire pool on error net: bcmgenet: Add a check for oversized packets m68k: Check syscall_trace_enter() return code s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() can: isotp: check CAN address family in isotp_bind() gcc-plugins: drop -std=gnu++11 to fix GCC 13 build tools/power/x86/intel-speed-select: Add Emerald Rapid quirk wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup ACPI: video: Fix Lenovo Ideapad Z570 DMI match net/mlx5: fw_tracer: Fix debug print coda: Avoid partial allocation of sig_inputArgs uaccess: Add minimum bounds check on kernel buffer size s390/idle: mark arch_cpu_idle() noinstr time/debug: Fix memory leak with using debugfs_lookup() PM: domains: fix memory leak with using debugfs_lookup() PM: EM: fix memory leak with using debugfs_lookup() Bluetooth: Fix issue with Actions Semi ATS2851 based devices Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921 Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30 hv_netvsc: Check status in SEND_RNDIS_PKT completion message s390/kfence: fix page fault reporting devlink: Fix TP_STRUCT_entry in trace of devlink health report scm: add user copy checks to put_cmsg() drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F drm: panel-orientation-quirks: Add quirk for DynaBook K50 drm/amd/display: Reduce expected sdp bandwidth for dcn321 drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write drm/amd/display: Fix potential null-deref in dm_resume drm/omap: dsi: Fix excessive stack usage HID: Add Mapping for System Microphone Mute drm/tiny: ili9486: Do not assume 8-bit only SPI controllers drm/amd/display: Defer DIG FIFO disable after VID stream enable drm/radeon: free iio for atombios when driver shutdown drm/amd: Avoid BUG() for case of SRIOV missing IP version drm/amdkfd: Page aligned memory reserve size scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Revert "fbcon: don't lose the console font across generic->chip driver switch" drm/amd: Avoid ASSERT for some message failures drm: amd: display: Fix memory leakage drm/amd/display: fix mapping to non-allocated address HID: uclogic: Add frame type quirk HID: uclogic: Add battery quirk HID: uclogic: Add support for XP-PEN Deco Pro SW HID: uclogic: Add support for XP-PEN Deco Pro MW drm/msm/dsi: Add missing check for alloc_ordered_workqueue drm: rcar-du: Add quirk for H3 ES1.x pclk workaround drm: rcar-du: Fix setting a reserved bit in DPLLCR drm/drm_print: correct format problem drm/amd/display: Set hvm_enabled flag for S/G mode habanalabs: extend fatal messages to contain PCI info habanalabs: fix bug in timestamps registration code docs/scripts/gdb: add necessary make scripts_gdb step drm/msm/dpu: Add DSC hardware blocks to register snapshot ASoC: soc-compress: Reposition and add pcm_mutex ASoC: kirkwood: Iterate over array indexes instead of using pointer math regulator: max77802: Bounds check regulator id against opmode regulator: s5m8767: Bounds check id indexing into arrays Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled" drm/amd/display: fix FCLK pstate change underflow gfs2: Improve gfs2_make_fs_rw error handling hwmon: (coretemp) Simplify platform device handling hwmon: (nct6775) Directly call ASUS ACPI WMI method hwmon: (nct6775) B650/B660/X670 ASUS boards support pinctrl: at91: use devm_kasprintf() to avoid potential leaks drm/amd/display: Do not commit pipe when updating DRR scsi: snic: Fix memory leak with using debugfs_lookup() scsi: ufs: core: Fix device management cmd timeout flow HID: logitech-hidpp: Don't restart communication if not necessary drm/amd/display: Enable P-state validation checks for DCN314 drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 drm/amd/display: Disable HUBP/DPP PG on DCN314 for now dm thin: add cond_resched() to various workqueue loops dm cache: add cond_resched() to various workqueue loops nfsd: zero out pointers after putting nfsd_files on COPY setup error nfsd: don't hand out delegation on setuid files being opened for write cifs: prevent data race in smb2_reconnect() drm/shmem-helper: Revert accidental non-GPL export driver core: fw_devlink: Avoid spurious error message wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu scsi: mpt3sas: Remove usage of dma_get_required_mask() API firmware: coreboot: framebuffer: Ignore reserved pixel color bits block: don't allow multiple bios for IOCB_NOWAIT issue block: clear bio->bi_bdev when putting a bio back in the cache block: be a bit more careful in checking for NULL bdev while polling rtc: pm8xxx: fix set-alarm race ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' ipmi:ssif: resend_msg() cannot fail ipmi_ssif: Rename idle state and check io_uring: Replace 0-length array with flexible array io_uring: use user visible tail in io_uring_poll() io_uring: handle TIF_NOTIFY_RESUME when checking for task_work io_uring: add a conditional reschedule to the IOPOLL cancelation loop io_uring: add reschedule point to handle_tw_list() io_uring/rsrc: disallow multi-source reg buffers io_uring: remove MSG_NOSIGNAL from recvmsg io_uring: fix fget leak when fs don't support nowait buffered read s390/extmem: return correct segment type in __segment_load() s390: discard .interp section s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/kprobes: fix current_kprobe never cleared after kprobes reenter KVM: s390: disable migration mode when dirty tracking is disabled cifs: Fix uninitialized memory read in smb3_qfs_tcon() cifs: Fix uninitialized memory reads for oparms.mode cifs: fix mount on old smb servers cifs: introduce cifs_io_parms in smb2_async_writev() cifs: split out smb3_use_rdma_offload() helper cifs: don't try to use rdma offload on encrypted connections cifs: Check the lease context if we actually got a lease cifs: return a single-use cfid if we did not get a lease scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi btrfs: hold block group refcount during async discard locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath ksmbd: fix wrong data area length for smb2 lock request ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length ksmbd: fix possible memory leak in smb2_lock() torture: Fix hang during kthread shutdown phase ARM: dts: exynos: correct HDMI phy compatible in Exynos4 io_uring: mark task TASK_RUNNING before handling resume/task work hfs: fix missing hfs_bnode_get() in __hfs_bnode_create fs: hfsplus: fix UAF issue in hfsplus_put_super exfat: fix reporting fs error when reading dir beyond EOF exfat: fix unexpected EOF while reading dir exfat: redefine DIR_DELETED as the bad cluster number exfat: fix inode->i_blocks for non-512 byte sector size device fs: dlm: don't set stop rx flag after node reset fs: dlm: move sending fin message into state change handling fs: dlm: send FIN ack back in right cases f2fs: fix information leak in f2fs_move_inline_dirents() f2fs: retry to update the inode page given data corruption f2fs: fix cgroup writeback accounting with fs-layer encryption f2fs: fix kernel crash due to null io->bio ocfs2: fix defrag path triggering jbd2 ASSERT ocfs2: fix non-auto defrag path not working issue fs/cramfs/inode.c: initialize file_ra_state selftests/landlock: Skip overlayfs tests when not supported selftests/landlock: Test ptrace as much as possible with Yama udf: Truncate added extents on failed expansion udf: Do not bother merging very long extents udf: Do not update file length for failed writes to inline files udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy udf: Fix file corruption when appending just after end of preallocated extent md: don't update recovery_cp when curr_resync is ACTIVE RDMA/siw: Fix user page pinning accounting KVM: Destroy target device if coalesced MMIO unregistration fails KVM: VMX: Fix crash due to uninitialized current_vmcs KVM: Register /dev/kvm as the _very_ last thing during initialization KVM: x86: Purge "highest ISR" cache when updating APICv state KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID KVM: SVM: Flush the "current" TLB when activating AVIC KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target KVM: SVM: Don't put/load AVIC when setting virtual APIC mode KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32 KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() KVM: SVM: hyper-v: placate modpost section mismatch error selftests: x86: Fix incorrect kernel headers search path x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/AMD: Fix mixed steppings support x86/speculation: Allow enabling STIBP with legacy IBRS Documentation/hw-vuln: Document the interaction between IBRS and STIBP virt/sev-guest: Return -EIO if certificate buffer is not large enough brd: mark as nowait compatible brd: return 0/-error from brd_insert_page() brd: check for REQ_NOWAIT and set correct page allocation mask ima: fix error handling logic when file measurement failed ima: Align ima_file_mmap() parameters with mmap_file LSM hook selftests/powerpc: Fix incorrect kernel headers search path selftests/ftrace: Fix eprobe syntax test case to check filter support selftests: sched: Fix incorrect kernel headers search path selftests: core: Fix incorrect kernel headers search path selftests: pid_namespace: Fix incorrect kernel headers search path selftests: arm64: Fix incorrect kernel headers search path selftests: clone3: Fix incorrect kernel headers search path selftests: pidfd: Fix incorrect kernel headers search path selftests: membarrier: Fix incorrect kernel headers search path selftests: kcmp: Fix incorrect kernel headers search path selftests: media_tests: Fix incorrect kernel headers search path selftests: gpio: Fix incorrect kernel headers search path selftests: filesystems: Fix incorrect kernel headers search path selftests: user_events: Fix incorrect kernel headers search path selftests: ptp: Fix incorrect kernel headers search path selftests: sync: Fix incorrect kernel headers search path selftests: rseq: Fix incorrect kernel headers search path selftests: move_mount_set_group: Fix incorrect kernel headers search path selftests: mount_setattr: Fix incorrect kernel headers search path selftests: perf_events: Fix incorrect kernel headers search path selftests: ipc: Fix incorrect kernel headers search path selftests: futex: Fix incorrect kernel headers search path selftests: drivers: Fix incorrect kernel headers search path selftests: dmabuf-heaps: Fix incorrect kernel headers search path selftests: vm: Fix incorrect kernel headers search path selftests: seccomp: Fix incorrect kernel headers search path irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Look for existing mapping only once irqdomain: Drop bogus fwspec-mapping error handling irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Fix mapping-creation race irqdomain: Fix domain registration race crypto: qat - fix out-of-bounds read mm/damon/paddr: fix missing folio_put() ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC jbd2: fix data missing when reusing bh which is ready to be checkpointed ext4: optimize ea_inode block expansion ext4: refuse to create ea block when umounted cxl/pmem: Fix nvdimm registration races mtd: spi-nor: sfdp: Fix index value for SCCR dwords mtd: spi-nor: spansion: Consider reserved bits in CFR5 register mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type dm: send just one event on resize, not two dm: add cond_resched() to dm_wq_work() dm: add cond_resched() to dm_wq_requeue_work() wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice wifi: rtl8xxxu: Use a longer retry limit of 48 wifi: ath11k: allow system suspend to survive ath11k wifi: cfg80211: Fix use after free for wext wifi: cfg80211: Set SSID if it is not already set cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies qede: fix interrupt coalescing configuration thermal: intel: powerclamp: Fix cur_state for multi package system dm flakey: fix logic when corrupting a bio dm cache: free background tracker's queued work in btracker_destroy dm flakey: don't corrupt the zero page dm flakey: fix a bug with 32-bit highmem systems hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div() ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: exynos: correct TMU phandle in Exynos4210 ARM: dts: exynos: correct TMU phandle in Exynos4 ARM: dts: exynos: correct TMU phandle in Odroid XU3 family ARM: dts: exynos: correct TMU phandle in Exynos5250 ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Odroid HC1 arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP fuse: add inode/permission checks to fileattr_get/fileattr_set rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ceph: update the time stamps and try to drop the suid/sgid regulator: core: Use ktime_get_boottime() to determine how long a regulator was off panic: fix the panic_print NMI backtrace setting mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON alpha: fix FEN fault handling dax/kmem: Fix leak of memory-hotplug resources mips: fix syscall_get_nr media: ipu3-cio2: Fix PM runtime usage_count in driver unbind remoteproc/mtk_scp: Move clk ops outside send_lock docs: gdbmacros: print newest record mm: memcontrol: deprecate charge moving mm/thp: check and bail out if page in deferred queue already ktest.pl: Give back console on Ctrt^C on monitor kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Add RUN_TIMEOUT option with default unlimited memory tier: release the new_memtier in find_create_memory_tier() ring-buffer: Handle race between rb_move_tail and rb_check_pages tools/bootconfig: fix single & used for logical condition tracing/eprobe: Fix to add filter on eprobe description in README file iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter iommu/amd: Improve page fault error reporting scsi: aacraid: Allocate cmd_priv with scsicmd scsi: qla2xxx: Fix link failure in NPIV environment scsi: qla2xxx: Check if port is online before sending ELS scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Remove unintended flag clearing scsi: qla2xxx: Fix erroneous link down scsi: qla2xxx: Remove increment of interface err cnt scsi: ses: Don't attach if enclosure has no components scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() RISC-V: add a spin_shadow_stack declaration riscv: Avoid enabling interrupts in die() riscv: mm: fix regression due to update_mmu_cache change riscv: jump_label: Fixup unaligned arch_static_branch function riscv, mm: Perform BPF exhandler fixup on page fault riscv: ftrace: Remove wasted nops for !RISCV_ISA_C riscv: ftrace: Reduce the detour code size to half MIPS: DTS: CI20: fix otg power gpio PCI/PM: Observe reset delay irrespective of bridge_d3 PCI: Unify delay handling for reset and resume PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: Avoid FLR for AMD FCH AHCI adapters PCI/DPC: Await readiness of secondary bus after reset bus: mhi: ep: Only send -ENOTCONN status if client driver is available bus: mhi: ep: Move chan->lock to the start of processing queued ch ring bus: mhi: ep: Save channel state locally during suspend and resume iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode iommu/vt-d: Fix PASID directory pointer coherency vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR vfio/type1: prevent underflow of locked_vm via exec() vfio/type1: track locked_vm per dma vfio/type1: restore locked_vm drm/amd: Fix initialization for nbio 7.5.1 drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv drm/radeon: Fix eDP for single-display iMac11,2 drm/i915: Don't use stolen memory for ring buffers with LLC drm/i915: Don't use BAR mappings for ring buffers with LLC drm/gud: Fix UBSAN warning drm/edid: fix AVI infoframe aspect ratio handling drm/edid: fix parsing of 3D modes from HDMI VSDB qede: avoid uninitialized entries in coal_entry array brd: use radix_tree_maybe_preload instead of radix_tree_preload sbitmap: Advance the queue index before waking up a queue wait: Return number of exclusive waiters awaken sbitmap: Try each queue to wake up at least one waiter kbuild: Port silent mode detection to future gnu make. net: avoid double iput when sock_alloc_file fails Linux 6.1.16 Change-Id: I705caf70ee547e6d55f38d133bdcd50713aed745 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 15:45:34 +00:00
Gabriel Krisman Bertazi	ff9571a4de	sbitmap: Try each queue to wake up at least one waiter ... commit 26edb30dd1c0c9be11fa676b4f330ada7b794ba6 upstream. Jan reported the new algorithm as merged might be problematic if the queue being awaken becomes empty between the waitqueue_active inside sbq_wake_ptr check and the wake up. If that happens, wake_up_nr will not wake up any waiter and we loose too many wake ups. In order to guarantee progress, we need to wake up at least one waiter here, if there are any. This now requires trying to wake up from every queue. Instead of walking through all the queues with sbq_wake_ptr, this call moves the wake up inside that function. In a previous version of the patch, I found that updating wake_index several times when walking through queues had a measurable overhead. This ensures we only update it once, at the end. Fixes: 4f8126bb2308 ("sbitmap: Use single per-bitmap counting to wake up queued tags") Reported-by: Jan Kara <jack@suse.cz> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20221115224553.23594-4-krisman@suse.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-10 09:34:34 +01:00
Gabriel Krisman Bertazi	12815a7d8f	sbitmap: Advance the queue index before waking up a queue ... commit 976570b4ecd30d3ec6e1b0910da8e5edc591f2b6 upstream. When a queue is awaken, the wake_index written by sbq_wake_ptr currently keeps pointing to the same queue. On the next wake up, it will thus retry the same queue, which is unfair to other queues, and can lead to starvation. This patch, moves the index update to happen before the queue is returned, such that it will now try a different queue first on the next wake up, improving fairness. Fixes: 4f8126bb2308 ("sbitmap: Use single per-bitmap counting to wake up queued tags") Reported-by: Jan Kara <jack@suse.cz> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> Link: https://lore.kernel.org/r/20221115224553.23594-2-krisman@suse.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-10 09:34:34 +01:00
Peter Zijlstra	b78434f6ee	cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG ... [ Upstream commit 5a5d7e9badd2cb8065db171961bd30bd3595e4b6 ] In order to avoid WARN/BUG from generating nested or even recursive warnings, force rcu_is_watching() true during WARN/lockdep_rcu_suspicious(). Notably things like unwinding the stack can trigger rcu_dereference() warnings, which then triggers more unwinding which then triggers more warnings etc.. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://lore.kernel.org/r/20230126151323.408156109@infradead.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:33:47 +01:00
Wang Hai	fe4dd80d58	kobject: Fix slab-out-of-bounds in fill_kobj_path() ... [ Upstream commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 ] In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug. The actual current problem occurs when the ixgbe probe. In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur. cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */ This is the kasan report: ================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 This reproducer triggers that bug: while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5 When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38@huawei.com> Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:33:30 +01:00
Greg Kroah-Hartman	f3ffd86915	kobject: modify kobject_get_path() to take a const * ... [ Upstream commit 33a0a1e3b3d17445832177981dc7a1c6a5b009f8 ] kobject_get_path() does not modify the kobject passed to it, so make the pointer constant. Cc: "Rafael J. Wysocki" <rafael@kernel.org> Link: https://lore.kernel.org/r/20221001165315.2690141-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: 3bb2a01caa81 ("kobject: Fix slab-out-of-bounds in fill_kobj_path()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:33:29 +01:00
Arnd Bergmann	adb2cfd3f2	printf: fix errname.c list ... [ Upstream commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 ] On most architectures, gcc -Wextra warns about the list of error numbers containing both EDEADLK and EDEADLOCK: lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err | ^~~ lib/errname.c:172:2: note: in expansion of macro 'E' 172 | E(EDEADLK), /* EDEADLOCK */ | ^ On parisc, a similar error happens with -ECANCELLED, which is an alias for ECANCELED. Make the EDEADLK printing conditional on the number being distinct from EDEADLOCK, and remove the -ECANCELLED bit completely as it can never be hit. To ensure these are correct, add static_assert lines that verify all the remaining aliases are in fact identical to the canonical name. Fixes: 57f5677e53 ("printf: add support for printing symbolic error names") Cc: Petr Mladek <pmladek@suse.com> Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Acked-by: Uwe Kleine-König <uwe@kleine-koenig.org> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org> Acked-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Petr Mladek <pmladek@suse.com> Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:33:27 +01:00
Herbert Xu	553d8b25cc	lib/mpi: Fix buffer overrun when SG is too long ... [ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ] The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes: 2d4d1eea54 ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:32:52 +01:00
Kemeng Shi	3e5ddf2b84	sbitmap: correct wake_batch recalculation to avoid potential IO hung ... [ Upstream commit b5fcf7871acb7f9a3a8ed341a68bd86aba3e254a ] Commit 180dccb0db ("blk-mq: fix tag_get wait task can't be awakened") mentioned that in case of shared tags, there could be just one real active hctx(queue) because of lazy detection of tag idle. Then driver tag allocation may wait forever on this real active hctx(queue) if wake_batch is > hctx_max_depth where hctx_max_depth is available tags depth for the actve hctx(queue). However, the condition wake_batch > hctx_max_depth is not strong enough to avoid IO hung as the sbitmap_queue_wake_up will only wake up one wait queue for each wake_batch even though there is only one waiter in the woken wait queue. After this, there is only one tag to free and wake_batch may not be reached anymore. Commit 180dccb0db ("blk-mq: fix tag_get wait task can't be awakened") methioned that driver tag allocation may wait forever. Actually, the inactive hctx(queue) will be truely idle after at most 30 seconds and will call blk_mq_tag_wakeup_all to wake one waiter per wait queue to break the hung. But IO hung for 30 seconds is also not acceptable. Set batch size to small enough that depth of the shared hctx(queue) is enough to wake up all of the queues like sbq_calc_wake_batch do to fix this potential IO hung. Although hctx_max_depth will be clamped to at least 4 while wake_batch recalculation does not do the clamp, the wake_batch will be always recalculated to 1 when hctx_max_depth <= 4. Fixes: 180dccb0db ("blk-mq: fix tag_get wait task can't be awakened") Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Link: https://lore.kernel.org/r/20230116205059.3821738-6-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:32:42 +01:00
Gabriel Krisman Bertazi	0f312961c7	sbitmap: Use single per-bitmap counting to wake up queued tags ... [ Upstream commit 4f8126bb2308066b877859e4b5923ffb54143630 ] sbitmap suffers from code complexity, as demonstrated by recent fixes, and eventual lost wake ups on nested I/O completion. The later happens, from what I understand, due to the non-atomic nature of the updates to wait_cnt, which needs to be subtracted and eventually reset when equal to zero. This two step process can eventually miss an update when a nested completion happens to interrupt the CPU in between the wait_cnt updates. This is very hard to fix, as shown by the recent changes to this code. The code complexity arises mostly from the corner cases to avoid missed wakes in this scenario. In addition, the handling of wake_batch recalculation plus the synchronization with sbq_queue_wake_up is non-trivial. This patchset implements the idea originally proposed by Jan [1], which removes the need for the two-step updates of wait_cnt. This is done by tracking the number of completions and wakeups in always increasing, per-bitmap counters. Instead of having to reset the wait_cnt when it reaches zero, we simply keep counting, and attempt to wake up N threads in a single wait queue whenever there is enough space for a batch. Waking up less than batch_wake shouldn't be a problem, because we haven't changed the conditions for wake up, and the existing batch calculation guarantees at least enough remaining completions to wake up a batch for each queue at any time. Performance-wise, one should expect very similar performance to the original algorithm for the case where there is no queueing. In both the old algorithm and this implementation, the first thing is to check ws_active, which bails out if there is no queueing to be managed. In the new code, we took care to avoid accounting completions and wakeups when there is no queueing, to not pay the cost of atomic operations unnecessarily, since it doesn't skew the numbers. For more interesting cases, where there is queueing, we need to take into account the cross-communication of the atomic operations. I've been benchmarking by running parallel fio jobs against a single hctx nullb in different hardware queue depth scenarios, and verifying both IOPS and queueing. Each experiment was repeated 5 times on a 20-CPU box, with 20 parallel jobs. fio was issuing fixed-size randwrites with qd=64 against nullb, varying only the hardware queue length per test. queue size 2 4 8 16 32 64 6.1-rc2 1681.1K (1.6K) 2633.0K (12.7K) 6940.8K (16.3K) 8172.3K (617.5K) 8391.7K (367.1K) 8606.1K (351.2K) patched 1721.8K (15.1K) 3016.7K (3.8K) 7543.0K (89.4K) 8132.5K (303.4K) 8324.2K (230.6K) 8401.8K (284.7K) The following is a similar experiment, ran against a nullb with a single bitmap shared by 20 hctx spread across 2 NUMA nodes. This has 40 parallel fio jobs operating on the same device queue size 2 4 8 16 32 64 6.1-rc2 1081.0K (2.3K) 957.2K (1.5K) 1699.1K (5.7K) 6178.2K (124.6K) 12227.9K (37.7K) 13286.6K (92.9K) patched 1081.8K (2.8K) 1316.5K (5.4K) 2364.4K (1.8K) 6151.4K (20.0K) 11893.6K (17.5K) 12385.6K (18.4K) It has also survived blktests and a 12h-stress run against nullb. I also ran the code against nvme and a scsi SSD, and I didn't observe performance regression in those. If there are other tests you think I should run, please let me know and I will follow up with results. [1] https://lore.kernel.org/all/aef9de29-e9f5-259a-f8be-12d1b734e72@google.com/ Cc: Hugh Dickins <hughd@google.com> Cc: Keith Busch <kbusch@kernel.org> Cc: Liu Song <liusong@linux.alibaba.com> Suggested-by: Jan Kara <jack@suse.cz> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> Link: https://lore.kernel.org/r/20221105231055.25953-1-krisman@suse.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Stable-dep-of: b5fcf7871acb ("sbitmap: correct wake_batch recalculation to avoid potential IO hung") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:32:42 +01:00
Kemeng Shi	b2fbd1c9bd	sbitmap: remove redundant check in __sbitmap_queue_get_batch ... [ Upstream commit 903e86f3a64d9573352bbab2f211fdbbaa5772b7 ] Commit fbb564a557 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()") mentioned that "Checking free bits when setting the target bits. Otherwise, it may reuse the busying bits." This commit add check to make sure all masked bits in word before cmpxchg is zero. Then the existing check after cmpxchg to check any zero bit is existing in masked bits in word is redundant. Actually, old value of word before cmpxchg is stored in val and we will filter out busy bits in val by "(get_mask & ~val)" after cmpxchg. So we will not reuse busy bits methioned in commit fbb564a557 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()"). Revert new-added check to remove redundant check. Fixes: fbb564a557 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()") Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Link: https://lore.kernel.org/r/20230116205059.3821738-3-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:32:42 +01:00
Greg Kroah-Hartman	f9cc3a7058	This is the 6.1.14 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmP54jIACgkQONu9yGCS aT5fDRAAjFsMbxMrru7XL9In9tJM51bQdVADhYkVm3QmehDEFhcKryKn/WH8zJGb /r5aOhErgOMb52IjjTMDiUP7VmNjdfCMkL8JrWyBPZ5ZGMvxdGdaUeer5Q+n4HG/ v1ES8T5vrZDFn4jKfbz2hK9adjOgjCry2oqnxqOyNN6b9kSdLY34mqGqUbfMsgkQ ZUJvLevwY2AKKMCjz3DQpxCDLMnfrCVvt7swGIFFmehtlYfrSf/HJgWpBNtoGvm0 QRJY4yAb3EqQDv4AcEr8mO7QgH9IBKoMsSNuUO0Q14Pqg5cklMC4Mfc6ENlvw59I KchWeophErmdVOT7s6UnOxb4vygvCXI5Gf5eSg9K4esOjpQarOEKJDc5D6jidFnu O2xrF+RPzIhl/ud2NnnJ9uSs4mM63guVwW7QwxR7427dgYbJYDvErwskFzNayISV 6kkBbus0AK7KxBVvZmOY/wUBTh93CS9gqVfoKO96IRpBOxkH9NLwgqdQmgOqRHB8 e4SzvrjJlnLEXdTPDGSr0nzHKh735ab7H/xVeB64qBVwKClifpD882HuYgT4cxl+ A0G+vbYGB1Ijdy3O7QQx6AQtp5S474vpsB8WWeL33U25JfEcTL03SMZ0rh5tdJgN v/5gY+txCjo42Kdp4BiY2GdBf8FdGEqLB/ELCpg/zYc7YZW4wUA= =4fvq -----END PGP SIGNATURE----- Merge 6.1.14 into android14-6.1 Changes in 6.1.14 drm/etnaviv: don't truncate physical page address wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while recovery wifi: rtl8xxxu: gen2: Turn on the rate control drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink clk: mxl: Switch from direct readl/writel based IO to regmap based IO clk: mxl: Remove redundant spinlocks clk: mxl: Add option to override gate clks clk: mxl: Fix a clk entry by adding relevant flags powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G clk: mxl: syscon_node_to_regmap() returns error pointers sched/psi: Stop relying on timer_pending() for poll_work rescheduling random: always mix cycle counter in add_latent_entropy() scsi: libsas: Add smp_ata_check_ready_type() scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset spi: mediatek: Enable irq when pdata is ready docs: perf: Fix PMU instance name of hisi-pcie-pmu KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 spi: mediatek: Enable irq before the spi registration drm/i915: Remove __maybe_unused from mtl_info KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET selftests: kvm: move declaration at the beginning of main() powerpc/64s/radix: Fix RWX mapping with relocated kernel nfp: ethtool: support reporting link modes nfp: ethtool: fix the bug of setting unsupported port speed uaccess: Add speculation barrier to copy_from_user() x86/alternatives: Introduce int3_emulate_jcc() x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions x86/static_call: Add support for Jcc tail-calls Bluetooth: btusb: Add more device IDs for WCN6855 riscv: remove special treatment for the link order of head.o arm64: remove special treatment for the link order of head.o arch: fix broken BuildID for arm64 and riscv powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 sh: define RUNTIME_DISCARD_EXIT wifi: mwifiex: Add missing compatible string for SD8787 audit: update the mailing list in MAINTAINERS platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY platform/x86: nvidia-wmi-ec-backlight: Add force module parameter ext4: Fix function prototype mismatch for ext4_feat_ktype randstruct: disable Clang 15 support bpf: add missing header file include Linux 6.1.14 Change-Id: I704196855630a372d2c6564ab68bf7f7968b889e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-25 15:37:47 +00:00
Dave Hansen	684db631a1	uaccess: Add speculation barrier to copy_from_user() ... commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 upstream. The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively: if (access_ok(from, size)) // Right here even for bad from/size combinations. On first glance, it would be ideal to just add a speculation barrier to "access_ok()" so that its results can never be mis-speculated. But there are lots of system calls just doing access_ok() via "copy_to_user()" and friends (example: fstat() and friends). Those are generally not problematic because they do not _consume_ data from userspace other than the pointer. They are also very quick and common system calls that should not be needlessly slowed down. "copy_from_user()" on the other hand uses a user-controller pointer and is frequently followed up with code that might affect caches. Take something like this: if (!copy_from_user(&kernelvar, uptr, size)) do_something_with(kernelvar); If userspace passes in an evil 'uptr' that *actually* points to a kernel addresses, and then do_something_with() has cache (or other) side-effects, it could allow userspace to infer kernel data values. Add a barrier to the common copy_from_user() code to prevent mis-speculated values which happen after the copy. Also add a stub for architectures that do not define barrier_nospec(). This makes the macro usable in generic code. Since the barrier is now usable in generic code, the x86 #ifdef in the BPF code can also go away. Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Daniel Borkmann <daniel@iogearbox.net> # BPF bits Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-25 11:25:41 +01:00
Greg Kroah-Hartman	c747c01851	This is the 6.1.11 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPkywAACgkQONu9yGCS aT42Kw/9FFrdwv29yND651dPIglYKgO0Oz27/LFNGqst1A/G1ITzfs/94NSRr+9j uvwmBLbC+n/OXYavliBVWlPaYUCLqoFSfR+q953yz/UT0803E8BUvQ8NN8O7lsg7 hfbWJaASxt5puy2pBFypeWM+OXoVOvUBj3VhbgtUwwcYLPuYafj9rCAytdIIf5fr RKWBLfx7As4OJ+Hb3KNkolTkFDTfV5+zqCAc9Ko474d1bpRnF15UdQN8Kkinr2+O YNGTvDT8jR8eAk/9PiCNrG7DEMSKaczP8n/ap6PikD/KnK7ShtCLwZztLnmu65g1 vZG+cnEda8FuY3Ms03UrHhKqzMzBY/vslzBNMBTNmDsr+b7ilhffAYXPKS8s7xrg bJjmfzfITFAjXrml25enVO0V9RtTxv6E07U7SnDrLsvE2KBFZfUR/3Xl70bVBb0S db60kmEoq3XHHtoVySOHlfihVHSy02V9dlFcLOYMQsDHsGVsRXOR87g6d7+rJS3h hYWz5YxMLJUr2qn2836DPBnX9Ix0VjDx+X2fB4bNYzKc1dMlgzbpYrhk9LEOUDsx emJuqZskjkLby9Bw36N3eHW3fKPOFrwpYwPWYJHdWx1mmFSNdV6MdfEtZXpuEkFJ iFyJPeeODGadoiznnXTaBFfhozRj+B6FXrY6pkF+WMoSt8ZlZpM= =vu7j -----END PGP SIGNATURE----- Merge 6.1.11 into android14-6.1 Changes in 6.1.11 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts' arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name linux,keycode ASoC: amd: acp-es8336: Drop reference count of ACPI device after use ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use ASoC: Intel: sof_es8336: Drop reference count of ACPI device after use ASoC: Intel: avs: Implement PCI shutdown bpf: Fix off-by-one error in bpf_mem_cache_idx() bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() bpf: Fix to preserve reg parent/live fields when copying range info selftests/filesystems: grant executable permission to run_fat_tests.sh ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() bpf: Add missing btf_put to register_btf_id_dtor_kfuncs media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX arm64: dts: imx8mm-verdin: Do not power down eth-phy drm/vc4: hdmi: make CEC adapter name unique drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" bpf: Fix the kernel crash caused by bpf_setsockopt(). ALSA: memalloc: Workaround for Xen PV vhost/net: Clear the pending messages when the backend is removed copy_oldmem_kernel() - WRITE is "data source", not destination WRITE is "data source", not destination... READ is "data destination", not source... zcore: WRITE is "data source", not destination... memcpy_real(): WRITE is "data source", not destination... fix iov_iter_bvec() "direction" argument fix 'direction' argument of iov_iter_{init,bvec}() fix "direction" argument of iov_iter_kvec() use less confusing names for iov_iter direction initializers vhost-scsi: unbreak any layout for response ice: Prevent set_channel from changing queues while RDMA active qede: execute xdp_do_flush() before napi_complete_done() virtio-net: execute xdp_do_flush() before napi_complete_done() dpaa_eth: execute xdp_do_flush() before napi_complete_done() dpaa2-eth: execute xdp_do_flush() before napi_complete_done() skb: Do mix page pool and page referenced frags in GRO sfc: correctly advertise tunneled IPv6 segmentation net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices net: wwan: t7xx: Fix Runtime PM initialization block, bfq: replace 0/1 with false/true in bic apis block, bfq: fix uaf for bfqq in bic_set_bfqq() netrom: Fix use-after-free caused by accept on already connected socket fscache: Use wait_on_bit() to wait for the freeing of relinquished volume platform/x86/amd/pmf: update to auto-mode limits only after AMT event platform/x86/amd/pmf: Add helper routine to update SPS thermals platform/x86/amd/pmf: Fix to update SPS default pprof thermals platform/x86/amd/pmf: Add helper routine to check pprof is balanced platform/x86/amd/pmf: Fix to update SPS thermals when power supply change platform/x86/amd/pmf: Ensure mutexes are initialized before use platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning 255 drm/i915/guc: Fix locking when searching for a hung request drm/i915: Fix request ref counting during error capture & debugfs dump drm/i915: Fix up locking around dumping requests lists drm/i915/adlp: Fix typo for reference clock net/tls: tls_is_tx_ready() checked list_entry ALSA: firewire-motu: fix unreleased lock warning in hwdep device netfilter: br_netfilter: disable sabotage_in hook after first suppression block: ublk: extending queue_size to fix overflow kunit: fix kunit_test_init_section_suites(...) squashfs: harden sanity check in squashfs_read_xattr_id_table maple_tree: should get pivots boundary by type sctp: do not check hb_timer.expires when resetting hb_timer net: phy: meson-gxl: Add generic dummy stubs for MMD register access drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address riscv: kprobe: Fixup kernel panic when probing an illegal position igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() octeontx2-af: Fix devlink unregister can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate can: raw: fix CAN FD frame transmissions over CAN XL devices can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq ata: libata: Fix sata_down_spd_limit() when no link speed is reported selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking virtio-net: Keep stop() to follow mirror sequence of open() net: openvswitch: fix flow memory leak in ovs_flow_cmd_new efi: fix potential NULL deref in efi_mem_reserve_persistent rtc: sunplus: fix format string for printing resource certs: Fix build error when PKCS#11 URI contains semicolon kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU i2c: mxs: suppress probe-deferral error message scsi: target: core: Fix warning on RT kernels x86/aperfmperf: Erase stale arch_freq_scale values when disabling frequency invariance readings perf/x86/intel: Add Emerald Rapids perf/x86/intel/cstate: Add Emerald Rapids scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress i2c: rk3x: fix a bunch of kernel-doc warnings Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one" x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table platform/x86: hp-wmi: Handle Omen Key event platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN net/x25: Fix to not accept on connected socket drm/amd/display: Fix timing not changning when freesync video is enabled bcache: Silence memcpy() run-time false positive warnings iio: adc: stm32-dfsdm: fill module aliases usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF fbcon: Check font dimension limits cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() ARM: dts: imx7d-smegw01: Fix USB host over-current polarity net: qrtr: free memory on error path in radix_tree_insert() can: isotp: split tx timer into transmission and timeout can: isotp: handle wait_event_interruptible() return values watchdog: diag288_wdt: do not use stack buffers for hardware data watchdog: diag288_wdt: fix __diag288() inline assembly ALSA: hda/realtek: Add Acer Predator PH315-54 ALSA: hda/realtek: fix mute/micmute LEDs, speaker don't work for a HP platform ASoC: codecs: wsa883x: correct playback min/max rates ASoC: SOF: sof-audio: unprepare when swidget->use_count > 0 ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL ASoC: SOF: keep prepare/unprepare widgets in sink path efi: Accept version 2 of memory attributes table rtc: efi: Enable SET/GET WAKEUP services as optional iio: hid: fix the retval in accel_3d_capture_sample iio: hid: fix the retval in gyro_3d_capture_sample iio: adc: xilinx-ams: fix devm_krealloc() return value check iio: adc: berlin2-adc: Add missing of_node_put() in error path iio: imx8qxp-adc: fix irq flood when call imx8qxp_adc_read_raw() iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: light: cm32181: Fix PM support on system with 2 I2C resources iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix incorrect ODR mode readback iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix MAGN sensor scale and unit nvmem: brcm_nvram: Add check for kzalloc nvmem: sunxi_sid: Always use 32-bit MMIO reads nvmem: qcom-spmi-sdam: fix module autoloading parisc: Fix return code of pdc_iodc_print() parisc: Replace hardcoded value with PRIV_USER constant in ptrace.c parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case riscv: disable generation of unwind tables Revert "mm: kmemleak: alloc gray object for reserved region with direct map" mm: multi-gen LRU: fix crash during cgroup migration mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints usb: typec: ucsi: Don't attempt to resume the ports before they exist usb: gadget: udc: do not clear gadget driver.bus kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() HV: hv_balloon: fix memory leak with using debugfs_lookup() x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses fpga: m10bmc-sec: Fix probe rollback fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm/uffd: fix pte marker when fork() without fork event mm/swapfile: add cond_resched() in get_swap_pages() mm/khugepaged: fix ->anon_vma race mm, mremap: fix mremap() expanding for vma's with vm_ops->close() mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups highmem: round down the address passed to kunmap_flush_on_unmap() ia64: fix build error due to switch case label appearing next to declaration Squashfs: fix handling and sanity checking of xattr_ids count maple_tree: fix mas_empty_area_rev() lower bound validation migrate: hugetlb: check for hugetlb shared PMD in node migration dma-buf: actually set signaling bit for private stub fences serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler drm/i915: Avoid potential vm use-after-free drm/i915: Fix potential bit_17 double-free drm/amd: Fix initialization for nbio 4.3.0 drm/amd/pm: drop unneeded dpm features disablement for SMU 13.0.4/11 drm/amdgpu: update wave data type to 3 for gfx11 nvmem: core: initialise nvmem->id early nvmem: core: remove nvmem_config wp_gpio nvmem: core: fix cleanup after dev_set_name() nvmem: core: fix registration vs use race nvmem: core: fix device node refcounting nvmem: core: fix cell removal on error nvmem: core: fix return value phy: qcom-qmp-combo: fix runtime suspend serial: 8250_dma: Fix DMA Rx completion race serial: 8250_dma: Fix DMA Rx rearm race platform/x86/amd: pmc: add CONFIG_SERIO dependency ASoC: SOF: sof-audio: prepare_widgets: Check swidget for NULL on sink failure iio:adc:twl6030: Enable measurement of VAC powerpc/64s/radix: Fix crash with unaligned relocated kernel powerpc/64s: Fix local irq disable when PMIs are disabled powerpc/imc-pmu: Revert nest_init_lock to being a mutex fs/ntfs3: Validate attribute data and valid sizes ovl: Use "buf" flexible array for memcpy() destination f2fs: initialize locks earlier in f2fs_fill_super() fbdev: smscufx: fix error handling code in ufx_usb_probe f2fs: fix to do sanity check on i_extra_isize in is_alive() wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads gfs2: Cosmetic gfs2_dinode_{in,out} cleanup gfs2: Always check inode size of inline inodes bpf: Skip invalid kfunc call in backtrack_insn Linux 6.1.11 Change-Id: I69722bc9711b91f2fca18de59746ada373f64c5e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-09 13:29:55 +00:00
Liam Howlett	82587c0e27	maple_tree: fix mas_empty_area_rev() lower bound validation ... commit 7327e8111adb315423035fb5233533016dfd3f2e upstream. mas_empty_area_rev() was not correctly validating the start of a gap against the lower limit. This could lead to the range starting lower than the requested minimum. Fix the issue by better validating a gap once one is found. This commit also adds tests to the maple tree test suite for this issue and tests the mas_empty_area() function for similar bound checking. Link: https://lkml.kernel.org/r/20230111200136.1851322-1-Liam.Howlett@oracle.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216911 Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: <amanieu@gmail.com> Link: https://lore.kernel.org/linux-mm/0b9f5425-08d4-8013-aa4c-e620c3b10bb2@leemhuis.info/ Tested-by: Holger Hoffsttte <holger@applied-asynchrony.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-09 11:28:23 +01:00
Wei Yang	e0514483fa	maple_tree: should get pivots boundary by type ... [ Upstream commit ab6ef70a8b0d314c2160af70b0de984664d675e0 ] We should get pivots boundary by type. Fixes a potential overindexing of mt_pivots[]. Link: https://lkml.kernel.org/r/20221112234308.23823-1-richard.weiyang@gmail.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Wei Yang <richard.weiyang@gmail.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-09 11:28:08 +01:00
Liam Howlett	d8ae61aba7	FROMLIST: maple_tree: fix mas_empty_area_rev() lower bound validation ... mas_empty_area_rev() was not correctly validating the start of a gap against the lower limit. This could lead to the range starting lower than the requested minimum. Fix the issue by better validating a gap once one is found. This commit also adds tests to the maple tree test suite for this issue and tests the mas_empty_area() function for similar bound checking. Link: https://lkml.kernel.org/r/20230111200136.1851322-1-Liam.Howlett@oracle.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216911 Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: <amanieu@gmail.com> Link: https://lore.kernel.org/linux-mm/0b9f5425-08d4-8013-aa4c-e620c3b10bb2@leemhuis.info/ Tested-by: Holger Hoffsttte <holger@applied-asynchrony.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 267250884 Link: https://lore.kernel.org/all/20230111200136.1851322-1-Liam.Howlett@oracle.com/T/#u Change-Id: I1a0ffb8a40a58699d2000f70e0f5e59614a329f5 Signed-off-by: Liam Howlett <liam.howlett@oracle.com> Signed-off-by: Capone Huang <capone.huang@mediatek.com>	2023-02-07 17:59:07 +00:00
Greg Kroah-Hartman	936f394ef7	This is the 6.1.9 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPaFzoACgkQONu9yGCS aT6Y7Q//bOQ+QfUsJ9oi0hCQpC4L4REaM/WpqyWFn+/75KB4KDZ7IGaHAZ8UZSPQ DwZ0aoIAapQyAL7Q5WUDnG51Q07Xi4NfWPHNlz1FqAKdJu2D8uAmYP9I6M0JpEbg nV5ki8UXETkIu7EnfS7+5MjHLt99DaA+W0Z1J+qqXONRoszELUNfMdTZMoqVX5Vx gqmSpHmySt2mhSr8k4Inx5OvhF6pZ9mQVq0baUEieAcyaRXSRBBLTtOgntcYyq+R aAoCV5E+lLDZVkjntc6wKtTECD6zegfXCBqZdxQ1RUt5SBTn7K2XnGqQt+V3UbeH 5kFwUngvnpGDQeS8VuzWo+yGBLu0cp6PShP329SbO5o0bY8qRxiWfr37sxfMq/yh F947AjG2wWouCK4xle68/O6GvZNLtKJI1Z0MihpFKmeLbvL0S88rkSnhwjPQ5qBe kK8RfUATLKkl6XoTyJT/v/o+/tlAuHj3txrH3zsB0MQWuuxBkZ1JAAnmDnBCcvIJ BAr6HFRFr6kTfcREnMKkWr2EXO98DGrk0Eg9FTedm1F4RSL8iGQenTXNmRMhSxFv /MtF0sRwkstI+v7EINmmK+wNJeye03WjmWDjJVxIqOwfmGC5EfCGhGV4CfmdnBsE N18DZMZ5oc9ft/zmH9Pi/vJUlwRHDS52uQ3r7K3TYXHHveT62FE= =8rzU -----END PGP SIGNATURE----- Merge 6.1.9 into android14-6.1 Changes in 6.1.9 memory: tegra: Remove clients SID override programming memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() arm64: dts: qcom: sc8280xp: fix primary USB-DP PHY reset dmaengine: qcom: gpi: Set link_rx bit on GO TRE for rx operation dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG soc: imx: imx8mp-blk-ctrl: enable global pixclk with HDMI_TX_PHY PD arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' arm64: dts: verdin-imx8mm: fix dahlia audio playback arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux arm64: dts: verdin-imx8mm: fix dev board audio playback arm64: dts: imx93-11x11-evk: correct clock and strobe pad setting ARM: imx: add missing of_node_put() soc: imx: imx8mp-blk-ctrl: don't set power device name arm64: dts: imx8mp: Fix missing GPC Interrupt arm64: dts: imx8mp: Fix power-domain typo arm64: dts: imx8mp-evk: pcie0-refclk cosmetic cleanup HID: intel_ish-hid: Add check for ishtp_dma_tx_map arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity soc: imx8m: Fix incorrect check for of_clk_get_by_name() reset: ti-sci: honor TI_SCI_PROTOCOL setting when not COMPILE_TEST reset: uniphier-glue: Fix possible null-ptr-deref EDAC/highbank: Fix memory leak in highbank_mc_probe() firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Harden shared memory access in fetch_notification firmware: arm_scmi: Fix virtio channels cleanup on shutdown interconnect: qcom: msm8996: Provide UFS clocks to A2NoC interconnect: qcom: msm8996: Fix regmap max_register values HID: amd_sfh: Fix warning unwind goto tomoyo: fix broken dependency on *.conf.default RDMA/rxe: Fix inaccurate constants in rxe_type_info RDMA/rxe: Prevent faulty rkey generation erofs: fix kvcalloc() misuse with __GFP_NOFAIL arm64: dts: marvell: AC5/AC5X: Fix address for UART1 RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Remove user expected buffer invalidate race affs: initialize fsdata in affs_truncate() PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() arm64: dts: qcom: msm8992: Don't use sfpb mutex arm64: dts: qcom: msm8992-libra: Fix the memory map kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y phy: ti: fix Kconfig warning and operator precedence drm/msm/gpu: Fix potential double-free NFSD: fix use-after-free in nfsd4_ssc_setup_dul() ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 drm/vc4: bo: Fix drmm_mutex_init memory hog phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe() bpf: hash map, avoid deadlock with suitable hash mask amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation drm/vc4: bo: Fix unused variable warning phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() net: lan966x: add missing fwnode_handle_put() for ports node sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid pinctrl: rockchip: fix reading pull type on rk3568 net: stmmac: Fix queue statistics reading net/sched: sch_taprio: fix possible use-after-free l2tp: convert l2tp_tunnel_list to idr l2tp: close all race conditions in l2tp_tunnel_register() net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() pinctrl: rockchip: fix mux route data for rk3568 ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp157c-emstamp-argon ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l HID: revert CHERRY_MOUSE_000C quirk block/rnbd-clt: fix wrong max ID in ida_alloc_max usb: ucsi: Ensure connector delayed work items are flushed usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request netfilter: conntrack: handle tcp challenge acks during connection reuse Bluetooth: Fix a buffer overflow in mgmt_mesh_add() Bluetooth: hci_conn: Fix memory leaks Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() Bluetooth: ISO: Avoid circular locking dependency Bluetooth: ISO: Fix possible circular locking dependency Bluetooth: hci_event: Fix Invalid wait context Bluetooth: Fix possible deadlock in rfcomm_sk_state_change net: ipa: disable ipa interrupt during suspend net/mlx5e: Avoid false lock dependency warning on tc_ht even more net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT net/mlx5e: QoS, Fix wrongfully setting parent_element_id on MODIFY_SCHEDULING_ELEMENT net/mlx5e: Set decap action based on attr for sample net/mlx5: E-switch, Fix switchdev mode after devlink reload net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding virtio-net: correctly enable callback during start_xmit l2tp: prevent lockdep issue in l2tp_tunnel_register() HID: betop: check shape of output reports drm/i915/selftests: Unwind hugepages to drop wakeref on error cifs: fix potential deadlock in cache_refresh_path() dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() dmaengine: tegra: Fix memory leak in terminate_all() phy: phy-can-transceiver: Skip warning if no "max-bitrate" drm/amd/display: fix issues with driver unload net: sched: gred: prevent races when adding offloads to stats nvme-pci: fix timeout request state check tcp: avoid the lookup process failing to get sk in ehash table usb: dwc3: fix extcon dependency ptdma: pt_core_execute_cmd() should use spinlock device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array selftests/net: toeplitz: fix race on tpacket_v3 block close net: dsa: microchip: ksz9477: port map correction in ALU table entry register thermal: Validate new state in cur_state_store() thermal/core: fix error code in __thermal_cooling_device_register() thermal: core: call put_device() only after device_register() fails net: stmmac: enable all safety features by default bnxt: Do not read past the end of test names tcp: fix rate_app_limited to default to 1 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace ASoC: SOF: pm: Set target state earlier ASoC: SOF: pm: Always tear down pipelines before DSP suspend ASoC: SOF: Add FW state to debugfs ASoC: amd: yc: Add Razer Blade 14 2022 into DMI table spi: cadence: Fix busy cycles calculation cpufreq: CPPC: Add u64 casts to avoid overflowing cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist ASoC: mediatek: mt8186: support rt5682s_max98360 ASoC: mediatek: mt8186: Add machine support for max98357a ASoC: amd: yc: Add ASUS M5402RA into DMI table ASoC: support machine driver with max98360 kcsan: test: don't put the expect array on the stack cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist ASoC: fsl_micfil: Correct the number of steps on SX controls drm/msm/a6xx: Avoid gx gbit halt during rpm suspend net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard s390: expicitly align _edata and _end symbols on page boundary xen/pvcalls: free active map buffer on pvcalls_front_free_map perf/x86/cstate: Add Meteor Lake support perf/x86/msr: Add Meteor Lake support perf/x86/msr: Add Emerald Rapids perf/x86/intel/uncore: Add Emerald Rapids nolibc: fix fd_set type tools/nolibc: Fix S_ISxxx macros tools/nolibc: fix missing includes causing build issues at -O0 tools/nolibc: prevent gcc from making memset() loop over itself cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA drm/amdkfd: Add sync after creating vram bo drm/amdkfd: Fix NULL pointer error for GC 11.0.1 on mGPU cifs: fix potential memory leaks in session setup spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Use abort task set to reset SAS disks when discovered scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id r8152: add vendor/device ID pair for Microsoft Devkit platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_CAMERA platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK platform/x86: asus-wmi: Add quirk wmi_ignore_fan platform/x86: asus-wmi: Ignore fan on E410MA platform/x86: simatic-ipc: correct name of a model platform/x86: simatic-ipc: add another model lockref: stop doing cpu_relax in the cmpxchg loop ata: pata_cs5535: Don't build on UML firmware: coreboot: Check size of table entry and use flex-array btrfs: zoned: enable metadata over-commit for non-ZNS setup Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" arm64: efi: Recover from synchronous exceptions occurring in firmware arm64: efi: Avoid workqueue to check whether EFI runtime is live arm64: efi: Account for the EFI runtime stack in stack unwinder Bluetooth: hci_sync: cancel cmd_timer if hci_open failed drm/i915: Allow panel fixed modes to have differing sync polarities drm/i915: Allow alternate fixed modes always for eDP drm/amdgpu: complete gfxoff allow signal during suspend without delay io_uring/msg_ring: fix remote queue to disabled ring wifi: mac80211: Proper mark iTXQs for resumption wifi: mac80211: Fix iTXQ AMPDU fragmentation handling sched/fair: Check if prev_cpu has highest spare cap in feec() sched/uclamp: Fix a uninitialized variable warnings vfio/type1: Respect IOMMU reserved regions in vfio_test_domain_fgsp() scsi: hpsa: Fix allocation size for scsi_host_alloc() kvm/vfio: Fix potential deadlock on vfio group_lock nfsd: don't free files unconditionally in __nfsd_file_cache_purge module: Don't wait for GOING modules ftrace: Export ftrace_free_filter() to modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect ksmbd: add max connections parameter ksmbd: do not sign response to session request for guest login ksmbd: downgrade ndr version error message to debug ksmbd: limit pdu length size according to connection status ovl: fix tmpfile leak ovl: fail on invalid uid/gid mapping at copy up io_uring/net: cache provided buffer group value for multishot receives KVM: x86/vmx: Do not skip segment attributes if unusable bit is set KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation scsi: ufs: core: Fix devfreq deadlocks riscv: fix -Wundef warning for CONFIG_RISCV_BOOT_SPINWAIT thermal: intel: int340x: Protect trip temperature from concurrent updates regulator: dt-bindings: samsung,s2mps14: add lost samsung,ext-control-gpios ipv6: fix reachability confirmation with proxy_ndp ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms drm/display/dp_mst: Correct the kref of port. drm/amd/pm: add missing AllowIHInterrupt message mapping for SMU13.0.0 drm/amdgpu: remove unconditional trap enable on add gfx11 queues drm/amdgpu/display/mst: Fix mst_state->pbn_div and slot count assignments drm/amdgpu/display/mst: limit payload to be updated one by one drm/amdgpu/display/mst: update mst_mgr relevant variable when long HPD io_uring: inline io_req_task_work_add() io_uring: inline __io_req_complete_post() io_uring: hold locks for io_req_complete_failed io_uring: use io_req_task_complete() in timeout io_uring: remove io_req_tw_post_queue io_uring: inline __io_req_complete_put() net: mana: Fix IRQ name - add PCI and queue number io_uring: always prep_async for drain requests i2c: designware: use casting of u64 in clock multiplication to avoid overflow i2c: designware: Fix unbalanced suspended flag drm/drm_vma_manager: Add drm_vma_node_allow_once() drm/i915: Fix a memory leak with reused mmap_offset iavf: fix temporary deadlock and failure to set MAC address iavf: schedule watchdog immediately when changing primary MAC netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path net: fec: Use page_pool_put_full_page when freeing rx buffers nvme: simplify transport specific device attribute handling nvme: consolidate setting the tagset flags nvme-fc: fix initialization order drm/i915/selftest: fix intel_selftest_modify_policy argument types ACPI: video: Add backlight=native DMI quirk for HP Pavilion g6-1d80nr ACPI: video: Add backlight=native DMI quirk for HP EliteBook 8460p ACPI: video: Add backlight=native DMI quirk for Asus U46E netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() net: dsa: microchip: fix probe of I2C-connected KSZ8563 net: ethernet: adi: adin1110: Fix multicast offloading netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting platform/x86: apple-gmux: Move port defines to apple-gmux.h platform/x86: apple-gmux: Add apple_gmux_detect() helper ACPI: video: Fix apple gmux detection tracing/osnoise: Use built-in RCU list checking net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope riscv/kprobe: Fix instruction simulation of JALR nvme: fix passthrough csi check gpio: mxc: Unlock on error path in mxc_flip_edge() gpio: ep93xx: Fix port F hwirq numbers in handler net: ravb: Fix lack of register setting after system resumed for Gen3 net: ravb: Fix possible hang if RIS2_QFF1 happen net: mctp: add an explicit reference from a mctp_sk_key to sock net: mctp: move expiry timer delete to unhash net: mctp: hold key reference when looking up a general key net: mctp: mark socks as dead on unhash, prevent re-add thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() riscv: Move call to init_cpu_topology() to later initialization stage net/tg3: resolve deadlock in tg3_reset_task() during EEH tsnep: Fix TX queue stop/wake for multiple queues net: mdio-mux-meson-g12a: force internal PHY off on mux switch Partially revert "perf/arm-cmn: Optimise DTC counter accesses" block: ublk: move ublk_chr_class destroying after devices are removed treewide: fix up files incorrectly marked executable tools: gpio: fix -c option of gpio-event-mon Fix up more non-executable files marked executable Revert "mm/compaction: fix set skip in fast_find_migrateblock" Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" Input: i8042 - add Clevo PCX0DX to i8042 quirk table x86/sev: Add SEV-SNP guest feature negotiation support acpi: Fix suspend with Xen PV dt-bindings: riscv: fix underscore requirement for multi-letter extensions dt-bindings: riscv: fix single letter canonical order x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL dt-bindings: i2c: renesas,rzv2m: Fix SoC specific string netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int amdgpu: fix build on non-DCN platforms. Linux 6.1.9 Change-Id: I750dee519337922880b87841f6732565961c6b0a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 09:12:59 +00:00
Eric Dumazet	992e4ff711	netlink: prevent potential spectre v1 gadgets ... [ Upstream commit f0950402e8c76e7dcb08563f1b4e8000fbc62455 ] Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions. Fixes: bfa83a9e03 ("[NETLINK]: Type-safe netlink messages/attributes interface") Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20230119110150.2678537-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:34:43 +01:00
Mateusz Guzik	448e5fbbf9	lockref: stop doing cpu_relax in the cmpxchg loop ... [ Upstream commit f5fe24ef17b5fbe6db49534163e77499fb10ae8c ] On the x86-64 architecture even a failing cmpxchg grants exclusive access to the cacheline, making it preferable to retry the failed op immediately instead of stalling with the pause instruction. To illustrate the impact, below are benchmark results obtained by running various will-it-scale tests on top of the 6.2-rc3 kernel and Cascade Lake (2 sockets * 24 cores * 2 threads) CPU. All results in ops/s. Note there is some variance in re-runs, but the code is consistently faster when contention is present. open3 ("Same file open/close"): proc stock no-pause 1 805603 814942 (+%1) 2 1054980 1054781 (-0%) 8 1544802 1822858 (+18%) 24 1191064 2199665 (+84%) 48 851582 1469860 (+72%) 96 609481 1427170 (+134%) fstat2 ("Same file fstat"): proc stock no-pause 1 3013872 3047636 (+1%) 2 4284687 4400421 (+2%) 8 3257721 5530156 (+69%) 24 2239819 5466127 (+144%) 48 1701072 5256609 (+209%) 96 1269157 6649326 (+423%) Additionally, a kernel with a private patch to help access() scalability: access2 ("Same file access"): proc stock patched patched +nopause 24 2378041 2005501 5370335 (-15% / +125%) That is, fixing the problems in access itself *reduces* scalability after the cacheline ping-pong only happens in lockref with the pause instruction. Note that fstat and access benchmarks are not currently integrated into will-it-scale, but interested parties can find them in pull requests to said project. Code at hand has a rather tortured history. First modification showed up in commit d472d9d98b ("lockref: Relax in cmpxchg loop"), written with Itanium in mind. Later it got patched up to use an arch-dependent macro to stop doing it on s390 where it caused a significant regression. Said macro had undergone revisions and was ultimately eliminated later, going back to cpu_relax. While I intended to only remove cpu_relax for x86-64, I got the following comment from Linus: I would actually prefer just removing it entirely and see if somebody else hollers. You have the numbers to prove it hurts on real hardware, and I don't think we have any numbers to the contrary. So I think it's better to trust the numbers and remove it as a failure, than say "let's just remove it on x86-64 and leave everybody else with the potentially broken code" Additionally, Will Deacon (maintainer of the arm64 port, one of the architectures previously benchmarked): So, from the arm64 side of the fence, I'm perfectly happy just removing the cpu_relax() calls from lockref. As such, come back full circle in history and whack it altogether. Signed-off-by: Mateusz Guzik <mjguzik@gmail.com> Link: https://lore.kernel.org/all/CAGudoHHx0Nqg6DE70zAVA75eV-HXfWyhVMWZ-aSeOofkA_=WdA@mail.gmail.com/ Acked-by: Tony Luck <tony.luck@intel.com> # ia64 Acked-by: Nicholas Piggin <npiggin@gmail.com> # powerpc Acked-by: Will Deacon <will@kernel.org> # arm64 Acked-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:34:34 +01:00
Greg Kroah-Hartman	ee921ef7b4	Merge 6.1.8 into android14-6.1 ... Changes in 6.1.8 dma-buf: fix dma_buf_export init order v2 btrfs: fix trace event name typo for FLUSH_DELAYED_REFS wifi: iwlwifi: fw: skip PPAG for JF pNFS/filelayout: Fix coalescing test for single DS selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID net: ethernet: marvell: octeontx2: Fix uninitialized variable warning tools/virtio: initialize spinlocks in vring_test.c vdpa/mlx5: Return error on vlan ctrl commands if not supported vdpa/mlx5: Avoid using reslock in event_handler vdpa/mlx5: Avoid overwriting CVQ iotlb virtio_pci: modify ENOENT to EINVAL vduse: Validate vq_num in vduse_validate_config() vdpa_sim_net: should not drop the multicast/broadcast packet net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down() r8169: fix dmar pte write access is not set error bpf: keep a reference to the mm, in case the task is dead. RDMA/srp: Move large values to a new enum for gcc13 selftests: net: fix cmsg_so_mark.sh test hang btrfs: always report error in run_one_delayed_ref() x86/asm: Fix an assembler warning with current binutils f2fs: let's avoid panic if extent_tree is not created perf/x86/rapl: Treat Tigerlake like Icelake cifs: fix race in assemble_neg_contexts() memblock tests: Fix compilation error. perf/x86/rapl: Add support for Intel Meteor Lake perf/x86/rapl: Add support for Intel Emerald Rapids of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2 fbdev: omapfb: avoid stack overflow warning Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 Bluetooth: hci_qca: Fix driver shutdown on closed serdev wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices wifi: mac80211: fix MLO + AP_VLAN check wifi: mac80211: reset multiple BSSID options in stop_ap() wifi: mac80211: sdata can be NULL during AMPDU start wifi: mac80211: fix initialization of rx->link and rx->link_sta nommu: fix memory leak in do_mmap() error path nommu: fix do_munmap() error path nommu: fix split_vma() map_count error proc: fix PIE proc-empty-vm, proc-pid-vm tests Add exception protection processing for vd in axi_chan_handle_err function LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap zonefs: Detect append writes at invalid locations nilfs2: fix general protection fault in nilfs_btree_insert() mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE hugetlb: unshare some PMDs when splitting VMAs mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler" xhci-pci: set the dma max_seg_size usb: xhci: Check endpoint is valid before dereferencing it xhci: Fix null pointer dereference when host dies xhci: Add update_hub_device override for PCI xHCI hosts xhci: Add a flag to disable USB3 lpm on a xhci root port level. usb: acpi: add helper to check port lpm capability using acpi _DSM xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables prlimit: do_prlimit needs to have a speculation check USB: serial: option: add Quectel EM05-G (GR) modem USB: serial: option: add Quectel EM05-G (CS) modem USB: serial: option: add Quectel EM05-G (RS) modem USB: serial: option: add Quectel EC200U modem USB: serial: option: add Quectel EM05CN (SG) modem USB: serial: option: add Quectel EM05CN modem staging: vchiq_arm: fix enum vchiq_status return types USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 usb: misc: onboard_hub: Invert driver registration order usb: misc: onboard_hub: Move 'attach' work to the driver misc: fastrpc: Fix use-after-free and race in fastrpc_map_find misc: fastrpc: Don't remove map on creater_process and device_release misc: fastrpc: Fix use-after-free race condition for maps usb: core: hub: disable autosuspend for TI TUSB8041 comedi: adv_pci1760: Fix PWM instruction handling ACPI: PRM: Check whether EFI runtime is available mmc: sunxi-mmc: Fix clock refcount imbalance during unbind mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting mm/hugetlb: fix PTE marker handling in hugetlb_change_protection() mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection() mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list() btrfs: fix missing error handling when logging directory items btrfs: fix directory logging due to race with concurrent index key deletion btrfs: add missing setup of log for full commit at add_conflicting_inode() btrfs: do not abort transaction on failure to write log tree when syncing log btrfs: do not abort transaction on failure to update log root btrfs: qgroup: do not warn on record without old_roots populated btrfs: fix invalid leaf access due to inline extent during lseek btrfs: fix race between quota rescan and disable leading to NULL pointer deref cifs: do not include page data when checking signature thunderbolt: Disable XDomain lane 1 only in software connection manager thunderbolt: Use correct function to calculate maximum USB3 link rate thunderbolt: Do not report errors if on-board retimers are found thunderbolt: Do not call PM runtime functions in tb_retimer_scan() riscv: dts: sifive: fu740: fix size of pcie 32bit memory bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer tty: fix possible null-ptr-defer in spk_ttyio_release pktcdvd: check for NULL returna fter calling bio_split_to_limits() io_uring/poll: don't reissue in case of poll race on multishot request mptcp: explicitly specify sock family at subflow creation time mptcp: netlink: respect v4/v6-only sockets selftests: mptcp: userspace: validate v4-v6 subflows mix USB: gadgetfs: Fix race between mounting and unmounting USB: serial: cp210x: add SCALANCE LPE-9000 device id usb: cdns3: remove fetched trb from cache before dequeuing usb: host: ehci-fsl: Fix module alias usb: musb: fix error return code in omap2430_probe() usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail usb: typec: altmodes/displayport: Add pin assignment helper usb: typec: altmodes/displayport: Fix pin assignment calculation usb: gadget: g_webcam: Send color matching descriptor per frame USB: gadget: Add ID numbers to configfs-gadget driver names usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 arm64: dts: imx8mp: correct usb clocks dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation serial: pch_uart: Pass correct sg to dma_unmap_sg() dmaengine: lgm: Move DT parsing after initialization dmaengine: tegra210-adma: fix global intr clear dmaengine: idxd: Let probe fail when workqueue cannot be enabled dmaengine: idxd: Prevent use after free on completion memory dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable serial: amba-pl011: fix high priority character transmission in rs486 mode serial: atmel: fix incorrect baudrate setup serial: exar: Add support for Sealevel 7xxxC serial cards gsmi: fix null-deref in gsmi_get_variable mei: bus: fix unlink on bus in error path mei: me: add meteor lake point M DID VMCI: Use threaded irqs instead of tasklets ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI ARM: omap1: fix !ARCH_OMAP1_ANY link failures drm/amdgpu: fix amdgpu_job_free_resources v2 drm/amdgpu: allow multipipe policy on ASICs with one MEC drm/amdgpu: Correct the power calcultion for Renior/Cezanne. drm/i915: re-disable RC6p on Sandy Bridge drm/i915/display: Check source height is > 0 drm/i915: Allow switching away via vga-switcheroo if uninitialized drm/i915: Remove unused variable drm/amd/display: Fix set scaling doesn's work drm/amd/display: Calculate output_color_space after pixel encoding adjustment drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix drm/amd/display: disable S/G display on DCN 3.1.5 drm/amd/display: disable S/G display on DCN 3.1.4 cifs: reduce roundtrips on create/qinfo requests fs/ntfs3: Fix attr_punch_hole() null pointer derenference arm64: efi: Execute runtime services from a dedicated stack efi: rt-wrapper: Add missing include panic: Separate sysctl logic from CONFIG_SMP exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN drm/amdgpu/discovery: enable soc21 common for GC 11.0.4 drm/amdgpu/discovery: enable gmc v11 for GC 11.0.4 drm/amdgpu/discovery: enable gfx v11 for GC 11.0.4 drm/amdgpu/discovery: enable mes support for GC v11.0.4 drm/amdgpu: set GC 11.0.4 family drm/amdgpu/discovery: set the APU flag for GC 11.0.4 drm/amdgpu: add gfx support for GC 11.0.4 drm/amdgpu: add gmc v11 support for GC 11.0.4 drm/amdgpu/discovery: add PSP IP v13.0.11 support drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11 drm/amdgpu: add smu 13 support for smu 13.0.11 drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11 drm/amdgpu/soc21: add mode2 asic reset for SMU IP v13.0.11 drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4 drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1 drm/amdgpu: enable PSP IP v13.0.11 support drm/amdgpu: enable GFX IP v11.0.4 CG support drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4 drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4 drm/amdgpu: add tmz support for GC 11.0.1 drm/amdgpu: add tmz support for GC IP v11.0.4 drm/amdgpu: correct MEC number for gfx11 APUs octeontx2-pf: Avoid use of GFP_KERNEL in atomic context net/ulp: use consistent error code when blocking ULP octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() block: mq-deadline: Rename deadline_is_seq_writes() Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" soc: qcom: apr: Make qcom,protection-domain optional again Linux 6.1.8 Change-Id: I35d5b5a1ed4822eddb2fc8b29b323b36f7d11926 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-26 12:13:04 +00:00
Kees Cook	13aa82f007	panic: Consolidate open-coded panic_on_warn checks ... commit 79cc1ba7badf9e7a12af99695a557e9ce27ee967 upstream. Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location. Cc: Marco Elver <elver@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Juri Lelli <juri.lelli@redhat.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Ben Segall <bsegall@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Daniel Bristot de Oliveira <bristot@redhat.com> Cc: Valentin Schneider <vschneid@redhat.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: David Gow <davidgow@google.com> Cc: tangmeng <tangmeng@uniontech.com> Cc: Jann Horn <jannh@google.com> Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: Petr Mladek <pmladek@suse.com> Cc: "Paul E. McKenney" <paulmck@kernel.org> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Cc: kasan-dev@googlegroups.com Cc: linux-mm@kvack.org Reviewed-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Marco Elver <elver@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Link: https://lore.kernel.org/r/20221117234328.594699-4-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-24 07:24:41 +01:00
Greg Kroah-Hartman	47a0453b99	This is the 6.1.5 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmO/6qcACgkQONu9yGCS aT5/dhAAmz5tf0T/IJNrfhFeMt9L7vq3grmisuDUTbTGb/1Nd8C+2h8K7PCZDaI7 vzR8Py5jA9pZtjxYmV+rp/6Z3Vofme8kz4b8KEu2FumsXRqW0LHsH0B+GKzbHR5S rOjhE7xSTkuF1agqlSMoJ97c3r81ejU7U27yWg9cvaBo/NgUJfNvZjvlhH6zU6pF BaMHRsxak1RkOHI3aZa3ZGM3ky6Uu8jfNSuxWyKkOWzxsZkju6JPqiWxS/LNdIxp MZbnq5c5qnVHBwFjwbOM2MLplEGwt5seibHKxbSRI4FGXdaAQKG8VJnMgk9kCKmf eJST8/jFn4gdP2TufP61xzipNGHfGIl95Ha8t6j8KAQp0kjwisu4YE9pa/dvtmVZ wReikI7iuNK5nQAwtmLHOZLAa8lcGNFhJQrpwXaNwGKgL5Un1eMQZRBYnY0ia7jI 8lKkT3fPrOXPynjjuBbIij/VF7pU7AC00u29PQQ3TTwzzgN7K2ilo9Bg7AxVj6Kr gPxvcDFV2OLk0OdEMWNckR5lZqyrJS1B12iL7F3gdoWbgYLlaRmsuRwz8S9yr4F+ UNECCzn4ZRIdxCwe3qER9beh9BAr43vXXEOksGhblAMm5UNNNdUhuWsK5sYHXOQW VAjJDXZ/MHZFh9btXzNr4Af1VW1fuJ2HXZs/qLBFXjIEtzNXdtg= =ons5 -----END PGP SIGNATURE----- Merge 6.1.5 into android14-6.1 Changes in 6.1.5 ARM: renumber bits related to _TIF_WORK_MASK btrfs: replace strncpy() with strscpy() cifs: fix interface count calculation during refresh cifs: refcount only the selected iface during interface update usb: dwc3: gadget: Ignore End Transfer delay on teardown btrfs: fix off-by-one in delalloc search during lseek btrfs: fix compat_ro checks against remount perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data phy: qcom-qmp-combo: fix broken power on btrfs: fix an error handling path in btrfs_defrag_leaves() SUNRPC: ensure the matching upcall is in-flight upon downcall wifi: ath9k: use proper statements in conditionals bpf: pull before calling skb_postpull_rcsum() drm/panfrost: Fix GEM handle creation ref-counting netfilter: nf_tables: consolidate set description netfilter: nf_tables: add function to create set stateful expressions netfilter: nf_tables: perform type checking for existing sets ice: xsk: do not use xdp_return_frame() on tx_buf->raw_buf net: vrf: determine the dst using the original ifindex for multicast vmxnet3: correctly report csum_level for encapsulated packet mptcp: fix deadlock in fastopen error path mptcp: fix lockdep false positive netfilter: nf_tables: honor set timeout and garbage collection updates bonding: fix lockdep splat in bond_miimon_commit() net: lan966x: Fix configuration of the PCS veth: Fix race with AF_XDP exposing old or uninitialized descriptors nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: hns3: fix miss L3E checking for rx packet net: hns3: fix VF promisc mode not update when mac table full net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure net: dsa: mv88e6xxx: depend on PTP conditionally nfc: Fix potential resource leaks bnxt_en: Simplify bnxt_xdp_buff_init() bnxt_en: Fix XDP RX path bnxt_en: Fix first buffer size calculations for XDP multi-buffer bnxt_en: Fix HDS and jumbo thresholds for RX packets vdpa/mlx5: Fix rule forwarding VLAN to TIR vdpa/mlx5: Fix wrong mac address deletion vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() vhost/vsock: Fix error handling in vhost_vsock_init() vringh: fix range used in iotlb_translate() vhost: fix range used in translate_desc() vhost-vdpa: fix an iotlb memory leak vdpa_sim: fix vringh initialization in vdpasim_queue_ready() virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove vdpasim: fix memory leak when freeing IOTLBs net/mlx5: E-Switch, properly handle ingress tagged packets on VST net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path net/mlx5: Fix io_eq_size and event_eq_size params validation net/mlx5: Avoid recovery in probe flows net/mlx5: Fix RoCE setting at HCA level net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default net/mlx5e: Fix RX reporter for XSK RQs net/mlx5e: CT: Fix ct debugfs folder name net/mlx5e: Always clear dest encap in neigh-update-del net/mlx5e: Fix hw mtu initializing at XDP SQ allocation net/mlx5e: Set geneve_tlv_option_0_exist when matching on geneve option net/mlx5: Lag, fix failure to cancel delayed bond work bpf: Always use maximal size for copy_array() tcp: Add TIME_WAIT sockets in bhash2. net: hns3: refine the handling for VF heartbeat net: amd-xgbe: add missed tasklet_kill net: ena: Fix toeplitz initial hash value net: ena: Don't register memory info on XDP exchange net: ena: Account for the number of processed bytes in XDP net: ena: Use bitmask to indicate packet redirection net: ena: Fix rx_copybreak value update net: ena: Set default value for RX interrupt moderation net: ena: Update NUMA TPH hint register upon NUMA node update net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe gpio: pca953x: avoid to use uninitialized value pinctrl RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device RDMA/mlx5: Fix validation of max_rd_atomic caps for DC selftests: net: fix cleanup_v6() for arp_ndisc_evict_nocarrier selftests: net: return non-zero for failures reported in arp_ndisc_evict_nocarrier drm/meson: Reduce the FIFO lines held when AFBC is not used filelock: new helper: vfs_inode_has_locks ceph: switch to vfs_inode_has_locks() to fix file lock bug gpio: sifive: Fix refcount leak in sifive_gpio_probe net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop vxlan: Fix memory leaks in error path net: sparx5: Fix reading of the MAC address netfilter: ipset: fix hash:net,port,net hang with /0 subnet netfilter: ipset: Rework long task execution when adding/deleting entries drm/virtio: Fix memory leak in virtio_gpu_object_create() perf tools: Fix resources leak in perf_data__open_dir() drm/imx: ipuv3-plane: Fix overlay plane width fs/ntfs3: don't hold ni_lock when calling truncate_setsize() drivers/net/bonding/bond_3ad: return when there's no aggregator octeontx2-pf: Fix lmtst ID used in aura free usb: rndis_host: Secure rndis_query check against int overflow perf lock contention: Fix core dump related to not finding the "__sched_text_end" symbol on s/390 perf stat: Fix handling of unsupported cgroup events when using BPF counters perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() drm/i915/gvt: fix double free bug in split_2MB_gtt_entry ublk: honor IO_URING_F_NONBLOCK for handling control command qed: allow sleep in qed_mcp_trace_dump() net/ulp: prevent ULP without clone op from entering the LISTEN status caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file usb: dwc3: xilinx: include linux/gpio/consumer.h hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling ASoC: SOF: Revert: "core: unregister clients and machine drivers in .shutdown" 9p/client: fix data race on req->status ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet ASoC: SOF: mediatek: initialize panic_info to zero drm/amdgpu: Fix size validation for non-exclusive domains (v4) drm/amdkfd: Fix kfd_process_device_init_vm error handling drm/amdkfd: Fix double release compute pasid io_uring/cancel: re-grab ctx mutex after finishing wait nvme: fix multipath crash caused by flush request when blktrace is enabled ACPI: video: Allow GPU drivers to report no panels drm/amd/display: Report to ACPI video if no panels were found ACPI: video: Don't enable fallback path for creating ACPI backlight by default io_uring: check for valid register opcode earlier kunit: alloc_string_stream_fragment error handling bug fix nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it nvme: also return I/O command effects from nvme_command_effects ASoC: SOF: Intel: pci-tgl: unblock S5 entry if DMA stop has failed" x86/kexec: Fix double-free of elf header buffer x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB bpf: Fix panic due to wrong pageattr of im->image Revert "drm/amd/display: Enable Freesync Video Mode by default" Revert "net: dsa: qca8k: cache lo and hi for mdio write" net: dsa: qca8k: fix wrong length value for mgmt eth packet net: dsa: tag_qca: fix wrong MGMT_DATA2 size block: don't allow splitting of a REQ_NOWAIT bio io_uring: pin context while queueing deferred tw io_uring: fix CQ waiting timeout handling tpm: Allow system suspend to continue when TPM suspend fails vhost_vdpa: fix the crash in unmap a large memory thermal: int340x: Add missing attribute for data rate base riscv: uaccess: fix type of 0 variable on error in get_user() riscv, kprobes: Stricter c.jr/c.jalr decoding of/fdt: run soc memory setup when early_init_dt_scan_memory fails drm/plane-helper: Add the missing declaration of drm_atomic_state drm/amdkfd: Fix kernel warning during topology setup drm/i915/gvt: fix gvt debugfs destroy drm/i915/gvt: fix vgpu debugfs clean in remove virtio-blk: use a helper to handle request queuing errors virtio_blk: Fix signedness bug in virtblk_prep_rq() drm/amd/display: Add check for DET fetch latency hiding for dcn32 drm/amd/display: Uninitialized variables causing 4k60 UCLK to stay at DPM1 and not DPM0 btrfs: handle case when repair happens with dev-replace ksmbd: fix infinite loop in ksmbd_conn_handler_loop() ksmbd: send proper error response in smb2_tree_connect() ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence drm/i915/dsi: fix MIPI_BKLT_EN_1 native GPIO index efi: random: combine bootloader provided RNG seed with RNG protocol output wifi: ath11k: Send PME message during wakeup from D3cold Linux 6.1.5 Change-Id: I8db9e71d31b830cb2686aed0f69e35ce52c70ee7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 18:49:33 +00:00
Greg Kroah-Hartman	66746d4cf7	This is the 6.1.4 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmO5RX4ACgkQONu9yGCS aT7NFRAAlqi2Wwx1NZU3HE9nr/fgdGFDlEJbKXP9jiwIjiIx5mAPaysb9uhOG5qj 11uG/S3+xsb5ryhSpCR5I0rPnymK/XWDQtfYlKMuB+bLr+w03BBYzZX5v+YihUmw mWa32+xiei1KzIjxMGVFciiSYoMxWR5smqe559LPiabB3dcRfRPSHQDJCOWE5T2y 2Tlts/gUpfqMh+MPNQOYgB0TZmUhzin9XW4AcDqLsyupKRLKEusDVIA5QfznuCyN UFjTem9h+4qPSZOgzdmSX9QljYL8Jqh4gwXUcl4/EUoObPN/tTbjCYZkuyOT4r3F FsN/w6+32C/TjQSBg50d4yT4TFC4bjnc3VCb2dI+6WazLqAjS7RrkoqTl37K/rwC Gb3FmjwQNNx/iNq5kM5NvuJgLWuLAVZBn+WxWBk1hqE5f8l0l5/NgxdHfSwjMvJL toqXT98yoSTMMGaQ8QA4MLh9Gx2CYC0JeyaWnFavMOBs9Oxy+SbNyoUKo0Wn8kHh z/6/Pdk6Qd3PKv9pXsrTpWAPzQs5w23+XbZ2pJw+K5yVKvmNQJEhSJ9fzFRksldW ykDMzVmZ0kswcNuJgQFUi4QTu17p3FA4UJG1xvJNCKPsgelLe8153TFDds0yXfu1 IwqZiHpwBF1tyGHYEBdqmivj77eWtNsWMSZHHDN9jJ9sNxS+kSM= =CeYO -----END PGP SIGNATURE----- Merge 6.1.4 into android14-6.1 Changes in 6.1.4 drm/amdgpu: skip MES for S0ix as well since it's part of GFX drm/amdgpu: skip mes self test after s0i3 resume for MES IP v11.0 media: stv0288: use explicitly signed char cxl/region: Fix memdev reuse check arm64: dts: qcom: sc8280xp: fix UFS DMA coherency arm64: Prohibit instrumentation on arch_stack_walk() soc: qcom: Select REMAP_MMIO for LLCC driver soc: qcom: Select REMAP_MMIO for ICC_BWMON driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them jbd2: use the correct print format perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D perf/x86/intel/uncore: Clear attr_update properly arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength arm64: dts: qcom: sc8280xp: fix UFS reference clocks mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K phy: qcom-qmp-combo: fix out-of-bounds clock access drm/amd/pm: update SMU13.0.0 reported maximum shader clock drm/amd/pm: correct SMU13.0.0 pstate profiling clock settings btrfs: fix uninitialized parent in insert_state btrfs: fix extent map use-after-free when handling missing device in read_one_chunk btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-samsung-w737: correct I2C12 pins drive strength random: use rejection sampling for uniform bounded random integers x86/fpu/xstate: Fix XSTATE_WARN_ON() to emit relevant diagnostics arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength cxl/region: Fix missing probe failure EDAC/mc_sysfs: Increase legacy channel support to 12 selftests: Use optional USERCFLAGS and USERLDFLAGS x86/MCE/AMD: Clear DFR errors found in THR handler random: add helpers for random numbers with given floor or range PM/devfreq: governor: Add a private governor_data for governor cpufreq: Init completion before kobject_init_and_add() ext2: unbugger ext2_empty_dir() media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 bpf: Resolve fext program type when checking map compatibility ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops platform/x86: thinkpad_acpi: Fix max_brightness of thinklight platform/x86: ideapad-laptop: Revert "check for touchpad support in _CFG" platform/x86: ideapad-laptop: Add new _CFG bit numbers for future use platform/x86: ideapad-laptop: support for more special keys in WMI ACPI: video: Simplify __acpi_video_get_backlight_type() ACPI: video: Prefer native over vendor platform/x86: ideapad-laptop: Refactor ideapad_sync_touchpad_state() platform/x86: ideapad-laptop: Do not send KEY_TOUCHPAD* events on probe / resume platform/x86: ideapad-laptop: Only toggle ps2 aux port on/off on select models platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models platform/x86: ideapad-laptop: Stop writing VPCCMD_W_TOUCHPAD at probe time platform/x86: intel-uncore-freq: add Emerald Rapids support ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock. platform/x86: x86-android-tablets: Add Medion Lifetab S10346 data platform/x86: x86-android-tablets: Add Lenovo Yoga Tab 3 (YT3-X90F) charger + fuel-gauge data platform/x86: x86-android-tablets: Add Advantech MICA-071 extra button HID: Ignore HP Envy x360 eu0009nv stylus battery ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless fs: dlm: fix sock release if listen fails fs: dlm: retry accept() until -EAGAIN or error returns mptcp: netlink: fix some error return code mptcp: remove MPTCP 'ifdef' in TCP SYN cookies mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: resume even if in FAIL mode dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata ata: ahci: fix enum constants for gcc-13 PCI/DOE: Fix maximum data object length miscalculation tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' perf/core: Call LSM hook after copying perf_event_attr xtensa: add __umulsidi3 helper of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values ima: Fix hash dependency to correct algorithm KVM: VMX: Resume guest immediately when injecting #GP on ECREATE KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails KVM: x86: fix APICv/x2AVIC disabled when vm reboot by itself KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 x86/microcode/intel: Do not retry microcode reloading on the APs ftrace/x86: Add back ftrace_expected for ftrace bug reports x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK tracing: Fix race where eprobes can be called before the event powerpc/ftrace: fix syscall tracing on PPC64_ELF_ABI_V1 tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE tracing/hist: Fix wrong return value in parse_action_params() tracing/probes: Handle system names with hyphens tracing: Fix issue of missing one synthetic field tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line staging: media: tegra-video: fix chan->mipi value on error staging: media: tegra-video: fix device_node use after free arm64: dts: mediatek: mt8195-demo: fix the memory size of node secmon ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options cifs: set correct tcon status after initial tree connect cifs: set correct ipc status after initial tree connect cifs: set correct status of tcon ipc when reconnecting ravb: Fix "failed to switch device to config mode" message during unbind rtc: ds1347: fix value written to century register drm/amdgpu: fix mmhub register base coding error block: mq-deadline: Fix dd_finish_request() for zoned devices block: mq-deadline: Do not break sequential write streams to zoned HDDs md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk wifi: wilc1000: sdio: fix module autoloading ASoC: jz4740-i2s: Handle independent FIFO flush bits ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection() ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() mtd: spi-nor: gigadevice: gd25q256: replace gd25q256_default_init with gd25q256_post_bfpt ima: Fix memory leak in __ima_inode_hash() um: virt-pci: Avoid GCC non-NULL warning crypto: ccree,hisilicon - Fix dependencies to correct algorithm PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path RISC-V: kexec: Fix memory leak of fdt buffer riscv: Fixup compile error with !MMU RISC-V: kexec: Fix memory leak of elf header buffer riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument riscv: mm: notify remote harts about mmu cache updates crypto: n2 - add missing hash statesize crypto: ccp - Add support for TEE for PCI ID 0x14CA driver core: Fix bus_type.match() error handling in __driver_attach() bus: mhi: host: Fix race between channel preparation and M0 event phy: qcom-qmp-combo: fix sdm845 reset phy: qcom-qmp-combo: fix sc8180x reset iommu/amd: Fix ivrs_acpihid cmdline parsing code iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options test_kprobes: Fix implicit declaration error of test_kprobes hugetlb: really allocate vma lock for all sharable vmas remoteproc: imx_dsp_rproc: Add mutex protection for workqueue remoteproc: core: Do pm_relax when in RPROC_OFFLINE state remoteproc: imx_rproc: Correct i.MX93 DRAM mapping parisc: led: Fix potential null-ptr-deref in start_task() parisc: Drop locking in pdc console code parisc: Fix locking in pdc_iodc_print() firmware call parisc: Add missing FORCE prerequisites in Makefile parisc: Drop duplicate kgdb_pdc console parisc: Drop PMD_SHIFT from calculation in pgtable.h device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor drm/mgag200: Fix PLL setup for G200_SE_A rev >=4 drm/etnaviv: move idle mapping reaping into separate function drm/i915/dsi: fix VBT send packet port selection for dual link DSI drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() drm/etnaviv: reap idle mapping if it doesn't match the softpin address ext4: silence the warning when evicting inode with dioread_nolock ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: remove trailing newline from ext4_msg() message ext4: correct inconsistent error msg in nojournal mode fs: ext4: initialize fsdata in pagecache_write() ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: journal_path mount options should follow links ext4: check and assert if marking an no_delete evicting inode dirty ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: don't allow journal inode to have encrypt flag ext4: disable fast-commit of encrypted dir operations ext4: fix leaking uninitialized memory in fast-commit journal ext4: don't set up encryption key during jbd2 transaction ext4: add missing validation of fast-commit record lengths ext4: fix unaligned memory access in ext4_fc_reserve_space() ext4: fix off-by-one errors in fast-commit block filling ext4: fix uninititialized value in 'ext4_evict_inode' ext4: init quota for 'old.inode' in 'ext4_rename' ext4: don't fail GETFSUUID when the caller provides a long buffer ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: fix bad checksum after online resize ext4: dont return EINVAL from GETFSUUID when reporting UUID length ext4: fix corrupt backup group descriptors after online resize ext4: avoid BUG_ON when creating xattrs ext4: fix deadlock due to mbcache entry corruption ext4: fix kernel BUG in 'ext4_write_inline_data_end()' ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area drm/i915/ttm: consider CCS for backup objects drm/amd/display: Add DCN314 display SG Support drm/amdgpu: handle polaris10/11 overlap asics (v2) drm/amdgpu: make display pinning more flexible (v2) drm/i915: improve the catch-all evict to handle lock contention drm/i915/migrate: Account for the reserved_space drm/amd/pm: add missing SMU13.0.0 mm_dpm feature mapping drm/amd/pm: add missing SMU13.0.7 mm_dpm feature mapping drm/amd/pm: bump SMU13.0.0 driver_if header to version 0x34 drm/amd/pm: correct the fan speed retrieving in PWM for some SMU13 asics Linux 6.1.4 Change-Id: I79c26bc73b1275fab4e9984d2a32a8b915bbfa1c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 18:49:08 +00:00
Greg Kroah-Hartman	2712923303	This is the 6.1.2 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOwLA8ACgkQONu9yGCS aT6RYxAAhsnIlIBCtaca7Uio9TZdluV7Fzn3c9+QogVisrwVMTtP1iHX43ofFC89 BCmiQOS9fForddjNP0vkqjZlshMYYSCDPX0s0mK6R4UoNPVg8oehZ9vJfOiR3MMX C3fApQQhYf5Bx/rC50i58ChdAw/Dqj0WNBZX/ZWod4B2JKUq7ORk7GjnorfuJxuP xO2K6KdpajZufkxtTyKtwqK8FG3dkZP9YF6MqFIvTfQ8qkLnQsrL3moFGU9giSH5 swRCFH/QII+kumKS2bir87QHz0CmvtSa3Ob4DyKiJMkNN8tspE7nOMkds4usCov6 +yM84sWp03j2RKFyadctAMKwdH16IGU0kdgqlhb9OmzGNRvX6/l5q4+QzqzPJHHQ F+v/PEJoKz3K6CK2ai8DPXoTUMgDDCaYDHg139Tv2Dj/ulDg9xzJ+CS6WBMQxMoU xO1OWhpLMDKT8soPogGY13yOsSbhPY6ef3+//eRczxLf8bg3qzoKo362PjqHVxlq IY01Ul+MB3M4NdFuFNMKM2/DBHn9qBeoZdQxnQ/vpxhBbpP2hIyEflyfsUQOmUYU lWBcnxbSLxf87CmJ3f1VSsms6kbgnxYJyNBgkXiU3WHFfcRZqoU/R+SFu2THRMPt ugor1zCHNxBBIdDEMRDWJvDTt34vRsT51Xbig+hH5BVdiKQzQ3k= =MYDV -----END PGP SIGNATURE----- Merge 6.1.2 into android14-6.1 Changes in 6.1.2 MIPS: DTS: CI20: fix reset line polarity of the ethernet controller usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: renesas: r8a779g0: Fix HSCIF0 "brg_int" clock arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable arm64: dts: qcom: sdm845-xiaomi-polaris: fix codec pin conf name arm64: dts: qcom: msm8996: Add MSM8996 Pro support arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible arm64: dts: fsd: fix drive strength macros as per FSD HW UM arm64: dts: fsd: fix drive strength values as per FSD HW UM memory: renesas-rpc-if: Clear HS bit during hardware initialization objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static firmware: ti_sci: Fix polled mode during system suspend riscv: dts: microchip: fix memory node unit address for icicle arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name arm64: dts: qcom: sm8250: correct LPASS pin pull down arm64: dts: qcom: sc7180-trogdor-homestar: fully configure secondary I2S pins soc: qcom: llcc: make irq truly optional arm64: dts: qcom: sm8150: fix UFS PHY registers arm64: dts: qcom: sm8250: fix UFS PHY registers arm64: dts: qcom: sm8350: fix UFS PHY registers arm64: dts: qcom: sm8450: fix UFS PHY registers arm64: dts: qcom: msm8996: fix sound card reset line polarity arm64: dts: qcom: sm8250-mtp: fix reset line polarity arm64: dts: qcom: sc7280: fix codec reset line polarity for CRD 3.0/3.1 arm64: dts: qcom: sc7280: fix codec reset line polarity for CRD 1.0/2.0 arm64: dts: qcom: sm8250: drop bogus DP PHY clock arm64: dts: qcom: sm6350: drop bogus DP PHY clock soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm64: dts: qcom: pm6350: Include header for KEY_POWER arm64: dts: qcom: sm6125: fix SDHCI CQE reg names arm64: dts: renesas: r8a779f0: Fix HSCIF "brg_int" clock arm64: dts: renesas: r8a779f0: Fix SCIF "brg_int" clock arm64: dts: renesas: r9a09g011: Fix unit address format error arm64: dts: renesas: r9a09g011: Fix I2C SoC specific strings dt-bindings: pwm: fix microchip corePWM's pwm-cells soc: sifive: ccache: fix missing iounmap() in error path in sifive_ccache_init() soc: sifive: ccache: fix missing free_irq() in error path in sifive_ccache_init() soc: sifive: ccache: fix missing of_node_put() in sifive_ccache_init() arm64: dts: mt7986: fix trng node name soc/tegra: cbb: Use correct master_id mask for CBB NOC in Tegra194 soc/tegra: cbb: Update slave maps for Tegra234 soc/tegra: cbb: Add checks for potential out of bound errors soc/tegra: cbb: Check firewall before enabling error reporting arm64: dts: qcom: sc7280: Mark all Qualcomm reference boards as LTE arm: dts: spear600: Fix clcd interrupt riscv: dts: microchip: fix the icicle's #pwm-cells soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm64: mm: kfence: only handle translation faults perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init() perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j7200-mcu-wakeup: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721s2: Fix the interrupt ranges property for main & wkup gpio intr riscv: dts: microchip: remove pcie node from the sev kit ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes arm64: dts: mediatek: mt8195: Fix CPUs capacity-dmips-mhz arm64: dts: mt7896a: Fix unit_address_vs_reg warning for oscillator arm64: dts: mt6779: Fix devicetree build warnings arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name arm64: tegra: Fix Prefetchable aperture ranges of Tegra234 PCIe controllers arm64: tegra: Fix non-prefetchable aperture of PCIe C3 controller arm64: dts: mt7986: move wed_pcie node ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC soc: apple: sart: Stop casting function pointer signatures soc: apple: rtkit: Stop casting function pointer signatures drivers/perf: hisi: Fix some event id for hisi-pcie-pmu seccomp: Move copy_seccomp() to no failure path. pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP arch: arm64: apple: t8103: Use standard "iommu" node name tpm: tis_i2c: Fix sanity check interrupt enable mask tpm: Add flag to use default cancellation policy tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() sched/uclamp: Fix relationship between uclamp and migration margin sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Fix fits_capacity() check in feec() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() sched/uclamp: Make cpu_overutilized() use util_fits_cpu() sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix TIF_NOTIFY_SIGNAL handling alpha: fix syscall entry in !AUDUT_SYSCALL case sched/psi: Fix possible missing or delayed pending event x86/sgx: Reduce delay and interference of enclave release PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() x86/split_lock: Add sysctl to control the misery mode ACPI: irq: Fix some kernel-doc issues selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() selftests: cgroup: fix unsigned comparison with less than zero cpufreq: qcom-hw: Fix the frequency returned by cpufreq_driver->get() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() mailbox: pcc: Reset pcc_chan_count to zero in case of PCC probe failure ACPI: pfr_telemetry: use ACPI_FREE() to free acpi_object ACPI: pfr_update: use ACPI_FREE() to free acpi_object perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() thermal: core: fix some possible name leaks in error paths irqchip/loongson-pch-pic: Fix translate callback for DT path irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() irqchip/loongson-liointc: Fix improper error handling in liointc_init() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() NFSD: Finish converting the NFSv2 GETACL result encoder NFSD: Finish converting the NFSv3 GETACL result encoder nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file debugfs: fix error when writing negative value to atomic_t debugfs file ocfs2: fix memory leak in ocfs2_mount_volume() rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Access registers according to spec futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state cpu/hotplug: Do not bail-out in DYING/STARTING sections clocksource/drivers/timer-ti-dm: Fix warning for omap_timer_match clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Do not call __rpm_callback() from rpm_idle() erofs: check the uniqueness of fsid in shared domain in advance erofs: Fix pcluster memleak when its block address is zero erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails erofs: validate the extent length for uncompressed pclusters platform/chrome: cros_ec_typec: zero out stale pointers platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used lockd: set other missing fields when unlocking files nfsd: return error if nfs4_setacl fails NFSD: pass range end to vfs_fsync_range() instead of count fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open ipc: fix memory leak in init_mqueue_fs() platform/mellanox: mlxbf-pmc: Fix event typo selftests/bpf: Add missing bpf_iter_vma_offset__destroy call wifi: fix multi-link element subelement iteration wifi: mac80211: mlme: fix null-ptr deref on failed assoc wifi: mac80211: check link ID in auth/assoc continuation wifi: mac80211: fix ifdef symbol name drm/atomic-helper: Don't allocate new plane state in CRTC check wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips wifi: ath11k: fix firmware assert during bandwidth change for peer sta drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix memory leak in parse_usdt_arg() selftests/bpf: Fix memory leak caused by not destroying skeleton selftest/bpf: Fix memory leak in kprobe_multi_test selftests/bpf: Fix error failure of case test_xdp_adjust_tail_grow selftest/bpf: Fix error usage of ASSERT_OK in xdp_adjust_tail.c libbpf: Use elf_getshdrnum() instead of e_shnum libbpf: Deal with section with no data gracefully libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() drm: lcdif: Switch to limited range for RGB to YUV conversion ata: libata: fix NCQ autosense logic pinctrl: ocelot: add missing destroy_workqueue() in error path in ocelot_pinctrl_probe() ASoC: Intel: avs: Fix DMA mask assignment ASoC: Intel: avs: Fix potential RX buffer overflow ipmi: kcs: Poll OBF briefly to reduce OBE latency drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly" drm/amdgpu/powerplay/psm: Fix memory leak in power state init net: ethernet: adi: adin1110: Fix SPI transfers samples/bpf: Fix map iteration in xdp1_user samples/bpf: Fix MAC address swapping in xdp2_kern selftests/bpf: fix missing BPF object files drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe Input: iqs7222 - protect against undefined slider size media: v4l2-ctrls: Fix off-by-one error in integer menu control check media: coda: jpeg: Add check for kmalloc media: amphion: reset instance if it's aborted before codec header parsed media: adv748x: afe: Select input port when initializing AFE media: v4l2-ioctl.c: Unify YCbCr/YUV terms in format descriptions media: cedrus: hevc: Fix offset adjustments media: mediatek: vcodec: fix h264 cavlc bitstream fail drm/i915/guc: Limit scheduling properties to avoid overflow drm/i915: Fix compute pre-emption w/a to apply to compute engines media: i2c: hi846: Fix memory leak in hi846_parse_dt() media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() soreuseport: Fix socket selection for SO_INCOMING_CPU. media: i2c: ov5648: Free V4L2 fwnode data on unbind media: exynos4-is: don't rely on the v4l2_async_subdev internals libbpf: Btf dedup identical struct test needs check for nested structs/arrays can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming clk: renesas: r8a779f0: Fix SD0H clock name clk: renesas: r8a779a0: Fix SD0H clock name ASoC: dt-bindings: rt5682: Set sound-dai-cells to 1 drm/i915/guc: Add error-capture init warnings when needed drm/i915/guc: Fix GuC error capture sizing estimation and reporting dw9768: Enable low-power probe on ACPI drm/amd/display: wait for vblank during pipe programming drm/rockchip: lvds: fix PM usage counter unbalance in poweron drm/i915: Handle all GTs on driver (un)load paths drm/i915: Refactor ttm ghost obj detection drm/i915: Encapsulate lmem rpm stuff in intel_runtime_pm drm/i915/dgfx: Grab wakeref at i915_ttm_unmap_virtual clk: renesas: r9a06g032: Repair grave increment error drm: lcdif: change burst size to 256B drm/panel/panel-sitronix-st7701: Fix RTNI calculation spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED drm/msm/mdp5: stop overriding drvdata ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: use devres helper for runtime PM management bpf: Clobber stack slot when writing over spilled PTR_TO_BTF_ID bpf: Fix slot type check in check_stack_write_var_off drm/msm/dpu1: Account for DSC's bits_per_pixel having 4 fractional bits drm/msm/dsi: Remove useless math in DSC calculations drm/msm/dsi: Remove repeated calculation of slice_per_intf drm/msm/dsi: Use DIV_ROUND_UP instead of conditional increment on modulo drm/msm/dsi: Reuse earlier computed dsc->slice_chunk_size drm/msm/dsi: Appropriately set dsc->mux_word_size based on bpc drm/msm/dsi: Migrate to drm_dsc_compute_rc_parameters() drm/msm/dsi: Account for DSC's bits_per_pixel having 4 fractional bits drm/msm/dsi: Disallow 8 BPC DSC configuration for alternative BPC values drm/msm/dsi: Prevent signed BPG offsets from bleeding into adjacent bits media: platform: mtk-mdp3: fix error handling in mdp_cmdq_send() media: platform: mtk-mdp3: fix error handling about components clock_on media: platform: mtk-mdp3: fix error handling in mdp_probe() media: rkvdec: Add required padding media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-ipq806x: use parent_data for the last remaining entry clk: qcom: dispcc-sm6350: Add CLK_OPS_PARENT_ENABLE to pixel&byte src clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() mtd: core: fix possible resource leak in init_mtd() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming media: camss: Do not attach an already attached power domain on MSM8916 platform clk: renesas: r8a779f0: Fix HSCIF parent clocks clk: renesas: r8a779f0: Fix SCIF parent clocks virt/sev-guest: Add a MODULE_ALIAS net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack drm: lcdif: Set and enable FIFO Panic threshold wifi: rtw89: use u32_encode_bits() to fill MAC quota value drm: rcar-du: Drop leftovers dependencies from Kconfig regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode drbd: use blk_queue_max_discard_sectors helper bfq: fix waker_bfqq inconsistency crash drm/radeon: Add the missed acpi_put_table() to fix memory leak dt-bindings: pinctrl: update uart/mmc bindings for MT7986 SoC pinctrl: mediatek: fix the pinconf register offset of some pins wifi: iwlwifi: mei: make sure ownership confirmed message is sent wifi: iwlwifi: mei: don't send SAP commands if AMT is disabled wifi: iwlwifi: mei: fix tx DHCP packet for devices with new Tx API wifi: iwlwifi: mei: avoid blocking sap messages handling due to rtnl lock wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone module: Fix NULL vs IS_ERR checking for module_get_next_page ASoC: codecs: wsa883x: Use proper shutdown GPIO polarity ASoC: codecs: wsa883x: use correct header file selftests/bpf: Fix xdp_synproxy compilation failure in 32-bit arch selftests/bpf: Fix incorrect ASSERT in the tcp_hdr_options test drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() nvmet: only allocate a single slab for bvecs regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() nvme: return err on nvme_init_non_mdts_limits fail wifi: rtw89: Fix some error handling path in rtw89_core_sta_assoc() regulator: qcom-rpmh: Fix PMR735a S3 regulator spec drm/fourcc: Fix vsub/hsub for Q410 and Q401 ALSA: memalloc: Allocate more contiguous pages for fallback case integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() block: clear ->slave_dir when dropping the main slave_dir reference dm: cleanup open_table_device dm: cleanup close_table_device dm: make sure create and remove dm device won't race with open and close table dm: track per-add_disk holder relations in DM selftests/bpf: fix memory leak of lsm_cgroup wifi: ath10k: Fix return value in ath10k_pci_init() drm/msm/a6xx: Fix speed-bin detection vs probe-defer mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off ASoC: amd: acp: Fix possible UAF in acp_dma_open net: ethernet: mtk_eth_soc: do not overwrite mtu configuration running reset routine media: amphion: add lock around vdec_g_fmt media: amphion: apply vb2_queue_error instead of setting manually media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: amphion: Fix error handling in vpu_driver_init() media: videobuf-dma-contig: use dma_mmap_coherent net: ethernet: mtk_eth_soc: fix RSTCTRL_PPE{0,1} definitions udp: Clean up some functions. net: Return errno in sk->sk_prot->get_port(). mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Fix the number of bytes for the dummy cycles clk: imx93: correct the flexspi1 clock setting bpf: Pin the start cgroup in cgroup_iter_seq_init() HID: i2c: let RMI devices decide what constitutes wakeup event clk: imx93: unmap anatop base in error handling path clk: imx93: correct enet clock bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes clk: imx: imxrt1050: fix IMXRT1050_CLK_LCDIF_APB offsets pinctrl: k210: call of_node_put() wifi: rtw89: fix physts IE page check ASoC: Intel: Skylake: Fix Kconfig dependency ASoC: Intel: avs: Lock substream before snd_pcm_stop() ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak drm/i915/guc: make default_lists const data selftests/bpf: Make sure zero-len skbs aren't redirectable selftests/bpf: Mount debugfs in setns_by_fd bonding: fix link recovery in mode 2 when updelay is nonzero clk: microchip: check for null return of devm_kzalloc() mtd: core: Fix refcount error in del_mtd_device() mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: remove call to memset before free device/resource/connection drbd: destroy workqueue when drbd device was freed ASoC: qcom: Add checks for devm_kcalloc ASoC: qcom: cleanup and fix dependency of QCOM_COMMON ASoC: mediatek: mt8186: Correct I2S shared clocks media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() media: imx: imx7-media-csi: Clear BIT_MIPI_DOUBLE_CMPNT for <16b formats media: mt9p031: Drop bogus v4l2_subdev_get_try_crop() call from mt9p031_init_cfg() clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: replace osc_hdmi with dummy clk: imx: rename video_pll1 to video_pll clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx8mn: fix imx8mn_enet_phy_sels clocks list pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() x86/boot: Skip realmode init code when running as Xen PV guest media: sun6i-mipi-csi2: Require both pads to be connected for streaming media: sun8i-a83t-mipi-csi2: Require both pads to be connected for streaming media: sun6i-mipi-csi2: Register async subdev with no sensor attached media: sun8i-a83t-mipi-csi2: Register async subdev with no sensor attached media: amphion: try to wakeup vpu core to avoid failure media: amphion: cancel vpu before release instance media: amphion: lock and check m2m_ctx in event handler media: mediatek: vcodec: Fix getting NULL pointer for dst buffer media: mediatek: vcodec: Fix h264 set lat buffer error media: mediatek: vcodec: Setting lat buf to lat_list when lat decode error media: mediatek: vcodec: Core thread depends on core_list media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd drm/msm/mdp5: fix reading hw revision on db410c platform NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Always decode the security label NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() wifi: rtl8xxxu: Fix use after rcu_read_unlock in rtl8xxxu_bss_info_changed wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Enable IRQ when pdata is ready clk: mediatek: fix dependency of MT7986 ADC clocks drm/amd/pm/smu11: BACO is supported when it's in BACO state amdgpu/nv.c: Corrected typo in the video capabilities resolution drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/amdkfd: Fix memory leakage drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe clk: visconti: Fix memory leak in visconti_register_pll() netfilter: conntrack: set icmpv6 redirects as RELATED Input: wistron_btns - disable on UML bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: nl80211: Add checks for nla_nest_start() in nl80211_send_iface() wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: mac80211: fix maybe-unused warning wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails wifi: mt76: mt7921: fix antenna signal are way off in monitor mode wifi: mt76: mt7915: fix mt7915_mac_set_timing() wifi: mt76: mt7915: fix reporting of TX AGGR histogram wifi: mt76: mt7921: fix reporting of TX AGGR histogram wifi: mt76: mt7915: rework eeprom tx paths and streams init wifi: mt76: mt7915: Fix chainmask calculation on mt7915 DBDC wifi: mt76: mt7921: fix wrong power after multiple SAR set wifi: mt76: fix coverity overrun-call in mt76_get_txpower() wifi: mt76: mt7921: Add missing __packed annotation of struct mt7921_clc wifi: mt76: do not send firmware FW_FEATURE_NON_DL region mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() regulator: core: fix module refcount leak in set_supply() clk: qcom: lpass-sc7280: Fix pm_runtime usage clk: qcom: lpass-sc7180: Fix pm_runtime usage clk: qcom: clk-krait: fix wrong div2 functions Revert "net: hsr: use hlist_head instead of list_head for mac addresses" hsr: Add a rcu-read lock to hsr_forward_skb(). hsr: Avoid double remove of a node. hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf: Add dummy type reference to nf_conn___init to fix type deduplication bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() media: ov5640: set correct default link frequency ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions() xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.2: Set the correct size scratch buffer for decoding READ_PLUS NFS: Allow very small rsize & wsize again NFSv4.x: Fail client initialisation if state manager thread can't run riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC bpftool: Fix memory leak in do_build_table_cb hwmon: (emc2305) fix unable to probe emc2301/2/3 hwmon: (emc2305) fix pwm never being able to set lower mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_pci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: litex_mmc: ensure `host->irq == 0` if polling mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() mmc: renesas_sdhi: alway populate SCC pointer memstick/ms_block: Add check for alloc_ordered_workqueue mmc: core: Normalize the error handling branch in sd_read_ext_regs() nvme: pass nr_maps explicitly to nvme_alloc_io_tag_set regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc media: staging: stkwebcam: Restore MEDIA_{USB,CAMERA}_SUPPORT dependencies clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled bpf: Do not zero-extend kfunc return values clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: stmmac: fix possible memory leak in stmmac_dvr_probe() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() ipvs: use u64_stats_t for the per-cpu counters of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() net: setsockopt: fix IPV6_UNICAST_IF option for connected sockets af_unix: call proto_unregister() in the error path in af_unix_init() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts can: m_can: Call the RAM init directly from m_can_chip_config can: tcan4x5x: Fix use of register error status mask net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open() net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: hci_core: fix error handling in hci_register_dev() Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS Bluetooth: Fix EALREADY and ELOOP cases in bt_status() Bluetooth: hci_conn: Fix crash on hci_create_cis_sync Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() octeontx2-af: cn10k: mcs: Fix a resource leak in the probe and remove functions stmmac: fix potential division by 0 i40e: Fix the inability to attach XDP program on downed interface net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi apparmor: Fix regression in stacking due to label flags crypto: hisilicon/qm - fix incorrect parameters usage crypto: hisilicon/qm - re-enable communicate interrupt before notifying PF crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() crypto: tcrypt - fix return value for multiple subtests scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() fortify: Do not cast to "unsigned char" f2fs: fix to invalidate dcc->f2fs_issue_discard in error path f2fs: fix gc mode when gc_urgent_high_remaining is 1 f2fs: fix normal discard process f2fs: allow to set compression for inlined file f2fs: fix the assign logic of iocb f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super() RDMA/irdma: Report the correct link speed scsi: qla2xxx: Fix set-but-not-used variable warnings RDMA/siw: Fix immediate work request flush to completion queue IB/mad: Don't call to function that might sleep while in atomic context PCI: vmd: Disable MSI remapping after suspend PCI: imx6: Initialize PHY before deasserting core reset f2fs: fix to avoid accessing uninitialized spinlock RDMA/restrack: Release MR restrack when delete RDMA/core: Make sure "ib_port" is valid when access sysfs node RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status RDMA/irdma: Fix inline for multiple SGE's RDMA/irdma: Fix RQ completion opcode RDMA/irdma: Do not request 2-level PBLEs for CQ alloc scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/rxe: Fix mr->map double free RDMA/hns: Fix ext_sge num error when post send RDMA/hns: Fix incorrect sge nums calculation PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/irdma: Initialize net_type before checking it RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq dt-bindings: visconti-pcie: Fix interrupts array max constraints PCI: endpoint: pci-epf-vntb: Fix call pci_epc_mem_free_addr() in error path scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() crypto: x86/aegis128 - fix possible crash with CFI enabled crypto: x86/aria - fix crash with CFI enabled crypto: x86/sha1 - fix possible crash with CFI enabled crypto: x86/sha256 - fix possible crash with CFI enabled crypto: x86/sha512 - fix possible crash with CFI enabled crypto: x86/sm3 - fix possible crash with CFI enabled crypto: x86/sm4 - fix crash with CFI enabled crypto: arm64/sm3 - add NEON assembly implementation crypto: arm64/sm3 - fix possible crash with CFI enabled crypto: hisilicon/qm - fix 'QM_XEQ_DEPTH_CAP' mask value scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: efct: Fix possible memleak in efct_device_init() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() scsi: ufs: core: Fix the polling implementation RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: set zstd compress level correctly f2fs: fix to enable compress for newly created file if extension matches f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: qat - fix error return code in adf_probe crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA: Disable IB HW for UML RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() PCI: vmd: Fix secondary bus reset for Intel bridges orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix the gid problem caused by free mr RDMA/hns: Fix AH attr queried by query_qp RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix error code of CMD RDMA/hns: Fix XRC caps on HIP08 RISC-V: Fix unannoted hardirqs-on in return to userspace slow-path RISC-V: Fix MEMREMAP_WB for systems with Svpbmt riscv: Fix crash during early errata patching crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RISC-V: Align the shadow stack f2fs: fix iostat parameter for discard riscv: Fix P4D_SHIFT definition for 3-level page table mode drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating serial: 8250_bcm7271: Fix error handling in brcmuart_init() drivers: staging: r8188eu: Fix sleep-in-atomic-context bug in rtw_join_timeout_handler class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method vfio/iova_bitmap: Fix PAGE_SIZE unaligned bitmaps uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues interconnect: qcom: sc7180: fix dropped const of qcom_icc_bcm staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails usb: typec: tipd: Fix spurious fwnode_handle_put in error path usb: typec: tipd: Fix typec_unregister_port error paths usb: musb: omap2430: Fix probe regression for missing resources extcon: usbc-tusb320: Update state on probe even if no IRQ pending USB: gadget: Fix use-after-free during usb config switch serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: stm32: move dma_request_chan() before clk_prepare_enable() serial: pch: Fix PCI device refcount leak in pch_request_dma() serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() habanalabs: fix return value check in hl_fw_get_sec_attest_data() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update coresight: trbe: remove cpuhp instance node before remove cpuhp state coresight: cti: Fix null pointer error on CTI init before ETM tracing/user_events: Fix call print_fmt leak usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: core: hcd: Fix return value check in usb_hcd_setup_local_mem() usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() vfio/iova_bitmap: refactor iova_bitmap_set() to better handle page boundaries i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: cdev: fix NULL-pointer dereferences gpiolib: protect the GPIO device against being dropped while in use by user-space i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() tracing/hist: Fix issue of losting command info in error_log ksmbd: Fix resource leak in ksmbd_session_rpc_open() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range thermal/drivers/k3_j72xx_bandgap: Fix the debug print message thermal/of: Fix memory leak on thermal_of_zone_register() failure thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 thermal/drivers/qcom/lmh: Fix irq handler return value fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: geode: don't build on UML fbdev: uvesafb: don't build on UML fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() led: qcom-lpg: Fix sleeping in atomic perf tools: Fix "kernel lock contention analysis" test by not printing warnings in quiet mode perf stat: Use evsel__is_hybrid() more perf stat: Move common code in print_metric_headers() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol power: supply: z2_battery: Fix possible memleak in z2_batt_probe() power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe() HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: Fix refcount leak in rk817_charger_probe power: supply: bq25890: Factor out regulator registration code power: supply: bq25890: Convert to i2c's .probe_new() power: supply: bq25890: Ensure pump_express_work is cancelled on remove perf branch: Fix interpretation of branch records power: supply: fix null pointer dereferencing in power_supply_get_battery_info gfs2: Partially revert gfs2_inode_lookup change leds: is31fl319x: Fix setting current limit for is31fl319{0,1,3} perf off_cpu: Fix a typo in BTF tracepoint name, it should be 'btf_trace_sched_switch' ftrace: Allow WITH_ARGS flavour of graph tracer with shadow call stack perf stat: Do not delay the workload with --delay RDMA/siw: Fix pointer cast warning fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() fs/ntfs3: Harden against integer overflows phy: marvell: phy-mvebu-a3700-comphy: Reset COMPHY registers before USB 3.0 power on phy: qcom-qmp-pcie: drop bogus register update dmaengine: idxd: Make max batch size attributes in sysfs invisible for Intel IAA dmaengine: apple-admac: Allocate cache SRAM to channels remoteproc: core: Auto select rproc-virtio device id phy: qcom-qmp-pcie: drop power-down delay config phy: qcom-qmp-pcie: replace power-down delay phy: qcom-qmp-pcie: fix sc8180x initialisation phy: qcom-qmp-pcie: fix ipq8074-gen3 initialisation phy: qcom-qmp-pcie: fix ipq6018 initialisation phy: qcom-qmp-usb: clean up power-down handling phy: qcom-qmp-usb: drop sc8280xp power-down delay phy: qcom-qmp-usb: drop power-down delay config phy: qcom-qmp-usb: clean up status polling phy: qcom-qmp-usb: drop start and pwrdn-ctrl abstraction phy: qcom-qmp-usb: correct registers layout for IPQ8074 USB3 PHY iommu/s390: Fix duplicate domain attachments iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size iommu/sun50i: Implement .iotlb_sync_map iommu/rockchip: fix permission bits in page table entries v2 dmaengine: idxd: Make read buffer sysfs attributes invisible for Intel IAA phy: qcom-qmp-usb: fix sc8280xp PCS_USB offset phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices phy: usb: Use slow clock for wake enabled suspend phy: usb: Fix clock imbalance for suspend/resume include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation pwm: tegra: Ensure the clock rate is not less than needed phy: qcom-qmp-pcie: split register tables into common and extra parts phy: qcom-qmp-pcie: split pcs_misc init cfg for ipq8074 pcs table phy: qcom-qmp-pcie: support separate tables for EP mode phy: qcom-qmp-pcie: Support SM8450 PCIe1 PHY in EP mode phy: qcom-qmp-pcie: Fix high latency with 4x2 PHY when ASPM is enabled phy: qcom-qmp-pcie: Fix sm8450_qmp_gen4x2_pcie_pcs_tbl[] register names fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs dmaengine: idxd: Fix crc_val field for completion record rtc: rzn1: Check return value in rzn1_rtc_probe rtc: class: Fix potential memleak in devm_rtc_allocate_device() rtc: pcf2127: Convert to .probe_new() rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/mediatek: Check return value after calling platform_get_resource() iommu: Avoid races around device probe iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/pseries: fix the object owners enum value in plpks driver powerpc/pseries: Fix the H_CALL error code in PLPKS driver powerpc/pseries: Return -EIO instead of -EINTR for H_ABORTED error powerpc/pseries: fix plpks_read_var() code for different consumers kprobes: Fix check for probe enabled in kill_kprobe() powerpc: dts: turris1x.dts: Add channel labels for temperature sensor powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/mediatek: Add platform_device_put for recovering the device refcnt iommu/mediatek: Use component_match_add iommu/mediatek: Add error path for loop of mm_dts_parse iommu/mediatek: Validate number of phandles associated with "mediatek,larbs" iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm pwm: mediatek: always use bus clock for PWM on MT7622 RISC-V: KVM: Fix reg_val check in kvm_riscv_vcpu_set_reg_config() remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() powerpc/pseries/eeh: use correct API for error log size dt-bindings: mfd: qcom,spmi-pmic: Drop PWM reg dependency mfd: axp20x: Do not sleep in the power off handler mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: pm8008: Fix return value check in pm8008_probe() netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control iommu/mediatek: Fix forever loop in error handling nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock bonding: add missed __rcu annotation for curr_active_slave bonding: do failover when high prio link up mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() block, bfq: fix possible uaf for 'bfqq->bic' selftests/bpf: Select CONFIG_FUNCTION_ERROR_INJECTION bpf: prevent leak of lsm program after failed attach media: v4l2-ctrls-api.c: add back dropped ctrl->is_new = 1 net: enetc: avoid buffer leaks on xdp_do_redirect() failure nfc: pn533: Clear nfc_target before being used unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() r6040: Fix kmemleak in probe and remove net: dsa: mv88e6xxx: avoid reg_lock deadlock in mv88e6xxx_setup_port() igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: allow BaseTime 0 enrollment for Qbv igc: recalculate Qbv end_time by considering cycle time igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() devlink: hold region lock when flushing snapshots selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key soc: mediatek: pm-domains: Fix the power glitch issue arm64: dts: mt8183: Fix Mali GPU clock devlink: protect devlink dump by the instance lock skbuff: Account for tail adjustment during pull operations mailbox: mpfs: read the system controller's status mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() mctp: serial: Fix starting value for frame check sequence cifs: don't leak -ENOMEM in smb2_open_file() net: dsa: microchip: remove IRQF_TRIGGER_FALLING in request_threaded_irq mctp: Remove device type check at unregister HID: amd_sfh: Add missing check for dma_alloc_coherent net: fec: check the return value of build_skb() rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe ARM: dts: aspeed: rainier,everest: Move reserved memory regions video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags arm64: dts: qcom: sm8450: disable SDHCI SDR104/SDR50 on all boards arm64: dts: qcom: sm6350: Add apps_smmu with streamID to SDHCI 1/2 nodes fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() jfs: Fix fortify moan in symlink fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value ACPI: EC: Add quirk for the HP Pavilion Gaming 15-cx0041ur ACPICA: Fix error code path in acpi_ds_call_control_method() thermal/core: Ensure that thermal device is registered in thermal_zone_get_temp ACPI: video: Change GIGABYTE GB-BXBT-2807 quirk to force_none ACPI: video: Change Sony Vaio VPCEH3U1E quirk to force_native ACPI: video: Add force_vendor quirk for Sony Vaio PCG-FRV35 ACPI: video: Add force_native quirk for Sony Vaio VPCY11S1E nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() x86/apic: Handle no CONFIG_X86_X2APIC on systems with x2APIC enabled by BIOS ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Tab 3 Pro (YT3-X90F) btrfs: do not panic if we can't allocate a prealloc extent state ACPI: x86: Add skip i2c clients quirk for Medion Lifetab S10346 hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 media: imx-jpeg: Disable useless interrupt to avoid kernel panic brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ASoC: Intel: avs: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver wifi: ath10k: Delay the unmapping of the buffer openvswitch: Use kmalloc_size_roundup() to match ksize() usage bnx2: Use kmalloc_size_roundup() to match ksize() usage drm/amd/display: skip commit minimal transition state drm/amd/display: prevent memory leak drm/edid: add a quirk for two LG monitors to get them to work on 10bpc Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" drm/rockchip: use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() blk-mq: avoid double ->queue_rq() because of early timeout HID: apple: fix key translations where multiple quirks attempt to translate the same key HID: apple: enable APPLE_ISO_TILDE_QUIRK for the keyboards of Macs with the T2 chip wifi: ath11k: Fix qmi_msg_handler data structure initialization qed (gcc13): use u16 for fid to be big enough drm/meson: Fix return type of meson_encoder_cvbs_mode_valid() bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() wifi: brcmfmac: Fix potential NULL pointer dereference in 'brcmf_c_preinit_dcmds()' HID: input: do not query XP-PEN Deco LW battery HID: uclogic: Add support for XP-PEN Deco LW igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/amd/display: Use min transition for SubVP into MPO drm/amd/display: Disable DRR actions during state commit drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid0, raid10: Don't set discard sectors for request queue md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: Workaround to increase phantom pipe vactive in pipesplit drm/amd/display: fix array index out of bound error in bios parser nvme-auth: don't override ctrl keys before validation net: add atomic_long_t to net_device_stats fields ipv6/sit: use DEV_STATS_INC() to avoid data-races mrp: introduce active flags to prevent UAF when applicant uninit net: ethernet: mtk_eth_soc: drop packets to WDMA if the ring is full bpf/verifier: Use kmalloc_size_roundup() to match ksize() usage ppp: associate skb with a device at tx drm/amd/display: Fix display corruption w/ VSR enable bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() media: mediatek: vcodec: Can't set dst buffer to done when lat decode error blk-mq: fix possible memleak when register 'hctx' failed ALSA: usb-audio: Add quirk for Tascam Model 12 drm/amdgpu: Fix potential double free and null pointer dereference drm/amd/display: Use the largest vready_offset in pipe group drm/amd/display: Fix DTBCLK disable requests and SRC_SEL programming ASoC: amd: yc: Add Xiaomi Redmi Book Pro 14 2022 into DMI table libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on wifi: mt76: do not run mt76u_status_worker if the device is not running hwmon: (nct6775) add ASUS CROSSHAIR VIII/TUF/ProArt B550M selftests/bpf: Fix conflicts with built-in functions in bpf_iter_ksym nfs: fix possible null-ptr-deref when parsing param mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: add quirk for broken register layout mmc: renesas_sdhi: better reset from HS400 mode mmc: sdhci-tegra: Issue CMD and DAT resets together media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() regulator: core: Use different devices for resource allocation and DT lookup ice: synchronize the misc IRQ when tearing down Tx tracker Bluetooth: hci_bcm: Add CYW4373A0 support Bluetooth: Add quirk to disable extended scanning Bluetooth: Add quirk to disable MWS Transport Configuration regulator: core: Fix resolve supply lookup issue crypto: hisilicon/hpre - fix resource leak in remove process scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs scsi: ufs: Reduce the START STOP UNIT timeout crypto: hisilicon/qm - increase the memory of local variables Revert "PCI: Clear PCI_STATUS when setting up device" scsi: elx: libefc: Fix second parameter type in state callbacks hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() scsi: smartpqi: Add new controller PCI IDs scsi: smartpqi: Correct device removal for multi-actuator devices drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() scsi: target: iscsi: Fix a race condition between login_work and the login thread orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_sysfs_init() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() hwmon: (jc42) Fix missing unlock on error in jc42_write() ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() ALSA: hda/hdmi: fix i915 silent stream programming flow ALSA: hda/hdmi: set default audio parameters for KAE silent-stream ALSA: hda/hdmi: fix stream-id config keep-alive for rt suspend ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern LoadPin: Ignore the "contents" argument of the LSM hooks lkdtm: cfi: Make PAC test work with GCC 7 and 8 pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion drm/amd/pm: avoid large variable on kernel stack perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() perf tools: Make quiet mode consistent between tools perf probe: Check -v and -q options in the right place MIPS: ralink: mt7621: avoid to init common ralink reset controller perf test: Fix "all PMU test" to skip parametrized events afs: Fix lost servers_outstanding count cfi: Fix CFI failure with KASAN pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule Input: iqs7222 - drop unused device node references Input: iqs7222 - report malformed properties Input: iqs7222 - add support for IQS7222A v1.13+ dt-bindings: input: iqs7222: Reduce 'linux,code' to optional dt-bindings: input: iqs7222: Correct minimum slider size dt-bindings: input: iqs7222: Add support for IQS7222A v1.13+ ALSA: usb-audio: Workaround for XRUN at prepare ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list HID: logitech-hidpp: Guard FF init code against non-USB devices usb: cdnsp: fix lack of ZLP for ep0 usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq arm64: dts: qcom: sm6350: fix USB-DP PHY registers arm64: dts: qcom: sm8250: fix USB-DP PHY registers dt-bindings: clocks: imx8mp: Add ID for usb suspend clock clk: imx: imx8mp: add shared clk gate for usb suspend clk usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init xhci: Prevent infinite loop in transaction errors recovery for streams HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw loop: Fix the max_loop commandline argument treatment when it is set to 0 9p: set req refcount to zero to avoid uninitialized usage security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 reiserfs: Add missing calls to reiserfs_security_free() iio: fix memory leak in iio_device_register_eventset() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table iio: addac: ad74413r: fix integer promotion bug in ad74413_get_input_current_offset() regulator: core: fix deadlock on regulator enable spi: fsl_spi: Don't change speed while chipselect is active floppy: Fix memory leak in do_floppy_init() gcov: add support for checksum field test_maple_tree: add test for mas_spanning_rebalance() on insufficient data maple_tree: fix mas_spanning_rebalance() on insufficient data fbdev: fbcon: release buffer when fbcon_do_set_font() failed ovl: fix use inode directly in rcu-walk mode btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range mm/gup: disallow FOLL_FORCE|FOLL_WRITE on hugetlb mappings scsi: qla2xxx: Fix crash when I/O abort times out blk-iolatency: Fix memory leak on add_disk() failures io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag io_uring: add completion locking for iopoll io_uring: dont remove file from msg_ring reqs io_uring: improve io_double_lock_ctx fail handling io_uring/net: ensure compat import handlers clear free_iov io_uring/net: fix cleanup after recycle io_uring: protect cq_timeouts with timeout_lock io_uring: remove iopoll spinlock net: stmmac: fix errno when create_singlethread_workqueue() fails media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug drm/amd/display: revert Disable DRR actions during state commit mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code pwm: tegra: Fix 32 bit build Linux 6.1.2 Change-Id: I8f7c080f3b8288ed319fc0e25aaefb7ad5cd6b84 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 18:44:34 +00:00
YoungJun.park	84cc257e18	kunit: alloc_string_stream_fragment error handling bug fix ... [ Upstream commit 93ef83050e597634d2c7dc838a28caf5137b9404 ] When it fails to allocate fragment, it does not free and return error. And check the pointer inappropriately. Fixed merge conflicts with commit 618887768b ("kunit: update NULL vs IS_ERR() tests") Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: YoungJun.park <her0gyugyu@gmail.com> Reviewed-by: David Gow <davidgow@google.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-12 12:02:41 +01:00
Ard Biesheuvel	1c0ab9432e	ANDROID: crypto: lib/aes - add vendor hooks for AES library routines ... Add vendor hooks that will allow the FIPS140 kernel module to override the implementations of the AES library routines. The FIPS 140 versions are identical to the normal ones, but their code and rodata will have been integrity checked at module load time. Original commits: android12-5.10: 9c556792b713 ("ANDROID: crypto: lib/aes - add vendor hooks for AES library routines") android14-5.15: d4966a820397 ("ANDROID: fips140: remove CONFIG_CRYPTO_FIPS140 option") Bug: 153614920 Bug: 188620248 Change-Id: I5711fc42eced903565fd3c8d41ca7cdd82641148 Signed-off-by: Ard Biesheuvel <ardb@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com>	2023-01-09 21:33:28 +00:00
Ard Biesheuvel	1984e62b10	ANDROID: crypto: lib/sha256 - add vendor hook for sha256() routine ... Add a vendor hook that will allow the FIPS140 kernel module to override the implementation of the sha256() library routine. The FIPS 140 version is identical to the normal one, but its code and rodata will have been integrity checked at module load time. Original commits: android12-5.10: 1e351b98e7c7 ("ANDROID: crypto: lib/sha256 - add vendor hook for sha256() routine") android14-5.15: 0ef21e1c1ae5 ("ANDROID: vendor_hooks: Reduce pointless modversions CRC churn") d4966a820397 ("ANDROID: fips140: remove CONFIG_CRYPTO_FIPS140 option") Bug: 153614920 Bug: 188620248 Change-Id: I8ccc4f0cc8206af39fa922134b438dacac2a614a Signed-off-by: Ard Biesheuvel <ardb@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com>	2023-01-09 21:33:18 +00:00
Li Hua	ee29001a63	test_kprobes: Fix implicit declaration error of test_kprobes ... commit 63a4dc0a0bb0e9bfeb2c88ccda81abdde4cdd6b8 upstream. If KPROBES_SANITY_TEST and ARCH_CORRECT_STACKTRACE_ON_KRETPROBE is enabled, but STACKTRACE is not set. Build failed as below: lib/test_kprobes.c: In function ‘stacktrace_return_handler’: lib/test_kprobes.c:228:8: error: implicit declaration of function ‘stack_trace_save’; did you mean ‘stacktrace_driver’? [-Werror=implicit-function-declaration] ret = stack_trace_save(stack_buf, STACK_BUF_SIZE, 0); ^~~~~~~~~~~~~~~~ stacktrace_driver cc1: all warnings being treated as errors scripts/Makefile.build:250: recipe for target 'lib/test_kprobes.o' failed make[2]: *** [lib/test_kprobes.o] Error 1 To fix this error, Select STACKTRACE if ARCH_CORRECT_STACKTRACE_ON_KRETPROBE is enabled. Link: https://lore.kernel.org/all/20221121030620.63181-1-hucool.lihua@huawei.com/ Fixes: 1f6d3a8f5e ("kprobes: Add a test case for stacktrace from kretprobe handler") Cc: stable@vger.kernel.org Signed-off-by: Li Hua <hucool.lihua@huawei.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-07 11:11:55 +01:00
Liam Howlett	9c9e8be758	maple_tree: fix mas_spanning_rebalance() on insufficient data ... commit 0abb964aae3da746ea2fd4301599a6fa26da58db upstream. Mike Rapoport contacted me off-list with a regression in running criu. Periodic tests fail with an RCU stall during execution. Although rare, it is possible to hit this with other uses so this patch should be backported to fix the regression. This patchset adds the fix and a test case to the maple tree test suite. This patch (of 2): An insufficient node was causing an out-of-bounds access on the node in mas_leaf_max_gap(). The cause was the faulty detection of the new node being a root node when overwriting many entries at the end of the tree. Fix the detection of a new root and ensure there is sufficient data prior to entering the spanning rebalance loop. Link: https://lkml.kernel.org/r/20221219161922.2708732-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20221219161922.2708732-2-Liam.Howlett@oracle.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: Mike Rapoport <rppt@kernel.org> Tested-by: Mike Rapoport <rppt@kernel.org> Cc: Andrei Vagin <avagin@gmail.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muhammad Usama Anjum <usama.anjum@collabora.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-31 13:33:11 +01:00
Liam Howlett	8034a1ad67	test_maple_tree: add test for mas_spanning_rebalance() on insufficient data ... commit c5651b31f51584bd1199b3a552c8211a8523d6e1 upstream. Add a test to the maple tree test suite for the spanning rebalance insufficient node issue does not go undetected again. Link: https://lkml.kernel.org/r/20221219161922.2708732-3-Liam.Howlett@oracle.com Fixes: 54a611b605 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Andrei Vagin <avagin@gmail.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muhammad Usama Anjum <usama.anjum@collabora.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-31 13:33:11 +01:00