android_kernel_xiaomi_sm8450

Author	SHA1	Message	Date
Michael Bestas	6725684c74	Merge tag 'ASB-2024-12-05_12-5.10' of https://android.googlesource.com/kernel/common into android13-5.10-waipio https://source.android.com/docs/security/bulletin/2024-12-01 * tag 'ASB-2024-12-05_12-5.10' of https://android.googlesource.com/kernel/common: (649 commits) ANDROID: ABI: update symbol list for honor ANDROID: fs: add vendor hook to collect IO statistics ANDROID: tools/objtool: Pass CFLAGS to libsubcmd build via EXTRA_CFLAGS UPSTREAM: HID: core: zero-initialize the report buffer ANDROID: libsubcmd: Hoist iterator variable declarations in parse_options_subcommand() ANDROID: mm: Fix SPF-aware fast-mremap UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT UPSTREAM: f2fs: support SEEK_DATA and SEEK_HOLE for compression files Revert "genetlink: hold RCU in genlmsg_mcast()" ANDROID: add file for recording allowed ABI breaks ANDROID: GKI: update symbol list for honor ANDROID: Allow vendor modules perform more operations on memleak detect UPSTREAM: drm/omap: fix misleading indentation in pixinc() UPSTREAM: bitfield: build kunit tests without structleak plugin BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze FROMGIT: binder: allow freeze notification for dead nodes FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work() ... Conflicts: android/abi_gki_aarch64.xml net/qrtr/af_qrtr.c Change-Id: I4f416cf6c90e71fbdc0bea2c76a620842a2a2288	2024-12-16 00:43:42 +02:00
Rui Chen	5f45a7ef79	ANDROID: fs: add vendor hook to collect IO statistics Add vendor hook to get metainfo of direct/buffered read and write. Determine hot files in each performance-sensitive user scenario. Bug: 380502059 Change-Id: Ie7604852df637d6664afd72e87bd6d4b14bbc2a2 Signed-off-by: Rui Chen <chenrui9@honor.com>	2024-12-02 19:22:28 +00:00
Greg Kroah-Hartman	b0e9b554c3	Merge tag 'android12-5.10.228_r00' into android12-5.10 This merges up to the 5.10.228 LTS release into the android12-5.10 branch. Changes included in here are: * `38dc270ca0` Revert "genetlink: hold RCU in genlmsg_mcast()" * `c515597aec` Merge `02874ca52d` ("tracing: Consider the NULL character when validating the event length") into android12-5.10-lts \|\ \| * `02874ca52d` tracing: Consider the NULL character when validating the event length \| * `df848523d6` jfs: Fix sanity check in dbMount \| * `8605ca4bd0` arm64: Force position-independent veneers \| * `0329056e07` ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit \| * `75f828e944` drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA \| * `649d646506` iomap: update ki_pos a little later in iomap_dio_complete \| * `c9b7743807` exec: don't WARN for racy path_noexec check \| * `20e27c7739` block, bfq: fix procress reference leakage for bfqq in merge chain \| * `bf83ba3c55` KVM: s390: gaccess: Check if guest address is in memslot \| * `6e1659b674` KVM: s390: gaccess: Cleanup access to guest pages \| * `472088ffb1` KVM: s390: gaccess: Refactor access address range check \| * `511ca93509` KVM: s390: gaccess: Refactor gpa and length calculation \| * `cf9ddf9ed9` arm64: probes: Fix uprobes for big-endian kernels \| * `7f1ef59185` arm64:uprobe fix the uprobe SWBP_INSN in big-endian \| * `6c151aeb6d` Bluetooth: bnep: fix wild-memory-access in proto_unregister \| * `5c345c47e8` s390: Initialize psw mask in perf_arch_fetch_caller_regs() \| * `6af43ec3bf` usb: typec: altmode should keep reference to parent \| * `ed31aba8ce` smb: client: fix OOBs when building SMB2_IOCTL request \| * `8c1e6717f6` scsi: target: core: Fix null-ptr-deref in target_alloc_device() \| * `4af714e823` genetlink: hold RCU in genlmsg_mcast() \| * `b632114677` net: systemport: fix potential memory leak in bcm_sysport_xmit() \| * `f48eaf4e88` net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid \| * `aacf6e28ae` net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() \| * `56dbb74b6a` macsec: don't increment counters for an unrelated SA \| * `2c7dd3ca6b` drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation \| * `df6fed0a2a` RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages \| * `78aaf54ad5` RDMA/bnxt_re: Return more meaningful error \| * `718609f518` ipv4: give an IPv4 dev to blackhole_netdev \| * `59df170bde` RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP \| * `9076d449e7` ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin \| * `dbe51dd516` RDMA/bnxt_re: Add a check for memory allocation \| * `c17e5cbbb1` RDMA/bnxt_re: Fix incorrect AVID type in WQE structure * \| `012423e6bd` Merge 5.10.228 into android12-5.10-lts \|\\| \| * `5a8fa04b2a` Linux 5.10.228 \| * `2abe57d62a` ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 \| * `25e86fb0ae` powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() \| * `c1d0476885` nilfs2: propagate directory read errors from nilfs_find_entry() \| * `c38add9ac0` tcp: fix mptcp DSS corruption due to large pmtu xmit \| * `fde99e972b` mptcp: handle consistently DSS corruption \| * `609937aa96` mptcp: track and update contiguous data status \| * `b7d7b7fc87` irqchip/gic-v4: Don't allow a VMOVP on a dying VPE \| * `6f44a5fc15` x86/entry_32: Clear CPU buffers after register restore in NMI return \| * `9ab38a1cdb` x86/entry_32: Do not clobber user EFLAGS.ZF \| * `8462805788` x86/apic: Always explicitly disarm TSC-deadline timer \| * `e475220d64` x86/resctrl: Annotate get_mem_config() functions as __init \| * `1826b6d69b` parport: Proper fix for array out-of-bounds access \| * `9f8ddf14fa` USB: serial: option: add Telit FN920C04 MBIM compositions \| * `0fc55ec9fc` USB: serial: option: add support for Quectel EG916Q-GL \| * `608b626f71` xhci: Fix incorrect stream context type macro \| * `fc2cb5e3af` Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 \| * `63d6a3b078` Bluetooth: Remove debugfs directory on module init failure \| * `516655749a` iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig \| * `f80375f275` iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig \| * `dc99dfa2ba` iio: light: opt3001: add missing full-scale range value \| * `bf3ab8e1c2` iio: light: veml6030: fix IIO device retrieval from embedded device \| * `2d06787b70` iio: light: veml6030: fix ALS sensor resolution \| * `ffc4174309` iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() \| * `9504153a48` iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig \| * `c27133637a` iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig \| * `c4c2211b12` iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig \| * `3abc1ebea3` iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig \| * `0782809c01` drm/vmwgfx: Handle surface check failure correctly \| * `df75c78bfe` drm/radeon: Fix encoder->possible_clones \| * `6ddcaee244` io_uring/sqpoll: close race on waiting for sqring entries \| * `3bc6d0f8b7` blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race \| * `eca3edf876` x86/bugs: Do not use UNTRAIN_RET with IBPB on entry \| * `e7c0f8ca3b` x86/bugs: Skip RSB fill at VMEXIT \| * `0ab77a47e3` x86/entry: Have entry_ibpb() invalidate return predictions \| * `c5e57863d7` x86/cpufeatures: Add a IBPB_NO_RET BUG flag \| * `77fa260620` x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET \| * `dfa4b5d4ba` KVM: s390: Change virtual to physical address access in diag 0x258 handler \| * `d047095095` s390/sclp_vt220: Convert newlines to CRLF instead of LFCR \| * `b12ef2d4df` io_uring/sqpoll: do not put cpumask on stack \| * `66b98c4f18` io_uring/sqpoll: retain test for whether the CPU is valid \| * `54a987b41d` io_uring/sqpoll: do not allow pinning outside of cpuset \| * `71fbc3af3d` KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() \| * `e8e599a635` wifi: mac80211: fix potential key use-after-free \| * `417d5838ca` mm/swapfile: skip HugeTLB pages for unuse_vma \| * `043f055261` fat: fix uninitialized variable \| * `bf1a022222` irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 \| * `cafa5942bd` net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY \| * `ce43c48cdc` arm64: probes: Fix simulate_ldr_literal() \| `3728b4eb27` arm64: probes: Remove broken LDR (literal) uprobe support \| * `673a1c5a29` posix-clock: Fix missing timespec64 check in pc_clock_settime() \| * `dbe055567a` net: enetc: add missing static descriptor and inline keyword \| * `5f47cdeeef` ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 * \| `af2f7573ea` Revert "xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup" * \| `705b091042` Revert "net: Handle l3mdev in ip_tunnel_init_flow" * \| `0ba4653710` Merge 5.10.227 into android12-5.10-lts \|\\| \| * `eac1c5bfc1` Linux 5.10.227 \| * `9350016415` net: dsa: microchip: fix build warning \| * `9f76a9d184` RDMA/hns: Fix uninitialized variable * \| `7ad1ad5a55` Merge `4911610c7a` ("ext4: fix warning in ext4_dio_write_end_io()") into android12-5.10-lts \|\\| \| * `4911610c7a` ext4: fix warning in ext4_dio_write_end_io() * \| `b585ecc2c9` Merge `05cc42d601` ("netfilter: ip6t_rpfilter: Fix regression with VRF interfaces") into android12-5.10-lts \|\\| \| * `05cc42d601` netfilter: ip6t_rpfilter: Fix regression with VRF interfaces \| * `95f62e5a78` net: vrf: determine the dst using the original ifindex for multicast \| * `3adb1be04f` net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev \| * `ab6c9463b1` net: Handle l3mdev in ip_tunnel_init_flow \| * `0825c5ff24` xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup \| * `4bf1bd3fff` net: geneve: add missing netlink policy and size for IFLA_GENEVE_INNER_PROTO_INHERIT \| * `73f75d2b5a` nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error \| * `548d0102dc` net: dsa: lan9303: ensure chip reset and wait for READY status \| * `68ad5da6ca` net: Fix an unsafe loop on the list \| * `fcda074c98` hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma \| * `e7a1d51b39` usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip \| * `1d7fc802a7` usb: xhci: Fix problem with xhci resume from suspend \| * `f8dea2fede` usb: dwc3: core: Stop processing of pending events if controller is halted * \| `9b1caf0550` Merge `a7564b1606` ("Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"") into android12-5.10-lts \|\\| \| * `a7564b1606` Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" \| * `8669bca53f` HID: plantronics: Workaround for an unexcepted opposite volume key \| * `799a06ca7f` hwmon: (adm9240) Add missing dependency on REGMAP_I2C \| * `ab6bc15e99` hwmon: (tmp513) Add missing dependency on REGMAP_I2C \| * `1d5f85f1b7` resource: fix region_intersects() vs add_memory_driver_managed() \| * `36b054324d` slip: make slhc_remember() more robust against malicious packets \| * `30d91a478d` ppp: fix ppp_async_encode() illegal access * \| `4098b69102` Revert "net: Add l3mdev index to flow struct and avoid oif reset for port devices" * \| `5cb5d15755` Revert "netfilter: rpfilter/fib: Populate flowic_l3mdev field" * \| `6fc602a28c` Revert "netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces." * \| `7253529039` Revert "netfilter: fib: check correct rtable in vrf setups" * \| `81d8cb7a3e` Merge `3502b1a297` ("netfilter: fib: check correct rtable in vrf setups") into android12-5.10-lts \|\\| \| * `3502b1a297` netfilter: fib: check correct rtable in vrf setups \| * `037145e2a2` netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces. \| * `d98558fe26` netfilter: rpfilter/fib: Populate flowic_l3mdev field \| * `740de19877` net: Add l3mdev index to flow struct and avoid oif reset for port devices * \| `ff0e27a0f9` Merge `265bf63e24` ("sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start") into android12-5.10-lts \|\\| \| * `265bf63e24` sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start \| * `23e139f90b` net: ibm: emac: mal: fix wrong goto \| * `adbc3eef43` net/sched: accept TCA_STAB only for root qdisc \| * `d79af3af2f` igb: Do not bring the device up after non-fatal error \| * `c70e05b929` gpio: aspeed: Use devm_clk api to manage clock source \| * `36fd66cb51` gpio: aspeed: Add the flush write to ensure the write complete. * \| `ca21e0d3a8` Merge `0e91c4b484` ("net: dsa: b53: fix jumbo frames on 10/100 ports") into android12-5.10-lts \|\\| \| * `0e91c4b484` net: dsa: b53: fix jumbo frames on 10/100 ports \| * `a7c9402bbc` net: dsa: b53: allow lower MTUs on BCM5325/5365 \| * `9f3407aa6c` net: dsa: b53: fix max MTU for BCM5325/BCM5365 \| * `0109267c1e` net: dsa: b53: fix max MTU for 1g switches \| * `a625acf221` net: dsa: b53: fix jumbo frame mtu check \| * `e13ffbf5fd` net: phy: bcm84881: Fix some error handling paths \| * `ef44274dae` Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change \| * `cce8419b81` netfilter: br_netfilter: fix panic with metadata_dst skb \| * `8a517d1845` tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe \| * `fe238ddf85` tcp: fix to allow timestamp undo if no retransmits were sent * \| `6c71f56f4f` Merge `21b5af7f0c` ("net: phy: dp83869: fix memory corruption when enabling fiber") into android12-5.10-lts \|\\| \| * `21b5af7f0c` net: phy: dp83869: fix memory corruption when enabling fiber \| * `f892165c56` NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() \| * `64f1b4922b` SUNRPC: Fix integer overflow in decode_rc_list() \| * `1fc13f6a41` ice: fix VLAN replay after reset \| * `993ce09fe6` NFSD: Mark filecache "down" if init fails * \| `e22e091f95` Merge `de5a059e36` ("RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt") into android12-5.10-lts \|\\| \| * `de5a059e36` RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt \| * `252f147b18` fbdev: sisfb: Fix strbuf array overflow \| * `f4149eec96` drm/amd/display: Check null pointer before dereferencing se \| * `56452dbc0a` driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute \| * `d8ac7378bc` tools/iio: Add memory allocation failure check for trigger_name \| * `4ce662fe4b` virtio_pmem: Check device status before requesting flush \| * `30ea38665d` usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario \| * `4c83143fc6` usb: chipidea: udc: enable suspend interrupt after usb reset \| * `b677b94a91` clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D \| * `37c181e389` media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() \| * `b650189687` ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition \| * `63047187a5` PCI: Mark Creative Labs EMU20k2 INTx masking as broken \| * `a28703d4d4` i2c: i801: Use a different adapter-name for IDF adapters \| * `e4f218455c` PCI: Add ACS quirk for Qualcomm SA8775P \| * `f3e0a8b7d4` clk: bcm: bcm53573: fix OF node leak in init \| * `b10c1ca941` PCI: Add function 0 DMA alias quirk for Glenfly Arise chip \| * `713adaf0ec` RDMA/mad: Improve handling of timed out WRs of mad agent \| * `24318116c4` ktest.pl: Avoid false positives with grub2 skip regex \| * `345d3c0bf2` s390/cpum_sf: Remove WARN_ON_ONCE statements \| * `c2097d5efb` ext4: nested locking for xattr inode \| * `dced2c9d66` s390/mm: Add cond_resched() to cmm_alloc/free_pages() \| * `1cd197813e` s390/facility: Disable compile time optimization for decompressor code \| * `029aa36ba3` bpf: Check percpu map value size first \| * `4f4a6d70d7` Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal \| * `546fb43a2e` tracing/kprobes: Fix symbol counting logic by looking at modules as well \| * `90a6a070a8` tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols * \| `2a22a03cae` Merge `2622c805ab` ("kallsyms: Make module_kallsyms_on_each_symbol generally available") into android12-5.10-lts \|\\| \| * `2622c805ab` kallsyms: Make module_kallsyms_on_each_symbol generally available \| * `2aa861ec72` kallsyms: Make kallsyms_on_each_symbol generally available \| * `9b82d737d2` virtio_console: fix misc probe bugs \| * `f2fd1a9597` tracing: Have saved_cmdlines arrays all in one allocation \| * `25b0021620` s390/zcore: release dump save area on restart or power down \| * `0b4dc46f87` s390/zcore: no need to check return value of debugfs_create functions \| * `421795b064` drm/crtc: fix uninitialized variable use even harder \| * `a009e88cc9` tracing: Remove precision vsnprintf() check from print event \| * `6063d72b61` net: ethernet: cortina: Drop TSO support \| * `39fffca572` unicode: Don't special case ignorable code points \| * `6592347f06` vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() \| * `2f6da71e9d` ext4: fix inode tree inconsistency caused by ENOMEM \| * `da964de4c1` ACPI: battery: Fix possible crash when unregistering a battery hook \| * `20557232c9` ACPI: battery: Simplify battery hook locking \| * `991e8b0bab` r8169: add tally counter fields added with RTL8125 \| * `238d5c541e` r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun" \| * `281edfa1cd` clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks * \| `96a5139526` Merge `570e257621` ("drm/rockchip: vop: clear DMA stop bit on RK3066") into android12-5.10-lts \|\\| \| * `570e257621` drm/rockchip: vop: clear DMA stop bit on RK3066 \| * `411e2e1d01` drm/rockchip: support gamma control on RK3399 \| * `1aeaa7e8d8` drm/rockchip: define gamma registers for RK3399 \| * `f561b48d63` uprobes: fix kernel info leak via "[uprobes]" vma * \| `042d3e2676` Merge `24afda0421` ("arm64: errata: Expand speculative SSBS workaround once more") into android12-5.10-lts \|\\| \| * `24afda0421` arm64: errata: Expand speculative SSBS workaround once more \| * `9df353ca13` arm64: cputype: Add Neoverse-N3 definitions \| * `c45edd5942` arm64: Add Cortex-715 CPU part definition * \| `ce691439c0` Revert "ext4: properly sync file size update after O_SYNC direct IO" * \| `f46870ab3d` Revert "ext4: dax: fix overflowing extents beyond inode size when partially writing" * \| `5d9c84863f` Merge `f8a7c34232` ("ext4: dax: fix overflowing extents beyond inode size when partially writing") into android12-5.10-lts \|\\| \| * `f8a7c34232` ext4: dax: fix overflowing extents beyond inode size when partially writing * \| `8fb88ba5de` Merge `dde4c1e166` ("ext4: properly sync file size update after O_SYNC direct IO") into android12-5.10-lts \|\\| \| * `dde4c1e166` ext4: properly sync file size update after O_SYNC direct IO * \| `e62d85f9ba` Merge `6ff56ef7f7` ("i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled") into android12-5.10-lts \|\\| \| * `6ff56ef7f7` i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled * \| `b5e0cda160` Merge `d223126bb0` ("i2c: xiic: Use devm_clk_get_enabled()") into android12-5.10-lts \|\\| \| * `d223126bb0` i2c: xiic: Use devm_clk_get_enabled() * \| `ed3c358943` Merge `9bd3443e34` ("i2c: xiic: Simplify with dev_err_probe()") into android12-5.10-lts \|\\| \| * `9bd3443e34` i2c: xiic: Simplify with dev_err_probe() * \| `93d28c0f5a` Merge `8b55076b7b` ("kconfig: qconf: fix buffer overflow in debug links") into android12-5.10-lts \|\\| \| * `8b55076b7b` kconfig: qconf: fix buffer overflow in debug links * \| `6e988ae353` Merge `bfab5fbc12` ("drm/sched: Add locking to drm_sched_entity_modify_sched") into android12-5.10-lts \|\\| \| * `bfab5fbc12` drm/sched: Add locking to drm_sched_entity_modify_sched * \| `25d36c65fb` Merge `c54aa7d750` ("gpio: davinci: fix lazy disable") into android12-5.10-lts \|\\| \| * `c54aa7d750` gpio: davinci: fix lazy disable * \| `9fbdcfe7bb` Merge `70b60c8d9b` ("btrfs: wait for fixup workers before stopping cleaner kthread during umount") into android12-5.10-lts \|\\| \| * `70b60c8d9b` btrfs: wait for fixup workers before stopping cleaner kthread during umount * \| `d476e18cbf` Merge `d73d48acf3` ("btrfs: fix a NULL pointer dereference when failed to start a new trasacntion") into android12-5.10-lts \|\\| \| * `d73d48acf3` btrfs: fix a NULL pointer dereference when failed to start a new trasacntion * \| `657f07546b` Merge `67db431b85` ("ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]") into android12-5.10-lts \|\\| \| * `67db431b85` ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[] * \| `17c42250e8` Merge `1a819c7f85` ("ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]") into android12-5.10-lts \|\\| \| * `1a819c7f85` ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[] * \| `c53240428e` Revert "clk: qcom: clk-rpmh: Fix overflow in BCM vote" * \| `509ddbb2b8` Merge `f976d964a6` ("Input: adp5589-keys - fix adp5589_gpio_get_value()") into android12-5.10-lts \|\\| \| * `f976d964a6` Input: adp5589-keys - fix adp5589_gpio_get_value() \| * `bf8363e46f` rtc: at91sam9: fix OF node leak in probe() error path \| * `e33fe25b1e` net: stmmac: Fix zero-division error when disabling tc cbs \| * `68e579316c` tomoyo: fallback to realpath if symlink's pathname does not exist \| * `68c77a70e3` iio: magnetometer: ak8975: Fix reading for ak099xx sensors \| * `1d108095d5` clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable() \| * `60b6968341` media: venus: fix use after free bug in venus_remove due to race condition \| * `4445bc6e9f` clk: qcom: clk-rpmh: Fix overflow in BCM vote \| * `3f73da56af` media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags \| * `5443e70fb7` media: sun4i_csi: Implement link validate for sun4i_csi subdev \| * `ed0d5103f9` clk: rockchip: fix error for unknown clocks \| * `f63461af2c` aoe: fix the potential use-after-free problem in more places \| * `7ae7ada29a` NFSD: Fix NFSv4's PUTPUBFH operation \| * `0ea4333c67` nfsd: map the EBADMSG to nfserr_io to avoid warning \| * `96cad5da79` nfsd: fix delegation_blocked() to block correctly for at least 30 seconds \| * `f692160d3e` exfat: fix memory leak in exfat_load_bitmap() \| * `e01e9ae43e` riscv: define ILLEGAL_POINTER_VALUE for 64bit \| * `61b84013e5` ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate \| * `bf605ae98d` ocfs2: fix null-ptr-deref when journal load failed. \| * `3f1ca6ba54` ocfs2: remove unreasonable unlock in ocfs2_read_blocks \| * `14114d8148` ocfs2: cancel dqi_sync_work before freeing oinfo \| * `aac31d654a` ocfs2: reserve space for inline xattr before attaching reflink tree \| * `8e3bf36636` ocfs2: fix uninit-value in ocfs2_get_block() \| * `ff1500fe26` ocfs2: fix the la space leak when unmounting an ocfs2 volume \| * `a543785856` mm: krealloc: consider spare memory for __GFP_ZERO \| * `7fabacb337` jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit \| * `481e8f18a2` jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error \| * `2bda897351` drm: omapdrm: Add missing check for alloc_ordered_workqueue \| * `3e8862875f` of/irq: Support #msi-cells=<0> in of_msi_get_domain \| * `a63fdf20cc` parisc: Fix stack start for ADDR_NO_RANDOMIZE personality \| * `ea7dead204` parisc: Fix 64-bit userspace syscall path \| * `25ec5c873c` ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() \| * `6766937d03` ext4: update orig_path in ext4_find_extent() \| * `b6c29c8f3d` ext4: fix double brelse() the buffer of the extents path \| * `5e811066c5` ext4: aovid use-after-free in ext4_ext_insert_extent() \| * `8c26d9e53e` ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free \| * `4286a04183` ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() \| * `7bcdef04d0` ext4: propagate errors from ext4_find_extent() in ext4_insert_range() \| * `e52f933598` ext4: fix slab-use-after-free in ext4_split_extent_at() \| * `133ff0d78f` ext4: no need to continue when the number of entries is 1 * \| `6a00671aec` Merge `2c08dfc99f` ("ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9") into android12-5.10-lts \|\\| \| * `2c08dfc99f` ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9 \| * `c36ff6948c` ALSA: line6: add hw monitor volume control to POD HD500X \| * `64d315aeec` ALSA: core: add isascii() check to card ID generator \| * `b078a7eee1` drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS \| * `afa9990523` parisc: Fix itlb miss handler for 64-bit programs \| * `d6b22a2d55` perf/core: Fix small negative period being ignored \| * `8ab638bb49` spi: bcm63xx: Fix module autoloading \| * `f53c2b55d0` firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() \| * `2c1effc225` i2c: xiic: Wait for TX empty to avoid missed TX NAKs \| * `46c72b0139` i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() \| * `9b8bc33ad6` i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume \| * `10dde0c1fb` selftests/mm: fix charge_reserved_hugetlb.sh test \| * `e45803c71f` selftests: vDSO: fix vDSO symbols lookup for powerpc64 \| * `7624223155` selftests: breakpoints: use remaining time to check if suspend succeed \| * `eda94fc74b` spi: s3c64xx: fix timeout counters in flush_fifo \| * `e3b57186f4` spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled \| * `53b1999cfd` ext4: fix i_data_sem unlock order in ext4_ind_migrate() \| * `b0cb4561fc` ext4: avoid use-after-free in ext4_ext_show_leaf() \| * `a34416ec26` ext4: ext4_search_dir should return a proper error \| * `e82df17e5f` of/irq: Refer to actual buffer size in of_irq_parse_one() \| * `29f3889457` drm/amd/pm: ensure the fw_info is not null before using it \| * `0a377fcace` drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() \| * `aec72bfbc1` scsi: aacraid: Rearrange order of struct aac_srb_unit \| * `cf387300b8` drm/printer: Allow NULL data in devcoredump printer \| * `f921335123` drm/amd/display: Initialize get_bytes_per_element's default to 1 \| * `7ab69af56a` drm/amd/display: Fix index out of bounds in DCN30 color transformation \| * `c130a3c09e` drm/amd/display: Fix index out of bounds in degamma hardware format translation \| * `ad89f83343` drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation \| * `0167d570f6` drm/amd/display: Check stream before comparing them \| * `e2743d0a03` platform/x86: touchscreen_dmi: add nanote-next quirk \| * `831e8a816e` drm/amdgpu: enable gfxoff quirk on HP 705G4 \| * `e407715e7a` drm/amdgpu: add raven1 gfxoff quirk \| * `8b1dcf25c2` jfs: Fix uninit-value access of new_ea in ea_buffer \| * `2451e5917c` jfs: check if leafidx greater than num leaves per dmap tree \| * `fd026b6b67` jfs: Fix uaf in dbFreeBits \| * `f9db7bb112` jfs: UBSAN: shift-out-of-bounds in dbFindBits \| * `8d54001f8d` drm/amd/display: Check null pointers before using dc->clk_mgr \| * `49ded70954` ata: sata_sil: Rename sil_blacklist to sil_quirks * \| `b48eba851f` Merge `1ebfa66638` ("drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream") into android12-5.10-lts \|\\| \| * `1ebfa66638` drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream \| * `de9e7f6876` iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count \| * `5652c448da` iommu/vt-d: Always reserve a domain ID for identity setup \| * `9e493f002d` power: reset: brcmstb: Do not go into infinite loop if reset fails \| * `d9245b9296` iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux \| * `ceff6f5e71` rcuscale: Provide clear error when async specified without primitives \| * `e6897e299f` fbdev: pxafb: Fix possible use after free in pxafb_task() \| * `79681036a3` x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments() \| * `98111af338` ALSA: hdsp: Break infinite MIDI input flush loop \| * `219587bca2` ALSA: asihpi: Fix potential OOB array access \| * `e2b200c502` ALSA: usb-audio: Add logitech Audio profile quirk \| * `35733d1a60` ALSA: usb-audio: Define macros for quirk table entries \| * `6ee6835f82` signal: Replace BUG_ON()s \| * `aa4e9056df` nfp: Use IRQF_NO_AUTOEN flag in request_irq() \| * `1756918f51` wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() \| * `47be40b698` proc: add config & param to block forcing mem writes \| * `02c1725eb2` ACPICA: iasl: handle empty connection_node \| * `95a91802e4` tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process \| * `b7cbdd6b1b` net: atlantic: Avoid warning about potential string truncation \| * `a479b653d5` ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family \| * `669d337aa1` ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). \| * `bf60b4f587` net: mvpp2: Increase size of queue_name buffer \| * `e2b2558971` tipc: guard against string buffer overrun \| * `cbb67e245d` ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() \| * `a40e7a2b80` ACPI: EC: Do not release locks during operation region accesses \| * `7cd004102b` wifi: rtw88: select WANT_DEV_COREDUMP \| * `0f26f26944` wifi: ath11k: fix array out-of-bound access in SoC stats \| * `1f61d50925` blk_iocost: fix more out of bound shifts \| * `62b8a46ba8` net: sched: consistently use rcu_replace_pointer() in taprio_change() * \| `baa474b078` Merge `74c63fd016` ("ACPICA: Fix memory leak if acpi_ps_get_next_field() fails") into android12-5.10-lts \|\\| \| * `74c63fd016` ACPICA: Fix memory leak if acpi_ps_get_next_field() fails \| * `30cd2158f2` ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails \| * `4440bac6f0` net: hisilicon: hns_mdio: fix OF node leak in probe() \| * `1245542856` net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() \| * `ac6e862b8d` net: hisilicon: hip04: fix OF node leak in probe() \| * `a7f0073fcd` net/xen-netback: prevent UAF in xenvif_flush_hash() \| * `ed418cad83` ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node() \| * `b02eb7c86f` wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit \| * `2171e1d750` wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() \| * `000bab8753` f2fs: Require FMODE_WRITE for atomic write ioctls \| * `b820cb910f` ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin \| * `f7785c4498` ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs \| * `f10d29b108` ALSA: hda/realtek: Fix the push button function for the ALC257 \| * `7c93044298` ALSA: mixer_oss: Remove some incorrect kfree_const() usages \| * `f13b04cf65` Bluetooth: L2CAP: Fix not validating setsockopt user input \| * `4ec4641df5` media: usbtv: Remove useless locks in usbtv_video_free() \| * `a73d996436` i2c: xiic: Try re-initialization on bus busy timeout \| * `c9668503e4` i2c: xiic: improve error message when transfer fails to start \| * `2d320d9de7` i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path \| * `148fdc3c7d` i2c: xiic: Fix RX IRQ busy check \| * `30def367fa` i2c: xiic: Switch from waitqueue to completion \| * `6da4bbeb16` i2c: xiic: Fix broken locking on tx_msg \| * `dd70c8a89e` sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start \| * `16b66c46b6` ipv4: ip_gre: Fix drops of small packets in ipgre_xmit \| * `566a931a14` net: add more sanity checks to qdisc_pkt_len_init() \| * `ba26060a29` net: avoid potential underflow in qdisc_pkt_len_init() with UFO \| * `185df15984` net: ethernet: lantiq_etop: fix memory disclosure \| * `c8bb4e2d5f` Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() * \| `6f91c0260d` Merge `531754952f` ("netfilter: nf_tables: prevent nf_skb_duplicated corruption") into android12-5.10-lts \|\\| \| * `531754952f` netfilter: nf_tables: prevent nf_skb_duplicated corruption \| * `7675fe977b` net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq() \| * `181fbbdd46` netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED * \| `6136b834d6` Merge `cdd86fb75f` ("net/mlx5: Added cond_resched() to crdump collection") into android12-5.10-lts \|\\| \| * `cdd86fb75f` net/mlx5: Added cond_resched() to crdump collection \| * `ca36d6c1a4` net/mlx5: Fix error path in multi-packet WQE transmit \| * `fd7fcd802e` ieee802154: Fix build error \| * `f55e003d26` ceph: remove the incorrect Fw reference check when dirtying pages \| * `32ee78823d` mailbox: bcm2835: Fix timeout during suspend mode \| * `3948c73c92` mailbox: rockchip: fix a typo in module autoloading \| * `6b9a551b83` spi: lpspi: Simplify some error message \| * `767b71f292` usb: yurex: Fix inconsistent locking bug in yurex_read() \| * `9f1c4edee8` i2c: isch: Add missed 'else' \| * `742a1b69c0` i2c: aspeed: Update the stop sw state when the bus recovery occurs \| * `52f7cab290` mm: only enforce minimum stack gap size if it's sensible \| * `1472dd897f` lockdep: fix deadlock issue between lockdep and rcu \| * `118a0c3e55` xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them. \| * `cc1de44135` usb: renesas-xhci: Remove renesas_xhci_pci_exit() \| * `0f8e74a061` pps: add an error check in parport_attach \| * `0e50834814` pps: remove usage of the deprecated ida_simple_xx() API \| * `47a632e5c6` USB: misc: yurex: fix race between read and write \| * `bf509ca62f` usb: yurex: Replace snprintf() with the safer scnprintf() variant \| * `6ea76e19d6` soc: versatile: realview: fix soc_dev leak during device remove \| * `6b3b25311d` soc: versatile: realview: fix memory leak during device remove \| * `263d04df06` PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler \| * `6dacc0b667` PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() \| * `46c4079460` padata: use integer wrap around to prevent deadlock on seq_nr overflow \| * `7d0079d644` nfs: fix memory leak in error path of nfs4_do_reclaim \| * `a239ff33c5` fs: Fix file_set_fowner LSM hook inconsistencies \| * `47a68c7505` vfs: fix race between evice_inodes() and find_inode()&iput() \| * `0eecd2ee23` arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity \| * `b2cb101b9b` arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency \| * `d41d665346` hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume \| * `1b2137f6c9` hwrng: mtk - Use devm_pm_runtime_enable \| * `cef1056ee6` f2fs: avoid potential int overflow in sanity_check_area_boundary() \| * `85c2f7bd57` f2fs: prevent possible int overflow in dir_block_index() \| * `5e3a031dfa` debugobjects: Fix conditions in fill_pool() \| * `dbffe7be55` wifi: rtw88: 8822c: Fix reported RX band width \| * `44f1816749` perf/x86/intel/pt: Fix sampling synchronization \| * `f76b69ab9c` efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption \| * `45a765f4ba` ACPI: resource: Add another DMI match for the TongFang GMxXGxx \| * `4b081991c4` ACPI: sysfs: validate return type of _STR method \| * `2e20b69b86` drbd: Add NULL check for net_conf to prevent dereference in state validation \| * `62720f2daa` drbd: Fix atomicity violation in drbd_uuid_set_bm() \| * `a295fa38dc` crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure \| * `c7148bf45d` tty: rp2: Fix reset with non forgiving PCIe host bridges \| * `c30558e6c5` firmware_loader: Block path traversal \| * `e89f925093` bus: integrator-lm: fix OF node leak in probe() \| * `61c12c72b1` USB: class: CDC-ACM: fix race between get_serial and set_serial \| * `fa83e1df43` USB: misc: cypress_cy7c63: check for short transfer \| * `1c5cd41b4b` USB: appledisplay: close race between probe and completion handler \| * `84f4d44703` drm/amd/display: Round calculated vtotal \| * `60aadf84be` Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line \| * `13175be789` Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table \| * `bf3f1affba` Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table \| * `cb9897b946` soc: versatile: integrator: fix OF node leak in probe() error path \| * `c55ebcb216` ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error \| * `aaaf3cd0a7` Remove .orig pattern from .gitignore \| `f291dc4cbc` mptcp: fix sometimes-uninitialized warning \| * `2dbc4b7bac` selinux,smack: don't bypass permissions check in inode_setsecctx hook \| * `4b81a9f92b` bpf: Fix DEVMAP_HASH overflow check on 32-bit arches \| * `0e6378dd9b` Revert "bpf: Eliminate rlimit-based memory accounting for devmap maps" \| * `bfe249c151` Revert "bpf: Fix DEVMAP_HASH overflow check on 32-bit arches" \| * `8926201447` x86/mm: Switch to new Intel CPU model defines \| * `089aece01a` powercap: RAPL: fix invalid initialization for pl4_supported field \| * `ba624f656a` Input: goodix - use the new soc_intel_is_byt() helper \| * `50460579fe` drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination * \| `f6317d304f` Merge `e0dbda9f26` ("netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS") into android12-5.10-lts \|\\| \| * `e0dbda9f26` netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS * \| `0e233e78a8` Merge `db9c5f08ee` ("netfilter: nf_tables: Keep deleted flowtable hooks until after RCU") into android12-5.10-lts \|\\| \| * `db9c5f08ee` netfilter: nf_tables: Keep deleted flowtable hooks until after RCU * \| `e45c637aa5` Merge `6c36857fe5` ("net: qrtr: Update packets cloning when broadcasting") into android12-5.10-lts \|\\| \| * `6c36857fe5` net: qrtr: Update packets cloning when broadcasting * \| `8acb711851` Merge `ec31cf42fc` ("tcp: check skb is non-NULL in tcp_rto_delta_us()") into android12-5.10-lts \|\\| \| * `ec31cf42fc` tcp: check skb is non-NULL in tcp_rto_delta_us() * \| `69acbd5795` Merge `98d14164c0` ("net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL") into android12-5.10-lts \|\\| \| * `98d14164c0` net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL * \| `13cdfa4cd3` Merge `338a0582b2` ("net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition") into android12-5.10-lts \|\\| \| * `338a0582b2` net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition * \| `973b583bb8` Merge `dcf48ab3ca` ("netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()") into android12-5.10-lts \|\\| \| * `dcf48ab3ca` netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() * \| `0407f5e40e` Merge `1429a9260f` ("Revert "dm: requeue IO if mapping table not yet available"") into android12-5.10-lts \|\\| \| * `1429a9260f` Revert "dm: requeue IO if mapping table not yet available" \| * `0c170b1e91` vhost_vdpa: assign irq bypass producer token correctly \| * `10348fb6fe` vdpa: Add eventfd for the vdpa callback \| * `64add9aaf7` interconnect: qcom: sm8250: Enable sync_state \| * `d4951dd16e` coresight: tmc: sg: Do not leak sg_table \| * `cf0674248d` iio: adc: ad7606: fix standby gpio state to match the documentation \| * `1ea56cd9a6` iio: adc: ad7606: fix oversampling gpio array \| * `b7413dbc63` spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time \| * `0ed35dd547` spi: lpspi: release requested DMA channels \| * `d612d419a5` spi: lpspi: Silence error message upon deferred probe \| * `6f2eeba7c3` f2fs: reduce expensive checkpoint trigger frequency \| * `3dc483f0e6` f2fs: remove unneeded check condition in __f2fs_setxattr() \| * `87aceb1ce6` f2fs: fix to update i_ctime in __f2fs_setxattr() \| * `db930da947` f2fs: fix typo \| * `7b5476f061` f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() \| * `0f1d007bbe` nfsd: return -EINVAL when namelen is 0 \| * `9f03f0016f` nfsd: call cache_put if xdr_reserve_space returns NULL \| * `40d5787354` ntb_perf: Fix printk format \| * `ef7e34237e` ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() \| * `dd598ac57d` RDMA/cxgb4: Added NULL check for lookup_atid \| * `502dac909e` riscv: Fix fp alignment bug in perf_callchain_user() \| * `322911a2e6` RDMA/hns: Optimize hem allocation performance \| * `07f0f643d7` RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled \| * `1e6195dc7a` RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() \| * `6258c4fb8d` RDMA/hns: Refactor root BT allocation for MTR \| * `d06fbe0b87` RDMA/hns: Add mapped page count checking for MTR \| * `2a2894e90c` watchdog: imx_sc_wdt: Don't disable WDT in suspend \| * `5353f8ec59` pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function \| * `d8c75b8a91` pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource() \| * `6007359143` nfsd: fix refcount leak when file is unhashed after being found \| * `6fcb4bbbec` nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire * \| `da5751e56b` Revert "device property: Add const qualifier to device_get_match_data() parameter" * \| `47d930c2c7` Revert "i2c: Add i2c_get_match_data()" * \| `a99e4337ab` Revert "hwmon: (max16065) Remove use of i2c_match_id()" * \| `9c428fa328` Revert "hwmon: (max16065) Fix alarm attributes" * \| `246d613c20` Revert "cgroup: Make operations on the cgroup root_list RCU safe" * \| `77867ef6d4` Revert "cgroup: Move rcu_head up near the top of cgroup_root" * \| `8cf71990ea` Revert "inet: inet_defrag: prevent sk release while still in use" * \| `3ce4532099` Revert "bareudp: Pull inner IP header in bareudp_udp_encap_recv()." * \| `9e57ad4546` Merge `0ce9d89343` ("clk: ti: dra7-atl: Fix leak of of_nodes") into android12-5.10-lts \|\\| \| * `0ce9d89343` clk: ti: dra7-atl: Fix leak of of_nodes \| * `88ba7cd9f4` pinctrl: single: fix missing error code in pcs_probe() \| * `2efe8da2dd` RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency \| * `f29951897a` PCI: xilinx-nwl: Fix register misspelling \| * `c289903b7a` PCI: keystone: Fix if-statement expression in ks_pcie_quirk() \| * `badbd736e6` drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error \| * `6ae3b9aee4` drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error \| * `45f826f6c8` clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 \| * `ca34aa3782` clk: imx: imx8mp: fix clock tree update of TF-A managed clocks \| * `11396ba4f8` perf time-utils: Fix 32-bit nsec parsing \| * `a10a7d6d17` perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time \| * `727660723e` perf sched timehist: Fix missing free of session in perf_sched__timehist() \| * `ea837ae511` bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit \| * `d20674f316` nilfs2: fix potential oob read in nilfs_btree_check_delete() \| * `e2290906bb` nilfs2: determine empty node blocks as corrupted \| * `24bf40740a` nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() \| * `7fc22c3b3f` ext4: avoid OOB when system.data xattr changes underneath the filesystem \| * `e65f698736` ext4: return error on ext4_find_inline_entry \| * `2e073a579f` ext4: avoid negative min_clusters in find_group_orlov() \| * `22d591d916` ext4: avoid potential buffer_head leak in __ext4_new_inode() \| * `08c63b7962` ext4: avoid buffer_head leak in ext4_mark_inode_used() \| * `c4227a38ab` smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso \| * `4766ba108b` ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard \| * `3a1a31a38f` kthread: fix task state in kthread worker if being frozen \| * `28fbbd0ce7` kthread: add kthread_work tracepoints \| * `dd417529c0` xz: cleanup CRC32 edits from 2018 \| * `4e1c8c12ca` selftests/bpf: Fix C++ compile error from missing _Bool type \| * `9374068b36` selftests/bpf: Fix error compiling test_lru_map.c \| * `c2db6acd8c` selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc \| * `3467a94126` selftests/bpf: Fix compiling tcp_rtt.c with musl-libc \| * `5ad69f5a04` selftests/bpf: Fix compiling flow_dissector.c with musl-libc \| * `306efef84b` selftests/bpf: Fix compiling kfree_skb.c with musl-libc \| * `cc52d5282a` selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c \| * `04eb60af43` selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c \| * `2c9b228938` tpm: Clean up TPM space after command failure \| * `a0a8b7bebe` xen/swiotlb: add alignment check for dma buffers \| * `cb9134aa09` xen: use correct end address of kernel for conflict checking \| * `86da3c79b8` drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() \| * `02657ced60` drm/msm: fix %s null argument error \| * `72fa5f700e` ipmi: docs: don't advertise deprecated sysfs entries \| * `e9e482e1e5` drm/msm/a5xx: workaround early ring-buffer emptiness check \| * `d041301f30` drm/msm: Drop priv->lastctx \| * `9dffbbd7b8` drm/msm: Add priv->mm_lock to protect active/inactive lists \| * `5ce4075dde` drm/msm/a5xx: fix races in preemption evaluation stage \| * `cfca8b26a9` drm/msm/a5xx: properly clear preemption records on resume \| * `fe93cd6635` drm/msm/a5xx: disable preemption in submits by default \| * `14531e3b82` drm/msm: Fix incorrect file name output in adreno_request_fw() \| * `0338e66cba` jfs: fix out-of-bounds in dbNextAG() and diAlloc() \| * `36820265a0` drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets \| * `6b38aedfdc` drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode \| * `5f37e8c415` drm/rockchip: vop: Allow 4096px width scaling \| * `e37fead06a` drm/radeon: properly handle vbios fake edid sizing \| * `af2fb608e9` drm/radeon: Replace one-element array with flexible-array member \| * `5f943045ec` drm/amdgpu: properly handle vbios fake edid sizing \| * `cd88105616` drm/amdgpu: Replace one-element array with flexible-array member \| * `65f9be0348` drm/stm: Fix an error handling path in stm_drm_platform_probe() \| * `278ec25952` mtd: powernv: Add check devm_kasprintf() returned value \| * `7661e90a60` fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() \| * `9fb482fdf3` power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense \| * `5c1997f7ad` power: supply: axp20x_battery: Remove design from min and max voltage \| * `c59f57f3f1` power: supply: axp20x_battery: allow disabling battery charging \| * `8202306e9f` hwmon: (ntc_thermistor) fix module autoloading \| * `9efa58381a` mtd: slram: insert break after errors in parsing the map \| * `d7a7dd2966` hwmon: (max16065) Fix alarm attributes \| * `932559f25a` hwmon: (max16065) Remove use of i2c_match_id() \| * `514a1508c3` i2c: Add i2c_get_match_data() \| * `167e4371ef` device property: Add const qualifier to device_get_match_data() parameter \| * `aeed49dd2b` hwmon: (max16065) Fix overflows seen when writing limits \| * `cdb20b703e` m68k: Fix kernel_clone_args.flags in m68k_clone() \| * `42a9899e56` clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() \| * `97586fbd69` reset: berlin: fix OF node leak in probe() error path \| * `ad0b53e4b5` ARM: versatile: fix OF node leak in CPUs prepare \| * `06ceed8eff` ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property \| * `fb3cd974fb` ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks \| * `5f19060ab0` spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ \| * `63c7417ad4` spi: ppc4xx: handle irq_of_parse_and_map() errors \| * `4bc4272e25` block: fix potential invalid pointer dereference in blk_add_partition \| * `4d2760df0f` block: print symbolic error name instead of error code \| * `3630a18846` block, bfq: don't break merge chain in bfq_split_bfqq() \| * `a819a496d2` block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() \| * `e1277ae780` block, bfq: fix possible UAF for bfqq->bic with merge chain \| * `cab9ff7fe8` net: tipc: avoid possible garbage value \| * `207503742c` net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input \| * `3df68f37c5` r8169: disable ALDPS per default for RTL8125 \| * `5755eabda2` net: enetc: Use IRQF_NO_AUTOEN flag in request_irq() \| * `e296245ca8` bareudp: Pull inner IP header on xmit. \| * `b48fae6788` geneve: Fix incorrect inner network header offset when innerprotoinherit is set \| * `3b84799ea2` net: geneve: support IPv4/IPv6 as inner protocol \| * `76851c70a5` bareudp: Pull inner IP header in bareudp_udp_encap_recv(). \| * `cb1f7ef1f4` bareudp: allow redirecting bareudp packets to eth devices \| * `2accdb38c1` Bluetooth: btusb: Fix not handling ZPL/short-transfer \| * `3703e18a91` can: m_can: m_can_close(): stop clocks after device has been shut down \| * `b6dce5b5a8` can: m_can: Add support for transceiver as phy \| * `5cc00913c1` can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). \| * `1a11a1a532` sock_map: Add a cond_resched() in sock_hash_free() \| * `557418e170` wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param \| * `f232916fab` wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() \| * `793e01f996` wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors \| * `f8e0ca3049` wifi: mt76: mt7915: fix rx filter setting for bfee functionality \| * `635ccdcd98` wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() \| * `7b0724f7a9` cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately \| * `0723ddb2d1` netfilter: nf_tables: reject expiration higher than timeout \| * `39c1012f5f` netfilter: nf_tables: reject element expiration with no timeout \| * `1c0c097ded` netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire \| * `4bb459040d` can: j1939: use correct function name in comment \| * `b0947eca2a` padata: Honor the caller's alignment in case of chunk_size 0 \| * `60da25076f` mount: handle OOM on mnt_warn_timestamp_expiry \| * `f0a39ba6e0` fs/namespace: fnic: Switch to use %ptTd \| * `396e9c5cbf` mount: warn only once about timestamp range expiration \| * `9722aa53fa` fs: explicitly unregister per-superblock BDIs \| * `005dcd6bc4` ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() \| * `a0c1e2da65` wifi: rtw88: always wait for both firmware loading attempts \| * `16e0ab9ed3` USB: usbtmc: prevent kernel-usb-infoleak \| * `50cff34dee` USB: serial: pl2303: add device id for Macrosilicon MS3020 \| * `31292316c5` usb: dwc3: Fix a typo in field name \| * `4abf184168` cgroup: Move rcu_head up near the top of cgroup_root \| * `65fd90e354` gpiolib: cdev: Ignore reconfiguration without direction \| * `1880a324af` ftrace: Fix possible use-after-free issue in ftrace_location() \| * `e6be2e1ebc` x86/ibt,ftrace: Search for __fentry__ location \| * `9705f447bf` inet: inet_defrag: prevent sk release while still in use \| * `0e7814b028` mptcp: pm: Fix uaf in __timer_delete_sync \| * `6a53e5def7` mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer \| * `a684b45a77` mptcp: export lookup_anno_list_by_saddr \| * `9d682e89c4` gpio: prevent potential speculation leaks in gpio_device_get_desc() \| * `5badd0ae8b` netfilter: nf_tables: missing iterator type in lookup walk \| * `ff89db14c6` netfilter: nft_set_pipapo: walk over current view on netlink dump \| * `45a81667e0` cgroup: Make operations on the cgroup root_list RCU safe \| * `57a3d89831` ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() \| * `34759b7e44` ocfs2: add bounds checking to ocfs2_xattr_find_entry() \| * `d5624db232` x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency \| * `bbd11db41b` spi: bcm63xx: Enable module autoloading \| * `040511d9f2` drm: komeda: Fix an issue related to normalized zpos \| * `3d39061b7b` ASoC: tda7419: fix module autoloading \| * `9c6d4649f2` ASoC: intel: fix module autoloading \| * `de46b1d24f` wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead \| * `db81677f4b` wifi: iwlwifi: lower message level for FW buffer destination \| * `dd34ef88d5` net: ftgmac100: Ensure tx descriptor updates are visible \| * `1a8e85289e` microblaze: don't treat zero reserved memory regions as error \| * `2e5052143c` pinctrl: at91: make it work with current gpiolib \| * `9f08d024ed` ALSA: hda/realtek - FIxed ALC285 headphone no sound \| * `fff183aa3c` ALSA: hda/realtek - Fixed ALC256 headphone no sound \| * `0f4da063a1` ASoC: allow module autoloading for table db1200_pids \| * `007180fcb6` dma-buf: heaps: Fix off-by-one in CMA heap fault handler \| * `5a2cc2bb81` ASoC: meson: axg-card: fix 'use-after-free' * \| `1f05cd743b` Merge `ae96b02b9d` ("soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"") into android12-5.10-lts \|\\| \| * `ae96b02b9d` soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" \| * `609260542c` spi: nxp-fspi: fix the KASAN report out-of-bounds bug \| * `1f31f51bfc` net: dpaa: Pad packets to ETH_ZLEN \| * `f2b13ec208` net: ftgmac100: Enable TX interrupt to avoid TX timeout \| * `392f6a97fc` fou: fix initialization of grc \| * `b9063702a0` net/mlx5e: Add missing link modes to ptys2ethtool_map \| * `097cc80396` net/mlx5: Update the list of the PCI supported devices \| * `e7a9cca35e` ice: fix accounting for filters shared by multiple VSIs \| * `a38c552abf` hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2 \| * `b9d15b50b2` hwmon: (pmbus) Introduce and use write_byte_data callback \| * `e829dbaf76` minmax: reduce min/max macro expansion in atomisp driver \| * `78078862f0` arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma \| * `14341f28a3` NFS: Avoid unnecessary rescanning of the per-server delegation list \| * `4f0e491644` Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table \| * `00d54431b0` drm/msm/adreno: Fix error return if missing firmware-name \| * `44eb665889` scripts: kconfig: merge_config: config files: add a trailing newline \| * `9deecde637` Input: synaptics - enable SMBus for HP Elitebook 840 G2 \| * `3f7183e28f` Input: ads7846 - ratelimit the spi_sync error message \| * `f08589057f` btrfs: update target inode's ctime on unlink \| * `43662ba6ca` powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL \| * `acb4baa484` net: phy: vitesse: repair vsc73xx autonegotiation \| * `3b9ca02300` net: ethernet: use ip_hdrlen() instead of bit shift \| * `b06bb81ef9` usbnet: ipheth: fix carrier detection in modes 1 and 4 * \| `8441327954` Revert "Merge `8a30bee7f5` ("usb: dwc3: core: update LC timer as per USB Spec V3.2") into android12-5.10-lts" * \| `18eef3d55a` Merge `8a30bee7f5` ("usb: dwc3: core: update LC timer as per USB Spec V3.2") into android12-5.10-lts \|\\| \| * `8a30bee7f5` usb: dwc3: core: update LC timer as per USB Spec V3.2 \| * `1ac0667658` usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug \| * `6b3af2ad53` usb: dwc3: Decouple USB 2.0 L1 & L2 events * `e477d44e5f` Merge branch 'android12-5.10' into android12-5.10-lts Change-Id: I8bacb03dd3c3b30729c5ec54bdd57a03f6ff7fe1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-28 17:25:42 +00:00
Daeho Jeong	a8339e7fd0	UPSTREAM: f2fs: support SEEK_DATA and SEEK_HOLE for compression files Fix to support SEEK_DATA and SEEK_HOLE for compression files Bug: 325092012 Signed-off-by: Daeho Jeong <daehojeong@google.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit a94c7fded76bfd1a061deae7be80fedbfa26774e) (cherry picked from https://android-review.googlesource.com/q/commit:268f1fed504a7bc9cfba291fe994ad767eda7a70) Merged-In: Iba62c53e634682205f84c8dc3566ab8df9079158 Change-Id: Iba62c53e634682205f84c8dc3566ab8df9079158	2024-11-23 00:50:57 +00:00
Greg Kroah-Hartman	c515597aec	Merge `02874ca52d` ("tracing: Consider the NULL character when validating the event length") into android12-5.10-lts Steps on the way to 5.10.229 Resolves conflicts in: drivers/net/macsec.c Change-Id: Ibc2583ddd810808fa9ce619e71935aeb5f97805a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-21 22:24:39 +00:00
Greg Kroah-Hartman	012423e6bd	Merge 5.10.228 into android12-5.10-lts Changes in 5.10.228 ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 net: enetc: add missing static descriptor and inline keyword posix-clock: Fix missing timespec64 check in pc_clock_settime() arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 fat: fix uninitialized variable mm/swapfile: skip HugeTLB pages for unuse_vma wifi: mac80211: fix potential key use-after-free KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() io_uring/sqpoll: do not allow pinning outside of cpuset io_uring/sqpoll: retain test for whether the CPU is valid io_uring/sqpoll: do not put cpumask on stack s390/sclp_vt220: Convert newlines to CRLF instead of LFCR KVM: s390: Change virtual to physical address access in diag 0x258 handler x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race io_uring/sqpoll: close race on waiting for sqring entries drm/radeon: Fix encoder->possible_clones drm/vmwgfx: Handle surface check failure correctly iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: light: opt3001: add missing full-scale range value iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Bluetooth: Remove debugfs directory on module init failure Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 xhci: Fix incorrect stream context type macro USB: serial: option: add support for Quectel EG916Q-GL USB: serial: option: add Telit FN920C04 MBIM compositions parport: Proper fix for array out-of-bounds access x86/resctrl: Annotate get_mem_config() functions as __init x86/apic: Always explicitly disarm TSC-deadline timer x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return irqchip/gic-v4: Don't allow a VMOVP on a dying VPE mptcp: track and update contiguous data status mptcp: handle consistently DSS corruption tcp: fix mptcp DSS corruption due to large pmtu xmit nilfs2: propagate directory read errors from nilfs_find_entry() powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 Linux 5.10.228 Change-Id: I46a08618e1091915449af89690af27a230a28855 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-17 20:12:50 +00:00
Greg Kroah-Hartman	6c71f56f4f	Merge `21b5af7f0c` ("net: phy: dp83869: fix memory corruption when enabling fiber") into android12-5.10-lts Steps on the way to 5.10.227 Resolves merge conflicts in: fs/nfsd/filecache.c Change-Id: Ied16cae04e74a6303fdf827703d9f9caf57f971a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-17 11:50:07 +00:00
Greg Kroah-Hartman	e22e091f95	Merge `de5a059e36` ("RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: Ie75a10f12b4c90baa487a120d138956dd5a09da8 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-17 08:15:32 +00:00
Greg Kroah-Hartman	2a22a03cae	Merge `2622c805ab` ("kallsyms: Make module_kallsyms_on_each_symbol generally available") into android12-5.10-lts Steps on the way to 5.10.227 Resolves merge conflicts in: include/linux/kallsyms.h include/linux/module.h kernel/kallsyms.c Change-Id: I207acf2f76d2f2bc3be7b811edec98d988365f60 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-17 08:15:15 +00:00
Greg Kroah-Hartman	ce691439c0	Revert "ext4: properly sync file size update after O_SYNC direct IO" This reverts commit `dde4c1e166` which is commit 91562895f8030cb9a0470b1db49de79346a69f91 upstream. It breaks the Android kernel tests, and can be brought back in the future if it is really needed. Bug: 161946584 Change-Id: Ia4acc78370c913f2c3691a68148db000f3034eaf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-16 18:27:09 +00:00
Greg Kroah-Hartman	f46870ab3d	Revert "ext4: dax: fix overflowing extents beyond inode size when partially writing" This reverts commit `f8a7c34232` which is commit dda898d7ffe85931f9cca6d702a51f33717c501e upstream. It breaks the Android kernel tests, and can be brought back in the future if it is really needed. Bug: 161946584 Change-Id: I8c5a06731ef7830612591c6f818ac69cf169d78a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-16 18:26:45 +00:00
Greg Kroah-Hartman	5d9c84863f	Merge `f8a7c34232` ("ext4: dax: fix overflowing extents beyond inode size when partially writing") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: Ifa9c84d819e26b5ec9a4503dbf77f3e48ff0782c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-16 16:40:19 +00:00
Greg Kroah-Hartman	8fb88ba5de	Merge `dde4c1e166` ("ext4: properly sync file size update after O_SYNC direct IO") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: If19e4b34d65d6f90dabc6fce79809aea1675bd0a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-16 16:40:14 +00:00
Greg Kroah-Hartman	9fbdcfe7bb	Merge `70b60c8d9b` ("btrfs: wait for fixup workers before stopping cleaner kthread during umount") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: Ie897a82549a26d8832c1cd233ac507bdaa083cdb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-16 16:39:36 +00:00
Greg Kroah-Hartman	d476e18cbf	Merge `d73d48acf3` ("btrfs: fix a NULL pointer dereference when failed to start a new trasacntion") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: Id9261beea462bed16ae80004e8eb46eb8cb4cbeb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-16 16:39:30 +00:00
Greg Kroah-Hartman	509ddbb2b8	Merge `f976d964a6` ("Input: adp5589-keys - fix adp5589_gpio_get_value()") into android12-5.10-lts Steps on the way to 5.10.227 Resolves merge conflicts in: fs/nfsd/nfs4xdr.c fs/nfsd/vfs.c Change-Id: I8ed4156759977aa5c53d577990f4b72e61530ebf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-14 11:34:30 +00:00
Greg Kroah-Hartman	6a00671aec	Merge `2c08dfc99f` ("ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9") into android12-5.10-lts Steps on the way to 5.10.227 Resolves merge conflicts in: fs/ext4/namei.c Change-Id: I7dfbf5a9d8837593f8e4a7ddb5ba34e256d94953 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-14 11:33:02 +00:00
Greg Kroah-Hartman	b48eba851f	Merge `1ebfa66638` ("drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: I5e69192f2ecbbda523c18c2749bb1f181837e99c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-14 11:32:05 +00:00
Greg Kroah-Hartman	baa474b078	Merge `74c63fd016` ("ACPICA: Fix memory leak if acpi_ps_get_next_field() fails") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: Ie190b64ce17dea26ec0ac8910bbcb5fb144aede0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-14 11:30:34 +00:00
Greg Kroah-Hartman	6136b834d6	Merge `cdd86fb75f` ("net/mlx5: Added cond_resched() to crdump collection") into android12-5.10-lts Steps on the way to 5.10.227 Change-Id: I780b041f7c72ac3204110981ba8c0ce36764d971 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-14 09:58:25 +00:00
Greg Kroah-Hartman	0407f5e40e	Merge `1429a9260f` ("Revert "dm: requeue IO if mapping table not yet available"") into android12-5.10-lts Steps on the way to 5.10.226 Resolves merge conflicts in: fs/f2fs/xattr.c fs/nfsd/filecache.c Change-Id: I09ff012f62cfc2cd08550684766f05eac93951fb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-14 07:16:40 +00:00
Chao Yu	ee2e0e624b	BACKPORT: f2fs: compress: fix to update i_compr_blocks correctly Previously, we account reserved blocks and compressed blocks into @compr_blocks, then, f2fs_i_compr_blocks_update(,compr_blocks) will update i_compr_blocks incorrectly, fix it. Meanwhile, for the case all blocks in cluster were reserved, fix to update dn->ofs_in_node correctly. Bug: 378001005 Fixes: eb8fbaa53374 ("f2fs: compress: fix to check unreleased compressed cluster") Change-Id: Ie195fc57a1d55ff9f42fe4855edd21da1c88bb90 Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit 186e7d71534df4589405925caca5597af7626c12)	2024-11-12 20:33:44 +00:00
Greg Kroah-Hartman	9e57ad4546	Merge `0ce9d89343` ("clk: ti: dra7-atl: Fix leak of of_nodes") into android12-5.10-lts Steps on the way to 5.10.226 Resolves merge conflicts in: drivers/dma-buf/heaps/heap-helpers.c drivers/usb/dwc3/core.h fs/ext4/inline.c Change-Id: Id7ab496884e549fc85b6fff8254fb56d6785d78c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-12 17:29:46 +00:00
Greg Kroah-Hartman	1f05cd743b	Merge `ae96b02b9d` ("soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"") into android12-5.10-lts Steps on the way to 5.10.226 Change-Id: I92c594018a2ec1c562a580e493117d780fade779 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-11-12 12:44:11 +00:00
Dave Kleikamp	df848523d6	jfs: Fix sanity check in dbMount [ Upstream commit 67373ca8404fe57eb1bb4b57f314cff77ce54932 ] MAXAG is a legitimate value for bmp->db_numag Fixes: e63866a47556 ("jfs: fix out-of-bounds in dbNextAG() and diAlloc()") Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-11-08 16:21:59 +01:00
Christoph Hellwig	649d646506	iomap: update ki_pos a little later in iomap_dio_complete upstream 936e114a245b6e38e0dbf706a67e7611fc993da1 commit. Move the ki_pos update down a bit to prepare for a better common helper that invalidates pages based of an iocb. Link: https://lkml.kernel.org/r/20230601145904.1385409-3-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Darrick J. Wong <djwong@kernel.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Andreas Gruenbacher <agruenba@redhat.com> Cc: Anna Schumaker <anna@kernel.org> Cc: Chao Yu <chao@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Ilya Dryomov <idryomov@gmail.com> Cc: Jaegeuk Kim <jaegeuk@kernel.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: Johannes Thumshirn <johannes.thumshirn@wdc.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Miklos Szeredi <miklos@szeredi.hu> Cc: Miklos Szeredi <mszeredi@redhat.com> Cc: Theodore Ts'o <tytso@mit.edu> Cc: Trond Myklebust <trond.myklebust@hammerspace.com> Cc: Xiubo Li <xiubli@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Mahmoud Adam <mngyadam@amazon.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-11-08 16:21:58 +01:00
Mateusz Guzik	c9b7743807	exec: don't WARN for racy path_noexec check [ Upstream commit 0d196e7589cefe207d5d41f37a0a28a1fdeeb7c6 ] Both i_mode and noexec checks wrapped in WARN_ON stem from an artifact of the previous implementation. They used to legitimately check for the condition, but that got moved up in two commits: `633fb6ac39` ("exec: move S_ISREG() check earlier") `0fd338b2d2` ("exec: move path_noexec() check earlier") Instead of being removed said checks are WARN_ON'ed instead, which has some debug value. However, the spurious path_noexec check is racy, resulting in unwarranted warnings should someone race with setting the noexec flag. One can note there is more to perm-checking whether execve is allowed and none of the conditions are guaranteed to still hold after they were tested for. Additionally this does not validate whether the code path did any perm checking to begin with -- it will pass if the inode happens to be regular. Keep the redundant path_noexec() check even though it's mindless nonsense checking for guarantee that isn't given so drop the WARN. Reword the commentary and do small tidy ups while here. Signed-off-by: Mateusz Guzik <mjguzik@gmail.com> Link: https://lore.kernel.org/r/20240805131721.765484-1-mjguzik@gmail.com [brauner: keep redundant path_noexec() check] Signed-off-by: Christian Brauner <brauner@kernel.org> [cascardo: keep exit label and use it] Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-11-08 16:21:58 +01:00
Paulo Alcantara	ed31aba8ce	smb: client: fix OOBs when building SMB2_IOCTL request [ Upstream commit 1ab60323c5201bef25f2a3dc0ccc404d9aca77f1 ] When using encryption, either enforced by the server or when using 'seal' mount option, the client will squash all compound request buffers down for encryption into a single iov in smb2_set_next_command(). SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the SMB2_IOCTL request in the first iov, and if the user passes an input buffer that is greater than 328 bytes, smb2_set_next_command() will end up writing off the end of @rqst->iov[0].iov_base as shown below: mount.cifs //srv/share /mnt -o ...,seal ln -s $(perl -e "print('a')for 1..1024") /mnt/link BUG: KASAN: slab-out-of-bounds in smb2_set_next_command.cold+0x1d6/0x24c [cifs] Write of size 4116 at addr ffff8881148fcab8 by task ln/859 CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] print_report+0x156/0x4d9 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] ? __virt_addr_valid+0x145/0x310 ? __phys_addr+0x46/0x90 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] kasan_report+0xda/0x110 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] kasan_check_range+0x10f/0x1f0 __asan_memcpy+0x3c/0x60 smb2_set_next_command.cold+0x1d6/0x24c [cifs] smb2_compound_op+0x238c/0x3840 [cifs] ? kasan_save_track+0x14/0x30 ? kasan_save_free_info+0x3b/0x70 ? vfs_symlink+0x1a1/0x2c0 ? do_symlinkat+0x108/0x1c0 ? __pfx_smb2_compound_op+0x10/0x10 [cifs] ? kmem_cache_free+0x118/0x3e0 ? cifs_get_writable_path+0xeb/0x1a0 [cifs] smb2_get_reparse_inode+0x423/0x540 [cifs] ? __pfx_smb2_get_reparse_inode+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? __kmalloc_noprof+0x37c/0x480 ? smb2_create_reparse_symlink+0x257/0x490 [cifs] ? smb2_create_reparse_symlink+0x38f/0x490 [cifs] smb2_create_reparse_symlink+0x38f/0x490 [cifs] ? __pfx_smb2_create_reparse_symlink+0x10/0x10 [cifs] ? find_held_lock+0x8a/0xa0 ? hlock_class+0x32/0xb0 ? __build_path_from_dentry_optional_prefix+0x19d/0x2e0 [cifs] cifs_symlink+0x24f/0x960 [cifs] ? __pfx_make_vfsuid+0x10/0x10 ? __pfx_cifs_symlink+0x10/0x10 [cifs] ? make_vfsgid+0x6b/0xc0 ? generic_permission+0x96/0x2d0 vfs_symlink+0x1a1/0x2c0 do_symlinkat+0x108/0x1c0 ? __pfx_do_symlinkat+0x10/0x10 ? strncpy_from_user+0xaa/0x160 __x64_sys_symlinkat+0xb9/0xf0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f08d75c13bb Reported-by: David Howells <dhowells@redhat.com> Fixes: `e77fe73c7e` ("cifs: we can not use small padding iovs together with encryption") Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-11-08 16:21:58 +01:00
Michael Bestas	529ffa5672	Merge tag 'ASB-2024-11-05_12-5.10' of https://android.googlesource.com/kernel/common into android13-5.10-waipio https://source.android.com/docs/security/bulletin/2024-11-01 CVE-2024-36978 CVE-2024-46740 * tag 'ASB-2024-11-05_12-5.10' of https://android.googlesource.com/kernel/common: (702 commits) UPSTREAM: dma-buf: heaps: Fix off-by-one in CMA heap fault handler BACKPORT: firmware: arm_scmi: Queue in scmi layer for mailbox implementation BACKPORT: gso: fix udp gso fraglist segmentation after pull from frag_list ANDROID: usb: Optimization the transfer rate of accessory mode in USB3.2 mode UPSTREAM: unicode: Don't special case ignorable code points ANDROID: 16K: Fixup padding vm_flags bits on VMA splits ANDROID: 16K: Introduce pgsize_migration_inline.h Revert "udf: Avoid excessive partition lengths" Revert "bareudp: Fix device stats updates." ANDROID: fix up change to pti_clone_pgtable() Revert "perf/aux: Fix AUX buffer serialization" Revert "clocksource/drivers/timer-of: Remove percpu irq related code" Revert "Merge `751777a79a` ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts" Revert "hwspinlock: Introduce hwspin_lock_bust()" Revert "bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode" Revert "bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt" Linux 5.10.226 memcg: protect concurrent access to mem_cgroup_idr net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket x86/mm: Fix PTI for i386 some more ... Conflicts: Documentation/devicetree/bindings/thermal/thermal-zones.yaml Change-Id: Ic0be4604440e84cc31e9cfc7ea7d72ebc3d7d64f	2024-11-07 10:53:18 +02:00
Greg Kroah-Hartman	b9d4c135c7	Merge tag 'android12-5.10.226_r00' into android12-5.10 This merges up to the 5.10.226 LTS release into android12-5.10. Included in here are the following commits: * `bfa0f472d5` Revert "udf: Avoid excessive partition lengths" * `90336334a0` Revert "bareudp: Fix device stats updates." * `bcfc839140` ANDROID: fix up change to pti_clone_pgtable() * `ebdacb6176` Revert "perf/aux: Fix AUX buffer serialization" * `3c59c9aebf` Revert "clocksource/drivers/timer-of: Remove percpu irq related code" * `7d3ca1ed3f` Merge 5.10.226 into android12-5.10-lts \|\ \| * `ceb091e2c4` Linux 5.10.226 \| * `912736a043` memcg: protect concurrent access to mem_cgroup_idr \| * `02ee1976ed` net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket \| * `dad75cf2c3` x86/mm: Fix PTI for i386 some more \| * `1401da1486` rtmutex: Drop rt_mutex::wait_lock before scheduling \| * `c6bd80f585` mmc: cqhci: Fix checking of CQHCI_HALT state \| * `b35d3c8181` drm/i915/fence: Mark debug_fence_free() with __maybe_unused \| * `b8dfa35f00` drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused \| * `50632b877c` nvmet-tcp: fix kernel crash if commands allocation fails \| * `4c3b21204a` arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry \| * `ccb95b37e9` arm64: acpi: Move get_cpu_for_acpi_id() to a header \| * `3658388cd3` ACPI: processor: Fix memory leaks in error paths of processor_add() \| * `5dac987d1b` ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() \| * `157c0d94b4` nilfs2: protect references to superblock parameters exposed in sysfs \| * `0630e3d435` nilfs2: replace snprintf in show functions with sysfs_emit \| * `7882923f1c` perf/aux: Fix AUX buffer serialization \| * `0f511f2840` uprobes: Use kzalloc to allocate xol area \| * `0af6b80dac` clocksource/drivers/timer-of: Remove percpu irq related code \| * `3ded318cf0` clocksource/drivers/imx-tpm: Fix next event not taking effect sometime \| * `cf6ffb1688` clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX \| * `6c563a2985` VMCI: Fix use-after-free when removing resource in vmci_resource_remove() \| * `359ea5edc9` Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic \| * `1d8e020e51` uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind \| * `38cd8bde8a` nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc \| * `3a8154bb4a` binder: fix UAF caused by offsets overwrite \| * `d0d3edb56e` iio: adc: ad7124: fix chip ID mismatch \| * `1719ebc8e3` iio: fix scale application in iio_convert_raw_to_processed_unlocked \| * `f3a54c27ba` iio: buffer-dmaengine: fix releasing dma channel on error \| * `41cc91e313` staging: iio: frequency: ad9834: Validate frequency parameter value \| * `d8a61e69f8` NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations \| * `6fb7b7f5ba` ata: pata_macio: Use WARN instead of BUG \| * `d3ff0f98a5` MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed \| * `99418ec776` lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() \| * `9d1e9f0876` of/irq: Prevent device address out-of-bounds read in interrupt map walk \| * `5c8906de98` Squashfs: sanity check symbolic link size \| * `2f14160d9f` usbnet: ipheth: race between ipheth_close and error handling \| * `51fa08edd8` Input: uinput - reject requests with unreasonable number of slots \| * `34185de73d` HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup \| * `3206e4a4b0` s390/vmlinux.lds.S: Move ro_after_init section behind rodata section \| * `912bcdc51b` btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() \| * `3eaad59258` kselftests: dmabuf-heaps: Ensure the driver name is null-terminated \| * `e6f3008de8` net: dpaa: avoid on-stack arrays of NR_CPUS elements \| * `e2355d513b` PCI: Add missing bridge lock to pci_bus_lock() \| * `c60676b81f` btrfs: clean up our handling of refs == 0 in snapshot delete \| * `ed1b61398c` btrfs: replace BUG_ON with ASSERT in walk_down_proc() \| * `8780129cbc` smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() \| * `9813770f25` wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() \| * `fb2257089a` libbpf: Add NULL checks to bpf_object__{prev_map,next_map} \| * `56cfdeb2c7` hwmon: (w83627ehf) Fix underflows seen when writing limit attributes \| * `8a1e958e26` hwmon: (nct6775-core) Fix underflows seen when writing limit attributes \| * `59c1fb9874` hwmon: (lm95234) Fix underflows seen when writing limit attributes \| * `2a3add62f1` hwmon: (adc128d818) Fix underflows seen when writing limit attributes \| * `bc1faed19d` pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv \| * `9b884bdc29` devres: Initialize an uninitialized struct member \| * `c8944d449f` um: line: always fill error_out in setup_one_line() \| `1434b72a2d` cgroup: Protect css->cgroup write under css_set_lock \| * `70854bf003` iommu/vt-d: Handle volatile descriptor status read \| * `8a7ef20bf7` dm init: Handle minors larger than 255 \| * `583b5d2d43` ASoC: topology: Properly initialize soc_enum values \| * `43b442c972` net: dsa: vsc73xx: fix possible subblocks range of CAPT block \| * `19af8a23a1` net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN \| * `231c235d2f` fou: Fix null-ptr-deref in GRO. \| * `0ea3f2798d` gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers \| * `77ad44ee33` gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers \| * `bc18f3c806` fou: remove sparse errors \| * `3c0cedc22c` bareudp: Fix device stats updates. \| * `32cbafeebf` usbnet: modern method to get random MAC \| * `594cc1dba0` net: usb: don't write directly to netdev->dev_addr \| * `98a4cabf87` drivers/net/usb: Remove all strcpy() uses \| * `acd2985137` igc: Unlock on error in igc_io_resume() \| * `3efe53eb22` tcp_bpf: fix return value of tcp_bpf_sendmsg() \| * `ee1c2ecf7b` platform/x86: dell-smbios: Fix error path in dell_smbios_init() \| * `45c0c747df` svcrdma: Catch another Reply chunk overflow case \| * `449d70b16b` igb: Fix not clearing TimeSync interrupts for 82580 \| * `aec92dbebd` can: bcm: Remove proc entry when dev is unregistered. \| * `ee50abebdc` pcmcia: Use resource_size function on resource object \| * `9380fe33ab` media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse \| * `ebbdbbc580` PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) \| * `1fa40e0d27` media: vivid: don't set HDMI TX controls if there are no HDMI outputs \| * `44a595f897` usb: uas: set host status byte on data completion error \| * `3ab3ee4125` wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 \| * `9e28a1df18` leds: spi-byte: Call of_node_put() on error path \| * `e73b63f138` media: vivid: fix wrong sizeimage value for mplane \| * `551966371e` udf: Avoid excessive partition lengths \| * `66234da64d` netfilter: nf_conncount: fix wrong variable type \| * `f56089a180` iommu: sun50i: clear bypass register \| * `1c5bad90e0` af_unix: Remove put_pid()/put_cred() in copy_peercred(). \| * `ec08e30082` irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 \| * `500e4bf673` smack: unix sockets: fix accept()ed socket label \| * `414736fcb7` ALSA: hda: Add input value sanity checks to HDMI channel map controls * \| `70fe52b634` Revert "Merge `751777a79a` ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts" * \| `c3e9a280ba` Merge `751777a79a` ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts \|\\| \| * `751777a79a` nfsd: make svc_stat per-network namespace instead of global \| * `f8219c4b80` nfsd: remove nfsd_stats, make th_cnt a global counter \| * `f2fe1ec906` nfsd: make all of the nfsd stats per-network namespace \| * `5545496966` nfsd: expose /proc/net/sunrpc/nfsd in net namespaces \| * `fec6561e75` nfsd: rename NFSD_NET_* to NFSD_STATS_* \| * `9eb5d44b8f` sunrpc: use the struct net as the svc proc private \| * `e0fba78ab9` sunrpc: remove ->pg_stats from svc_program \| * `7f2476914e` sunrpc: pass in the sv_stats struct through svc_create_pooled \| * `d06254ae7d` nfsd: stop setting ->pg_stats for unused stats \| * `2197b23eda` sunrpc: don't change ->sv_stats if it doesn't exist \| * `d47c660e8c` NFSD: Fix frame size warning in svc_export_parse() \| * `a8aaffc0c1` NFSD: Rewrite synopsis of nfsd_percpu_counters_init() \| * `c532274202` NFSD: simplify error paths in nfsd_svc() \| * `ebfce8dd7e` NFSD: Refactor the duplicate reply cache shrinker \| * `895807268a` NFSD: Replace nfsd_prune_bucket() \| * `a02f9d6ea3` NFSD: Rename nfsd_reply_cache_alloc() \| * `73b72f4b3b` NFSD: Refactor nfsd_reply_cache_free_locked() \| * `3025d489f9` nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net \| * `4e18b58b10` nfsd: move reply cache initialization into nfsd startup * \| `00588cd66d` Revert "hwspinlock: Introduce hwspin_lock_bust()" * \| `c2345ad899` Revert "bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode" * \| `fe709a1a77` Revert "bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt" * \| `b22678f8ef` Merge `ddee5b4b6a` ("mptcp: pm: avoid possible UaF when selecting endp") into android12-5.10-lts \|\\| \| * `ddee5b4b6a` mptcp: pm: avoid possible UaF when selecting endp \| * `91fb0512a0` mptcp: pr_debug: add missing \n at the end \| * `7e4c72dbaf` btrfs: fix use-after-free after failure to create a snapshot \| * `efdde00d4a` nilfs2: fix state management in error path of log writing function \| * `07e4dc2fe0` nilfs2: fix missing cleanup on rollforward recovery error \| * `7725152b54` sched: sch_cake: fix bulk flow accounting logic for host fairness \| * `93ee345ba3` ila: call nf_unregister_net_hooks() sooner \| * `e3ad85c477` tracing: Avoid possible softlockup in tracing_iter_reset() \| * `3a49b6b1ca` can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open \| * `6949a97f6d` clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API \| * `f540bc71d5` clk: qcom: clk-alpha-pll: Fix the pll post div mask \| * `0811d57384` fuse: use unsigned type for getxattr/listxattr size truncation \| * `9d38c704b4` fuse: update stats for pages in dropped aux writeback list \| * `4be36d9d18` mmc: sdhci-of-aspeed: fix module autoloading \| * `2793f42389` mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K \| * `b2ead09489` Bluetooth: MGMT: Ignore keys being loaded with invalid type \| * `029e462bb4` Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" \| * `cb27399b3d` irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() \| * `e0b122a8f6` ata: libata: Fix memory leak for error path in ata_host_alloc() \| * `0f27b8c07e` ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx \| * `2ef683b058` ALSA: hda/realtek: add patch for internal mic in Lenovo V145 \| * `adc688a505` ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices \| * `8ca21e7a27` ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object \| * `98c75d7618` sch/netem: fix use after free in netem_dequeue \| * `06e7be6934` bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt \| * `b140074560` i2c: Use IS_REACHABLE() for substituting empty ACPI functions \| * `dfc8eb4d7e` ext4: handle redirtying in ext4_bio_write_page() \| * `5895541d73` udf: Limit file size to 4TB \| * `17c43211d4` rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow \| * `842a97b5e4` virtio_net: Fix napi_skb_cache_put warning \| * `c8e5439b5b` net: set SOCK_RCU_FREE before inserting socket into hashtable \| * `cf002be3b8` bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode \| * `2ac9deb7e0` drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr \| * `3fd11fe4f2` block: initialize integrity buffer to zero before writing it to media \| * `0623c9f371` media: uvcvideo: Enforce alignment of frame and interval \| * `c083c8be6b` drm/amd/display: Skip wbscl_set_scaler_filter if filter is null \| * `5eb04f9894` block: remove the blk_flush_integrity call in blk_integrity_unregister \| * `0305a885cc` wifi: cfg80211: make hash table duplicates more survivable \| * `d24bc270b7` drm/meson: plane: Add error handling \| * `a948ec9935` smack: tcp: ipv4, fix incorrect labeling \| * `3f3ef1d9f6` fsnotify: clear PARENT_WATCHED flags lazily \| * `7e64cabe81` usb: typec: ucsi: Fix null pointer dereference in trace \| * `bd13c1119a` usbip: Don't submit special requests twice \| * `c7975f09ae` ionic: fix potential irq name truncation \| * `e85cf9a5a4` hwspinlock: Introduce hwspin_lock_bust() \| * `7eb7888021` PCI: al: Check IORESOURCE_BUS existence during probe \| * `9aa7dd5e31` wifi: iwlwifi: remove fw_running op \| * `ed7e9ed973` drm/amd/pm: check negtive return for table entries \| * `614564a5b2` drm/amdgpu: the warning dereferencing obj for nbio_v7_4 \| * `008933832a` drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs \| * `52338a3aa7` apparmor: fix possible NULL pointer dereference \| * `0842db679d` drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device \| * `310b9d8363` drm/amdgpu: fix mc_data out-of-bounds read warning \| * `5f09fa5e0a` drm/amdgpu: fix ucode out-of-bounds read warning \| * `725b728cc0` drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number \| * `c253b87c7c` drm/amdgpu: Fix out-of-bounds write warning \| * `60097df938` drm/amdgpu/pm: Fix uninitialized variable agc_btc_response \| * `74c5d8b057` drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create \| * `9160830546` drm/amd/display: Check msg_id before processing transcation \| * `7c47dd2e92` drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] \| * `2a63c90c7a` drm/amd/display: Add array index check for hdcp ddc access \| * `754321ed63` drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 \| * `40c2e8bc11` drm/amd/display: Check gpio_id before used as array index \| * `e24fa82729` drm/amdgpu: avoid reading vf2pf info size from FB \| * `1d0c85d0fc` drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr \| * `59ac791297` drm/amdgpu: fix uninitialized scalar variable warning \| * `38e32a0d83` drm/amd/pm: fix the Out-of-bounds read warning \| * `d592768c17` drm/amd/pm: fix warning using uninitialized value of max_vid_step \| * `a601129c78` drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr \| * `774bae3b8d` drm/amdgpu: fix overflowed array index read warning \| * `28b539bbcc` drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr \| * `40d0fedacf` net: usb: qmi_wwan: add MeiG Smart SRM825L \| * `ff5af3f9b5` dma-debug: avoid deadlock between dma debug vs printk and netconsole \| * `712921d2ab` i2c: Fix conditional for substituting empty ACPI functions \| * `0e69cf9b65` ALSA: hda/conexant: Mute speakers at suspend / shutdown \| * `221ebded43` ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown \| * `e78bc7099c` drm: panel-orientation-quirks: Add quirk for OrangePi Neo * \| `52c4910c65` ANDROID: fix up crc issue for cpuset_cpus_allowed() * \| `4951c68022` Merge 5.10.225 into android12-5.10-lts \|\\| \| * `b57d01c66f` Linux 5.10.225 \| * `7e8bad2cf3` apparmor: fix policy_unpack_test on big endian systems \| * `9e96dea7ef` scsi: aacraid: Fix double-free on probe failure \| * `4538335cc2` usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() \| * `59579a627a` usb: dwc3: st: add missing depopulate in probe error path \| * `6aee4c5635` usb: dwc3: st: fix probed platform device ref count on probe error path \| * `b72da4d89b` usb: dwc3: core: Prevent USB core invalid event buffer address access \| * `16cc6114c9` usb: dwc3: omap: add missing depopulate in probe error path \| * `f84d5dccc8` USB: serial: option: add MeiG Smart SRM825L \| * `612843f842` cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller \| * `f5a5a5a0e9` soc: qcom: cmd-db: Map shared memory as WC, not WB \| * `8ddaea033d` nfc: pn533: Add poll mod list filling check \| * `7e5d5c4ae7` net: busy-poll: use ktime_get_ns() instead of local_clock() \| * `8bbb9e4e0e` gtp: fix a potential NULL pointer dereference \| * `842a40c727` ethtool: check device is present when getting link settings \| * `2e8e93dea0` dmaengine: dw: Add memory bus width verification \| * `9cfe7c53fe` dmaengine: dw: Add peripheral bus width verification \| * `f8e1c92868` soundwire: stream: fix programming slave ports for non-continous port maps \| * `acddd7c6b7` ovl: do not fail because of O_NOATIME \| * `338a3ba30c` net:rds: Fix possible deadlock in rds_message_put \| * `688325078a` cgroup/cpuset: Prevent UAF in proc_cpuset_show() \| * `e83405e75d` ata: libata-core: Fix null pointer dereference on error \| * `f2b6cd1335` Revert "Input: ioc3kbd - convert to platform remove callback returning void" \| * `777d9c223e` media: uvcvideo: Fix integer overflow calculating timestamp \| * `f7276cdc19` drm/amdkfd: don't allow mapping the MMIO HDP page with large pages \| * `0365c9029a` ipc: replace costly bailout check in sysvipc_find_ipc() \| * `2933b4f8a6` mptcp: sched: check both backup in retrans \| * `1388df72dc` wifi: mwifiex: duplicate static structs used in driver instances \| * `4e9436375f` pinctrl: single: fix potential NULL dereference in pcs_get_function() \| * `d57e6298cc` pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins \| * `a45ee4c98d` KVM: arm64: Don't use cbz/adr with external symbols \| * `df02642c21` drm/amdgpu: Using uninitialized value size when calling amdgpu_vce_cs_reloc \| `239b1cacce` tools: move alignment-related macros to new <linux/align.h> \| * `05dd9aabd0` Input: MT - limit max slots \| * `56b82e6ff3` Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO \| * `93000b2949` nfsd: Don't call freezable_schedule_timeout() after each successful page allocation in svc_alloc_arg(). \| * `b009444700` ALSA: timer: Relax start tick time check for slave timer elements \| * `b891438bc3` Revert "drm/amd/display: Validate hw_points_num before using it" \| * `92915fa734` mmc: dw_mmc: allow biu and ciu clocks to defer \| * `15818af2f7` KVM: arm64: Make ICC_SGI_EL1 undef in the absence of a vGICv3 \| * `65e79c9437` cxgb4: add forgotten u64 ivlan cast before shift \| * `d1623e7b43` HID: microsoft: Add rumble support to latest xbox controllers \| * `8c0a21d37d` HID: wacom: Defer calculation of resolution until resolution_code is known \| * `fc73103a94` MIPS: Loongson64: Set timer mode in cpu-probe \| * `7fd3a59268` binfmt_misc: pass binfmt_misc flags to the interpreter \| * `9df9783bd8` Bluetooth: MGMT: Add error handling to pair_device() \| * `9b9ba386d7` mmc: mmc_test: Fix NULL dereference on allocation failure \| * `4370448fca` drm/msm/dp: reset the link phy params before link training \| * `e54b082752` drm/msm/dpu: don't play tricks with debug macros \| * `ff6607a477` net: xilinx: axienet: Fix dangling multicast addresses \| * `2884e73978` net: xilinx: axienet: Always disable promiscuous mode \| * `cb5880a0de` ipv6: prevent UAF in ip6_send_skb() \| * `c414000da1` netem: fix return value if duplicate enqueue fails \| * `050e7274ab` net: dsa: mv88e6xxx: Fix out-of-bound access \| * `5885217d66` net: dsa: mv88e6xxx: replace ATU violation prints with trace points \| * `5d8aed3ca6` net: dsa: mv88e6xxx: read FID when handling ATU violations \| * `544571911b` ice: fix ICE_LAST_OFFSET formula \| * `5c14483544` bonding: fix xfrm state handling when clearing active slave \| * `21816b696c` bonding: fix xfrm real_dev null pointer dereference \| * `81216b9352` bonding: fix null pointer deref in bond_ipsec_offload_ok \| * `e8c85f2ff3` bonding: fix bond_ipsec_offload_ok return type \| * `6e630e1d77` ip6_tunnel: Fix broken GRO \| * `4d42a2257b` netfilter: nft_counter: Synchronize nft_counter_reset() against reader. \| * `eb06c8d302` kcm: Serialise kcm_sendmsg() for the same socket. \| * `f4b762cf7e` tc-testing: don't access non-existent variable on exception \| * `095a1f19d4` Bluetooth: SMP: Fix assumption of Central always being Initiator \| * `7a4e7a0c6b` Bluetooth: hci_core: Fix LE quote calculation \| * `ce70b09150` dm suspend: return -ERESTARTSYS instead of -EINTR \| * `0ba3401777` media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) \| * `d1bd8e0a11` block: use "unsigned long" for blk_validate_block_size(). \| * `cbb9a969fc` gtp: pull network headers in gtp_dev_xmit() \| * `5970a540da` hrtimer: Prevent queuing of hrtimer without a function callback \| * `b09a5ec8de` nvmet-rdma: fix possible bad dereference when freeing rsps \| * `2143cba143` ext4: set the type of max_zeroout to unsigned int to avoid overflow \| * `f14cd61826` irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc \| * `9e1c4d0d6a` usb: dwc3: core: Skip setting event buffers for host only controllers \| * `1b8e318f99` s390/iucv: fix receive buffer virtual vs physical address confusion \| * `d0414f5436` openrisc: Call setup_memory() earlier in the init sequence \| * `e5272645a0` NFS: avoid infinite loop in pnfs_update_layout. \| * `9e0414220b` nvmet-tcp: do not continue for invalid icreq \| * `5ee7495ac2` net: hns3: add checking for vf id of mailbox \| * `c7c43a784f` Bluetooth: bnep: Fix out-of-bound access \| * `bf2f79970b` usb: gadget: fsl: Increase size of name buffer for endpoints \| * `bf0c603ab4` f2fs: fix to do sanity check in update_sit_entry \| * `8ec052c544` btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() \| * `0c1d7b960f` btrfs: send: handle unexpected data in header buffer in begin_cmd() \| * `94a7dff229` btrfs: handle invalid root reference found in may_destroy_subvol() \| * `3dd13074e7` btrfs: change BUG_ON to assertion when checking for delayed_node root \| * `e21448a49b` powerpc/boot: Only free if realloc() succeeds \| * `486fb5ebd5` powerpc/boot: Handle allocation failure in simple_realloc() \| * `05c21f285d` parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 \| * `4e5464005b` memory: stm32-fmc2-ebi: check regmap_read return value \| * `25d31baf92` x86: Increase brk randomness entropy for 64-bit systems \| * `76ec27b709` md: clean up invalid BUG_ON in md_ioctl \| * `95e49b9258` netlink: hold nlk->cb_mutex longer in __netlink_dump_start() \| * `316bf51edd` virtiofs: forbid newlines in tags \| * `be49c4f2a1` drm/lima: set gp bus_stop bit before hard reset \| * `aa469c3d28` net/sun3_82586: Avoid reading past buffer in debug output \| * `5fb0cbf84b` scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() \| * `a441ce39ad` fs: binfmt_elf_efpic: don't use missing interpreter's properties \| * `e7385510e2` media: pci: cx23885: check cx23885_vdev_init() return \| * `00d4f971fa` quota: Remove BUG_ON from dqget() \| * `239c5e988e` ext4: do not trim the group with corrupted block bitmap \| * `0f6425d90d` nvmet-trace: avoid dereferencing pointer too early \| * `5380f1b2b9` powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu \| * `372928e8be` IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock \| * `7138c59856` wifi: iwlwifi: abort scan when rfkill on but device enabled \| * `d483de53d4` gfs2: setattr_chown: Add missing initialization \| * `80456d39f0` scsi: spi: Fix sshdr use \| * `3663e78fab` media: qcom: venus: fix incorrect return value \| * `a43edc7abc` binfmt_misc: cleanup on filesystem umount \| * `c13541c5ef` staging: ks7010: disable bh on tx_dev_lock \| * `db3b679f66` drm/amd/display: Validate hw_points_num before using it \| * `cc49ee3433` staging: iio: resolver: ad2s1210: fix use before initialization \| * `01fa4415c3` media: radio-isa: use dev_name to fill in bus_info \| * `0f83d77926` s390/smp,mcck: fix early IPI handling \| * `aeda7043c4` RDMA/rtrs: Fix the problem of variable not initialized fully \| * `bbb662d0c2` i2c: riic: avoid potential division by zero \| * `5335c7f8db` wifi: cw1200: Avoid processing an invalid TIM IE \| * `11b0c7323c` wifi: mac80211: fix BA session teardown race \| * `5fe7bdbe4f` ssb: Fix division by zero issue in ssb_calc_clock_rate \| * `dfa894f7ea` ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 \| * `fc250eca15` net: hns3: fix a deadlock problem when config TC during resetting \| * `dbdbadec8a` net: hns3: fix wrong use of semaphore up \| * `e5ceff2196` netfilter: flowtable: initialise extack before use \| * `50c914b0e6` mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size \| * `8e8d306f3b` net: dsa: vsc73xx: check busy flag in MDIO operations \| * `351ad72c50` net: dsa: vsc73xx: use read_poll_timeout instead delay loop \| * `665a4caa9c` net: dsa: vsc73xx: pass value in phy_write operation \| * `aa9ce4193c` net: axienet: Fix register defines comment description \| * `1cece837e3` atm: idt77252: prevent use after free in dequeue_rx() \| * `4b730a1475` net/mlx5e: Correctly report errors for ethtool rx flows \| * `8e0e6b15ab` s390/uv: Panic for set and remove shared access UVC errors \| * `6bcd0f95b8` btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() \| * `c10ac31a72` s390/cio: rename bitmap_size() -> idset_bitmap_size() \| * `e24625310c` drm/amdgpu/jpeg2: properly set atomics vmid field \| * `ad149f5585` memcg_write_event_control(): fix a user-triggerable oops \| * `0452e15e7f` drm/amdgpu: Actually check flags for all context ops. \| * `d88083916f` btrfs: tree-checker: add dev extent item checks \| * `bbcdda4b0d` selinux: fix potential counting error in avc_add_xperms_decision() \| * `fe5bf14881` fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE \| * `de7be1940c` bitmap: introduce generic optimized bitmap_size() \| * `03880af02a` vfs: Don't evict inode under the inode lru traversing context \| * `ee030e4ffa` dm persistent data: fix memory allocation failure \| * `63fd38af88` dm resume: don't return EINVAL when signalled \| * `1b21a791af` arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE \| * `e245a18281` s390/dasd: fix error recovery leading to data corruption on ESE devices \| * `747bc15457` thunderbolt: Mark XDomain as unplugged when router is removed \| * `0f0654318e` xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration \| * `4905e56f7b` ALSA: usb-audio: Support Yamaha P-125 quirk entry \| * `4690e2171f` fuse: Initialize beyond-EOF page contents before setting uptodate * \| `39a8a0618d` ANDROID: Fix gki allmodconfig build errors in mptcp * \| `0c105dabe6` Revert "genirq: Allow the PM device to originate from irq domain" * \| `e62a1579e0` Revert "genirq: Allow irq_chip registration functions to take a const irq_chip" * \| `b5df17128a` Revert "irqchip/imx-irqsteer: Constify irq_chip struct" * \| `6943c015b0` Revert "irqchip/imx-irqsteer: Add runtime PM support" * \| `3141b23999` Revert "irqchip/imx-irqsteer: Handle runtime power management correctly" * \| `b84ad15be5` Merge 5.10.224 into android12-5.10-lts \|\\| \| * `b2add7c50b` Linux 5.10.224 \| * `2de18b5cc3` media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" \| * `e1ee1c4198` ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode \| * `80ac0cc9c0` wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values \| * `a563f12430` vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler \| * `06e9e6ac59` vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro \| * `b21ea49e6e` nvme/pci: Add APST quirk for Lenovo N60z laptop \| * `15469d46ba` exec: Fix ToCToU between perm check and set-uid/gid usage \| * `d39e0f582b` media: uvcvideo: Use entity get_cur in uvc_ctrl_set \| * `ec54634f91` arm64: cpufeature: Fix the visibility of compat hwcaps \| * `fb6675db04` powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. \| * `50111a8098` drm/i915/gem: Fix Virtual Memory mapping boundaries calculation \| * `31c35f9f89` netfilter: nf_tables: prefer nft_chain_validate \| * `d5f87c1111` netfilter: nf_tables: allow clone callbacks to sleep \| * `7b17de2a71` netfilter: nf_tables: use timestamp to check for set element timeout \| * `191fc44395` netfilter: nf_tables: set element extended ACK reporting support \| * `c52f9e1a9e` PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal \| * `7e62564d5e` Fix gcc 4.9 build issue in 5.10.y \| * `329eae03d0` Add gitignore file for samples/fanotify/ subdirectory \| * `9bdf0624bd` samples: Make fs-monitor depend on libc and headers \| * `5b9f49cc86` samples: Add fs error monitoring example \| * `3f84b37abb` mptcp: pm: fix backup support in signal endpoints \| * `44165604dd` mptcp: export local_address \| * `9b9a64ef9a` mptcp: mib: count MPJ with backup flag \| * `96f3c8a850` mptcp: fix NL PM announced address accounting \| * `1008f2bcbc` mptcp: distinguish rcv vs sent backup flag in requests \| * `381cad7a08` mptcp: sched: check both directions for backup \| * `32b133fb78` drm/mgag200: Set DDC timeout in milliseconds \| * `fd65cf86ca` drm/bridge: analogix_dp: properly handle zero sized AUX transactions \| * `450b6b22ac` x86/mtrr: Check if fixed MTRRs exist before saving them \| * `ab8b397d59` padata: Fix possible divide-by-0 panic in padata_mt_helper() \| * `eb223bf01e` tracing: Fix overflow in get_free_elt() \| * `ca2ea2dec1` power: supply: axp288_charger: Round constant_charge_voltage writes down \| * `51e8360d94` power: supply: axp288_charger: Fix constant_charge_voltage writes \| * `a26bcfeea3` genirq/irqdesc: Honor caller provided affinity in alloc_desc() \| * `db959cdfe6` irqchip/xilinx: Fix shift out of bounds \| * `52b138f102` serial: core: check uartclk for zero to avoid divide by zero \| * `227d455e6c` irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t' \| * `7dddf560e2` irqchip/meson-gpio: support more than 8 channels gpio irq \| * `5f1aa8ce64` scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES \| * `8f209716ea` scsi: mpt3sas: Remove scsi_dma_map() error messages \| * `f3405f4997` ntp: Safeguard against time_constant overflow \| * `f098e8fc72` driver core: Fix uevent_show() vs driver detach race \| * `dc335b92e5` ntp: Clamp maxerror and esterror to operating range \| * `668c6c4a7e` tick/broadcast: Move per CPU pointer access into the atomic section \| * `005c318981` scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic \| * `ef1b208ca8` usb: gadget: u_serial: Set start_delayed during suspend \| * `7cc9ebcfe5` usb: gadget: core: Check for unset descriptor \| * `f1205a5aad` USB: serial: debug: do not echo input by default \| * `4dacdb9720` usb: vhci-hcd: Do not drop references before new references are gained \| * `d993cb25ef` ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 \| * `c7c1ca6e25` ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list \| * `e7e7d2b180` ALSA: line6: Fix racy access to midibuf \| * `5291d4f734` drm/client: fix null pointer dereference in drm_client_modeset_probe \| * `44e11ae8f9` ALSA: usb-audio: Re-add ScratchAmp quirk entries \| * `c9c11ece5a` spi: spi-fsl-lpspi: Fix scldiv calculation \| * `c6ba514732` kprobes: Fix to check symbol prefixes correctly \| * `9ddd5e7835` bpf: kprobe: remove unused declaring of bpf_kprobe_override \| * `455769ebb6` i2c: smbus: Send alert notifications to all devices if source not found \| * `56f106d2c4` ASoC: codecs: wsa881x: Correct Soundwire ports mask \| * `5605992ad4` i2c: smbus: Improve handling of stuck alerts \| * `706f18a8fa` arm64: errata: Expand speculative SSBS workaround (again) \| * `f261c5d8d0` arm64: cputype: Add Cortex-A725 definitions \| * `bdae104b09` arm64: cputype: Add Cortex-X1C definitions \| * `4a500d4bdc` arm64: errata: Expand speculative SSBS workaround \| * `bf0d247dfb` arm64: errata: Unify speculative SSBS errata logic \| * `17ff37fe45` arm64: cputype: Add Cortex-X925 definitions \| * `77741cdc25` arm64: cputype: Add Cortex-A720 definitions \| * `b8d683f5b5` arm64: cputype: Add Cortex-X3 definitions \| * `9f7ba00782` arm64: errata: Add workaround for Arm errata 3194386 and 3312417 \| * `d8029a49c8` arm64: cputype: Add Neoverse-V3 definitions \| * `c46b7570c9` arm64: cputype: Add Cortex-X4 definitions \| * `55920e407a` arm64: Add Neoverse-V2 part \| * `5b9ae6bb33` arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space \| * `69299a4282` ext4: fix wrong unit use in ext4_mb_find_by_goal \| * `1d21d41750` sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime \| * `3b2b169fad` SUNRPC: Fix a race to wake a sync task \| * `a3e52a4c22` s390/sclp: Prevent release of buffer in I/O \| * `1a6b4240b0` jbd2: avoid memleak in jbd2_journal_write_metadata_buffer \| * `e48a901ce6` media: uvcvideo: Fix the bandwdith quirk on USB 3.x \| * `de305abd36` media: uvcvideo: Ignore empty TS packets \| * `c1749313f3` drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules \| * `d81c1eeb33` drm/amdgpu: Fix the null pointer dereference to ras_manager \| * `1d4e65fa62` btrfs: fix bitmap leak when loading free space cache on duplicate entry \| * `29ce18d767` wifi: nl80211: don't give key data to userspace \| * `934f815345` udf: prevent integer overflow in udf_bitmap_free_blocks() \| * `65b982b9af` PCI: Add Edimax Vendor ID to pci_ids.h \| * `55985e3aa1` selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT \| * `8e665ccc52` ACPI: SBS: manage alarm sysfs attribute through psy core \| * `85d8fe79a3` ACPI: battery: create alarm sysfs attribute atomically \| * `64ac0c0235` clocksource/drivers/sh_cmt: Address race condition for clock events \| * `c384dd4f1f` md/raid5: avoid BUG_ON() while continue reshape after reassembling \| * `5ccf99545c` md: do not delete safemode_timer in mddev_suspend \| * `464d242868` rcutorture: Fix rcu_torture_fwd_cb_cr() data race \| * `adc491f3e7` net: fec: Stop PPS on driver remove \| * `865948628a` l2tp: fix lockdep splat \| * `b7b8d9f5e6` net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() \| * `01150020c0` Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() \| * `085fb116c4` net: linkwatch: use system_unbound_wq \| * `e87f52225e` net: usb: qmi_wwan: fix memory leak for not ip packets \| * `52319d9d2f` sctp: Fix null-ptr-deref in reuseport_add_sock(). \| * `17a93a8201` sctp: move hlist_node and hashent out of sctp_ep_common \| * `ba4e59f34c` x86/mm: Fix pti_clone_entry_text() for i386 \| * `d00c9b4bbc` x86/mm: Fix pti_clone_pgtable() alignment assumption \| * `75880302cf` irqchip/mbigen: Fix mbigen node address layout \| * `c476c5c7bb` genirq: Allow irq_chip registration functions to take a const irq_chip \| * `12fa993433` netfilter: ipset: Add list flush to cancel_gc \| * `e93fa44f07` mptcp: fix duplicate data handling \| * `3deac6f686` r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY \| * `646e9e9071` net: usb: sr9700: fix uninitialized variable use in sr_mdio_read \| * `8b0a5709ac` ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G \| * `7b745257ff` ALSA: usb-audio: Correct surround channels in UAC1 channel map \| * `08775b3d6e` protect the fetch of ->fd[fd] in do_dup2() from mispredictions \| * `e4b2b0306b` HID: wacom: Modify pen IDs \| * `b12a67976b` platform/chrome: cros_ec_proto: Lock device when updating MKBP version \| * `59be4a1677` riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() \| * `7d72f51951` ipv6: fix ndisc_is_useropt() handling for PIO \| * `8e97cc828d` net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys \| * `c65f72eec6` net/iucv: fix use after free in iucv_sock_close() \| * `7c03ab555e` sched: act_ct: take care of padding in struct zones_ht_key \| * `b17eeed7cd` drm/vmwgfx: Fix overlay when using Screen Targets \| * `906372e753` drm/nouveau: prime: fix refcount underflow \| * `6b50462b47` remoteproc: imx_rproc: Skip over memory region when node value is NULL \| * `5991ef8e7a` remoteproc: imx_rproc: Fix ignoring mapping vdev regions \| * `a4ed3286a5` remoteproc: imx_rproc: ignore mapping vdev regions \| * `3a2884a44e` irqchip/imx-irqsteer: Handle runtime power management correctly \| * `0548b54d0a` irqchip/imx-irqsteer: Add runtime PM support \| * `06a93b7203` irqchip/imx-irqsteer: Constify irq_chip struct \| * `652e7b4d73` genirq: Allow the PM device to originate from irq domain \| * `ef56dcdca8` devres: Fix memory leakage caused by driver API devm_free_percpu() \| * `81484ab285` driver core: Cast to (void ) with __force for __percpu pointer \| `6bb9cc6e25` drivers: soc: xilinx: check return status of get_api_version() \| * `79ec4cde1d` soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver \| * `58b07286ae` ext4: check the extent status again before inserting delalloc block \| * `4b6d9a0fe7` ext4: factor out a common helper to query extent map \| * `b2591c89a6` sysctl: always initialize i_uid/i_gid \| * `88f053a1dd` fuse: verify {g,u}id mount options correctly \| * `997d3c9cbe` fuse: name fs_context consistently \| * `2fa82af6fd` powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC \| * `d28869a145` fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT \| * `be23ae6308` nvme-pci: add missing condition check for existence of mapped data \| * `ce90f30157` nvme: split command copy into a helper \| * `b59013d264` ceph: fix incorrect kmalloc size of pagevec mempool \| * `eb1b7575fe` ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable \| * `3ff4316953` lirc: rc_dev_get_from_fd(): fix file leak \| * `ea72a88810` powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() \| * `347dcb84a4` apparmor: Fix null pointer deref when receiving skb during sock creation \| * `9460ac3dd1` mISDN: Fix a use after free in hfcmulti_tx() \| * `dda518dea6` bpf: Fix a segment issue when downgrading gso_size \| * `5cc4d71dda` net: nexthop: Initialize all fields in dumped nexthops \| * `dc2a655437` net: stmmac: Correct byte order of perfect_match \| * `aa38bf7489` tipc: Return non-zero value from tipc_udp_addr2str() on error \| * `cf791b98fe` netfilter: nft_set_pipapo_avx2: disable softinterrupts \| * `c8ae5939f4` net: bonding: correctly annotate RCU in bond_should_notify_peers() \| * `3bf09eab40` ipv4: Fix incorrect source address in Record Route option \| * `f62a9cc0c2` MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later \| * `257193083e` dma: fix call order in dmam_free_coherent \| * `641b7a8920` libbpf: Fix no-args func prototype BTF dumping syntax \| * `ff2387553f` f2fs: fix start segno of large section \| * `721190921a` um: time-travel: fix time-travel-start option \| * `538a27c804` jfs: Fix array-index-out-of-bounds in diFree \| * `1c089efe76` kdb: Use the passed prompt in kdb_position_cursor() \| * `f0ad62559f` kdb: address -Wformat-security warnings \| * `65dba3c9ce` kernel: rerun task_work while freezing in get_signal() \| * `b839175c06` io_uring/io-wq: limit retrying worker initialisation \| * `5f0a6800b8` nilfs2: handle inconsistent state in nilfs_btnode_create_block() \| * `9fa8eca259` Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 \| * `4d3eb40ccd` Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables \| * `1fccae3fd7` rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings \| * `52d8d27fd6` rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait \| * `76b62f3035` drm/panfrost: Mark simple_ondemand governor as softdep \| * `77411a2d22` MIPS: Loongson64: env: Hook up Loongsson-2K \| * `636163de03` MIPS: ip30: ip30-console: Add missing include \| * `4e8f70d3cc` rbd: don't assume rbd_is_lock_owner() for exclusive mappings \| * `24933a55bf` selftests/sigaltstack: Fix ppc64 GCC build \| * `94ee7ff99b` RDMA/iwcm: Fix a use-after-free related to destroying CM IDs \| * `9667d46f8a` platform: mips: cpu_hwmon: Disable driver on unsupported hardware \| * `19f108b3d1` watchdog/perf: properly initialize the turbo mode timestamp and rearm counter \| * `9cba1ec637` rtc: isl1208: Fix return value of nvmem callbacks \| * `a49321257f` perf/x86/intel/pt: Fix a topa_entry base address calculation \| * `3b8e1b7d26` perf/x86/intel/pt: Fix topa_entry base length \| * `a3ab508a48` scsi: qla2xxx: validate nvme_local_port correctly \| * `57ba756371` scsi: qla2xxx: Complete command early within lock \| * `b0c39dcbd8` scsi: qla2xxx: Fix flash read failure \| * `87db8d7b75` scsi: qla2xxx: Fix for possible memory corruption \| * `e5ed6a26ff` scsi: qla2xxx: During vport delete send async logout explicitly \| * `2fcd485289` rtc: cmos: Fix return value of nvmem callbacks \| * `d4d814159f` devres: Fix devm_krealloc() wasting memory \| * `648d549046` kobject_uevent: Fix OOB access within zap_modalias_env() \| * `41dd963641` kbuild: Fix '-S -c' in x86 stack protector scripts \| * `0730ea8502` decompress_bunzip2: fix rare decompression failure \| * `bed9580165` ubi: eba: properly rollback inside self_check_eba \| * `ae99754cd8` clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use \| * `54bc4e8844` f2fs: fix to don't dirty inode for readonly filesystem \| * `b848b40794` scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds \| * `a44f88f757` dev/parport: fix the array out-of-bounds risk \| * `388ee7a4d3` binder: fix hang of unregistered readers \| * `ac2459460c` PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio \| * `e5bae95306` PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN \| * `af1d27f88e` hwrng: amd - Convert PCIBIOS_* return codes to errnos \| * `43aab4483d` tools/memory-model: Fix bug in lock.cat \| * `9d289ce917` KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() \| * `cdbcb4e9f6` jbd2: make jbd2_journal_get_max_txn_bufs() internal \| * `6d5223be13` leds: ss4200: Convert PCIBIOS_* return codes to errnos \| * `35f8c9ac0c` wifi: mwifiex: Fix interface type change \| * `de2a011a13` ext4: make sure the first directory block is not a hole \| * `42d4205170` ext4: check dot and dotdot of dx_root before making dir indexed \| * `3846394785` m68k: amiga: Turn off Warp1260 interrupts during boot \| * `2199e157a4` udf: Avoid using corrupted block bitmap buffer \| * `5c59cb8dd9` task_work: Introduce task_work_cancel() again \| * `1fd27cc6f0` task_work: s/task_work_cancel()/task_work_cancel_func()/ \| * `973155ca67` apparmor: use kvfree_sensitive to free data->data \| * `eb46367187` sched/fair: Use all little CPUs for CPU-bound workloads \| * `9ce89824ff` drm/amd/display: Check for NULL pointer \| * `748e9ad7c0` scsi: qla2xxx: Fix optrom version displayed in FDMI \| * `6735d02ead` drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes \| * `b6ac46a001` drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes \| * `86f4ca8b3b` ext2: Verify bitmap and itable block numbers before using them \| * `10f7163bfb` hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() \| * `4c9d235630` media: venus: fix use after free in vdec_close \| * `e65cccfae7` char: tpm: Fix possible memory leak in tpm_bios_measurements_open() \| * `cf0c713c69` sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks \| * `5c5b02d489` ipv6: take care of scope when choosing the src addr \| * `83e2dfadcb` af_packet: Handle outgoing VLAN packets without hardware offloading \| * `7e36a3c701` net: netconsole: Disable target before netpoll cleanup \| * `9ef7190228` tick/broadcast: Make takeover of broadcast hrtimer reliable \| * `f2c2c4cc5a` dt-bindings: thermal: correct thermal zone node name limit \| * `14083dc69b` rtc: interface: Add RTC offset to alarm after fix-up \| * `84ffa27eb0` nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro \| * `9d6571b1c4` fs/nilfs2: remove some unused macros to tame gcc \| * `3c6fa67023` fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP \| * `21a15d52bc` pinctrl: freescale: mxs: Fix refcount of child \| * `d2de7746e5` pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails \| * `73303a4a8f` pinctrl: ti: ti-iodelay: Drop if block with always false condition \| * `15014206f9` pinctrl: single: fix possible memory leak when pinctrl_enable() fails \| * `8c3bef7ca8` pinctrl: core: fix possible memory leak when pinctrl_enable() fails \| * `53f2d5bce1` pinctrl: rockchip: update rk3308 iomux routes \| * `01c0341e98` net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports \| * `ef6af29942` net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports \| * `eb4ca1a97e` netfilter: ctnetlink: use helper function to calculate expect ID \| * `9118c408ee` bnxt_re: Fix imm_data endianness \| * `edc2dee07a` RDMA/hns: Fix missing pagesize and alignment check in FRMR \| * `29723ad948` macintosh/therm_windtunnel: fix module unload. \| * `445ffbccd0` powerpc/xmon: Fix disassembly CPU feature checks \| * `38a7e4b8bf` MIPS: Octeron: remove source file executable bit \| * `3009d371a2` Input: elan_i2c - do not leave interrupt disabled on suspend failure \| * `37a484f771` RDMA/device: Return error earlier if port in not valid \| * `695d70c60b` mtd: make mtd_test.c a separate module \| * `ab2114f6ff` ASoC: max98088: Check for clk_prepare_enable() error \| * `771f129bed` RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs \| * `506e71b0e1` RDMA/mlx4: Fix truncated output warning in alias_GUID.c \| * `6bf3cf61f3` RDMA/mlx4: Fix truncated output warning in mad.c \| * `26b6512d5d` Input: qt1050 - handle CHIP_ID reading error \| * `2be7e24056` coresight: Fix ref leak when of_coresight_parse_endpoint() fails \| * `3d1c4bf57d` PCI: Fix resource double counting on remove & rescan \| * `8105318210` SUNRPC: Fixup gss_status tracepoint error output \| * `8f1dc3f33f` sparc64: Fix incorrect function signature and add prototype for prom_cif_init \| * `3d096f2a99` ext4: avoid writing unitialized memory to disk in EA inodes \| * `91c22df701` SUNRPC: avoid soft lockup when transmitting UDP to reachable server. \| * `84edcf61bd` xprtrdma: Fix rpcrdma_reqs_reset() \| * `974294806b` xprtrdma: Rename frwr_release_mr() \| * `cf9141d2f7` mfd: omap-usb-tll: Use struct_size to allocate tll \| * `72ac78ec1a` media: venus: flush all buffers in output plane streamoff \| * `5ed0496e38` ext4: fix infinite loop when replaying fast_commit \| * `c9106ad5ea` Revert "leds: led-core: Fix refcount leak in of_led_get()" \| * `4e87f592a4` drm/qxl: Add check for drm_cvt_mode \| * `cd105977b1` drm/etnaviv: fix DMA direction handling for cached RW buffers \| * `6ef4f1e981` perf report: Fix condition in sort__sym_cmp() \| * `09c1583f0e` leds: trigger: Unregister sysfs attributes before calling deactivate() \| * `3c9071a871` media: renesas: vsp1: Store RPF partition configuration per RPF instance \| * `3944484005` media: renesas: vsp1: Fix _irqsave and _irq mix \| * `9459f33175` media: uvcvideo: Override default flags \| * `115d814d6a` media: uvcvideo: Allow entity-defined get_info and get_cur \| * `e470e95616` saa7134: Unchecked i2c_transfer function result fixed \| * `f3968b3d3c` media: imon: Fix race getting ictx->lock \| * `bcc963f591` media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() \| * `7aaa368c68` drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare() \| * `fb20da8338` drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators \| * `be9d08ff10` xdp: fix invalid wait context of page_pool_destroy() \| * `96178b12c8` selftests: forwarding: devlink_lib: Wait for udev events after reloading \| * `859bc76374` bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o \| * `6ce46045f9` bna: adjust 'name' buf size of bna_tcb and bna_ccb structures \| * `28c8fce207` bpf: annotate BTF show functions with __printf \| * `1ccb1399bd` selftests/bpf: Close fd in error path in drop_on_reuseport \| * `be53b70fc0` wifi: virt_wifi: don't use strlen() in const context \| * `f851ff5c6e` gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey \| * `05c4488a0e` wifi: virt_wifi: avoid reporting connection success with wrong SSID \| * `b33dd45086` qed: Improve the stack space of filter_config() \| * `7f132aca18` perf: Prevent passing zero nr_pages to rb_alloc_aux() \| * `a2450206c0` perf: Fix perf_aux_size() for greater-than 32-bit size \| * `a497a6b72b` perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation \| * `d4f4188ecf` netfilter: nf_tables: rise cap on SELinux secmark context \| * `0d08015bee` ipvs: Avoid unnecessary calls to skb_is_gso_sctp \| * `2912a0d136` net: fec: Fix FEC_ECR_EN1588 being cleared on link-down \| * `29254059a1` net: fec: Refactor: #define magic constants \| * `2e201b3d16` wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() \| * `72e470089f` wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() \| * `4055275ca3` wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers \| * `2aa1739334` ath11k: dp: stop rx pktlog before suspend \| * `dae1ab7040` mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors \| * `aa98eb0740` mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible \| * `36a9996e02` mlxsw: spectrum_acl_erp: Fix object nesting warning \| * `22ae17a267` lib: objagg: Fix general protection fault \| * `ada0c31925` selftests/bpf: Check length of recv in test_sockmap \| * `249adb30cb` net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined \| * `15c2ec7c28` net/smc: Allow SMC-D 1MB DMB allocations \| * `8d0d50a8b7` net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP \| * `2f5738bdd6` selftests/bpf: Fix prog numbers in test_sockmap \| * `1302433dc6` wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device \| * `1eb5751e23` firmware: turris-mox-rwtm: Initialize completion before mailbox \| * `085dc94289` firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout() \| * `6f3cb1fd6b` ARM: spitz: fix GPIO assignment for backlight \| * `7b7d06a310` ARM: pxa: spitz: use gpio descriptors for audio \| * `3ae2ec97d8` m68k: cmpxchg: Fix return value for default case in __arch_xchg() \| * `ba1d2ecfcf` x86/xen: Convert comma to semicolon \| * `4a49ce2d63` m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages \| * `e04654f425` arm64: dts: amlogic: gx: correct hdmi clocks \| * `4745535fce` arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux \| * `be5ca40647` arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property \| * `b1e9396ac4` ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity \| * `a992c88fbb` ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects \| * `c79a7cad41` ARM: dts: imx6qdl-kontron-samx6i: fix board reset \| * `efd89b5db5` ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset \| * `bbfa9a71ae` ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node \| * `31a9a0958b` arm64: dts: rockchip: Increase VOP clk rate on RK3328 \| * `5cc525351b` soc: qcom: pdr: fix parsing of domains lists \| * `eab05737ee` soc: qcom: pdr: protect locator_addr with the main mutex \| * `a584e5d3f7` arm64: dts: qcom: msm8996: specify UFS core_clk frequencies \| * `eedd9fd986` soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers \| * `39f4cb508e` arm64: dts: qcom: sdm845: add power-domain to UFS PHY \| * `d3e6b30c9c` hwmon: (max6697) Fix swapped temp{1,8} critical alarms \| * `15770a1476` hwmon: (max6697) Fix underflow when writing limit attributes \| * `ae8bd075a9` pwm: stm32: Always do lazy disabling \| * `d8571b9a83` hwmon: (adt7475) Fix default duty on fan is disabled \| * `685976438b` x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos \| * `010441f083` x86/pci/xen: Fix PCIBIOS_* return code handling \| * `c995bea85e` x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling \| * `e2fdf7b79f` x86/of: Return consistent error type from x86_of_pci_irq_enable() \| * `97795f23a8` hfsplus: fix to avoid false alarm of circular locking \| * `c0748b7684` platform/chrome: cros_ec_debugfs: fix wrong EC message version \| * `3070e81609` EDAC, i10nm: make skx_common.o a separate module \| * `9bff9479e1` EDAC/skx_common: Add new ADXL components for 2-level memory * `767b3cdf4f` Merge branch 'android12-5.10' into android12-5.10-lts Change-Id: I0e05e42a679534cd2d7254df19f21f2d8732df5f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-10-28 18:51:06 +00:00
Ryusuke Konishi	c1d0476885	nilfs2: propagate directory read errors from nilfs_find_entry() commit 08cfa12adf888db98879dbd735bc741360a34168 upstream. Syzbot reported that a task hang occurs in vcs_open() during a fuzzing test for nilfs2. The root cause of this problem is that in nilfs_find_entry(), which searches for directory entries, ignores errors when loading a directory page/folio via nilfs_get_folio() fails. If the filesystem images is corrupted, and the i_size of the directory inode is large, and the directory page/folio is successfully read but fails the sanity check, for example when it is zero-filled, nilfs_check_folio() may continue to spit out error messages in bursts. Fix this issue by propagating the error to the callers when loading a page/folio fails in nilfs_find_entry(). The current interface of nilfs_find_entry() and its callers is outdated and cannot propagate error codes such as -EIO and -ENOMEM returned via nilfs_find_entry(), so fix it together. Link: https://lkml.kernel.org/r/20241004033640.6841-1-konishi.ryusuke@gmail.com Fixes: `2ba466d74e` ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: Lizhi Xu <lizhi.xu@windriver.com> Closes: https://lkml.kernel.org/r/20240927013806.3577931-1-lizhi.xu@windriver.com Reported-by: syzbot+8a192e8d090fa9a31135@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8a192e8d090fa9a31135 Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-22 15:39:30 +02:00
OGAWA Hirofumi	043f055261	fat: fix uninitialized variable commit 963a7f4d3b90ee195b895ca06b95757fcba02d1a upstream. syszbot produced this with a corrupted fs image. In theory, however an IO error would trigger this also. This affects just an error report, so should not be a serious error. Link: https://lkml.kernel.org/r/87r08wjsnh.fsf@mail.parknet.co.jp Link: https://lkml.kernel.org/r/66ff2c95.050a0220.49194.03e9.GAE@google.com Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Reported-by: syzbot+ef0d7bc412553291aa86@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-22 15:39:24 +02:00
Jan Kara	4911610c7a	ext4: fix warning in ext4_dio_write_end_io() commit 619f75dae2cf117b1d07f27b046b9ffb071c4685 upstream. The syzbot has reported that it can hit the warning in ext4_dio_write_end_io() because i_size < i_disksize. Indeed the reproducer creates a race between DIO IO completion and truncate expanding the file and thus ext4_dio_write_end_io() sees an inconsistent inode state where i_disksize is already updated but i_size is not updated yet. Since we are careful when setting up DIO write and consider it extending (and thus performing the IO synchronously with i_rwsem held exclusively) whenever it goes past either of i_size or i_disksize, we can use the same test during IO completion without risking entering ext4_handle_inode_extension() without i_rwsem held. This way we make it obvious both i_size and i_disksize are large enough when we report DIO completion without relying on unreliable WARN_ON. Reported-by: <syzbot+47479b71cdfc78f56d30@syzkaller.appspotmail.com> Fixes: 91562895f803 ("ext4: properly sync file size update after O_SYNC direct IO") Signed-off-by: Jan Kara <jack@suse.cz> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Link: https://lore.kernel.org/r/20231130095653.22679-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:39 +02:00
Yanjun Zhang	f892165c56	NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() [ Upstream commit a848c29e3486189aaabd5663bc11aea50c5bd144 ] On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog: [232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [232066.588586] Mem abort info: [232066.588701] ESR = 0x0000000096000007 [232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits [232066.589084] SET = 0, FnV = 0 [232066.589216] EA = 0, S1PTW = 0 [232066.589340] FSC = 0x07: level 3 translation fault [232066.589559] Data abort info: [232066.589683] ISV = 0, ISS = 0x00000007 [232066.589842] CM = 0, WnR = 0 [232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400 [232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000 [232066.590757] Internal error: Oops: 96000007 [#1] SMP [232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2 [232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs [232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1 [232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06 [232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4] [232066.598595] sp : ffff8000f568fc70 [232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000 [232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001 [232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050 [232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000 [232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000 [232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6 [232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828 [232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a [232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058 [232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000 [232066.601636] Call trace: [232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4] [232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4] [232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4] [232066.602690] kthread+0x110/0x114 [232066.602830] ret_from_fork+0x10/0x20 [232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00) [232066.603284] SMP: stopping secondary CPUs [232066.606936] Starting crashdump kernel... [232066.607146] Bye! Analysing the vmcore, we know that nfs4_copy_state listed by destination nfs_server->ss_copies was added by the field copies in handle_async_copy(), and we found a waiting copy process with the stack as: PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp" #0 [ffff8001116ef740] __switch_to at ffff8000081b92f4 #1 [ffff8001116ef760] __schedule at ffff800008dd0650 #2 [ffff8001116ef7c0] schedule at ffff800008dd0a00 #3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0 #4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c #5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898 #6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4] #7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4] #8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4] #9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4] The NULL-pointer dereference was due to nfs42_complete_copies() listed the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state. So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and the data accessed through this pointer was also incorrect. Generally, the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state(). When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED and copies are not deleted in nfs_server->ss_copies, the source state may be passed to the nfs42_complete_copies() process earlier, resulting in this crash scene finally. To solve this issue, we add a list_head nfs_server->ss_src_copies for a server-to-server copy specially. Fixes: `0e65a32c8a` ("NFS: handle source server reboot") Signed-off-by: Yanjun Zhang <zhangyanjun@cestc.cn> Reviewed-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-10-17 15:08:33 +02:00
Dan Carpenter	64f1b4922b	SUNRPC: Fix integer overflow in decode_rc_list() [ Upstream commit 6dbf1f341b6b35bcc20ff95b6b315e509f6c5369 ] The math in "rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t)" could have an integer overflow. Add bounds checking on rc_list->rcl_nrefcalls to fix that. Fixes: `4aece6a19c` ("nfs41: cb_sequence xdr implementation") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-10-17 15:08:33 +02:00
Chuck Lever	993ce09fe6	NFSD: Mark filecache "down" if init fails [ Upstream commit dc0d0f885aa422f621bc1c2124133eff566b0bc8 ] NeilBrown says: > The handling of NFSD_FILE_CACHE_UP is strange. nfsd_file_cache_init() > sets it, but doesn't clear it on failure. So if nfsd_file_cache_init() > fails for some reason, nfsd_file_cache_shutdown() would still try to > clean up if it was called. Reported-by: NeilBrown <neilb@suse.de> Fixes: c7b824c3d06c ("NFSD: Replace the "init once" mechanism") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-10-17 15:08:33 +02:00
Wojciech Gładysz	c2097d5efb	ext4: nested locking for xattr inode [ Upstream commit d1bc560e9a9c78d0b2314692847fc8661e0aeb99 ] Add nested locking with I_MUTEX_XATTR subclass to avoid lockdep warning while handling xattr inode on file open syscall at ext4_xattr_inode_iget. Backtrace EXT4-fs (loop0): Ignoring removed oldalloc option ====================================================== WARNING: possible circular locking dependency detected 5.10.0-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor543/2794 is trying to acquire lock: ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425 but task is already holding lock: ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&ei->i_data_sem/3){++++}-{3:3}: lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566 down_write+0x93/0x180 kernel/locking/rwsem.c:1564 ext4_update_i_disksize fs/ext4/ext4.h:3267 [inline] ext4_xattr_inode_write fs/ext4/xattr.c:1390 [inline] ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1538 [inline] ext4_xattr_set_entry+0x331a/0x3d80 fs/ext4/xattr.c:1662 ext4_xattr_ibody_set+0x124/0x390 fs/ext4/xattr.c:2228 ext4_xattr_set_handle+0xc27/0x14e0 fs/ext4/xattr.c:2385 ext4_xattr_set+0x219/0x390 fs/ext4/xattr.c:2498 ext4_xattr_user_set+0xc9/0xf0 fs/ext4/xattr_user.c:40 __vfs_setxattr+0x404/0x450 fs/xattr.c:177 __vfs_setxattr_noperm+0x11d/0x4f0 fs/xattr.c:208 __vfs_setxattr_locked+0x1f9/0x210 fs/xattr.c:266 vfs_setxattr+0x112/0x2c0 fs/xattr.c:283 setxattr+0x1db/0x3e0 fs/xattr.c:548 path_setxattr+0x15a/0x240 fs/xattr.c:567 __do_sys_setxattr fs/xattr.c:582 [inline] __se_sys_setxattr fs/xattr.c:578 [inline] __x64_sys_setxattr+0xc5/0xe0 fs/xattr.c:578 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb -> #0 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729 __lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955 lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566 down_write+0x93/0x180 kernel/locking/rwsem.c:1564 inode_lock include/linux/fs.h:782 [inline] ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425 ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485 ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline] ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774 __ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline] __ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018 ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562 notify_change+0xbb6/0xe60 fs/attr.c:435 do_truncate+0x1de/0x2c0 fs/open.c:64 handle_truncate fs/namei.c:2970 [inline] do_open fs/namei.c:3311 [inline] path_openat+0x29f3/0x3290 fs/namei.c:3425 do_filp_open+0x20b/0x450 fs/namei.c:3452 do_sys_openat2+0x124/0x460 fs/open.c:1207 do_sys_open fs/open.c:1223 [inline] __do_sys_open fs/open.c:1231 [inline] __se_sys_open fs/open.c:1227 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1227 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ei->i_data_sem/3); lock(&ea_inode->i_rwsem#7/1); lock(&ei->i_data_sem/3); lock(&ea_inode->i_rwsem#7/1); * DEADLOCK * 5 locks held by syz-executor543/2794: #0: ffff888026fbc448 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x4a/0x2a0 fs/namespace.c:365 #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: do_truncate+0x1cf/0x2c0 fs/open.c:62 #2: ffff8880215e3310 (&ei->i_mmap_sem){++++}-{3:3}, at: ext4_setattr+0xec4/0x19c0 fs/ext4/inode.c:5519 #3: ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559 #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5938 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x4fb/0x810 fs/ext4/inode.c:6018 stack backtrace: CPU: 1 PID: 2794 Comm: syz-executor543 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x177/0x211 lib/dump_stack.c:118 print_circular_bug+0x146/0x1b0 kernel/locking/lockdep.c:2002 check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2123 check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729 __lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955 lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566 down_write+0x93/0x180 kernel/locking/rwsem.c:1564 inode_lock include/linux/fs.h:782 [inline] ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425 ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485 ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline] ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774 __ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline] __ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018 ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562 notify_change+0xbb6/0xe60 fs/attr.c:435 do_truncate+0x1de/0x2c0 fs/open.c:64 handle_truncate fs/namei.c:2970 [inline] do_open fs/namei.c:3311 [inline] path_openat+0x29f3/0x3290 fs/namei.c:3425 do_filp_open+0x20b/0x450 fs/namei.c:3452 do_sys_openat2+0x124/0x460 fs/open.c:1207 do_sys_open fs/open.c:1223 [inline] __do_sys_open fs/open.c:1231 [inline] __se_sys_open fs/open.c:1227 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1227 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f0cde4ea229 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd81d1c978 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0030656c69662f30 RCX: 00007f0cde4ea229 RDX: 0000000000000089 RSI: 00000000000a0a00 RDI: 00000000200001c0 RBP: 2f30656c69662f2e R08: 0000000000208000 R09: 0000000000208000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd81d1c9c0 R13: 00007ffd81d1ca00 R14: 0000000000080000 R15: 0000000000000003 EXT4-fs error (device loop0): ext4_expand_extra_isize_ea:2730: inode #13: comm syz-executor543: corrupted in-inode xattr Signed-off-by: Wojciech Gładysz <wojciech.gladysz@infogain.com> Link: https://patch.msgid.link/20240801143827.19135-1-wojciech.gladysz@infogain.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-10-17 15:08:30 +02:00
Gabriel Krisman Bertazi	39fffca572	unicode: Don't special case ignorable code points commit 5c26d2f1d3f5e4be3e196526bead29ecb139cf91 upstream. We don't need to handle them separately. Instead, just let them decompose/casefold to themselves. Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:28 +02:00
zhanchengbin	2f6da71e9d	ext4: fix inode tree inconsistency caused by ENOMEM commit 3f5424790d4377839093b68c12b130077a4e4510 upstream. If ENOMEM fails when the extent is splitting, we need to restore the length of the split extent. In the ext4_split_extent_at function, only in ext4_ext_create_new_leaf will it alloc memory and change the shape of the extent tree,even if an ENOMEM is returned at this time, the extent tree is still self-consistent, Just restore the split extent lens in the function ext4_split_extent_at. ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf 1)ext4_ext_split ext4_find_extent 2)ext4_ext_grow_indepth ext4_find_extent Signed-off-by: zhanchengbin <zhanchengbin1@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230103022812.130603-1-zhanchengbin1@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: Baokun Li <libaokun1@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:28 +02:00
Zhihao Cheng	f8a7c34232	ext4: dax: fix overflowing extents beyond inode size when partially writing [ Upstream commit dda898d7ffe85931f9cca6d702a51f33717c501e ] The dax_iomap_rw() does two things in each iteration: map written blocks and copy user data to blocks. If the process is killed by user(See signal handling in dax_iomap_iter()), the copied data will be returned and added on inode size, which means that the length of written extents may exceed the inode size, then fsck will fail. An example is given as: dd if=/dev/urandom of=file bs=4M count=1 dax_iomap_rw iomap_iter // round 1 ext4_iomap_begin ext4_iomap_alloc // allocate 0~2M extents(written flag) dax_iomap_iter // copy 2M data iomap_iter // round 2 iomap_iter_advance iter->pos += iter->processed // iter->pos = 2M ext4_iomap_begin ext4_iomap_alloc // allocate 2~4M extents(written flag) dax_iomap_iter fatal_signal_pending done = iter->pos - iocb->ki_pos // done = 2M ext4_handle_inode_extension ext4_update_inode_size // inode size = 2M fsck reports: Inode 13, i_size is 2097152, should be 4194304. Fix? Fix the problem by truncating extents if the written length is smaller than expected. Fixes: `776722e85d` ("ext4: DAX iomap write support") CC: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=219136 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Link: https://patch.msgid.link/20240809121532.2105494-1-chengzhihao@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-10-17 15:08:26 +02:00
Jan Kara	dde4c1e166	ext4: properly sync file size update after O_SYNC direct IO [ Upstream commit 91562895f8030cb9a0470b1db49de79346a69f91 ] Gao Xiang has reported that on ext4 O_SYNC direct IO does not properly sync file size update and thus if we crash at unfortunate moment, the file can have smaller size although O_SYNC IO has reported successful completion. The problem happens because update of on-disk inode size is handled in ext4_dio_write_iter() after iomap_dio_rw() (and thus dio_complete() in particular) has returned and generic_file_sync() gets called by dio_complete(). Fix the problem by handling on-disk inode size update directly in our ->end_io completion handler. References: https://lore.kernel.org/all/02d18236-26ef-09b0-90ad-030c4fe3ee20@linux.alibaba.com Reported-by: Gao Xiang <hsiangkao@linux.alibaba.com> CC: stable@vger.kernel.org Fixes: `378f32bab3` ("ext4: introduce direct I/O write using iomap infrastructure") Signed-off-by: Jan Kara <jack@suse.cz> Tested-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reviewed-by: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com> Link: https://lore.kernel.org/r/20231013121350.26872-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu> Stable-dep-of: dda898d7ffe8 ("ext4: dax: fix overflowing extents beyond inode size when partially writing") Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-10-17 15:08:26 +02:00
Filipe Manana	70b60c8d9b	btrfs: wait for fixup workers before stopping cleaner kthread during umount commit 41fd1e94066a815a7ab0a7025359e9b40e4b3576 upstream. During unmount, at close_ctree(), we have the following steps in this order: 1) Park the cleaner kthread - this doesn't destroy the kthread, it basically halts its execution (wake ups against it work but do nothing); 2) We stop the cleaner kthread - this results in freeing the respective struct task_struct; 3) We call btrfs_stop_all_workers() which waits for any jobs running in all the work queues and then free the work queues. Syzbot reported a case where a fixup worker resulted in a crash when doing a delayed iput on its inode while attempting to wake up the cleaner at btrfs_add_delayed_iput(), because the task_struct of the cleaner kthread was already freed. This can happen during unmount because we don't wait for any fixup workers still running before we call kthread_stop() against the cleaner kthread, which stops and free all its resources. Fix this by waiting for any fixup workers at close_ctree() before we call kthread_stop() against the cleaner and run pending delayed iputs. The stack traces reported by syzbot were the following: BUG: KASAN: slab-use-after-free in __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065 Read of size 8 at addr ffff8880272a8a18 by task kworker/u8:3/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.12.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-fixup btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xb0/0x1480 kernel/sched/core.c:4154 btrfs_writepage_fixup_worker+0xc16/0xdf0 fs/btrfs/inode.c:2842 btrfs_work_helper+0x390/0xc50 fs/btrfs/async-thread.c:314 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4086 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4187 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1107 copy_process+0x5d1/0x3d50 kernel/fork.c:2206 kernel_clone+0x223/0x880 kernel/fork.c:2787 kernel_thread+0x1bc/0x240 kernel/fork.c:2849 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:765 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 61: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2343 [inline] slab_free mm/slub.c:4580 [inline] kmem_cache_free+0x1a2/0x420 mm/slub.c:4682 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:228 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1037 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5318 [inline] __schedule+0x184b/0x4ae0 kernel/sched/core.c:6675 schedule_idle+0x56/0x90 kernel/sched/core.c:6793 do_idle+0x56a/0x5d0 kernel/sched/idle.c:354 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:424 start_secondary+0x102/0x110 arch/x86/kernel/smpboot.c:314 common_startup_64+0x13e/0x147 The buggy address belongs to the object at ffff8880272a8000 which belongs to the cache task_struct of size 7424 The buggy address is located 2584 bytes inside of freed 7424-byte region [ffff8880272a8000, ffff8880272a9d00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x272a8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head\|node=0\|zone=1\|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801bafa500 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080040004 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801bafa500 dead000000000122 0000000000000000 head: 0000000000000000 0000000080040004 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea00009caa01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO\|__GFP_FS\|__GFP_NOWARN\|__GFP_NORETRY\|__GFP_COMP\|__GFP_NOMEMALLOC), pid 2, tgid 2 (kthreadd), ts 71247381401, free_ts 71214998153 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x3039/0x3180 mm/page_alloc.c:3457 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x120 mm/slub.c:2413 allocate_slab+0x5a/0x2f0 mm/slub.c:2579 new_slab mm/slub.c:2632 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3819 __slab_alloc+0x58/0xa0 mm/slub.c:3909 __slab_alloc_node mm/slub.c:3962 [inline] slab_alloc_node mm/slub.c:4123 [inline] kmem_cache_alloc_node_noprof+0x1fe/0x320 mm/slub.c:4187 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1107 copy_process+0x5d1/0x3d50 kernel/fork.c:2206 kernel_clone+0x223/0x880 kernel/fork.c:2787 kernel_thread+0x1bc/0x240 kernel/fork.c:2849 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:765 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 page last free pid 5230 tgid 5230 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0xcd0/0xf00 mm/page_alloc.c:2638 discard_slab mm/slub.c:2678 [inline] __put_partials+0xeb/0x130 mm/slub.c:3146 put_cpu_partial+0x17c/0x250 mm/slub.c:3221 __slab_free+0x2ea/0x3d0 mm/slub.c:4450 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4086 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4142 getname_flags+0xb7/0x540 fs/namei.c:139 do_sys_openat2+0xd2/0x1d0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880272a8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880272a8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880272a8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880272a8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880272a8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: syzbot+8aaf2df2ef0164ffe1fb@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/66fb36b1.050a0220.aab67.003b.GAE@google.com/ CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Qu Wenruo <wqu@suse.com> Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:25 +02:00
Qu Wenruo	d73d48acf3	btrfs: fix a NULL pointer dereference when failed to start a new trasacntion commit c3b47f49e83197e8dffd023ec568403bcdbb774b upstream. [BUG] Syzbot reported a NULL pointer dereference with the following crash: FAULT_INJECTION: forcing a failure. start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676 prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642 relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678 ... BTRFS info (device loop0): balance: ended with status: -12 Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667] RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926 Call Trace: <TASK> commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496 btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430 del_balance_item fs/btrfs/volumes.c:3678 [inline] reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742 btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [CAUSE] The allocation failure happens at the start_transaction() inside prepare_to_relocate(), and during the error handling we call unset_reloc_control(), which makes fs_info->balance_ctl to be NULL. Then we continue the error path cleanup in btrfs_balance() by calling reset_balance_state() which will call del_balance_item() to fully delete the balance item in the root tree. However during the small window between set_reloc_contrl() and unset_reloc_control(), we can have a subvolume tree update and created a reloc_root for that subvolume. Then we go into the final btrfs_commit_transaction() of del_balance_item(), and into btrfs_update_reloc_root() inside commit_fs_roots(). That function checks if fs_info->reloc_ctl is in the merge_reloc_tree stage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer dereference. [FIX] Just add extra check on fs_info->reloc_ctl inside btrfs_update_reloc_root(), before checking fs_info->reloc_ctl->merge_reloc_tree. That DEAD_RELOC_TREE handling is to prevent further modification to the reloc tree during merge stage, but since there is no reloc_ctl at all, we do not need to bother that. Reported-by: syzbot+283673dbc38527ef9f3d@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/66f6bfa7.050a0220.38ace9.0019.GAE@google.com/ CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:25 +02:00
Chuck Lever	7ae7ada29a	NFSD: Fix NFSv4's PUTPUBFH operation commit 202f39039a11402dcbcd5fece8d9fa6be83f49ae upstream. According to RFC 8881, all minor versions of NFSv4 support PUTPUBFH. Replace the XDR decoder for PUTPUBFH with a "noop" since we no longer want the minorversion check, and PUTPUBFH has no arguments to decode. (Ideally nfsd4_decode_noop should really be called nfsd4_decode_void). PUTPUBFH should now behave just like PUTROOTFH. Reported-by: Cedric Blancher <cedric.blancher@gmail.com> Fixes: `e1a90ebd8b` ("NFSD: Combine decode operations for v4 and v4.1") Cc: Dan Shelton <dan.f.shelton@gmail.com> Cc: Roland Mainz <roland.mainz@nrubsig.org> Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:23 +02:00
Li Lingfeng	0ea4333c67	nfsd: map the EBADMSG to nfserr_io to avoid warning commit 340e61e44c1d2a15c42ec72ade9195ad525fd048 upstream. Ext4 will throw -EBADMSG through ext4_readdir when a checksum error occurs, resulting in the following WARNING. Fix it by mapping EBADMSG to nfserr_io. nfsd_buffered_readdir iterate_dir // -EBADMSG -74 ext4_readdir // .iterate_shared ext4_dx_readdir ext4_htree_fill_tree htree_dirblock_to_tree ext4_read_dirblock __ext4_read_dirblock ext4_dirblock_csum_verify warn_no_space_for_csum __warn_no_space_for_csum return ERR_PTR(-EFSBADCRC) // -EBADMSG -74 nfserrno // WARNING [ 161.115610] ------------[ cut here ]------------ [ 161.116465] nfsd: non-standard errno: -74 [ 161.117315] WARNING: CPU: 1 PID: 780 at fs/nfsd/nfsproc.c:878 nfserrno+0x9d/0xd0 [ 161.118596] Modules linked in: [ 161.119243] CPU: 1 PID: 780 Comm: nfsd Not tainted 5.10.0-00014-g79679361fd5d #138 [ 161.120684] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qe mu.org 04/01/2014 [ 161.123601] RIP: 0010:nfserrno+0x9d/0xd0 [ 161.124676] Code: 0f 87 da 30 dd 00 83 e3 01 b8 00 00 00 05 75 d7 44 89 ee 48 c7 c7 c0 57 24 98 89 44 24 04 c6 05 ce 2b 61 03 01 e8 99 20 d8 00 <0f> 0b 8b 44 24 04 eb b5 4c 89 e6 48 c7 c7 a0 6d a4 99 e8 cc 15 33 [ 161.127797] RSP: 0018:ffffc90000e2f9c0 EFLAGS: 00010286 [ 161.128794] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 161.130089] RDX: 1ffff1103ee16f6d RSI: 0000000000000008 RDI: fffff520001c5f2a [ 161.131379] RBP: 0000000000000022 R08: 0000000000000001 R09: ffff8881f70c1827 [ 161.132664] R10: ffffed103ee18304 R11: 0000000000000001 R12: 0000000000000021 [ 161.133949] R13: 00000000ffffffb6 R14: ffff8881317c0000 R15: ffffc90000e2fbd8 [ 161.135244] FS: 0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000 [ 161.136695] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 161.137761] CR2: 00007fcaad70b348 CR3: 0000000144256006 CR4: 0000000000770ee0 [ 161.139041] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 161.140291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 161.141519] PKRU: 55555554 [ 161.142076] Call Trace: [ 161.142575] ? __warn+0x9b/0x140 [ 161.143229] ? nfserrno+0x9d/0xd0 [ 161.143872] ? report_bug+0x125/0x150 [ 161.144595] ? handle_bug+0x41/0x90 [ 161.145284] ? exc_invalid_op+0x14/0x70 [ 161.146009] ? asm_exc_invalid_op+0x12/0x20 [ 161.146816] ? nfserrno+0x9d/0xd0 [ 161.147487] nfsd_buffered_readdir+0x28b/0x2b0 [ 161.148333] ? nfsd4_encode_dirent_fattr+0x380/0x380 [ 161.149258] ? nfsd_buffered_filldir+0xf0/0xf0 [ 161.150093] ? wait_for_concurrent_writes+0x170/0x170 [ 161.151004] ? generic_file_llseek_size+0x48/0x160 [ 161.151895] nfsd_readdir+0x132/0x190 [ 161.152606] ? nfsd4_encode_dirent_fattr+0x380/0x380 [ 161.153516] ? nfsd_unlink+0x380/0x380 [ 161.154256] ? override_creds+0x45/0x60 [ 161.155006] nfsd4_encode_readdir+0x21a/0x3d0 [ 161.155850] ? nfsd4_encode_readlink+0x210/0x210 [ 161.156731] ? write_bytes_to_xdr_buf+0x97/0xe0 [ 161.157598] ? __write_bytes_to_xdr_buf+0xd0/0xd0 [ 161.158494] ? lock_downgrade+0x90/0x90 [ 161.159232] ? nfs4svc_decode_voidarg+0x10/0x10 [ 161.160092] nfsd4_encode_operation+0x15a/0x440 [ 161.160959] nfsd4_proc_compound+0x718/0xe90 [ 161.161818] nfsd_dispatch+0x18e/0x2c0 [ 161.162586] svc_process_common+0x786/0xc50 [ 161.163403] ? nfsd_svc+0x380/0x380 [ 161.164137] ? svc_printk+0x160/0x160 [ 161.164846] ? svc_xprt_do_enqueue.part.0+0x365/0x380 [ 161.165808] ? nfsd_svc+0x380/0x380 [ 161.166523] ? rcu_is_watching+0x23/0x40 [ 161.167309] svc_process+0x1a5/0x200 [ 161.168019] nfsd+0x1f5/0x380 [ 161.168663] ? nfsd_shutdown_threads+0x260/0x260 [ 161.169554] kthread+0x1c4/0x210 [ 161.170224] ? kthread_insert_work_sanity_check+0x80/0x80 [ 161.171246] ret_from_fork+0x1f/0x30 Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:23 +02:00
NeilBrown	96cad5da79	nfsd: fix delegation_blocked() to block correctly for at least 30 seconds commit 45bb63ed20e02ae146336412889fe5450316a84f upstream. The pair of bloom filtered used by delegation_blocked() was intended to block delegations on given filehandles for between 30 and 60 seconds. A new filehandle would be recorded in the "new" bit set. That would then be switch to the "old" bit set between 0 and 30 seconds later, and it would remain as the "old" bit set for 30 seconds. Unfortunately the code intended to clear the old bit set once it reached 30 seconds old, preparing it to be the next new bit set, instead cleared the new bit set before switching it to be the old bit set. This means that the "old" bit set is always empty and delegations are blocked between 0 and 30 seconds. This patch updates bd->new before clearing the set with that index, instead of afterwards. Reported-by: Olga Kornievskaia <okorniev@redhat.com> Cc: stable@vger.kernel.org Fixes: `6282cd5655` ("NFSD: Don't hand out delegations for 30 seconds after recalling them.") Signed-off-by: NeilBrown <neilb@suse.de> Reviewed-by: Benjamin Coddington <bcodding@redhat.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:22 +02:00
Yuezhang Mo	f692160d3e	exfat: fix memory leak in exfat_load_bitmap() commit d2b537b3e533f28e0d97293fe9293161fe8cd137 upstream. If the first directory entry in the root directory is not a bitmap directory entry, 'bh' will not be released and reassigned, which will cause a memory leak. Fixes: `1e49a94cf7` ("exfat: add bitmap operations") Cc: stable@vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com> Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:22 +02:00
Lizhi Xu	61b84013e5	ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate commit 33b525cef4cff49e216e4133cc48452e11c0391e upstream. When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Link: https://lkml.kernel.org/r/20240902023636.1843422-3-joseph.qi@linux.alibaba.com Fixes: `cf76c78595` ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reported-by: Heming Zhao <heming.zhao@suse.com> Suggested-by: Heming Zhao <heming.zhao@suse.com> Cc: <stable@vger.kernel.org> [4.20+] Cc: Changwei Ge <gechangwei@live.cn> Cc: Gang He <ghe@suse.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Jun Piao <piaojun@huawei.com> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Mark Fasheh <mark@fasheh.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:22 +02:00
Julian Sun	bf605ae98d	ocfs2: fix null-ptr-deref when journal load failed. commit 5784d9fcfd43bd853654bb80c87ef293b9e8e80a upstream. During the mounting process, if journal_reset() fails because of too short journal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. Subsequently, ocfs2_journal_shutdown() calls jbd2_journal_flush()->jbd2_cleanup_journal_tail()-> __jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail() ->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer dereference error. To resolve this issue, we should check the JBD2_LOADED flag to ensure the journal was properly loaded. Additionally, use journal instead of osb->journal directly to simplify the code. Link: https://syzkaller.appspot.com/bug?extid=05b9b39d8bdfe1a0861f Link: https://lkml.kernel.org/r/20240902030844.422725-1-sunjunchao2870@gmail.com Fixes: `f6f50e28f0` ("jbd2: Fail to load a journal if it is too short") Signed-off-by: Julian Sun <sunjunchao2870@gmail.com> Reported-by: syzbot+05b9b39d8bdfe1a0861f@syzkaller.appspotmail.com Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Gang He <ghe@suse.com> Cc: Jun Piao <piaojun@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:22 +02:00
Lizhi Xu	3f1ca6ba54	ocfs2: remove unreasonable unlock in ocfs2_read_blocks commit c03a82b4a0c935774afa01fd6d128b444fd930a1 upstream. Patch series "Misc fixes for ocfs2_read_blocks", v5. This series contains 2 fixes for ocfs2_read_blocks(). The first patch fix the issue reported by syzbot, which detects bad unlock balance in ocfs2_read_blocks(). The second patch fixes an issue reported by Heming Zhao when reviewing above fix. This patch (of 2): There was a lock release before exiting, so remove the unreasonable unlock. Link: https://lkml.kernel.org/r/20240902023636.1843422-1-joseph.qi@linux.alibaba.com Link: https://lkml.kernel.org/r/20240902023636.1843422-2-joseph.qi@linux.alibaba.com Fixes: `cf76c78595` ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reviewed-by: Heming Zhao <heming.zhao@suse.com> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reported-by: syzbot+ab134185af9ef88dfed5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab134185af9ef88dfed5 Tested-by: syzbot+ab134185af9ef88dfed5@syzkaller.appspotmail.com Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Gang He <ghe@suse.com> Cc: Jun Piao <piaojun@huawei.com> Cc: <stable@vger.kernel.org> [4.20+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-10-17 15:08:22 +02:00

1 2 3 4 5 ...

72895 Commits