Commit Graph

738 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
4951c68022 Merge 5.10.225 into android12-5.10-lts
Changes in 5.10.225
	fuse: Initialize beyond-EOF page contents before setting uptodate
	ALSA: usb-audio: Support Yamaha P-125 quirk entry
	xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
	thunderbolt: Mark XDomain as unplugged when router is removed
	s390/dasd: fix error recovery leading to data corruption on ESE devices
	arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
	dm resume: don't return EINVAL when signalled
	dm persistent data: fix memory allocation failure
	vfs: Don't evict inode under the inode lru traversing context
	bitmap: introduce generic optimized bitmap_size()
	fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
	selinux: fix potential counting error in avc_add_xperms_decision()
	btrfs: tree-checker: add dev extent item checks
	drm/amdgpu: Actually check flags for all context ops.
	memcg_write_event_control(): fix a user-triggerable oops
	drm/amdgpu/jpeg2: properly set atomics vmid field
	s390/cio: rename bitmap_size() -> idset_bitmap_size()
	btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
	s390/uv: Panic for set and remove shared access UVC errors
	net/mlx5e: Correctly report errors for ethtool rx flows
	atm: idt77252: prevent use after free in dequeue_rx()
	net: axienet: Fix register defines comment description
	net: dsa: vsc73xx: pass value in phy_write operation
	net: dsa: vsc73xx: use read_poll_timeout instead delay loop
	net: dsa: vsc73xx: check busy flag in MDIO operations
	mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
	netfilter: flowtable: initialise extack before use
	net: hns3: fix wrong use of semaphore up
	net: hns3: fix a deadlock problem when config TC during resetting
	ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
	ssb: Fix division by zero issue in ssb_calc_clock_rate
	wifi: mac80211: fix BA session teardown race
	wifi: cw1200: Avoid processing an invalid TIM IE
	i2c: riic: avoid potential division by zero
	RDMA/rtrs: Fix the problem of variable not initialized fully
	s390/smp,mcck: fix early IPI handling
	media: radio-isa: use dev_name to fill in bus_info
	staging: iio: resolver: ad2s1210: fix use before initialization
	drm/amd/display: Validate hw_points_num before using it
	staging: ks7010: disable bh on tx_dev_lock
	binfmt_misc: cleanup on filesystem umount
	media: qcom: venus: fix incorrect return value
	scsi: spi: Fix sshdr use
	gfs2: setattr_chown: Add missing initialization
	wifi: iwlwifi: abort scan when rfkill on but device enabled
	IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
	powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
	nvmet-trace: avoid dereferencing pointer too early
	ext4: do not trim the group with corrupted block bitmap
	quota: Remove BUG_ON from dqget()
	media: pci: cx23885: check cx23885_vdev_init() return
	fs: binfmt_elf_efpic: don't use missing interpreter's properties
	scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
	net/sun3_82586: Avoid reading past buffer in debug output
	drm/lima: set gp bus_stop bit before hard reset
	virtiofs: forbid newlines in tags
	netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
	md: clean up invalid BUG_ON in md_ioctl
	x86: Increase brk randomness entropy for 64-bit systems
	memory: stm32-fmc2-ebi: check regmap_read return value
	parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
	powerpc/boot: Handle allocation failure in simple_realloc()
	powerpc/boot: Only free if realloc() succeeds
	btrfs: change BUG_ON to assertion when checking for delayed_node root
	btrfs: handle invalid root reference found in may_destroy_subvol()
	btrfs: send: handle unexpected data in header buffer in begin_cmd()
	btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
	f2fs: fix to do sanity check in update_sit_entry
	usb: gadget: fsl: Increase size of name buffer for endpoints
	Bluetooth: bnep: Fix out-of-bound access
	net: hns3: add checking for vf id of mailbox
	nvmet-tcp: do not continue for invalid icreq
	NFS: avoid infinite loop in pnfs_update_layout.
	openrisc: Call setup_memory() earlier in the init sequence
	s390/iucv: fix receive buffer virtual vs physical address confusion
	usb: dwc3: core: Skip setting event buffers for host only controllers
	irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
	ext4: set the type of max_zeroout to unsigned int to avoid overflow
	nvmet-rdma: fix possible bad dereference when freeing rsps
	hrtimer: Prevent queuing of hrtimer without a function callback
	gtp: pull network headers in gtp_dev_xmit()
	block: use "unsigned long" for blk_validate_block_size().
	media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
	dm suspend: return -ERESTARTSYS instead of -EINTR
	Bluetooth: hci_core: Fix LE quote calculation
	Bluetooth: SMP: Fix assumption of Central always being Initiator
	tc-testing: don't access non-existent variable on exception
	kcm: Serialise kcm_sendmsg() for the same socket.
	netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
	ip6_tunnel: Fix broken GRO
	bonding: fix bond_ipsec_offload_ok return type
	bonding: fix null pointer deref in bond_ipsec_offload_ok
	bonding: fix xfrm real_dev null pointer dereference
	bonding: fix xfrm state handling when clearing active slave
	ice: fix ICE_LAST_OFFSET formula
	net: dsa: mv88e6xxx: read FID when handling ATU violations
	net: dsa: mv88e6xxx: replace ATU violation prints with trace points
	net: dsa: mv88e6xxx: Fix out-of-bound access
	netem: fix return value if duplicate enqueue fails
	ipv6: prevent UAF in ip6_send_skb()
	net: xilinx: axienet: Always disable promiscuous mode
	net: xilinx: axienet: Fix dangling multicast addresses
	drm/msm/dpu: don't play tricks with debug macros
	drm/msm/dp: reset the link phy params before link training
	mmc: mmc_test: Fix NULL dereference on allocation failure
	Bluetooth: MGMT: Add error handling to pair_device()
	binfmt_misc: pass binfmt_misc flags to the interpreter
	MIPS: Loongson64: Set timer mode in cpu-probe
	HID: wacom: Defer calculation of resolution until resolution_code is known
	HID: microsoft: Add rumble support to latest xbox controllers
	cxgb4: add forgotten u64 ivlan cast before shift
	KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
	mmc: dw_mmc: allow biu and ciu clocks to defer
	Revert "drm/amd/display: Validate hw_points_num before using it"
	ALSA: timer: Relax start tick time check for slave timer elements
	nfsd: Don't call freezable_schedule_timeout() after each successful page allocation in svc_alloc_arg().
	Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
	Input: MT - limit max slots
	tools: move alignment-related macros to new <linux/align.h>
	drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
	KVM: arm64: Don't use cbz/adr with external symbols
	pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
	pinctrl: single: fix potential NULL dereference in pcs_get_function()
	wifi: mwifiex: duplicate static structs used in driver instances
	mptcp: sched: check both backup in retrans
	ipc: replace costly bailout check in sysvipc_find_ipc()
	drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
	media: uvcvideo: Fix integer overflow calculating timestamp
	Revert "Input: ioc3kbd - convert to platform remove callback returning void"
	ata: libata-core: Fix null pointer dereference on error
	cgroup/cpuset: Prevent UAF in proc_cpuset_show()
	net:rds: Fix possible deadlock in rds_message_put
	ovl: do not fail because of O_NOATIME
	soundwire: stream: fix programming slave ports for non-continous port maps
	dmaengine: dw: Add peripheral bus width verification
	dmaengine: dw: Add memory bus width verification
	ethtool: check device is present when getting link settings
	gtp: fix a potential NULL pointer dereference
	net: busy-poll: use ktime_get_ns() instead of local_clock()
	nfc: pn533: Add poll mod list filling check
	soc: qcom: cmd-db: Map shared memory as WC, not WB
	cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
	USB: serial: option: add MeiG Smart SRM825L
	usb: dwc3: omap: add missing depopulate in probe error path
	usb: dwc3: core: Prevent USB core invalid event buffer address access
	usb: dwc3: st: fix probed platform device ref count on probe error path
	usb: dwc3: st: add missing depopulate in probe error path
	usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
	scsi: aacraid: Fix double-free on probe failure
	apparmor: fix policy_unpack_test on big endian systems
	Linux 5.10.225

Change-Id: I5028ef07db680262d45fba4096094fe8b19dd052
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-09-11 14:51:02 +00:00
Miklos Szeredi
acddd7c6b7 ovl: do not fail because of O_NOATIME
commit b6650dab404c701d7fe08a108b746542a934da84 upstream.

In case the file cannot be opened with O_NOATIME because of lack of
capabilities, then clear O_NOATIME instead of failing.

Remove WARN_ON(), since it would now trigger if O_NOATIME was cleared.
Noticed by Amir Goldstein.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-09-04 13:17:45 +02:00
Greg Kroah-Hartman
88eb084d18 Revert "Merge 5.10.220 into android12-5.10-lts"
This reverts commit 87a7f35a24, reversing
changes made to 640645c85b.

5.10.220 is a bunch of vfs and nfs changes that are not needed in
Android systems, so revert the whole lot all at once, except for the
version number bump.

Change-Id: If28dc2231f27d326d3730716f23545dd0a2cdc75
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-07-16 16:33:14 +00:00
Greg Kroah-Hartman
87a7f35a24 Merge 5.10.220 into android12-5.10-lts
Changes in 5.10.220
	SUNRPC: Rename svc_encode_read_payload()
	NFSD: Invoke svc_encode_result_payload() in "read" NFSD encoders
	NFSD: A semicolon is not needed after a switch statement.
	nfsd/nfs3: remove unused macro nfsd3_fhandleres
	NFSD: Clean up the show_nf_may macro
	NFSD: Remove extra "0x" in tracepoint format specifier
	NFSD: Add SPDX header for fs/nfsd/trace.c
	nfsd: Fix error return code in nfsd_file_cache_init()
	SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer()
	SUNRPC: Prepare for xdr_stream-style decoding on the server-side
	NFSD: Add common helpers to decode void args and encode void results
	NFSD: Add tracepoints in nfsd_dispatch()
	NFSD: Add tracepoints in nfsd4_decode/encode_compound()
	NFSD: Replace the internals of the READ_BUF() macro
	NFSD: Replace READ* macros in nfsd4_decode_access()
	NFSD: Replace READ* macros in nfsd4_decode_close()
	NFSD: Replace READ* macros in nfsd4_decode_commit()
	NFSD: Change the way the expected length of a fattr4 is checked
	NFSD: Replace READ* macros that decode the fattr4 size attribute
	NFSD: Replace READ* macros that decode the fattr4 acl attribute
	NFSD: Replace READ* macros that decode the fattr4 mode attribute
	NFSD: Replace READ* macros that decode the fattr4 owner attribute
	NFSD: Replace READ* macros that decode the fattr4 owner_group attribute
	NFSD: Replace READ* macros that decode the fattr4 time_set attributes
	NFSD: Replace READ* macros that decode the fattr4 security label attribute
	NFSD: Replace READ* macros that decode the fattr4 umask attribute
	NFSD: Replace READ* macros in nfsd4_decode_fattr()
	NFSD: Replace READ* macros in nfsd4_decode_create()
	NFSD: Replace READ* macros in nfsd4_decode_delegreturn()
	NFSD: Replace READ* macros in nfsd4_decode_getattr()
	NFSD: Replace READ* macros in nfsd4_decode_link()
	NFSD: Relocate nfsd4_decode_opaque()
	NFSD: Add helpers to decode a clientid4 and an NFSv4 state owner
	NFSD: Add helper for decoding locker4
	NFSD: Replace READ* macros in nfsd4_decode_lock()
	NFSD: Replace READ* macros in nfsd4_decode_lockt()
	NFSD: Replace READ* macros in nfsd4_decode_locku()
	NFSD: Replace READ* macros in nfsd4_decode_lookup()
	NFSD: Add helper to decode NFSv4 verifiers
	NFSD: Add helper to decode OPEN's createhow4 argument
	NFSD: Add helper to decode OPEN's openflag4 argument
	NFSD: Replace READ* macros in nfsd4_decode_share_access()
	NFSD: Replace READ* macros in nfsd4_decode_share_deny()
	NFSD: Add helper to decode OPEN's open_claim4 argument
	NFSD: Replace READ* macros in nfsd4_decode_open()
	NFSD: Replace READ* macros in nfsd4_decode_open_confirm()
	NFSD: Replace READ* macros in nfsd4_decode_open_downgrade()
	NFSD: Replace READ* macros in nfsd4_decode_putfh()
	NFSD: Replace READ* macros in nfsd4_decode_read()
	NFSD: Replace READ* macros in nfsd4_decode_readdir()
	NFSD: Replace READ* macros in nfsd4_decode_remove()
	NFSD: Replace READ* macros in nfsd4_decode_rename()
	NFSD: Replace READ* macros in nfsd4_decode_renew()
	NFSD: Replace READ* macros in nfsd4_decode_secinfo()
	NFSD: Replace READ* macros in nfsd4_decode_setattr()
	NFSD: Replace READ* macros in nfsd4_decode_setclientid()
	NFSD: Replace READ* macros in nfsd4_decode_setclientid_confirm()
	NFSD: Replace READ* macros in nfsd4_decode_verify()
	NFSD: Replace READ* macros in nfsd4_decode_write()
	NFSD: Replace READ* macros in nfsd4_decode_release_lockowner()
	NFSD: Replace READ* macros in nfsd4_decode_cb_sec()
	NFSD: Replace READ* macros in nfsd4_decode_backchannel_ctl()
	NFSD: Replace READ* macros in nfsd4_decode_bind_conn_to_session()
	NFSD: Add a separate decoder to handle state_protect_ops
	NFSD: Add a separate decoder for ssv_sp_parms
	NFSD: Add a helper to decode state_protect4_a
	NFSD: Add a helper to decode nfs_impl_id4
	NFSD: Add a helper to decode channel_attrs4
	NFSD: Replace READ* macros in nfsd4_decode_create_session()
	NFSD: Replace READ* macros in nfsd4_decode_destroy_session()
	NFSD: Replace READ* macros in nfsd4_decode_free_stateid()
	NFSD: Replace READ* macros in nfsd4_decode_getdeviceinfo()
	NFSD: Replace READ* macros in nfsd4_decode_layoutcommit()
	NFSD: Replace READ* macros in nfsd4_decode_layoutget()
	NFSD: Replace READ* macros in nfsd4_decode_layoutreturn()
	NFSD: Replace READ* macros in nfsd4_decode_secinfo_no_name()
	NFSD: Replace READ* macros in nfsd4_decode_sequence()
	NFSD: Replace READ* macros in nfsd4_decode_test_stateid()
	NFSD: Replace READ* macros in nfsd4_decode_destroy_clientid()
	NFSD: Replace READ* macros in nfsd4_decode_reclaim_complete()
	NFSD: Replace READ* macros in nfsd4_decode_fallocate()
	NFSD: Replace READ* macros in nfsd4_decode_nl4_server()
	NFSD: Replace READ* macros in nfsd4_decode_copy()
	NFSD: Replace READ* macros in nfsd4_decode_copy_notify()
	NFSD: Replace READ* macros in nfsd4_decode_offload_status()
	NFSD: Replace READ* macros in nfsd4_decode_seek()
	NFSD: Replace READ* macros in nfsd4_decode_clone()
	NFSD: Replace READ* macros in nfsd4_decode_xattr_name()
	NFSD: Replace READ* macros in nfsd4_decode_setxattr()
	NFSD: Replace READ* macros in nfsd4_decode_listxattrs()
	NFSD: Make nfsd4_ops::opnum a u32
	NFSD: Replace READ* macros in nfsd4_decode_compound()
	NFSD: Remove macros that are no longer used
	nfsd: only call inode_query_iversion in the I_VERSION case
	nfsd: simplify nfsd4_change_info
	nfsd: minor nfsd4_change_attribute cleanup
	nfsd4: don't query change attribute in v2/v3 case
	Revert "nfsd4: support change_attr_type attribute"
	nfsd: add a new EXPORT_OP_NOWCC flag to struct export_operations
	nfsd: allow filesystems to opt out of subtree checking
	nfsd: close cached files prior to a REMOVE or RENAME that would replace target
	exportfs: Add a function to return the raw output from fh_to_dentry()
	nfsd: Fix up nfsd to ensure that timeout errors don't result in ESTALE
	nfsd: Set PF_LOCAL_THROTTLE on local filesystems only
	nfsd: Record NFSv4 pre/post-op attributes as non-atomic
	exec: Don't open code get_close_on_exec
	exec: Move unshare_files to fix posix file locking during exec
	exec: Simplify unshare_files
	exec: Remove reset_files_struct
	kcmp: In kcmp_epoll_target use fget_task
	bpf: In bpf_task_fd_query use fget_task
	proc/fd: In proc_fd_link use fget_task
	Revert "fget: clarify and improve __fget_files() implementation"
	file: Rename __fcheck_files to files_lookup_fd_raw
	file: Factor files_lookup_fd_locked out of fcheck_files
	file: Replace fcheck_files with files_lookup_fd_rcu
	file: Rename fcheck lookup_fd_rcu
	file: Implement task_lookup_fd_rcu
	proc/fd: In tid_fd_mode use task_lookup_fd_rcu
	kcmp: In get_file_raw_ptr use task_lookup_fd_rcu
	file: Implement task_lookup_next_fd_rcu
	proc/fd: In proc_readfd_common use task_lookup_next_fd_rcu
	proc/fd: In fdinfo seq_show don't use get_files_struct
	file: Merge __fd_install into fd_install
	file: In f_dupfd read RLIMIT_NOFILE once.
	file: Merge __alloc_fd into alloc_fd
	file: Rename __close_fd to close_fd and remove the files parameter
	file: Replace ksys_close with close_fd
	inotify: Increase default inotify.max_user_watches limit to 1048576
	fs/lockd: convert comma to semicolon
	NFSD: Fix sparse warning in nfssvc.c
	NFSD: Restore NFSv4 decoding's SAVEMEM functionality
	SUNRPC: Make trace_svc_process() display the RPC procedure symbolically
	SUNRPC: Display RPC procedure names instead of proc numbers
	SUNRPC: Move definition of XDR_UNIT
	NFSD: Update GETATTR3args decoder to use struct xdr_stream
	NFSD: Update ACCESS3arg decoder to use struct xdr_stream
	NFSD: Update READ3arg decoder to use struct xdr_stream
	NFSD: Update WRITE3arg decoder to use struct xdr_stream
	NFSD: Update READLINK3arg decoder to use struct xdr_stream
	NFSD: Fix returned READDIR offset cookie
	NFSD: Add helper to set up the pages where the dirlist is encoded
	NFSD: Update READDIR3args decoders to use struct xdr_stream
	NFSD: Update COMMIT3arg decoder to use struct xdr_stream
	NFSD: Update the NFSv3 DIROPargs decoder to use struct xdr_stream
	NFSD: Update the RENAME3args decoder to use struct xdr_stream
	NFSD: Update the LINK3args decoder to use struct xdr_stream
	NFSD: Update the SETATTR3args decoder to use struct xdr_stream
	NFSD: Update the CREATE3args decoder to use struct xdr_stream
	NFSD: Update the MKDIR3args decoder to use struct xdr_stream
	NFSD: Update the SYMLINK3args decoder to use struct xdr_stream
	NFSD: Update the MKNOD3args decoder to use struct xdr_stream
	NFSD: Update the NFSv2 GETATTR argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 READ argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 WRITE argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 READLINK argument decoder to use struct xdr_stream
	NFSD: Add helper to set up the pages where the dirlist is encoded
	NFSD: Update the NFSv2 READDIR argument decoder to use struct xdr_stream
	NFSD: Update NFSv2 diropargs decoding to use struct xdr_stream
	NFSD: Update the NFSv2 RENAME argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 LINK argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 SETATTR argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 CREATE argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 SYMLINK argument decoder to use struct xdr_stream
	NFSD: Remove argument length checking in nfsd_dispatch()
	NFSD: Update the NFSv2 GETACL argument decoder to use struct xdr_stream
	NFSD: Add an xdr_stream-based decoder for NFSv2/3 ACLs
	NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 ACL GETATTR argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 ACL ACCESS argument decoder to use struct xdr_stream
	NFSD: Clean up after updating NFSv2 ACL decoders
	NFSD: Update the NFSv3 GETACL argument decoder to use struct xdr_stream
	NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream
	NFSD: Clean up after updating NFSv3 ACL decoders
	nfsd: remove unused stats counters
	nfsd: protect concurrent access to nfsd stats counters
	nfsd: report per-export stats
	nfsd4: simplify process_lookup1
	nfsd: simplify process_lock
	nfsd: simplify nfsd_renew
	nfsd: rename lookup_clientid->set_client
	nfsd: refactor set_client
	nfsd: find_cpntf_state cleanup
	nfsd: remove unused set_client argument
	nfsd: simplify nfsd4_check_open_reclaim
	nfsd: cstate->session->se_client -> cstate->clp
	NFSv4_2: SSC helper should use its own config.
	nfs: use change attribute for NFS re-exports
	nfsd: skip some unnecessary stats in the v4 case
	inotify, memcg: account inotify instances to kmemcg
	module: unexport find_module and module_mutex
	module: use RCU to synchronize find_module
	kallsyms: refactor {,module_}kallsyms_on_each_symbol
	kallsyms: only build {,module_}kallsyms_on_each_symbol when required
	fs: add file and path permissions helpers
	namei: introduce struct renamedata
	NFSD: Extract the svcxdr_init_encode() helper
	NFSD: Update the GETATTR3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 ACCESS3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 LOOKUP3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 wccstat result encoder to use struct xdr_stream
	NFSD: Update the NFSv3 READLINK3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 READ3res encode to use struct xdr_stream
	NFSD: Update the NFSv3 WRITE3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 CREATE family of encoders to use struct xdr_stream
	NFSD: Update the NFSv3 RENAMEv3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 LINK3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 FSSTAT3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 FSINFO3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 PATHCONF3res encoder to use struct xdr_stream
	NFSD: Update the NFSv3 COMMIT3res encoder to use struct xdr_stream
	NFSD: Add a helper that encodes NFSv3 directory offset cookies
	NFSD: Count bytes instead of pages in the NFSv3 READDIR encoder
	NFSD: Update the NFSv3 READDIR3res encoder to use struct xdr_stream
	NFSD: Update NFSv3 READDIR entry encoders to use struct xdr_stream
	NFSD: Remove unused NFSv3 directory entry encoders
	NFSD: Reduce svc_rqst::rq_pages churn during READDIR operations
	NFSD: Update the NFSv2 stat encoder to use struct xdr_stream
	NFSD: Update the NFSv2 attrstat encoder to use struct xdr_stream
	NFSD: Update the NFSv2 diropres encoder to use struct xdr_stream
	NFSD: Update the NFSv2 READLINK result encoder to use struct xdr_stream
	NFSD: Update the NFSv2 READ result encoder to use struct xdr_stream
	NFSD: Update the NFSv2 STATFS result encoder to use struct xdr_stream
	NFSD: Add a helper that encodes NFSv3 directory offset cookies
	NFSD: Count bytes instead of pages in the NFSv2 READDIR encoder
	NFSD: Update the NFSv2 READDIR result encoder to use struct xdr_stream
	NFSD: Update the NFSv2 READDIR entry encoder to use struct xdr_stream
	NFSD: Remove unused NFSv2 directory entry encoders
	NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs
	NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream
	NFSD: Update the NFSv2 SETACL result encoder to use struct xdr_stream
	NFSD: Update the NFSv2 ACL GETATTR result encoder to use struct xdr_stream
	NFSD: Update the NFSv2 ACL ACCESS result encoder to use struct xdr_stream
	NFSD: Clean up after updating NFSv2 ACL encoders
	NFSD: Update the NFSv3 GETACL result encoder to use struct xdr_stream
	NFSD: Update the NFSv3 SETACL result encoder to use struct xdr_stream
	NFSD: Clean up after updating NFSv3 ACL encoders
	NFSD: Add a tracepoint to record directory entry encoding
	NFSD: Clean up NFSDDBG_FACILITY macro
	nfsd: helper for laundromat expiry calculations
	nfsd: Log client tracking type log message as info instead of warning
	nfsd: Fix typo "accesible"
	nfsd: COPY with length 0 should copy to end of file
	nfsd: don't ignore high bits of copy count
	nfsd: report client confirmation status in "info" file
	SUNRPC: Export svc_xprt_received()
	UAPI: nfsfh.h: Replace one-element array with flexible-array member
	NFSD: Use DEFINE_SPINLOCK() for spinlock
	fsnotify: allow fsnotify_{peek,remove}_first_event with empty queue
	Revert "fanotify: limit number of event merge attempts"
	fanotify: reduce event objectid to 29-bit hash
	fanotify: mix event info and pid into merge key hash
	fsnotify: use hash table for faster events merge
	fanotify: limit number of event merge attempts
	fanotify: configurable limits via sysfs
	fanotify: support limited functionality for unprivileged users
	fanotify_user: use upper_32_bits() to verify mask
	nfsd: remove unused function
	nfsd: removed unused argument in nfsd_startup_generic()
	nfsd: hash nfs4_files by inode number
	nfsd: track filehandle aliasing in nfs4_files
	nfsd: reshuffle some code
	nfsd: grant read delegations to clients holding writes
	nfsd: Fix fall-through warnings for Clang
	NFSv4.2: Remove ifdef CONFIG_NFSD from NFSv4.2 client SSC code.
	NFS: fix nfs_fetch_iversion()
	fanotify: fix permission model of unprivileged group
	NFSD: Add an RPC authflavor tracepoint display helper
	NFSD: Add nfsd_clid_cred_mismatch tracepoint
	NFSD: Add nfsd_clid_verf_mismatch tracepoint
	NFSD: Remove trace_nfsd_clid_inuse_err
	NFSD: Add nfsd_clid_confirmed tracepoint
	NFSD: Add nfsd_clid_reclaim_complete tracepoint
	NFSD: Add nfsd_clid_destroyed tracepoint
	NFSD: Add a couple more nfsd_clid_expired call sites
	NFSD: Add tracepoints for SETCLIENTID edge cases
	NFSD: Add tracepoints for EXCHANGEID edge cases
	NFSD: Constify @fh argument of knfsd_fh_hash()
	NFSD: Capture every CB state transition
	NFSD: Drop TRACE_DEFINE_ENUM for NFSD4_CB_<state> macros
	NFSD: Add cb_lost tracepoint
	NFSD: Adjust cb_shutdown tracepoint
	NFSD: Enhance the nfsd_cb_setup tracepoint
	NFSD: Add an nfsd_cb_lm_notify tracepoint
	NFSD: Add an nfsd_cb_offload tracepoint
	NFSD: Replace the nfsd_deleg_break tracepoint
	NFSD: Add an nfsd_cb_probe tracepoint
	NFSD: Remove the nfsd_cb_work and nfsd_cb_done tracepoints
	NFSD: Update nfsd_cb_args tracepoint
	nfsd: Prevent truncation of an unlinked inode from blocking access to its directory
	nfsd: move some commit_metadata()s outside the inode lock
	NFSD add vfs_fsync after async copy is done
	NFSD: delay unmount source's export after inter-server copy completed.
	nfsd: move fsnotify on client creation outside spinlock
	nfsd4: Expose the callback address and state of each NFS4 client
	nfsd: fix kernel test robot warning in SSC code
	NFSD: Fix error return code in nfsd4_interssc_connect()
	nfsd: rpc_peeraddr2str needs rcu lock
	lockd: Remove stale comments
	lockd: Create a simplified .vs_dispatch method for NLM requests
	lockd: Common NLM XDR helpers
	lockd: Update the NLMv1 void argument decoder to use struct xdr_stream
	lockd: Update the NLMv1 TEST arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 LOCK arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 CANCEL arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 UNLOCK arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 nlm_res arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 SM_NOTIFY arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 SHARE arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 FREE_ALL arguments decoder to use struct xdr_stream
	lockd: Update the NLMv1 void results encoder to use struct xdr_stream
	lockd: Update the NLMv1 TEST results encoder to use struct xdr_stream
	lockd: Update the NLMv1 nlm_res results encoder to use struct xdr_stream
	lockd: Update the NLMv1 SHARE results encoder to use struct xdr_stream
	lockd: Update the NLMv4 void arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 TEST arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 LOCK arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 CANCEL arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 UNLOCK arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 nlm_res arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 SM_NOTIFY arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 SHARE arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 FREE_ALL arguments decoder to use struct xdr_stream
	lockd: Update the NLMv4 void results encoder to use struct xdr_stream
	lockd: Update the NLMv4 TEST results encoder to use struct xdr_stream
	lockd: Update the NLMv4 nlm_res results encoder to use struct xdr_stream
	lockd: Update the NLMv4 SHARE results encoder to use struct xdr_stream
	nfsd: remove redundant assignment to pointer 'this'
	NFSD: Prevent a possible oops in the nfs_dirent() tracepoint
	nfsd: fix NULL dereference in nfs3svc_encode_getaclres
	kernel/pid.c: remove static qualifier from pidfd_create()
	kernel/pid.c: implement additional checks upon pidfd_create() parameters
	fanotify: minor cosmetic adjustments to fid labels
	fanotify: introduce a generic info record copying helper
	fanotify: add pidfd support to the fanotify API
	fsnotify: replace igrab() with ihold() on attach connector
	fsnotify: count s_fsnotify_inode_refs for attached connectors
	fsnotify: count all objects with attached connectors
	fsnotify: optimize the case of no marks of any type
	NFSD: Clean up splice actor
	SUNRPC: Add svc_rqst_replace_page() API
	NFSD: Batch release pages during splice read
	NFSD: remove vanity comments
	sysctl: introduce new proc handler proc_dobool
	lockd: change the proc_handler for nsm_use_hostnames
	nlm: minor nlm_lookup_file argument change
	nlm: minor refactoring
	lockd: update nlm_lookup_file reexport comment
	Keep read and write fds with each nlm_file
	nfs: don't atempt blocking locks on nfs reexports
	lockd: don't attempt blocking locks on nfs reexports
	nfs: don't allow reexport reclaims
	SUNRPC: Add svc_rqst::rq_auth_stat
	SUNRPC: Set rq_auth_stat in the pg_authenticate() callout
	SUNRPC: Eliminate the RQ_AUTHERR flag
	NFS: Add a private local dispatcher for NFSv4 callback operations
	NFS: Remove unused callback void decoder
	fsnotify: fix sb_connectors leak
	NLM: Fix svcxdr_encode_owner()
	nfsd: Fix a warning for nfsd_file_close_inode
	fsnotify: pass data_type to fsnotify_name()
	fsnotify: pass dentry instead of inode data
	fsnotify: clarify contract for create event hooks
	fsnotify: Don't insert unmergeable events in hashtable
	fanotify: Fold event size calculation to its own function
	fanotify: Split fsid check from other fid mode checks
	inotify: Don't force FS_IN_IGNORED
	fsnotify: Add helper to detect overflow_event
	fsnotify: Add wrapper around fsnotify_add_event
	fsnotify: Retrieve super block from the data field
	fsnotify: Protect fsnotify_handle_inode_event from no-inode events
	fsnotify: Pass group argument to free_event
	fanotify: Support null inode event in fanotify_dfid_inode
	fanotify: Allow file handle encoding for unhashed events
	fanotify: Encode empty file handle when no inode is provided
	fanotify: Require fid_mode for any non-fd event
	fsnotify: Support FS_ERROR event type
	fanotify: Reserve UAPI bits for FAN_FS_ERROR
	fanotify: Pre-allocate pool of error events
	fanotify: Support enqueueing of error events
	fanotify: Support merging of error events
	fanotify: Wrap object_fh inline space in a creator macro
	fanotify: Add helpers to decide whether to report FID/DFID
	fanotify: WARN_ON against too large file handles
	fanotify: Report fid info for file related file system errors
	fanotify: Emit generic error info for error event
	fanotify: Allow users to request FAN_FS_ERROR events
	SUNRPC: Trace calls to .rpc_call_done
	NFSD: Optimize DRC bucket pruning
	NFSD: move filehandle format declarations out of "uapi".
	NFSD: drop support for ancient filehandles
	NFSD: simplify struct nfsfh
	NFSD: Initialize pointer ni with NULL and not plain integer 0
	NFSD: Have legacy NFSD WRITE decoders use xdr_stream_subsegment()
	SUNRPC: Replace the "__be32 *p" parameter to .pc_decode
	SUNRPC: Change return value type of .pc_decode
	NFSD: Save location of NFSv4 COMPOUND status
	SUNRPC: Replace the "__be32 *p" parameter to .pc_encode
	SUNRPC: Change return value type of .pc_encode
	nfsd: update create verifier comment
	NFSD:fix boolreturn.cocci warning
	nfsd4: remove obselete comment
	NFSD: Fix exposure in nfsd4_decode_bitmap()
	NFSD: Fix READDIR buffer overflow
	fsnotify: clarify object type argument
	fsnotify: separate mark iterator type from object type enum
	fanotify: introduce group flag FAN_REPORT_TARGET_FID
	fsnotify: generate FS_RENAME event with rich information
	fanotify: use macros to get the offset to fanotify_info buffer
	fanotify: use helpers to parcel fanotify_info buffer
	fanotify: support secondary dir fh and name in fanotify_info
	fanotify: record old and new parent and name in FAN_RENAME event
	fanotify: record either old name new name or both for FAN_RENAME
	fanotify: report old and/or new parent+name in FAN_RENAME event
	fanotify: wire up FAN_RENAME event
	exit: Implement kthread_exit
	exit: Rename module_put_and_exit to module_put_and_kthread_exit
	NFSD: Fix sparse warning
	NFSD: handle errors better in write_ports_addfd()
	SUNRPC: change svc_get() to return the svc.
	SUNRPC/NFSD: clean up get/put functions.
	SUNRPC: stop using ->sv_nrthreads as a refcount
	nfsd: make nfsd_stats.th_cnt atomic_t
	SUNRPC: use sv_lock to protect updates to sv_nrthreads.
	NFSD: narrow nfsd_mutex protection in nfsd thread
	NFSD: Make it possible to use svc_set_num_threads_sync
	SUNRPC: discard svo_setup and rename svc_set_num_threads_sync()
	NFSD: simplify locking for network notifier.
	lockd: introduce nlmsvc_serv
	lockd: simplify management of network status notifiers
	lockd: move lockd_start_svc() call into lockd_create_svc()
	lockd: move svc_exit_thread() into the thread
	lockd: introduce lockd_put()
	lockd: rename lockd_create_svc() to lockd_get()
	SUNRPC: move the pool_map definitions (back) into svc.c
	SUNRPC: always treat sv_nrpools==1 as "not pooled"
	lockd: use svc_set_num_threads() for thread start and stop
	NFS: switch the callback service back to non-pooled.
	NFSD: Remove be32_to_cpu() from DRC hash function
	NFSD: Fix inconsistent indenting
	NFSD: simplify per-net file cache management
	NFSD: Combine XDR error tracepoints
	nfsd: improve stateid access bitmask documentation
	NFSD: De-duplicate nfsd4_decode_bitmap4()
	nfs: block notification on fs with its own ->lock
	nfsd4: add refcount for nfsd4_blocked_lock
	NFSD: Fix zero-length NFSv3 WRITEs
	nfsd: map EBADF
	nfsd: Add errno mapping for EREMOTEIO
	nfsd: Retry once in nfsd_open on an -EOPENSTALE return
	NFSD: Clean up nfsd_vfs_write()
	NFSD: De-duplicate net_generic(SVC_NET(rqstp), nfsd_net_id)
	NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id)
	nfsd: Add a tracepoint for errors in nfsd4_clone_file_range()
	NFSD: Write verifier might go backwards
	NFSD: Clean up the nfsd_net::nfssvc_boot field
	NFSD: Rename boot verifier functions
	NFSD: Trace boot verifier resets
	Revert "nfsd: skip some unnecessary stats in the v4 case"
	NFSD: Move fill_pre_wcc() and fill_post_wcc()
	nfsd: fix crash on COPY_NOTIFY with special stateid
	fanotify: remove variable set but not used
	lockd: fix server crash on reboot of client holding lock
	lockd: fix failure to cleanup client locks
	NFSD: Fix the behavior of READ near OFFSET_MAX
	NFSD: Fix ia_size underflow
	NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
	NFSD: COMMIT operations must not return NFS?ERR_INVAL
	NFSD: Deprecate NFS_OFFSET_MAX
	nfsd: Add support for the birth time attribute
	NFSD: De-duplicate hash bucket indexing
	NFSD: Skip extra computation for RC_NOCACHE case
	NFSD: Streamline the rare "found" case
	SUNRPC: Remove the .svo_enqueue_xprt method
	SUNRPC: Merge svc_do_enqueue_xprt() into svc_enqueue_xprt()
	SUNRPC: Remove svo_shutdown method
	SUNRPC: Rename svc_create_xprt()
	SUNRPC: Rename svc_close_xprt()
	SUNRPC: Remove svc_shutdown_net()
	NFSD: Remove svc_serv_ops::svo_module
	NFSD: Move svc_serv_ops::svo_function into struct svc_serv
	NFSD: Remove CONFIG_NFSD_V3
	NFSD: Clean up _lm_ operation names
	nfsd: fix using the correct variable for sizeof()
	fsnotify: fix merge with parent's ignored mask
	fsnotify: optimize FS_MODIFY events with no ignored masks
	fsnotify: remove redundant parameter judgment
	SUNRPC: Return true/false (not 1/0) from bool functions
	nfsd: Fix a write performance regression
	nfsd: Clean up nfsd_file_put()
	fanotify: do not allow setting dirent events in mask of non-dir
	fs/lock: documentation cleanup. Replace inode->i_lock with flc_lock.
	inotify: move control flags from mask to mark flags
	fsnotify: pass flags argument to fsnotify_alloc_group()
	fsnotify: make allow_dups a property of the group
	fsnotify: create helpers for group mark_mutex lock
	inotify: use fsnotify group lock helpers
	nfsd: use fsnotify group lock helpers
	dnotify: use fsnotify group lock helpers
	fsnotify: allow adding an inode mark without pinning inode
	fanotify: create helper fanotify_mark_user_flags()
	fanotify: factor out helper fanotify_mark_update_flags()
	fanotify: implement "evictable" inode marks
	fanotify: use fsnotify group lock helpers
	fanotify: enable "evictable" inode marks
	fsnotify: introduce mark type iterator
	fsnotify: consistent behavior for parent not watching children
	fanotify: fix incorrect fmode_t casts
	NFSD: Clean up nfsd_splice_actor()
	NFSD: add courteous server support for thread with only delegation
	NFSD: add support for share reservation conflict to courteous server
	NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd
	fs/lock: add helper locks_owner_has_blockers to check for blockers
	fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict
	NFSD: add support for lock conflict to courteous server
	NFSD: Show state of courtesy client in client info
	NFSD: Clean up nfsd3_proc_create()
	NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create()
	NFSD: Refactor nfsd_create_setattr()
	NFSD: Refactor NFSv3 CREATE
	NFSD: Refactor NFSv4 OPEN(CREATE)
	NFSD: Remove do_nfsd_create()
	NFSD: Clean up nfsd_open_verified()
	NFSD: Instantiate a struct file when creating a regular NFSv4 file
	NFSD: Remove dprintk call sites from tail of nfsd4_open()
	NFSD: Fix whitespace
	NFSD: Move documenting comment for nfsd4_process_open2()
	NFSD: Trace filecache opens
	NFSD: Clean up the show_nf_flags() macro
	SUNRPC: Use RMW bitops in single-threaded hot paths
	nfsd: Unregister the cld notifier when laundry_wq create failed
	nfsd: Fix null-ptr-deref in nfsd_fill_super()
	nfsd: destroy percpu stats counters after reply cache shutdown
	NFSD: Modernize nfsd4_release_lockowner()
	NFSD: Add documenting comment for nfsd4_release_lockowner()
	NFSD: nfsd_file_put() can sleep
	NFSD: Fix potential use-after-free in nfsd_file_put()
	SUNRPC: Optimize xdr_reserve_space()
	fanotify: refine the validation checks on non-dir inode mask
	NFS: restore module put when manager exits.
	NFSD: Decode NFSv4 birth time attribute
	lockd: set fl_owner when unlocking files
	lockd: fix nlm_close_files
	fs: inotify: Fix typo in inotify comment
	fanotify: prepare for setting event flags in ignore mask
	fanotify: cleanups for fanotify_mark() input validations
	fanotify: introduce FAN_MARK_IGNORE
	fsnotify: Fix comment typo
	nfsd: eliminate the NFSD_FILE_BREAK_* flags
	SUNRPC: Fix xdr_encode_bool()
	NLM: Defend against file_lock changes after vfs_test_lock()
	NFSD: Fix space and spelling mistake
	nfsd: remove redundant assignment to variable len
	NFSD: Demote a WARN to a pr_warn()
	NFSD: Report filecache LRU size
	NFSD: Report count of calls to nfsd_file_acquire()
	NFSD: Report count of freed filecache items
	NFSD: Report average age of filecache items
	NFSD: Add nfsd_file_lru_dispose_list() helper
	NFSD: Refactor nfsd_file_gc()
	NFSD: Refactor nfsd_file_lru_scan()
	NFSD: Report the number of items evicted by the LRU walk
	NFSD: Record number of flush calls
	NFSD: Zero counters when the filecache is re-initialized
	NFSD: Hook up the filecache stat file
	NFSD: WARN when freeing an item still linked via nf_lru
	NFSD: Trace filecache LRU activity
	NFSD: Leave open files out of the filecache LRU
	NFSD: Fix the filecache LRU shrinker
	NFSD: Never call nfsd_file_gc() in foreground paths
	NFSD: No longer record nf_hashval in the trace log
	NFSD: Remove lockdep assertion from unhash_and_release_locked()
	NFSD: nfsd_file_unhash can compute hashval from nf->nf_inode
	NFSD: Refactor __nfsd_file_close_inode()
	NFSD: nfsd_file_hash_remove can compute hashval
	NFSD: Remove nfsd_file::nf_hashval
	NFSD: Replace the "init once" mechanism
	NFSD: Set up an rhashtable for the filecache
	NFSD: Convert the filecache to use rhashtable
	NFSD: Clean up unused code after rhashtable conversion
	NFSD: Separate tracepoints for acquire and create
	NFSD: Move nfsd_file_trace_alloc() tracepoint
	NFSD: NFSv4 CLOSE should release an nfsd_file immediately
	NFSD: Ensure nf_inode is never dereferenced
	NFSD: refactoring v4 specific code to a helper in nfs4state.c
	NFSD: keep track of the number of v4 clients in the system
	NFSD: limit the number of v4 clients to 1024 per 1GB of system memory
	nfsd: silence extraneous printk on nfsd.ko insertion
	NFSD: Optimize nfsd4_encode_operation()
	NFSD: Optimize nfsd4_encode_fattr()
	NFSD: Clean up SPLICE_OK in nfsd4_encode_read()
	NFSD: Add an nfsd4_read::rd_eof field
	NFSD: Optimize nfsd4_encode_readv()
	NFSD: Simplify starting_len
	NFSD: Use xdr_pad_size()
	NFSD: Clean up nfsd4_encode_readlink()
	NFSD: Fix strncpy() fortify warning
	NFSD: nfserrno(-ENOMEM) is nfserr_jukebox
	NFSD: Shrink size of struct nfsd4_copy_notify
	NFSD: Shrink size of struct nfsd4_copy
	NFSD: Reorder the fields in struct nfsd4_op
	NFSD: Make nfs4_put_copy() static
	NFSD: Replace boolean fields in struct nfsd4_copy
	NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2)
	NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2)
	NFSD: Refactor nfsd4_do_copy()
	NFSD: Remove kmalloc from nfsd4_do_async_copy()
	NFSD: Add nfsd4_send_cb_offload()
	NFSD: Move copy offload callback arguments into a separate structure
	NFSD: drop fh argument from alloc_init_deleg
	NFSD: verify the opened dentry after setting a delegation
	NFSD: introduce struct nfsd_attrs
	NFSD: set attributes when creating symlinks
	NFSD: add security label to struct nfsd_attrs
	NFSD: add posix ACLs to struct nfsd_attrs
	NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before returning.
	NFSD: always drop directory lock in nfsd_unlink()
	NFSD: only call fh_unlock() once in nfsd_link()
	NFSD: reduce locking in nfsd_lookup()
	NFSD: use explicit lock/unlock for directory ops
	NFSD: use (un)lock_inode instead of fh_(un)lock for file operations
	NFSD: discard fh_locked flag and fh_lock/fh_unlock
	lockd: detect and reject lock arguments that overflow
	NFSD: fix regression with setting ACLs.
	nfsd_splice_actor(): handle compound pages
	NFSD: move from strlcpy with unused retval to strscpy
	lockd: move from strlcpy with unused retval to strscpy
	NFSD enforce filehandle check for source file in COPY
	NFSD: remove redundant variable status
	nfsd: Avoid some useless tests
	nfsd: Propagate some error code returned by memdup_user()
	NFSD: Increase NFSD_MAX_OPS_PER_COMPOUND
	NFSD: Protect against send buffer overflow in NFSv2 READDIR
	NFSD: Protect against send buffer overflow in NFSv3 READDIR
	NFSD: Protect against send buffer overflow in NFSv2 READ
	NFSD: Protect against send buffer overflow in NFSv3 READ
	NFSD: drop fname and flen args from nfsd_create_locked()
	NFSD: Fix handling of oversized NFSv4 COMPOUND requests
	nfsd: clean up mounted_on_fileid handling
	nfsd: remove nfsd4_prepare_cb_recall() declaration
	NFSD: Add tracepoints to report NFSv4 callback completions
	NFSD: Add a mechanism to wait for a DELEGRETURN
	NFSD: Refactor nfsd_setattr()
	NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY
	NFSD: Make nfsd4_rename() wait before returning NFS4ERR_DELAY
	NFSD: Make nfsd4_remove() wait before returning NFS4ERR_DELAY
	NFSD: keep track of the number of courtesy clients in the system
	NFSD: add shrinker to reap courtesy clients on low memory condition
	SUNRPC: Parametrize how much of argsize should be zeroed
	NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing
	NFSD: Refactor common code out of dirlist helpers
	NFSD: Use xdr_inline_decode() to decode NFSv3 symlinks
	NFSD: Clean up WRITE arg decoders
	NFSD: Clean up nfs4svc_encode_compoundres()
	NFSD: Remove "inline" directives on op_rsize_bop helpers
	NFSD: Remove unused nfsd4_compoundargs::cachetype field
	NFSD: Pack struct nfsd4_compoundres
	nfsd: use DEFINE_PROC_SHOW_ATTRIBUTE to define nfsd_proc_ops
	nfsd: use DEFINE_SHOW_ATTRIBUTE to define export_features_fops and supported_enctypes_fops
	nfsd: use DEFINE_SHOW_ATTRIBUTE to define client_info_fops
	nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_reply_cache_stats_fops
	nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_file_cache_stats_fops
	NFSD: Rename the fields in copy_stateid_t
	NFSD: Cap rsize_bop result based on send buffer size
	nfsd: only fill out return pointer on success in nfsd4_lookup_stateid
	nfsd: fix comments about spinlock handling with delegations
	nfsd: make nfsd4_run_cb a bool return function
	nfsd: extra checks when freeing delegation stateids
	fs/notify: constify path
	fsnotify: remove unused declaration
	fanotify: Remove obsoleted fanotify_event_has_path()
	nfsd: fix nfsd_file_unhash_and_dispose
	nfsd: rework hashtable handling in nfsd_do_file_acquire
	NFSD: unregister shrinker when nfsd_init_net() fails
	nfsd: fix net-namespace logic in __nfsd_file_cache_purge
	nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint
	nfsd: put the export reference in nfsd4_verify_deleg_dentry
	NFSD: Fix reads with a non-zero offset that don't end on a page boundary
	filelock: add a new locks_inode_context accessor function
	lockd: use locks_inode_context helper
	nfsd: use locks_inode_context helper
	NFSD: Simplify READ_PLUS
	NFSD: Remove redundant assignment to variable host_err
	NFSD: Finish converting the NFSv2 GETACL result encoder
	NFSD: Finish converting the NFSv3 GETACL result encoder
	nfsd: ignore requests to disable unsupported versions
	nfsd: move nfserrno() to vfs.c
	nfsd: allow disabling NFSv2 at compile time
	exportfs: use pr_debug for unreachable debug statements
	NFSD: Pass the target nfsd_file to nfsd_commit()
	NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately"
	NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection
	NFSD: Flesh out a documenting comment for filecache.c
	NFSD: Clean up nfs4_preprocess_stateid_op() call sites
	NFSD: Trace stateids returned via DELEGRETURN
	NFSD: Trace delegation revocations
	NFSD: Use const pointers as parameters to fh_ helpers
	NFSD: Update file_hashtbl() helpers
	NFSD: Clean up nfsd4_init_file()
	NFSD: Add a nfsd4_file_hash_remove() helper
	NFSD: Clean up find_or_add_file()
	NFSD: Refactor find_file()
	NFSD: Use rhashtable for managing nfs4_file objects
	NFSD: Fix licensing header in filecache.c
	nfsd: remove the pages_flushed statistic from filecache
	nfsd: reorganize filecache.c
	nfsd: fix up the filecache laundrette scheduling
	NFSD: Add an nfsd_file_fsync tracepoint
	lockd: set other missing fields when unlocking files
	nfsd: return error if nfs4_setacl fails
	NFSD: Use struct_size() helper in alloc_session()
	lockd: set missing fl_flags field when retrieving args
	lockd: ensure we use the correct file descriptor when unlocking
	lockd: fix file selection in nlmsvc_cancel_blocked
	NFSD: pass range end to vfs_fsync_range() instead of count
	NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker
	NFSD: add support for sending CB_RECALL_ANY
	NFSD: add delegation reaper to react to low memory condition
	NFSD: Use only RQ_DROPME to signal the need to drop a reply
	NFSD: Avoid clashing function prototypes
	nfsd: rework refcounting in filecache
	nfsd: fix handling of cached open files in nfsd4_open codepath
	Revert "SUNRPC: Use RMW bitops in single-threaded hot paths"
	NFSD: Use set_bit(RQ_DROPME)
	NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
	NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time
	NFSD: replace delayed_work with work_struct for nfsd_client_shrinker
	nfsd: don't free files unconditionally in __nfsd_file_cache_purge
	nfsd: don't destroy global nfs4_file table in per-net shutdown
	NFSD: enhance inter-server copy cleanup
	nfsd: allow nfsd_file_get to sanely handle a NULL pointer
	nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
	NFSD: fix leaked reference count of nfsd4_ssc_umount_item
	nfsd: don't hand out delegation on setuid files being opened for write
	NFSD: fix problems with cleanup on errors in nfsd4_copy
	nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
	nfsd: don't fsync nfsd_files on last close
	NFSD: copy the whole verifier in nfsd_copy_write_verifier
	NFSD: Protect against filesystem freezing
	lockd: set file_lock start and end when decoding nlm4 testargs
	nfsd: don't replace page in rq_pages if it's a continuation of last page
	NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
	nfsd: call op_release, even when op_func returns an error
	nfsd: don't open-code clear_and_wake_up_bit
	nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
	nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
	nfsd: don't kill nfsd_files because of lease break error
	nfsd: add some comments to nfsd_file_do_acquire
	nfsd: don't take/put an extra reference when putting a file
	nfsd: update comment over __nfsd_file_cache_purge
	nfsd: allow reaping files still under writeback
	NFSD: Convert filecache to rhltable
	nfsd: simplify the delayed disposal list code
	NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
	nfsd: make a copy of struct iattr before calling notify_change
	nfsd: fix double fget() bug in __write_ports_addfd()
	lockd: drop inappropriate svc_get() from locked_get()
	NFSD: Add an nfsd4_encode_nfstime4() helper
	nfsd: Fix creation time serialization order
	nfsd: don't allow nfsd threads to be signalled.
	nfsd: Simplify code around svc_exit_thread() call in nfsd()
	nfsd: separate nfsd_last_thread() from nfsd_put()
	Documentation: Add missing documentation for EXPORT_OP flags
	NFSD: fix possible oops when nfsd/pool_stats is closed.
	nfsd: call nfsd_last_thread() before final nfsd_put()
	nfsd: drop the nfsd_put helper
	nfsd: fix RELEASE_LOCKOWNER
	nfsd: don't take fi_lock in nfsd_break_deleg_cb()
	nfsd: don't call locks_release_private() twice concurrently
	nfsd: Fix a regression in nfsd_setattr()
	Linux 5.10.220

Change-Id: I589ec5e63d1f985ab69f9755b9a87330627d44c5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-07-16 15:58:54 +00:00
Christian Brauner
e864d4d834 namei: introduce struct renamedata
[ Upstream commit 9fe61450972d3900bffb1dc26a17ebb9cdd92db2 ]

In order to handle idmapped mounts we will extend the vfs rename helper
to take two new arguments in follow up patches. Since this operations
already takes a bunch of arguments add a simple struct renamedata and
make the current helper use it before we extend it.

Link: https://lore.kernel.org/r/20210121131959.646623-14-christian.brauner@ubuntu.com
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ cel: backported to 5.10.y, prior to idmapped mounts ]
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-06-21 14:52:59 +02:00
Greg Kroah-Hartman
7999a9a70d This is the 5.10.202 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmVmG20ACgkQONu9yGCS
 aT6dzg/7BnCP2SpVmgEaD7FdPvGO/A6O5VrC9zu3sQE6g2gAwirZhdgE8NRn+ggm
 WSQ1kIA+HEcY23FKpq46pBED4P1irudiW7DkLw8nyOGp+XLb4wGkF5lBBP5z+B2P
 ga2RgwqKvYWeDaUW4n1Uy7m2Cz+wqCg/EvnITo40glSWPh20gM532/CSnA5akoje
 9mjZYZ0rKHKTZGu65aNScNR7XnXHIivJU6C1jF6L9N1+Xn679nUHKQP4KM/RcjpX
 g1WQMWFC3mGIn5IX28W1wvKS320D5HLmTLnLqJvFpJN9+13DUnUoXcX469zvQoxJ
 GL3S94goWN/0BPOgr5KcKvTj00b4O+EWhQuQt+x8NLdydzRQuyFu2UpLNhIKKSou
 sT+BcxzeuqJhEh1tZItcZkZBptpLEkb0ezT11u5McnU5FjPzzzP8CtEetKKmEaBU
 AUoEP/lQQlVyk1I6xAeuzu53smncNQt6CqnXJxYXOBGgJ2txAM5kroMKXPin5C8k
 BCpUIqghhKmBd1hwuKyaOBKF99eLKKZsuvXppoPD0Yz7/Nq5TgdBw0qbNt2iLr05
 XSM7WIIeCBROaV+ZiVxgtcXDR51FpMr7CLTbkBQ6IgLwircHeHSK7rQn7kFO3fCg
 OezhWAuh72qDZ2PCJ84fj21IhZ49a5oCLbUdBew+KzZervVpSo0=
 =eW67
 -----END PGP SIGNATURE-----

Merge 5.10.202 into android12-5.10-lts

Changes in 5.10.202
	locking/ww_mutex/test: Fix potential workqueue corruption
	perf/core: Bail out early if the request AUX area is out of bound
	clocksource/drivers/timer-imx-gpt: Fix potential memory leak
	clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
	x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
	wifi: mac80211_hwsim: fix clang-specific fortify warning
	wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
	bpf: Detect IP == ksym.end as part of BPF program
	wifi: ath9k: fix clang-specific fortify warnings
	wifi: ath10k: fix clang-specific fortify warning
	net: annotate data-races around sk->sk_tx_queue_mapping
	net: annotate data-races around sk->sk_dst_pending_confirm
	wifi: ath10k: Don't touch the CE interrupt registers after power up
	Bluetooth: btusb: Add date->evt_skb is NULL check
	Bluetooth: Fix double free in hci_conn_cleanup
	platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
	drm/komeda: drop all currently held locks if deadlock happens
	drm/msm/dp: skip validity check for DP CTS EDID checksum
	drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
	drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
	drm/amdgpu: Fix potential null pointer derefernce
	drm/panel: fix a possible null pointer dereference
	drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
	drm/panel: st7703: Pick different reset sequence
	drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
	selftests/efivarfs: create-read: fix a resource leak
	ASoC: soc-card: Add storage for PCI SSID
	crypto: pcrypt - Fix hungtask for PADATA_RESET
	RDMA/hfi1: Use FIELD_GET() to extract Link Width
	fs/jfs: Add check for negative db_l2nbperpage
	fs/jfs: Add validity check for db_maxag and db_agpref
	jfs: fix array-index-out-of-bounds in dbFindLeaf
	jfs: fix array-index-out-of-bounds in diAlloc
	HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
	ARM: 9320/1: fix stack depot IRQ stack filter
	ALSA: hda: Fix possible null-ptr-deref when assigning a stream
	PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
	atm: iphase: Do PCI error checks on own line
	scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
	misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
	HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
	exfat: support handle zero-size directory
	tty: vcc: Add check for kstrdup() in vcc_probe()
	usb: gadget: f_ncm: Always set current gadget in ncm_bind()
	9p/trans_fd: Annotate data-racy writes to file::f_flags
	i2c: sun6i-p2wi: Prevent potential division by zero
	media: gspca: cpia1: shift-out-of-bounds in set_flicker
	media: vivid: avoid integer overflow
	gfs2: ignore negated quota changes
	gfs2: fix an oops in gfs2_permission
	media: cobalt: Use FIELD_GET() to extract Link Width
	media: imon: fix access to invalid resource for the second interface
	drm/amd/display: Avoid NULL dereference of timing generator
	kgdb: Flush console before entering kgdb on panic
	ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
	drm/amdgpu: fix software pci_unplug on some chips
	pwm: Fix double shift bug
	wifi: iwlwifi: Use FW rate for non-data frames
	xhci: turn cancelled td cleanup to its own function
	SUNRPC: ECONNRESET might require a rebind
	SUNRPC: Add an IS_ERR() check back to where it was
	NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
	SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
	gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
	ipvlan: add ipvlan_route_v6_outbound() helper
	tty: Fix uninit-value access in ppp_sync_receive()
	net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
	net: hns3: fix VF reset fail issue
	tipc: Fix kernel-infoleak due to uninitialized TLV value
	ppp: limit MRU to 64K
	xen/events: fix delayed eoi list handling
	ptp: annotate data-race around q->head and q->tail
	bonding: stop the device in bond_setup_by_slave()
	net: ethernet: cortina: Fix max RX frame define
	net: ethernet: cortina: Handle large frames
	net: ethernet: cortina: Fix MTU max setting
	netfilter: nf_conntrack_bridge: initialize err to 0
	net: stmmac: fix rx budget limit check
	net/mlx5e: fix double free of encap_header
	net/mlx5_core: Clean driver version and name
	net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
	macvlan: Don't propagate promisc change to lower dev in passthru
	tools/power/turbostat: Fix a knl bug
	cifs: spnego: add ';' in HOST_KEY_LEN
	cifs: fix check of rc in function generate_smb3signingkey
	media: venus: hfi: add checks to perform sanity on queue pointers
	powerpc/perf: Fix disabling BHRB and instruction sampling
	randstruct: Fix gcc-plugin performance mode to stay in group
	bpf: Fix check_stack_write_fixed_off() to correctly spill imm
	bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
	scsi: mpt3sas: Fix loop logic
	scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
	x86/cpu/hygon: Fix the CPU topology evaluation for real
	KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
	KVM: x86: Ignore MSR_AMD64_TW_CFG access
	audit: don't take task_lock() in audit_exe_compare() code path
	audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
	tty/sysrq: replace smp_processor_id() with get_cpu()
	hvc/xen: fix console unplug
	hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
	PCI/sysfs: Protect driver's D3cold preference from user space
	watchdog: move softlockup_panic back to early_param
	ACPI: resource: Do IRQ override on TongFang GMxXGxx
	arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
	parisc/pdc: Add width field to struct pdc_model
	clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
	clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
	mmc: vub300: fix an error code
	mmc: sdhci_am654: fix start loop index for TAP value parsing
	PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
	arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
	PM: hibernate: Use __get_safe_page() rather than touching the list
	PM: hibernate: Clean up sync_read handling in snapshot_write_next()
	rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
	btrfs: don't arbitrarily slow down delalloc if we're committing
	firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
	ima: detect changes to the backing overlay file
	wifi: ath11k: fix temperature event locking
	wifi: ath11k: fix dfs radar event locking
	wifi: ath11k: fix htt pktlog locking
	mmc: meson-gx: Remove setting of CMD_CFG_ERROR
	genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
	PCI: keystone: Don't discard .remove() callback
	PCI: keystone: Don't discard .probe() callback
	jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
	quota: explicitly forbid quota files from being encrypted
	kernel/reboot: emergency_restart: Set correct system_state
	i2c: core: Run atomic i2c xfer when !preemptible
	mcb: fix error handling for different scenarios when parsing
	dmaengine: stm32-mdma: correct desc prep when channel running
	mm/cma: use nth_page() in place of direct struct page manipulation
	mm/memory_hotplug: use pfn math in place of direct struct page manipulation
	mtd: cfi_cmdset_0001: Byte swap OTP info
	i3c: master: cdns: Fix reading status register
	parisc: Prevent booting 64-bit kernels on PA1.x machines
	parisc/pgtable: Do not drop upper 5 address bits of physical address
	xhci: Enable RPM on controllers that support low-power states
	ALSA: info: Fix potential deadlock at disconnection
	ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
	ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
	serial: meson: remove redundant initialization of variable id
	tty: serial: meson: retrieve port FIFO size from DT
	serial: meson: Use platform_get_irq() to get the interrupt
	tty: serial: meson: fix hard LOCKUP on crtscts mode
	cpufreq: stats: Fix buffer overflow detection in trans_stats()
	Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
	bluetooth: Add device 0bda:887b to device tables
	bluetooth: Add device 13d3:3571 to device tables
	Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
	Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
	PCI: exynos: Don't discard .remove() callback
	arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO
	arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
	Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
	lsm: fix default return value for vm_enough_memory
	lsm: fix default return value for inode_getsecctx
	i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
	net: dsa: lan9303: consequently nested-lock physical MDIO
	net: phylink: initialize carrier state at creation
	i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
	f2fs: avoid format-overflow warning
	media: lirc: drop trailing space from scancode transmit
	media: sharp: fix sharp encoding
	media: venus: hfi_parser: Add check to keep the number of codecs within range
	media: venus: hfi: fix the check to handle session buffer requirement
	media: venus: hfi: add checks to handle capabilities from firmware
	nfsd: fix file memleak on client_opens_release
	mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
	media: qcom: camss: Fix vfe_get() error jump
	Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
	ext4: apply umask if ACL support is disabled
	ext4: correct offset of gdb backup in non meta_bg group to update_backups
	ext4: correct return value of ext4_convert_meta_bg
	ext4: correct the start block of counting reserved clusters
	ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
	drm/amd/pm: Handle non-terminated overdrive commands.
	drm/amdgpu: fix error handling in amdgpu_bo_list_get()
	drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
	io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
	tracing: Have trace_event_file have ref counters
	netfilter: nftables: update table flags from the commit phase
	netfilter: nf_tables: fix table flag updates
	netfilter: nf_tables: disable toggling dormant table state more than once
	interconnect: qcom: Add support for mask-based BCMs
	Linux 5.10.202

Change-Id: I762bcd4848d9b87cbb4efe4104fe1685999dc0f7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-12-08 16:26:36 +00:00
Mimi Zohar
cd5a262a07 ima: detect changes to the backing overlay file
commit b836c4d29f2744200b2af41e14bf50758dddc818 upstream.

Commit 18b44bc5a672 ("ovl: Always reevaluate the file signature for
IMA") forced signature re-evaulation on every file access.

Instead of always re-evaluating the file's integrity, detect a change
to the backing file, by comparing the cached file metadata with the
backing file's metadata.  Verifying just the i_version has not changed
is insufficient.  In addition save and compare the i_ino and s_dev
as well.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Tested-by: Eric Snowberg <eric.snowberg@oracle.com>
Tested-by: Raul E Rangel <rrangel@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-28 16:54:57 +00:00
Greg Kroah-Hartman
e04ba5f57f This is the 5.10.199 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmU45eIACgkQONu9yGCS
 aT6OGw//TD8VOR/VIUsdCH4keamvfoOjW7IdUMI6WWrXGw4TBQhOb1S5OFmUXLIW
 1TQKvnJSpkukW9oQXChEPiVm9LMXq0dsWOaI11I23HmAzenZQ+cdHLFa8Rod3DeJ
 t17qefmsZxvI3U5nXJiCYRlUcqWF8rgpYR8NaJass8xOOGKEDk9JMXy1hvCG1N8C
 1Zvth4wJmaDvJxSLHCL0gZkYBQBddePtrHwxWqLJ9vwUJEHGWf6AlwaASFUtRMut
 am2sWYx7aDKQT4w6B4MEJfA3bcTbLAglZG5s85ENhYYAMYW+cX/YtQH182KcpRTx
 mRmDc2vk1tJsSAuuE94OAAESjCdWF7V5SUkk/GLawnRiR7NeOax7vvS634uPtN+g
 LdTOlWMlcum46LmrJd6pu7oLXyZHGrr0/cBPewwYTlcRsmSS+WADUfH1yZL14lDC
 Nf8JASLIj68jrxnTn1lWGtShn8unNV9ZVauA8krsXJzvgjYNpaQSRhxOnltc+Zuy
 GFC0oipwgbzM8Y3lSPfF8rwBA85tmvF397oBM5c4uzZ+ULn7XWPJG+wIYtk7R9N7
 57rKAKyu+s3hHEUCyF7Z/HF7pHiL6vg4hQzhgIKqDMYkZmyHYV3iIAy5j5jvCkvD
 8zjBiV3iBC9PYzNYghVRVm5LjRwlXvqSpy88YwgkB1iD+5rZ3RQ=
 =PvGf
 -----END PGP SIGNATURE-----

Merge 5.10.199 into android12-5.10-lts

Changes in 5.10.199
        RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
        RDMA/srp: Do not call scsi_done() from srp_abort()
        RDMA/cxgb4: Check skb value for failure to allocate
        perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
        lib/test_meminit: fix off-by-one error in test_pages()
        HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
        quota: Fix slow quotaoff
        net: prevent address rewrite in kernel_bind()
        drm/msm/dp: do not reinitialize phy unless retry during link training
        drm/msm/dsi: skip the wait for video mode done if not applicable
        drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
        ravb: Fix up dma_free_coherent() call in ravb_remove()
        ieee802154: ca8210: Fix a potential UAF in ca8210_probe
        mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
        xen-netback: use default TX queue size for vifs
        riscv, bpf: Factor out emit_call for kernel and bpf context
        riscv, bpf: Sign-extend return values
        drm/vmwgfx: fix typo of sizeof argument
        net: macsec: indicate next pn update when offloading
        net: phy: mscc: macsec: reject PN update requests
        ixgbe: fix crash with empty VF macvlan list
        net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
        pinctrl: renesas: rzn1: Enable missing PINMUX
        nfc: nci: assert requested protocol is valid
        workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
        Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure"
        Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe"
        net: add sysctl accept_ra_min_rtr_lft
        net: change accept_ra_min_rtr_lft to affect all RA lifetimes
        net: release reference to inet6_dev pointer
        media: mtk-jpeg: Fix use after free bug due to uncanceled work
        dmaengine: stm32-mdma: abort resume if no ongoing transfer
        usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
        net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
        usb: dwc3: Soft reset phy on probe for host
        usb: musb: Get the musb_qh poniter after musb_giveback
        usb: musb: Modify the "HWVers" register address
        iio: pressure: bmp280: Fix NULL pointer exception
        iio: pressure: dps310: Adjust Timeout Settings
        iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
        x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
        mcb: remove is_added flag from mcb_device struct
        thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
        libceph: use kernel_connect()
        ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
        ceph: fix type promotion bug on 32bit systems
        Input: powermate - fix use-after-free in powermate_config_complete
        Input: psmouse - fix fast_reconnect function for PS/2 mode
        Input: xpad - add PXN V900 support
        Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
        Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
        tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
        cgroup: Remove duplicates in cgroup v1 tasks file
        pinctrl: avoid unsafe code pattern in find_pinctrl()
        counter: microchip-tcb-capture: Fix the use of internal GCLK logic
        usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
        usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
        dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
        powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
        powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
        x86/alternatives: Disable KASAN in apply_alternatives()
        arm64: report EL1 UNDEFs better
        arm64: die(): pass 'err' as long
        arm64: consistently pass ESR_ELx to die()
        arm64: rework FPAC exception handling
        arm64: rework BTI exception handling
        arm64: allow kprobes on EL0 handlers
        arm64: split EL0/EL1 UNDEF handlers
        arm64: factor out EL1 SSBS emulation hook
        arm64: factor insn read out of call_undef_hook()
        arm64: rework EL0 MRS emulation
        arm64: armv8_deprecated: fold ops into insn_emulation
        arm64: armv8_deprecated move emulation functions
        arm64: armv8_deprecated: move aarch32 helper earlier
        arm64: armv8_deprecated: rework deprected instruction handling
        arm64: armv8_deprecated: fix unused-function error
        RDMA/srp: Set scmnd->result only when scmnd is not NULL
        RDMA/srp: Fix srp_abort()
        ravb: Fix use-after-free issue in ravb_tx_timeout_work()
        dev_forward_skb: do not scrub skb mark within the same name space
        lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
        mm/memory_hotplug: rate limit page migration warnings
        Documentation: sysctl: align cells in second content column
        usb: hub: Guard against accesses to uninitialized BOS descriptors
        Bluetooth: hci_event: Ignore NULL link key
        Bluetooth: Reject connection with the device which has same BD_ADDR
        Bluetooth: Fix a refcnt underflow problem for hci_conn
        Bluetooth: vhci: Fix race when opening vhci device
        Bluetooth: hci_event: Fix coding style
        Bluetooth: avoid memcmp() out of bounds warning
        ice: fix over-shifted variable
        ice: reset first in crash dump kernels
        nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
        regmap: fix NULL deref on lookup
        KVM: x86: Mask LVTPC when handling a PMI
        x86/sev: Disable MMIO emulation from user mode
        x86/sev: Check IOBM for IOIO exceptions from user-space
        x86/sev: Check for user-space IOIO pointing to kernel space
        tcp: check mptcp-level constraints for backlog coalescing
        netfilter: nft_payload: fix wrong mac header matching
        nvmet-tcp: Fix a possible UAF in queue intialization setup
        drm/i915: Retry gtt fault when out of fence registers
        qed: fix LL2 RX buffer allocation
        xfrm: fix a data-race in xfrm_gen_index()
        xfrm: interface: use DEV_STATS_INC()
        net: ipv4: fix return value check in esp_remove_trailer
        net: ipv6: fix return value check in esp_remove_trailer
        net: rfkill: gpio: prevent value glitch during probe
        tcp: fix excessive TLP and RACK timeouts from HZ rounding
        tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
        tun: prevent negative ifindex
        ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
        net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
        i40e: prevent crash on probe if hw registers have invalid values
        net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
        net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
        neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
        netfilter: nft_set_rbtree: .deactivate fails if element has expired
        net: pktgen: Fix interface flags printing
        thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
        resource: Add irqresource_disabled()
        ACPI: Drop acpi_dev_irqresource_disabled()
        ACPI: resources: Add DMI-based legacy IRQ override quirk
        ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
        ACPI: resource: Add ASUS model S5402ZA to quirks
        ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
        ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
        ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
        ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
        ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
        selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
        selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
        usb: core: Track SuperSpeed Plus GenXxY
        xhci: cleanup xhci_hub_control port references
        xhci: move port specific items such as state completions to port structure
        xhci: rename resume_done to resume_timestamp
        xhci: clear usb2 resume related variables in one place.
        xhci: decouple usb2 port resume and get_port_status request handling
        xhci: track port suspend state correctly in unsuccessful resume cases
        serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
        serial: 8250_omap: Fix errors with no_console_suspend
        drm/amd/display: only check available pipe to disable vbios mode.
        drm/amd/display: Don't set dpms_off for seamless boot
        drm/connector: Give connector sysfs devices there own device_type
        drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2)
        drm/connector: Add drm_connector_find_by_fwnode() function (v3)
        drm/connector: Add support for out-of-band hotplug notification (v3)
        usb: typec: altmodes/displayport: Notify drm subsys of hotplug events
        usb: typec: altmodes/displayport: Signal hpd low when exiting mode
        ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
        btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
        btrfs: initialize start_slot in btrfs_log_prealloc_extents
        i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
        overlayfs: set ctime when setting mtime and atime
        gpio: timberdale: Fix potential deadlock on &tgpio->lock
        ata: libata-eh: Fix compilation warning in ata_eh_link_report()
        tracing: relax trace_event_eval_update() execution with cond_resched()
        HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
        Bluetooth: Avoid redundant authentication
        Bluetooth: hci_core: Fix build warnings
        wifi: cfg80211: Fix 6GHz scan configuration
        wifi: mac80211: allow transmitting EAPOL frames with tainted key
        wifi: cfg80211: avoid leaking stack data into trace
        regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
        sky2: Make sure there is at least one frag_addr available
        ipv4/fib: send notify when delete source address routes
        drm: panel-orientation-quirks: Add quirk for One Mix 2S
        btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
        HID: multitouch: Add required quirk for Synaptics 0xcd7e device
        platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
        net/mlx5: Handle fw tracer change ownership event based on MTRC
        Bluetooth: hci_event: Fix using memcmp when comparing keys
        mtd: rawnand: qcom: Unmap the right resource upon probe failure
        mtd: rawnand: marvell: Ensure program page operations are successful
        mtd: rawnand: arasan: Ensure program page operations are successful
        mtd: spinand: micron: correct bitmask for ecc status
        mtd: physmap-core: Restore map_rom fallback
        mmc: core: sdio: hold retuning if sdio in 1-bit mode
        mmc: core: Capture correct oemid-bits for eMMC cards
        Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
        pNFS: Fix a hang in nfs4_evict_inode()
        ACPI: irq: Fix incorrect return value in acpi_register_gsi()
        nvme-pci: add BOGUS_NID for Intel 0a54 device
        nvme-rdma: do not try to stop unallocated queues
        USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
        USB: serial: option: add entry for Sierra EM9191 with new firmware
        USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
        perf: Disallow mis-matched inherited group reads
        s390/pci: fix iommu bitmap allocation
        platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
        platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
        gpio: vf610: set value before the direction to avoid a glitch
        ASoC: pxa: fix a memory leak in probe()
        phy: mapphone-mdm6600: Fix runtime disable on probe
        phy: mapphone-mdm6600: Fix runtime PM for remove
        phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
        Bluetooth: hci_sock: fix slab oob read in create_monitor_event
        Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
        xfrm6: fix inet6_dev refcount underflow problem
        Linux 5.10.199

NOTE, this reverts the following commits in order to apply things
cleanly and avoid ABI breakage.  Due to the complexity involved,
individual reverts would not work properly:
        fc778e9d79 xhci: track port suspend state correctly in unsuccessful resume cases
        1c034c6e22 xhci: decouple usb2 port resume and get_port_status request handling
        92088dd886 xhci: clear usb2 resume related variables in one place.
        e7abc4b18d xhci: rename resume_done to resume_timestamp
        d44c9285ce xhci: move port specific items such as state completions to port structure
        e2b4de13e5 xhci: cleanup xhci_hub_control port references
        489818719a arm64: armv8_deprecated: fix unused-function error
        da7603cedb arm64: armv8_deprecated: rework deprected instruction handling
        45a26d2a53 arm64: armv8_deprecated: move aarch32 helper earlier
        0b6a7a9f6d arm64: armv8_deprecated move emulation functions
        2202536144 arm64: armv8_deprecated: fold ops into insn_emulation
        5aa232345e arm64: rework EL0 MRS emulation
        15e964971f arm64: factor insn read out of call_undef_hook()
        0edde7fd1c arm64: factor out EL1 SSBS emulation hook
        7a76df1ae1 arm64: split EL0/EL1 UNDEF handlers
        8a8d4cc303 arm64: allow kprobes on EL0 handlers
        793ed958b6 arm64: rework BTI exception handling
        9113333d7c arm64: rework FPAC exception handling
        a8d7c8484f arm64: consistently pass ESR_ELx to die()
        004bdab6ed arm64: die(): pass 'err' as long
        835cb1f78d arm64: report EL1 UNDEFs better

Change-Id: I54f6d79ae4886b808d6e3c017343f1f25c5254c3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-10-27 11:58:41 +00:00
Greg Kroah-Hartman
3414e62421 This is the 5.10.197 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmUOqXUACgkQONu9yGCS
 aT61cQ//eD8Xrytp1SrUZNpXeCF3d6Ih6wk7it7jJa9rSuFJa/yq3RG1Eni19FNs
 eZodcbmdNz6H27vonI7XDVemlkWWw0g/6JTZAwZho93Nnolz4qS88UqWWLmKYcs5
 rpAkVFgMFcS4HnL/YG6DY3GP6lsbhyummySFnfzXncfJbX3GN/mRk/YzCvziLjr5
 +cwwMUW+kkd5VUSssxrLS0VHSRW25SL+JLGRweQwePlMm8H+WTFpQSPeU5mu2gPM
 b4kFtAKAk2gzH1JzNJSz6mTM3dtAVFcu+3wAY+NSb4VfSB409rB0YI7ne1Ia6mC9
 TQ3qnfo05JYj5HiglE3QMuamfVuPt2mUwpo7I278fVBwbZo9cDXruVZ9099dVzAc
 B0O+xVvGwC6h6rwIKMfh9mzPtULO1CrHlxEVzSLO2szNMAiQk2+hMZDIKbvpBd59
 D08TFP4C4ffCT1K0mWDDhJpp7t37kMumZcB6JiNjYR0YUeDRMhFd4L8oHV5ENfdP
 FvIEwCOl/D69DsgmKq1jV33kspqoUfxyxs6MjJ44/0aQyKk1EoemMxkgrAwBDasn
 P3KNmShfR7XIgqUz1OX27PAnMDMLZj2DiSSbTyWEUOmfaR/TbaZ04fkHQxWfPfFX
 RIa2SFBop87mBfl8H0rhbic0ggQ4c8Io0xiks62pRvXdbcYfNZs=
 =Pws3
 -----END PGP SIGNATURE-----

Merge 5.10.197 into android12-5.10-lts

Changes in 5.10.197
	autofs: fix memory leak of waitqueues in autofs_catatonic_mode
	btrfs: output extra debug info if we failed to find an inline backref
	locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
	ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
	kernel/fork: beware of __put_task_struct() calling context
	rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()
	scftorture: Forgive memory-allocation failure if KASAN
	ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
	perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
	ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
	hw_breakpoint: fix single-stepping when using bpf_overflow_handler
	devlink: remove reload failed checks in params get/set callbacks
	crypto: lrw,xts - Replace strlcpy with strscpy
	wifi: ath9k: fix fortify warnings
	wifi: ath9k: fix printk specifier
	wifi: mwifiex: fix fortify warning
	wifi: wil6210: fix fortify warnings
	crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
	tpm_tis: Resend command to recover from data transfer errors
	mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
	alx: fix OOB-read compiler warning
	netfilter: ebtables: fix fortify warnings in size_entry_mwt()
	wifi: mac80211_hwsim: drop short frames
	drm/bridge: tc358762: Instruct DSI host to generate HSE packets
	samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'
	ALSA: hda: intel-dsp-cfg: add LunarLake support
	drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
	bus: ti-sysc: Configure uart quirks for k3 SoC
	md: raid1: fix potential OOB in raid1_remove_disk()
	ext2: fix datatype of block number in ext2_xattr_set2()
	fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
	jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
	powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
	media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
	media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
	media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
	media: anysee: fix null-ptr-deref in anysee_master_xfer
	media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
	media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
	media: tuners: qt1010: replace BUG_ON with a regular error
	media: pci: cx23885: replace BUG with error return
	usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
	scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
	serial: cpm_uart: Avoid suspicious locking
	media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
	kobject: Add sanity check for kset->kobj.ktype in kset_register()
	mtd: rawnand: brcmnand: Allow SoC to provide I/O operations
	mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
	perf jevents: Make build dependency on test JSONs
	perf tools: Add an option to build without libbfd
	btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
	btrfs: add a helper to read the superblock metadata_uuid
	btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
	drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
	scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
	selftests: tracing: Fix to unmount tracefs for recovering environment
	scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
	x86/boot/compressed: Reserve more memory for page tables
	samples/hw_breakpoint: fix building without module unloading
	md/raid1: fix error: ISO C90 forbids mixed declarations
	attr: block mode changes of symlinks
	ovl: fix incorrect fdput() on aio completion
	btrfs: fix lockdep splat and potential deadlock after failure running delayed items
	btrfs: release path before inode lookup during the ino lookup ioctl
	drm/amdgpu: fix amdgpu_cs_p1_user_fence
	net/sched: Retire rsvp classifier
	proc: fix a dentry lock race between release_task and lookup
	mm/filemap: fix infinite loop in generic_file_buffered_read()
	drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma
	tracing: Have current_trace inc the trace array ref count
	tracing: Have option files inc the trace array ref count
	nfsd: fix change_info in NFSv4 RENAME replies
	tracefs: Add missing lockdown check to tracefs_create_dir()
	i2c: aspeed: Reset the i2c controller when timeout occurs
	ata: libata: disallow dev-initiated LPM transitions to unsupported states
	scsi: megaraid_sas: Fix deadlock on firmware crashdump
	scsi: pm8001: Setup IRQs on resume
	ext4: fix rec_len verify error
	Linux 5.10.197

Change-Id: Ic8626d7d13ec54d438c4d80efe1f8b6bddeb84a8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-10-26 17:52:15 +00:00
Jeff Layton
b4fcf1a0bb overlayfs: set ctime when setting mtime and atime
[ Upstream commit 03dbab3bba5f009d053635c729d1244f2c8bad38 ]

Nathan reported that he was seeing the new warning in
setattr_copy_mgtime pop when starting podman containers. Overlayfs is
trying to set the atime and mtime via notify_change without also
setting the ctime.

POSIX states that when the atime and mtime are updated via utimes() that
we must also update the ctime to the current time. The situation with
overlayfs copy-up is analogies, so add ATTR_CTIME to the bitmask.
notify_change will fill in the value.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Christian Brauner <brauner@kernel.org>
Acked-by: Amir Goldstein <amir73il@gmail.com>
Message-Id: <20230913-ctime-v1-1-c6bc509cbc27@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-10-25 11:54:23 +02:00
Amir Goldstein
c6422e6f17 ovl: fix incorrect fdput() on aio completion
commit 724768a39374d35b70eaeae8dd87048a2ec7ae8e upstream.

ovl_{read,write}_iter() always call fdput(real) to put one or zero
refcounts of the real file, but for aio, whether it was submitted or not,
ovl_aio_put() also calls fdput(), which is not balanced.  This is only a
problem in the less common case when FDPUT_FPUT flag is set.

To fix the problem use get_file() to take file refcount and use fput()
instead of fdput() in ovl_aio_put().

Fixes: 2406a307ac ("ovl: implement async IO routines")
Cc: <stable@vger.kernel.org> # v5.6
Reviewed-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-23 11:01:09 +02:00
Greg Kroah-Hartman
8026d5839b This is the 5.10.195 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmUJdfMACgkQONu9yGCS
 aT7i/w//Wbvt3F9hF/9Rmg9A4J23OWl2o07Z8Fi0a4F4B0FJjuQGSPRvpSvKtIWv
 +7taCzOw9+Qi52hTR7BK+QpLpEPgMbv1IdgyPu1gtjL4WHuKk1aOeafISYuQDgeZ
 XSFoV1EGjxkg3wbMZkucnmQVitGxC/iV0ojvxKleiIE9UNzceQclGmmBL0FwmEYp
 c91XKEACZ5K/spSyyxocP4Fw6mbk98ISiju+74op5EDFry9qnIYa2pU/au3gZvh/
 TScOYOQsBojOFTy/wuEfpOiVBK9gLFq8du0J/gHS2aUqswkp/qFcpH7wbS5Po3+l
 Ja9a76o2B4btMCz6UhyhwzB+0QTQ1Gdea35FHRbF3d4ssNJDqDtwBCHqd3zeMUYo
 uTDhyTsSGV40Gm9A5Sojyzjgj4X12rQ0ffL+zcXfXe60flE8SNIxR8DiIXPlAsC+
 pgNQ5l/HcdJE1abRoTkvpsptaT2sNXgwZZij+VOBI3Vp4wr61U69CfP/QWWPZZF5
 ECEh8ZDK1roiEyBjn6njqXmt5vbmNasgI5umgnNPBgKEB2OLXqox6rn9XK0qMJ+X
 /oiCaL9RveU/QL5qNvV6Z2beXPwT51Vdy8+bQBfb5bUFRGQcTVIWaBRG0ZIHeSGm
 pG10/VAnCGtNrC6M/HVGd0Wyih+ur65Jz/rNKbkMX69cvJuxPWk=
 =RAs8
 -----END PGP SIGNATURE-----

Merge 5.10.195 into android12-5.10-lts

Changes in 5.10.195
	erofs: ensure that the post-EOF tails are all zeroed
	ARM: pxa: remove use of symbol_get()
	mmc: au1xmmc: force non-modular build and remove symbol_get usage
	net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
	rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
	modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
	USB: serial: option: add Quectel EM05G variant (0x030e)
	USB: serial: option: add FOXCONN T99W368/T99W373 product
	usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
	usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
	HID: wacom: remove the battery when the EKR is off
	staging: rtl8712: fix race condition
	Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
	configfs: fix a race in configfs_lookup()
	serial: qcom-geni: fix opp vote on shutdown
	serial: sc16is7xx: fix broken port 0 uart init
	serial: sc16is7xx: fix bug when first setting GPIO direction
	firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
	fsi: master-ast-cf: Add MODULE_FIRMWARE macro
	nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
	nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
	pinctrl: amd: Don't show `Invalid config param` errors
	ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
	ARM: dts: imx: update sdma node name format
	ARM: dts: imx7s: Drop dma-apb interrupt-names
	ARM: dts: imx: Adjust dma-apbh node name
	ARM: dts: imx: Set default tuning step for imx7d usdhc
	phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
	media: pulse8-cec: handle possible ping error
	media: pci: cx23885: fix error handling for cx23885 ATSC boards
	9p: virtio: make sure 'offs' is initialized in zc_request
	ASoC: da7219: Flush pending AAD IRQ when suspending
	ASoC: da7219: Check for failure reading AAD IRQ events
	ethernet: atheros: fix return value check in atl1c_tso_csum()
	vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
	m68k: Fix invalid .section syntax
	s390/dasd: use correct number of retries for ERP requests
	s390/dasd: fix hanging device after request requeue
	fs/nls: make load_nls() take a const parameter
	ASoc: codecs: ES8316: Fix DMIC config
	ASoC: atmel: Fix the 8K sample parameter in I2SC master
	platform/x86: intel: hid: Always call BTNL ACPI method
	platform/x86: huawei-wmi: Silence ambient light sensor
	drm/amd/display: Exit idle optimizations before attempt to access PHY
	ovl: Always reevaluate the file signature for IMA
	ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
	security: keys: perform capable check only on privileged operations
	kprobes: Prohibit probing on CFI preamble symbol
	clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
	vmbus_testing: fix wrong python syntax for integer value comparison
	net: usb: qmi_wwan: add Quectel EM05GV2
	idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
	scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
	netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
	bnx2x: fix page fault following EEH recovery
	sctp: handle invalid error codes without calling BUG()
	scsi: storvsc: Always set no_report_opcodes
	ALSA: seq: oss: Fix racy open/close of MIDI devices
	tracing: Introduce pipe_cpumask to avoid race on trace_pipes
	platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
	net: Avoid address overwrite in kernel_connect
	udf: Check consistency of Space Bitmap Descriptor
	udf: Handle error when adding extent to a file
	Revert "net: macsec: preserve ingress frame ordering"
	reiserfs: Check the return value from __getblk()
	eventfd: Export eventfd_ctx_do_read()
	eventfd: prevent underflow for eventfd semaphores
	fs: Fix error checking for d_hash_and_lookup()
	tmpfs: verify {g,u}id mount options correctly
	selftests/harness: Actually report SKIP for signal tests
	refscale: Fix uninitalized use of wait_queue_head_t
	OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
	selftests/resctrl: Don't leak buffer in fill_cache()
	selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
	selftests/resctrl: Close perf value read fd on errors
	x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
	perf/imx_ddr: don't enable counter0 if none of 4 counters are used
	s390/pkey: fix/harmonize internal keyblob headers
	s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
	x86/efistub: Fix PCI ROM preservation in mixed mode
	cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
	bpftool: Use a local bpf_perf_event_value to fix accessing its fields
	bpf: Clear the probe_addr for uprobe
	tcp: tcp_enter_quickack_mode() should be static
	hwrng: nomadik - keep clock enabled while hwrng is registered
	regmap: rbtree: Use alloc_flags for memory allocations
	udp: re-score reuseport groups when connected sockets are present
	bpf: reject unhashed sockets in bpf_sk_assign
	wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
	spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
	can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
	wifi: mwifiex: Fix OOB and integer underflow when rx packets
	wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
	selftests/bpf: fix static assert compilation issue for test_cls_*.c
	crypto: stm32 - Properly handle pm_runtime_get failing
	crypto: api - Use work queue in crypto_destroy_instance
	Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
	Bluetooth: Fix potential use-after-free when clear keys
	net: tcp: fix unexcepted socket die when snd_wnd is 0
	selftests/bpf: Clean up fmod_ret in bench_rename test script
	ice: ice_aq_check_events: fix off-by-one check when filling buffer
	crypto: caam - fix unchecked return value error
	hwrng: iproc-rng200 - Implement suspend and resume calls
	lwt: Fix return values of BPF xmit ops
	lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
	fs: ocfs2: namei: check return value of ocfs2_add_entry()
	wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
	wifi: mwifiex: Fix missed return in oob checks failed path
	samples/bpf: fix broken map lookup probe
	wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
	wifi: ath9k: protect WMI command response buffer replacement with a lock
	wifi: mwifiex: avoid possible NULL skb pointer dereference
	Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
	wifi: ath9k: use IS_ERR() with debugfs_create_dir()
	net: arcnet: Do not call kfree_skb() under local_irq_disable()
	mlxsw: i2c: Fix chunk size setting in output mailbox buffer
	mlxsw: i2c: Limit single transaction buffer size
	hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
	net/sched: sch_hfsc: Ensure inner classes have fsc curve
	netrom: Deny concurrent connect().
	drm/bridge: tc358764: Fix debug print parameter order
	quota: factor out dquot_write_dquot()
	quota: rename dquot_active() to inode_quota_active()
	quota: add new helper dquot_active()
	quota: fix dqput() to follow the guarantees dquot_srcu should provide
	ASoC: stac9766: fix build errors with REGMAP_AC97
	soc: qcom: ocmem: Add OCMEM hardware version print
	soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
	arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
	drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
	ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
	ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
	ARM: dts: BCM53573: Drop nonexistent #usb-cells
	ARM: dts: BCM53573: Add cells sizes to PCIe node
	ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
	drm/etnaviv: fix dumping of active MMU context
	x86/mm: Fix PAT bit missing from page protection modify mask
	ARM: dts: s3c64xx: align pinctrl with dtschema
	ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
	ARM: dts: s5pv210: adjust node names to DT spec
	ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
	ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
	drm: adv7511: Fix low refresh rate register for ADV7533/5
	ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
	arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
	arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
	drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
	md/bitmap: don't set max_write_behind if there is no write mostly device
	md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
	drm/tegra: Remove superfluous error messages around platform_get_irq()
	drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
	of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
	drm/armada: Fix off-by-one error in armada_overlay_get_property()
	drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
	ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
	drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
	drm/msm/mdp5: Don't leak some plane state
	firmware: meson_sm: fix to avoid potential NULL pointer dereference
	smackfs: Prevent underflow in smk_set_cipso()
	drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
	drm/msm/a2xx: Call adreno_gpu_init() earlier
	audit: fix possible soft lockup in __audit_inode_child()
	bus: ti-sysc: Fix build warning for 64-bit build
	drm/mediatek: Fix potential memory leak if vmap() fail
	bus: ti-sysc: Fix cast to enum warning
	of: unittest: Fix overlay type in apply/revert check
	ALSA: ac97: Fix possible error value of *rac97
	ipmi:ssif: Add check for kstrdup
	ipmi:ssif: Fix a memory leak when scanning for an adapter
	drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
	clk: sunxi-ng: Modify mismatched function name
	clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
	clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
	ext4: correct grp validation in ext4_mb_good_group
	clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
	clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
	clk: qcom: reset: Use the correct type of sleep/delay based on length
	PCI: Mark NVIDIA T4 GPUs to avoid bus reset
	pinctrl: mcp23s08: check return value of devm_kasprintf()
	PCI: pciehp: Use RMW accessors for changing LNKCTL
	PCI/ASPM: Use RMW accessors for changing LNKCTL
	clk: imx8mp: fix sai4 clock
	clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
	vfio/type1: fix cap_migration information leak
	powerpc/fadump: reset dump area size if fadump memory reserve fails
	powerpc/perf: Convert fsl_emb notifier to state machine callbacks
	drm/amdgpu: Use RMW accessors for changing LNKCTL
	drm/radeon: Use RMW accessors for changing LNKCTL
	net/mlx5: Use RMW accessors for changing LNKCTL
	wifi: ath10k: Use RMW accessors for changing LNKCTL
	powerpc: Don't include lppaca.h in paca.h
	powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
	nfs/blocklayout: Use the passed in gfp flags
	powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
	jfs: validate max amount of blocks before allocation.
	fs: lockd: avoid possible wrong NULL parameter
	NFSD: da_addr_body field missing in some GETDEVICEINFO replies
	NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
	NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
	media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
	media: i2c: tvp5150: check return value of devm_kasprintf()
	media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
	drivers: usb: smsusb: fix error handling code in smsusb_init_device
	media: dib7000p: Fix potential division by zero
	media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
	media: cx24120: Add retval check for cx24120_message_send()
	scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
	scsi: libsas: Introduce more SAM status code aliases in enum exec_status
	scsi: hisi_sas: Modify v3 HW SSP underflow error processing
	scsi: hisi_sas: Modify v3 HW SATA completion error processing
	scsi: hisi_sas: Fix warnings detected by sparse
	scsi: hisi_sas: Fix normally completed I/O analysed as failed
	media: rkvdec: increase max supported height for H.264
	media: mediatek: vcodec: Return NULL if no vdec_fb is found
	usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
	scsi: RDMA/srp: Fix residual handling
	scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
	scsi: iscsi: Add length check for nlattr payload
	scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
	scsi: be2iscsi: Add length check when parsing nlattrs
	scsi: qla4xxx: Add length check when parsing nlattrs
	serial: sprd: Assign sprd_port after initialized to avoid wrong access
	serial: sprd: Fix DMA buffer leak issue
	x86/APM: drop the duplicate APM_MINOR_DEV macro
	scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
	scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
	scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
	coresight: tmc: Explicit type conversions to prevent integer overflow
	dma-buf/sync_file: Fix docs syntax
	driver core: test_async: fix an error code
	IB/uverbs: Fix an potential error pointer dereference
	fsi: aspeed: Reset master errors after CFAM reset
	iommu/qcom: Disable and reset context bank before programming
	iommu/vt-d: Fix to flush cache of PASID directory table
	media: go7007: Remove redundant if statement
	USB: gadget: f_mass_storage: Fix unused variable warning
	media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
	media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
	media: ov2680: Remove auto-gain and auto-exposure controls
	media: ov2680: Fix ov2680_bayer_order()
	media: ov2680: Fix vflip / hflip set functions
	media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
	cgroup:namespace: Remove unused cgroup_namespaces_init()
	scsi: core: Use 32-bit hostnum in scsi_host_lookup()
	scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
	serial: tegra: handle clk prepare error in tegra_uart_hw_init()
	amba: bus: fix refcount leak
	Revert "IB/isert: Fix incorrect release of isert connection"
	RDMA/siw: Balance the reference of cep->kref in the error path
	RDMA/siw: Correct wrong debug message
	HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
	HID: multitouch: Correct devm device reference for hidinput input_dev name
	x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
	tracing: Fix race issue between cpu buffer write and swap
	mtd: rawnand: brcmnand: Fix mtd oobsize
	phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
	phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
	phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
	rpmsg: glink: Add check for kstrdup
	mtd: spi-nor: Check bus width while setting QE bit
	mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
	um: Fix hostaudio build errors
	dmaengine: ste_dma40: Add missing IRQ check in d40_probe
	cpufreq: Fix the race condition while updating the transition_task of policy
	virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
	igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
	netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
	netfilter: xt_u32: validate user space input
	netfilter: xt_sctp: validate the flag_info count
	skbuff: skb_segment, Call zero copy functions before using skbuff frags
	igb: set max size RX buffer when store bad packet is enabled
	PM / devfreq: Fix leak in devfreq_dev_release()
	ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
	printk: ringbuffer: Fix truncating buffer size min_t cast
	scsi: core: Fix the scsi_set_resid() documentation
	ipmi_si: fix a memleak in try_smi_init()
	ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
	backlight/gpio_backlight: Compare against struct fb_info.device
	backlight/bd6107: Compare against struct fb_info.device
	backlight/lv5207lp: Compare against struct fb_info.device
	xtensa: PMU: fix base address for the newer hardware
	arm64: csum: Fix OoB access in IP checksum code for negative lengths
	media: dvb: symbol fixup for dvb_attach()
	Revert "scsi: qla2xxx: Fix buffer overrun"
	scsi: mpt3sas: Perform additional retries if doorbell read returns 0
	ntb: Drop packets when qp link is down
	ntb: Clean up tx tail index on link down
	ntb: Fix calculation ntb_transport_tx_free_entry()
	Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
	procfs: block chmod on /proc/thread-self/comm
	parisc: Fix /proc/cpuinfo output for lscpu
	dlm: fix plock lookup when using multiple lockspaces
	dccp: Fix out of bounds access in DCCP error handler
	X.509: if signature is unsupported skip validation
	net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
	fsverity: skip PKCS#7 parser when keyring is empty
	pstore/ram: Check start of empty przs during init
	s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
	crypto: stm32 - fix loop iterating through scatterlist for DMA
	cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
	usb: typec: bus: verify partner exists in typec_altmode_attention
	USB: core: Unite old scheme and new scheme descriptor reads
	USB: core: Change usb_get_device_descriptor() API
	USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
	USB: core: Fix oversight in SuperSpeed initialization
	usb: typec: tcpci: clear the fault status bit
	tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
	md/md-bitmap: remove unnecessary local variable in backlog_store()
	udf: initialize newblock to 0
	net/ipv6: SKB symmetric hash should incorporate transport ports
	io_uring: always lock in io_apoll_task_func
	io_uring: break out of iowq iopoll on teardown
	io_uring: break iopolling on signal
	scsi: qla2xxx: Fix deletion race condition
	scsi: qla2xxx: fix inconsistent TMF timeout
	scsi: qla2xxx: Fix erroneous link up failure
	scsi: qla2xxx: Turn off noisy message log
	scsi: qla2xxx: Remove unsupported ql2xenabledif option
	fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
	drm/ast: Fix DRAM init on AST2200
	lib/test_meminit: allocate pages up to order MAX_ORDER
	parisc: led: Fix LAN receive and transmit LEDs
	parisc: led: Reduce CPU overhead for disk & lan LED computation
	pinctrl: cherryview: fix address_space_handler() argument
	dt-bindings: clock: xlnx,versal-clk: drop select:false
	clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
	clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
	soc: qcom: qmi_encdec: Restrict string length in decode
	NFS: Fix a potential data corruption
	NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
	kconfig: fix possible buffer overflow
	backlight: gpio_backlight: Drop output GPIO direction check for initial power state
	perf annotate bpf: Don't enclose non-debug code with an assert()
	x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
	perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
	watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
	pwm: lpc32xx: Remove handling of PWM channels
	net/sched: fq_pie: avoid stalls in fq_pie_timer()
	sctp: annotate data-races around sk->sk_wmem_queued
	ipv4: annotate data-races around fi->fib_dead
	net: read sk->sk_family once in sk_mc_loop()
	drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
	drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
	ipv4: ignore dst hint for multipath routes
	igb: disable virtualization features on 82580
	veth: Fixing transmit return status for dropped packets
	net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
	af_unix: Fix data-races around user->unix_inflight.
	af_unix: Fix data-race around unix_tot_inflight.
	af_unix: Fix data-races around sk->sk_shutdown.
	af_unix: Fix data race around sk->sk_err.
	net: sched: sch_qfq: Fix UAF in qfq_dequeue()
	kcm: Destroy mutex in kcm_exit_net()
	igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
	igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
	igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
	s390/zcrypt: don't leak memory if dev_set_name() fails
	idr: fix param name in idr_alloc_cyclic() doc
	ip_tunnels: use DEV_STATS_INC()
	net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
	net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
	netfilter: nfnetlink_osf: avoid OOB read
	net: hns3: fix the port information display when sfp is absent
	sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
	ext4: add correct group descriptors and reserved GDT blocks to system zone
	ata: sata_gemini: Add missing MODULE_DESCRIPTION
	ata: pata_ftide010: Add missing MODULE_DESCRIPTION
	fuse: nlookup missing decrement in fuse_direntplus_link
	btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
	btrfs: use the correct superblock to compare fsid in btrfs_validate_super
	mtd: rawnand: brcmnand: Fix crash during the panic_write
	mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
	mtd: rawnand: brcmnand: Fix potential false time out warning
	drm/amd/display: prevent potential division by zero errors
	perf hists browser: Fix hierarchy mode header
	perf tools: Handle old data in PERF_RECORD_ATTR
	perf hists browser: Fix the number of entries for 'e' key
	ACPI: APEI: explicit init of HEST and GHES in apci_init()
	arm64: sdei: abort running SDEI handlers during crash
	scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
	scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
	scsi: qla2xxx: Fix crash in PCIe error handling
	scsi: qla2xxx: Flush mailbox commands on chip reset
	ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
	ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
	bus: mhi: host: Skip MHI reset if device is in RDDM
	net: ipv4: fix one memleak in __inet_del_ifa()
	selftests/kselftest/runner/run_one(): allow running non-executable files
	kselftest/runner.sh: Propagate SIGTERM to runner child
	net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
	net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
	net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
	hsr: Fix uninit-value access in fill_frame_info()
	r8152: check budget for r8152_poll()
	kcm: Fix memory leak in error path of kcm_sendmsg()
	platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
	platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
	net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
	ipv6: fix ip6_sock_set_addr_preferences() typo
	ixgbe: fix timestamp configuration code
	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
	drm/amd/display: Fix a bug when searching for insert_above_mpcc
	parisc: Drop loops_per_jiffy from per_cpu struct
	Linux 5.10.195

Change-Id: I4eef618f573b6d4201e05c9cf56088d77d712d97
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-09-19 11:32:32 +00:00
Eric Snowberg
331d85f0bc ovl: Always reevaluate the file signature for IMA
[ Upstream commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 ]

Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version")
partially closed an IMA integrity issue when directly modifying a file
on the lower filesystem.  If the overlay file is first opened by a user
and later the lower backing file is modified by root, but the extended
attribute is NOT updated, the signature validation succeeds with the old
original signature.

Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to
force signature reevaluation on every file access until a fine grained
solution can be found.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-19 12:20:05 +02:00
Greg Kroah-Hartman
b23fd871be Merge 5.10.192 into android12-5.10-lts
Changes in 5.10.192
	mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
	macsec: Fix traffic counters/statistics
	macsec: use DEV_STATS_INC()
	net/mlx5: Refactor init clock function
	net/mlx5: Move all internal timer metadata into a dedicated struct
	net/mlx5: Skip clock update work when device is in error state
	drm/radeon: Fix integer overflow in radeon_cs_parser_init
	ALSA: emu10k1: roll up loops in DSP setup code for Audigy
	ASoC: Intel: sof_sdw: add quirk for MTL RVP
	ASoC: Intel: sof_sdw: add quirk for LNL RVP
	PCI: tegra194: Fix possible array out of bounds access
	ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
	ASoC: Intel: sof_sdw: Add support for Rex soundwire
	iopoll: Call cpu_relax() in busy loops
	quota: Properly disable quotas when add_dquot_ref() fails
	quota: fix warning in dqgrab()
	dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
	drm/amdgpu: install stub fence into potential unused fence pointers
	HID: add quirk for 03f0:464a HP Elite Presenter Mouse
	RDMA/mlx5: Return the firmware result upon destroying QP/RQ
	ovl: check type and offset of struct vfsmount in ovl_entry
	udf: Fix uninitialized array access for some pathnames
	fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
	MIPS: dec: prom: Address -Warray-bounds warning
	FS: JFS: Fix null-ptr-deref Read in txBegin
	FS: JFS: Check for read-only mounted filesystem in txBegin
	media: v4l2-mem2mem: add lock to protect parameter num_rdy
	usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
	media: platform: mediatek: vpu: fix NULL ptr dereference
	usb: chipidea: imx: don't request QoS for imx8ulp
	usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
	gfs2: Fix possible data races in gfs2_show_options()
	pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
	Bluetooth: L2CAP: Fix use-after-free
	Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
	drm/amdgpu: Fix potential fence use-after-free v2
	ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
	ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
	powerpc/kasan: Disable KCOV in KASAN code
	ring-buffer: Do not swap cpu_buffer during resize process
	IMA: allow/fix UML builds
	iio: add addac subdirectory
	dt-bindings: iio: add AD74413R
	iio: adc: stx104: Utilize iomap interface
	iio: adc: stx104: Implement and utilize register structures
	iio: addac: stx104: Fix race condition for stx104_write_raw()
	iio: addac: stx104: Fix race condition when converting analog-to-digital
	bus: mhi: Add MHI PCI support for WWAN modems
	bus: mhi: Add MMIO region length to controller structure
	bus: mhi: Move host MHI code to "host" directory
	bus: mhi: host: Range check CHDBOFF and ERDBOFF
	irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
	irqchip/mips-gic: Use raw spinlock for gic_lock
	usb: gadget: udc: core: Introduce check_config to verify USB configuration
	usb: cdns3: allocate TX FIFO size according to composite EP number
	usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
	USB: dwc3: qcom: fix NULL-deref on suspend
	mmc: bcm2835: fix deferred probing
	mmc: sunxi: fix deferred probing
	mmc: core: add devm_mmc_alloc_host
	mmc: meson-gx: use devm_mmc_alloc_host
	mmc: meson-gx: fix deferred probing
	tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs
	tracing/probes: Fix to update dynamic data counter if fetcharg uses it
	virtio-mmio: Use to_virtio_mmio_device() to simply code
	virtio-mmio: don't break lifecycle of vm_dev
	i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
	fbdev: mmp: fix value check in mmphw_probe()
	powerpc/rtas_flash: allow user copy to flash block cache objects
	tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
	tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
	btrfs: fix BUG_ON condition in btrfs_cancel_balance
	i2c: designware: Handle invalid SMBus block data response length value
	net: xfrm: Fix xfrm_address_filter OOB read
	net: af_key: fix sadb_x_filter validation
	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
	xfrm: fix slab-use-after-free in decode_session6
	ip6_vti: fix slab-use-after-free in decode_session6
	ip_vti: fix potential slab-use-after-free in decode_session6
	xfrm: add NULL check in xfrm_update_ae_params
	xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
	selftests: mirror_gre_changes: Tighten up the TTL test match
	drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
	ipvs: fix racy memcpy in proc_do_sync_threshold
	netfilter: nft_dynset: disallow object maps
	net: phy: broadcom: stub c45 read/write for 54810
	team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
	i40e: fix misleading debug logs
	net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
	sock: Fix misuse of sk_under_memory_pressure()
	net: do not allow gso_size to be set to GSO_BY_FRAGS
	bus: ti-sysc: Flush posted write on enable before reset
	arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4
	arm64: dts: rockchip: use USB host by default on rk3399-rock-pi-4
	arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
	arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
	arm64: dts: rockchip: fix regulator name on rk3399-rock-4
	arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4
	arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
	ASoC: rt5665: add missed regulator_bulk_disable
	ASoC: meson: axg-tdm-formatter: fix channel slot allocation
	ALSA: hda/realtek - Remodified 3k pull low procedure
	serial: 8250: Fix oops for port->pm on uart_change_pm()
	ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
	cifs: Release folio lock on fscache read hit.
	mmc: wbsd: fix double mmc_free_host() in wbsd_init()
	mmc: block: Fix in_flight[issue_type] value error
	netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
	af_unix: Fix null-ptr-deref in unix_stream_sendpage().
	virtio-net: set queues after driver_ok
	net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
	mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
	x86/cpu: Fix __x86_return_thunk symbol type
	x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
	x86/alternative: Make custom return thunk unconditional
	objtool: Add frame-pointer-specific function ignore
	x86/ibt: Add ANNOTATE_NOENDBR
	x86/cpu: Clean up SRSO return thunk mess
	x86/cpu: Rename original retbleed methods
	x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
	x86/cpu: Cleanup the untrain mess
	x86/srso: Explain the untraining sequences a bit more
	x86/static_call: Fix __static_call_fixup()
	x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
	x86/CPU/AMD: Fix the DIV(0) initial fix attempt
	x86/srso: Disable the mitigation on unaffected configurations
	x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
	objtool/x86: Fixup frame-pointer vs rethunk
	x86/srso: Correct the mitigation status when SMT is disabled
	Linux 5.10.192

Change-Id: Id6dcc6748bce39baa640b8f0c3764d1d95643016
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-28 17:10:38 +00:00
Christian Brauner
a2966e0436 ovl: check type and offset of struct vfsmount in ovl_entry
[ Upstream commit f723edb8a532cd26e1ff0a2b271d73762d48f762 ]

Porting overlayfs to the new amount api I started experiencing random
crashes that couldn't be explained easily. So after much debugging and
reasoning it became clear that struct ovl_entry requires the point to
struct vfsmount to be the first member and of type struct vfsmount.

During the port I added a new member at the beginning of struct
ovl_entry which broke all over the place in the form of random crashes
and cache corruptions. While there's a comment in ovl_free_fs() to the
effect of "Hack! Reuse ofs->layers as a vfsmount array before freeing
it" there's no such comment on struct ovl_entry which makes this easy to
trip over.

Add a comment and two static asserts for both the offset and the type of
pointer in struct ovl_entry.

Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-26 15:26:44 +02:00
Greg Kroah-Hartman
477f5e6b9e This is the 5.10.188 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmTCEmYACgkQONu9yGCS
 aT5ETA/+MGhe+GasO74Gvx1MaSVJrPZgPzInUg5UoYIkf+N3BfNqH9KVrY/zFKfU
 mKNQSQDsli+WG8agHVzoa4lh3ZFHbiUrNx14n+3A8lZ0X5s31fqTLXRvKy9BCu4t
 8OQW6nuMv22SVDd40F5ciroNmAbDquDfUQK4KbETNRPU2Yzvd5VEZiCY9aQAGFbc
 YnqBbx1Qc5EQKmzoBmEiup2j04SWXwMPQERKdFVZ1jrjC3hC8MFmL62YwfbCH4gY
 faDSZPj++/V5c++bP6oG8QhfrQS+WYGwFmEJpf4GUJ8dxxJC9Ao9CwcXbd2jOjfz
 Tk0gNQ9YPs+a2gexAnaHsJqKXn+dcRvkIMzmArApZv73PET0LgMv8N7s3OB5E9ei
 K2ft+nfXs5NCLRjPFCqL9nAeclj8ZX92B4d4mrpbqHZ+fFBiHMb0H/aGxfCAR0MJ
 BuW1dWQJykR2crhzQ1PJr3OthnL9O4Nl+bBAAuOu6NwqiALFW57uKXQ/2xfhPPbI
 qi0cTyXNYYY28kRdprERyV1w4K8W8V6L2YUt3N8LWuPNsI9pHSSQQDKru2JIR1T5
 rHeC41JSR6iw8rBXtkCj1YhGbH5P8CP3fxlikuKo3Q4PHCjVJo8ZpzYU/Ci8FFCL
 g/g6DLb9/AHtIhJ8WgcRcxbRNkdyGUc2w9uh6c3rBVS4gwFm/44=
 =2pvu
 -----END PGP SIGNATURE-----

Merge 5.10.188 into android12-5.10-lts

Changes in 5.10.188
	media: atomisp: fix "variable dereferenced before check 'asd'"
	x86/smp: Use dedicated cache-line for mwait_play_dead()
	can: isotp: isotp_sendmsg(): fix return error fix on TX path
	video: imsttfb: check for ioremap() failures
	fbdev: imsttfb: Fix use after free bug in imsttfb_probe
	HID: wacom: Use ktime_t rather than int when dealing with timestamps
	HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
	Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"
	scripts/tags.sh: Resolve gtags empty index generation
	drm/amdgpu: Validate VM ioctl flags.
	nubus: Partially revert proc_create_single_data() conversion
	fs: pipe: reveal missing function protoypes
	x86/resctrl: Only show tasks' pid in current pid namespace
	blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
	md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
	md/raid10: fix overflow of md/safe_mode_delay
	md/raid10: fix wrong setting of max_corr_read_errors
	md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
	md/raid10: fix io loss while replacement replace rdev
	irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
	irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
	posix-timers: Prevent RT livelock in itimer_delete()
	tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
	clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
	PM: domains: fix integer overflow issues in genpd_parse_state()
	perf/arm-cmn: Fix DTC reset
	powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
	ARM: 9303/1: kprobes: avoid missing-declaration warnings
	cpufreq: intel_pstate: Fix energy_performance_preference for passive
	thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
	rcuscale: Console output claims too few grace periods
	rcuscale: Always log error message
	rcuscale: Move shutdown from wait_event() to wait_event_idle()
	rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
	rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
	perf/ibs: Fix interface via core pmu events
	x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
	evm: Complete description of evm_inode_setattr()
	ima: Fix build warnings
	pstore/ram: Add check for kstrdup
	igc: Enable and fix RX hash usage by netstack
	wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
	wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
	samples/bpf: Fix buffer overflow in tcp_basertt
	spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
	wifi: wilc1000: fix for absent RSN capabilities WFA testcase
	wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
	bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE
	sctp: add bpf_bypass_getsockopt proto callback
	libbpf: fix offsetof() and container_of() to work with CO-RE
	nfc: constify several pointers to u8, char and sk_buff
	nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
	bpftool: JIT limited misreported as negative value on aarch64
	regulator: core: Fix more error checking for debugfs_create_dir()
	regulator: core: Streamline debugfs operations
	wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
	wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
	wifi: atmel: Fix an error handling path in atmel_probe()
	wl3501_cs: Fix misspelling and provide missing documentation
	net: create netdev->dev_addr assignment helpers
	wl3501_cs: use eth_hw_addr_set()
	wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
	wifi: ray_cs: Utilize strnlen() in parse_addr()
	wifi: ray_cs: Drop useless status variable in parse_addr()
	wifi: ray_cs: Fix an error handling path in ray_probe()
	wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
	wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
	wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
	watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
	watchdog/perf: more properly prevent false positives with turbo modes
	kexec: fix a memory leak in crash_shrink_memory()
	memstick r592: make memstick_debug_get_tpc_name() static
	wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
	rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
	wifi: iwlwifi: pull from TXQs with softirqs disabled
	wifi: cfg80211: rewrite merging of inherited elements
	wifi: ath9k: convert msecs to jiffies where needed
	igc: Fix race condition in PTP tx code
	net: stmmac: fix double serdes powerdown
	netlink: fix potential deadlock in netlink_set_err()
	netlink: do not hard code device address lenth in fdb dumps
	selftests: rtnetlink: remove netdevsim device after ipsec offload test
	gtp: Fix use-after-free in __gtp_encap_destroy().
	net: axienet: Move reset before 64-bit DMA detection
	sfc: fix crash when reading stats while NIC is resetting
	nfc: llcp: simplify llcp_sock_connect() error paths
	net: nfc: Fix use-after-free caused by nfc_llcp_find_local
	lib/ts_bm: reset initial match offset for every block of text
	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
	netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
	ipvlan: Fix return value of ipvlan_queue_xmit()
	netlink: Add __sock_i_ino() for __netlink_diag_dump().
	radeon: avoid double free in ci_dpm_init()
	drm/amd/display: Explicitly specify update type per plane info change
	Input: drv260x - sleep between polling GO bit
	drm/bridge: tc358768: always enable HS video mode
	drm/bridge: tc358768: fix PLL parameters computation
	drm/bridge: tc358768: fix PLL target frequency
	drm/bridge: tc358768: fix TCLK_ZEROCNT computation
	drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
	drm/bridge: tc358768: fix TCLK_TRAILCNT computation
	drm/bridge: tc358768: fix THS_ZEROCNT computation
	drm/bridge: tc358768: fix TXTAGOCNT computation
	drm/bridge: tc358768: fix THS_TRAILCNT computation
	drm/vram-helper: fix function names in vram helper doc
	ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
	ARM: dts: meson8b: correct uart_B and uart_C clock references
	Input: adxl34x - do not hardcode interrupt trigger type
	drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
	drm/panel: sharp-ls043t1le01: adjust mode settings
	ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
	bus: ti-sysc: Fix dispc quirk masking bool variables
	arm64: dts: microchip: sparx5: do not use PSCI on reference boards
	RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
	RDMA/bnxt_re: Fix to remove unnecessary return labels
	RDMA/bnxt_re: Use unique names while registering interrupts
	RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
	RDMA/bnxt_re: Fix to remove an unnecessary log
	ARM: dts: gta04: Move model property out of pinctrl node
	arm64: dts: qcom: msm8916: correct camss unit address
	arm64: dts: qcom: msm8994: correct SPMI unit address
	arm64: dts: qcom: msm8996: correct camss unit address
	drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
	ARM: ep93xx: fix missing-prototype warnings
	ARM: omap2: fix missing tick_broadcast() prototype
	arm64: dts: qcom: apq8096: fix fixed regulator name property
	ARM: dts: stm32: Shorten the AV96 HDMI sound card name
	memory: brcmstb_dpfe: fix testing array offset after use
	ASoC: es8316: Increment max value for ALC Capture Target Volume control
	ASoC: es8316: Do not set rate constraints for unsupported MCLKs
	ARM: dts: meson8: correct uart_B and uart_C clock references
	soc/fsl/qe: fix usb.c build errors
	IB/hfi1: Use bitmap_zalloc() when applicable
	IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
	IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
	RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions
	RDMA/hns: Fix coding style issues
	RDMA/hns: Use refcount_t APIs for HEM
	RDMA/hns: Clean the hardware related code for HEM
	RDMA/hns: Fix hns_roce_table_get return value
	ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
	arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
	fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
	arm64: dts: ti: k3-j7200: Fix physical address of pin
	ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
	ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
	hwmon: (gsc-hwmon) fix fan pwm temperature scaling
	hwmon: (adm1275) enable adm1272 temperature reporting
	hwmon: (adm1275) Allow setting sample averaging
	hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
	ARM: dts: BCM5301X: fix duplex-full => full-duplex
	drm/amdkfd: Fix potential deallocation of previously deallocated memory.
	drm/radeon: fix possible division-by-zero errors
	amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
	RDMA/bnxt_re: wraparound mbox producer index
	RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
	clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
	clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
	clk: tegra: tegra124-emc: Fix potential memory leak
	ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
	drm/msm/dpu: do not enable color-management if DSPPs are not available
	drm/msm/dp: Free resources after unregistering them
	clk: vc5: check memory returned by kasprintf()
	clk: cdce925: check return value of kasprintf()
	clk: si5341: Allow different output VDD_SEL values
	clk: si5341: Add sysfs properties to allow checking/resetting device faults
	clk: si5341: return error if one synth clock registration fails
	clk: si5341: check return value of {devm_}kasprintf()
	clk: si5341: free unused memory on probe failure
	clk: keystone: sci-clk: check return value of kasprintf()
	clk: ti: clkctrl: check return value of kasprintf()
	drivers: meson: secure-pwrc: always enable DMA domain
	ovl: update of dentry revalidate flags after copy up
	ASoC: imx-audmix: check return value of devm_kasprintf()
	PCI: cadence: Fix Gen2 Link Retraining process
	scsi: qedf: Fix NULL dereference in error handling
	pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
	PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
	scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
	PCI: pciehp: Cancel bringup sequence if card is not present
	PCI: ftpci100: Release the clock resources
	PCI: Add pci_clear_master() stub for non-CONFIG_PCI
	perf bench: Use unbuffered output when pipe/tee'ing to a file
	perf bench: Add missing setlocale() call to allow usage of %'d style formatting
	pinctrl: cherryview: Return correct value if pin in push-pull mode
	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures
	perf script: Fixup 'struct evsel_script' method prefix
	perf script: Fix allocation of evsel->priv related to per-event dump files
	perf dwarf-aux: Fix off-by-one in die_get_varname()
	pinctrl: at91-pio4: check return value of devm_kasprintf()
	powerpc/powernv/sriov: perform null check on iov before dereferencing iov
	mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t *
	mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t *
	powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
	powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
	hwrng: virtio - add an internal buffer
	hwrng: virtio - don't wait on cleanup
	hwrng: virtio - don't waste entropy
	hwrng: virtio - always add a pending request
	hwrng: virtio - Fix race on data_avail and actual data
	crypto: nx - fix build warnings when DEBUG_FS is not enabled
	modpost: fix section mismatch message for R_ARM_ABS32
	modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
	crypto: marvell/cesa - Fix type mismatch warning
	modpost: fix off by one in is_executable_section()
	ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
	NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
	dax: Fix dax_mapping_release() use after free
	dax: Introduce alloc_dev_dax_id()
	hwrng: st - keep clock enabled while hwrng is registered
	io_uring: ensure IOPOLL locks around deferred work
	USB: serial: option: add LARA-R6 01B PIDs
	usb: dwc3: gadget: Propagate core init errors to UDC during pullup
	phy: tegra: xusb: Clear the driver reference in usb-phy dev
	block: fix signed int overflow in Amiga partition support
	block: change all __u32 annotations to __be32 in affs_hardblocks.h
	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
	w1: w1_therm: fix locking behavior in convert_t
	w1: fix loop in w1_fini()
	sh: j2: Use ioremap() to translate device tree address into kernel memory
	serial: 8250: omap: Fix freeing of resources on failed register
	clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
	media: usb: Check az6007_read() return value
	media: videodev2.h: Fix struct v4l2_input tuner index comment
	media: usb: siano: Fix warning due to null work_func_t function pointer
	clk: qcom: reset: Allow specifying custom reset delay
	clk: qcom: reset: support resetting multiple bits
	clk: qcom: ipq6018: fix networking resets
	usb: dwc3: qcom: Fix potential memory leak
	usb: gadget: u_serial: Add null pointer check in gserial_suspend
	extcon: Fix kernel doc of property fields to avoid warnings
	extcon: Fix kernel doc of property capability fields to avoid warnings
	usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
	usb: hide unused usbfs_notify_suspend/resume functions
	serial: 8250: lock port for stop_rx() in omap8250_irq()
	serial: 8250: lock port for UART_IER access in omap8250_irq()
	kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
	coresight: Fix loss of connection info when a module is unloaded
	mfd: rt5033: Drop rt5033-battery sub-device
	media: venus: helpers: Fix ALIGN() of non power of two
	media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
	KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
	usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
	usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
	usb: common: usb-conn-gpio: Set last role to unknown before initial detection
	usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
	mfd: intel-lpss: Add missing check for platform_get_resource
	Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection"
	serial: 8250_omap: Use force_suspend and resume for system suspend
	test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
	mfd: stmfx: Fix error path in stmfx_chip_init
	mfd: stmfx: Nullify stmfx->vdd in case of error
	KVM: s390: vsie: fix the length of APCB bitmap
	mfd: stmpe: Only disable the regulators if they are enabled
	phy: tegra: xusb: check return value of devm_kzalloc()
	pwm: imx-tpm: force 'real_period' to be zero in suspend
	pwm: sysfs: Do not apply state to already disabled PWMs
	rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
	media: cec: i2c: ch7322: also select REGMAP
	sctp: fix potential deadlock on &net->sctp.addr_wq_lock
	Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
	net: dsa: vsc73xx: fix MTU configuration
	spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
	mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
	f2fs: fix error path handling in truncate_dnode()
	octeontx2-af: Fix mapping for NIX block from CGX connection
	powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
	tcp: annotate data races in __tcp_oow_rate_limited()
	xsk: Honor SO_BINDTODEVICE on bind
	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
	pptp: Fix fib lookup calls.
	net: dsa: tag_sja1105: fix MAC DA patching from meta frames
	s390/qeth: Fix vipa deletion
	sh: dma: Fix DMA channel offset calculation
	apparmor: fix missing error check for rhashtable_insert_fast
	i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
	i2c: xiic: Don't try to handle more interrupt events after error
	ALSA: jack: Fix mutex call in snd_jack_report()
	i2c: qup: Add missing unwind goto in qup_i2c_probe()
	NFSD: add encoding of op_recall flag for write delegation
	io_uring: wait interruptibly for request completions on exit
	mmc: core: disable TRIM on Kingston EMMC04G-M627
	mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
	mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
	mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
	bcache: fixup btree_cache_wait list damage
	bcache: Remove unnecessary NULL point check in node allocations
	bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
	um: Use HOST_DIR for mrproper
	integrity: Fix possible multiple allocation in integrity_inode_get()
	autofs: use flexible array in ioctl structure
	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
	jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
	fs: avoid empty option when generating legacy mount string
	ext4: Remove ext4 locking of moved directory
	Revert "f2fs: fix potential corruption when moving a directory"
	fs: Establish locking order for unrelated directories
	fs: Lock moved directories
	btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
	btrfs: fix race when deleting quota root from the dirty cow roots list
	ASoC: mediatek: mt8173: Fix irq error path
	ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
	ARM: orion5x: fix d2net gpio initialization
	leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
	fs: no need to check source
	fanotify: disallow mount/sb marks on kernel internal pseudo fs
	tpm, tpm_tis: Claim locality in interrupt handler
	selftests/bpf: Add verifier test for PTR_TO_MEM spill
	block: add overflow checks for Amiga partition support
	sh: pgtable-3level: Fix cast to pointer from integer of different size
	netfilter: nf_tables: use net_generic infra for transaction data
	netfilter: nf_tables: add rescheduling points during loop detection walks
	netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
	netfilter: nf_tables: fix chain binding transaction logic
	netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
	netfilter: nf_tables: reject unbound anonymous set before commit phase
	netfilter: nf_tables: reject unbound chain set before commit phase
	netfilter: nftables: rename set element data activation/deactivation functions
	netfilter: nf_tables: drop map element references from preparation phase
	netfilter: nf_tables: unbind non-anonymous set if rule construction fails
	netfilter: nf_tables: fix scheduling-while-atomic splat
	netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
	netfilter: nf_tables: do not ignore genmask when looking up chain by id
	netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
	wireguard: queueing: use saner cpu selection wrapping
	wireguard: netlink: send staged packets when setting initial private key
	tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
	rcu-tasks: Mark ->trc_reader_nesting data races
	rcu-tasks: Mark ->trc_reader_special.b.need_qs data races
	rcu-tasks: Simplify trc_read_check_handler() atomic operations
	block/partition: fix signedness issue for Amiga partitions
	io_uring: Use io_schedule* in cqring wait
	io_uring: add reschedule point to handle_tw_list()
	net: lan743x: Don't sleep in atomic context
	workqueue: clean up WORK_* constant types, clarify masking
	drm/panel: simple: Add connector_type for innolux_at043tn24
	drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
	igc: Remove delay during TX ring configuration
	net/mlx5e: fix double free in mlx5e_destroy_flow_table
	net/mlx5e: Check for NOT_READY flag state after locking
	igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings
	scsi: qla2xxx: Fix error code in qla2x00_start_sp()
	net: mvneta: fix txq_map in case of txq_number==1
	net/sched: cls_fw: Fix improper refcount update leads to use-after-free
	gve: Set default duplex configuration to full
	ionic: remove WARN_ON to prevent panic_on_warn
	net: bgmac: postpone turning IRQs off to avoid SoC hangs
	net: prevent skb corruption on frag list segmentation
	icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
	udp6: fix udp6_ehashfn() typo
	ntb: idt: Fix error handling in idt_pci_driver_init()
	NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
	ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
	NTB: ntb_transport: fix possible memory leak while device_register() fails
	NTB: ntb_tool: Add check for devm_kcalloc
	ipv6/addrconf: fix a potential refcount underflow for idev
	platform/x86: wmi: remove unnecessary argument
	platform/x86: wmi: use guid_t and guid_equal()
	platform/x86: wmi: move variables
	platform/x86: wmi: Break possible infinite loop when parsing GUID
	igc: Fix launchtime before start of cycle
	igc: Fix inserting of empty frame for launchtime
	riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core
	riscv: bpf: Avoid breaking W^X
	bpf, riscv: Support riscv jit to provide bpf_line_info
	riscv, bpf: Fix inconsistent JIT image generation
	erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
	wifi: airo: avoid uninitialized warning in airo_get_rate()
	net/sched: flower: Ensure both minimum and maximum ports are specified
	netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
	net/sched: make psched_mtu() RTNL-less safe
	net/sched: sch_qfq: refactor parsing of netlink parameters
	net/sched: sch_qfq: account for stab overhead in qfq_enqueue
	nvme-pci: fix DMA direction of unmapping integrity data
	f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
	pinctrl: amd: Fix mistake in handling clearing pins at startup
	pinctrl: amd: Detect internal GPIO0 debounce handling
	pinctrl: amd: Only use special debounce behavior for GPIO 0
	tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
	mtd: rawnand: meson: fix unaligned DMA buffers handling
	net: bcmgenet: Ensure MDIO unregistration has clocks enabled
	powerpc: Fail build if using recordmcount with binutils v2.37
	misc: fastrpc: Create fastrpc scalar with correct buffer count
	erofs: fix compact 4B support for 16k block size
	MIPS: Loongson: Fix cpu_probe_loongson() again
	ext4: Fix reusing stale buffer heads from last failed mounting
	ext4: fix wrong unit use in ext4_mb_clear_bb
	ext4: get block from bh in ext4_free_blocks for fast commit replay
	ext4: fix wrong unit use in ext4_mb_new_blocks
	ext4: only update i_reserved_data_blocks on successful block allocation
	jfs: jfs_dmap: Validate db_l2nbperpage while mounting
	hwrng: imx-rngc - fix the timeout for init and self check
	PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
	PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
	PCI: qcom: Disable write access to read only registers for IP v2.3.3
	PCI: rockchip: Assert PCI Configuration Enable bit after probe
	PCI: rockchip: Write PCI Device ID to correct register
	PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
	PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
	PCI: rockchip: Use u32 variable to access 32-bit registers
	PCI: rockchip: Set address alignment for endpoint mode
	misc: pci_endpoint_test: Free IRQs before removing the device
	misc: pci_endpoint_test: Re-init completion for every test
	md/raid0: add discard support for the 'original' layout
	fs: dlm: return positive pid value for F_GETLK
	drm/atomic: Allow vblank-enabled + self-refresh "disable"
	drm/rockchip: vop: Leave vblank enabled in self-refresh
	drm/amd/display: Correct `DMUB_FW_VERSION` macro
	serial: atmel: don't enable IRQs prematurely
	tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
	tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
	firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
	ceph: don't let check_caps skip sending responses for revoke msgs
	xhci: Fix resume issue of some ZHAOXIN hosts
	xhci: Fix TRB prefetch issue of ZHAOXIN hosts
	xhci: Show ZHAOXIN xHCI root hub speed correctly
	meson saradc: fix clock divider mask length
	Revert "8250: add support for ASIX devices with a FIFO bug"
	s390/decompressor: fix misaligned symbol build error
	tracing/histograms: Add histograms to hist_vars if they have referenced variables
	samples: ftrace: Save required argument registers in sample trampolines
	net: ena: fix shift-out-of-bounds in exponential backoff
	ring-buffer: Fix deadloop issue on reading trace_pipe
	xtensa: ISS: fix call to split_if_spec
	tracing: Fix null pointer dereference in tracing_err_log_open()
	tracing/probes: Fix not to count error code to total length
	scsi: qla2xxx: Wait for io return on terminate rport
	scsi: qla2xxx: Array index may go out of bound
	scsi: qla2xxx: Fix buffer overrun
	scsi: qla2xxx: Fix potential NULL pointer dereference
	scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
	scsi: qla2xxx: Correct the index of array
	scsi: qla2xxx: Pointer may be dereferenced
	scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
	net/sched: sch_qfq: reintroduce lmax bound check for MTU
	RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
	drm/atomic: Fix potential use-after-free in nonblocking commits
	ALSA: hda/realtek - remove 3k pull low procedure
	ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
	keys: Fix linking a duplicate key to a keyring's assoc_array
	perf probe: Add test for regression introduced by switch to die_get_decl_file()
	btrfs: fix warning when putting transaction with qgroups enabled after abort
	fuse: revalidate: don't invalidate if interrupted
	selftests: tc: set timeout to 15 minutes
	selftests: tc: add 'ct' action kconfig dep
	regmap: Drop initial version of maximum transfer length fixes
	regmap: Account for register length in SMBus I/O limits
	can: bcm: Fix UAF in bcm_proc_show()
	drm/client: Fix memory leak in drm_client_target_cloned
	drm/client: Fix memory leak in drm_client_modeset_probe
	ASoC: fsl_sai: Disable bit clock with transmitter
	ext4: correct inline offset when handling xattrs in inode body
	debugobjects: Recheck debug_objects_enabled before reporting
	nbd: Add the maximum limit of allocated index in nbd_dev_add
	md: fix data corruption for raid456 when reshape restart while grow up
	md/raid10: prevent soft lockup while flush writes
	posix-timers: Ensure timer ID search-loop limit is valid
	btrfs: add xxhash to fast checksum implementations
	ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
	ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
	ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
	arm64: set __exception_irq_entry with __irq_entry as a default
	arm64: mm: fix VA-range sanity check
	sched/fair: Don't balance task to its current running CPU
	wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
	bpf: Address KCSAN report on bpf_lru_list
	devlink: report devlink_port_type_warn source device
	wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
	wifi: iwlwifi: mvm: avoid baid size integer overflow
	igb: Fix igb_down hung on surprise removal
	spi: bcm63xx: fix max prepend length
	fbdev: imxfb: warn about invalid left/right margin
	pinctrl: amd: Use amd_pinconf_set() for all config options
	net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
	bridge: Add extack warning when enabling STP in netns.
	iavf: Fix use-after-free in free_netdev
	iavf: Fix out-of-bounds when setting channels on remove
	security: keys: Modify mismatched function name
	octeontx2-pf: Dont allocate BPIDs for LBK interfaces
	tcp: annotate data-races around tcp_rsk(req)->ts_recent
	net: ipv4: Use kfree_sensitive instead of kfree
	net:ipv6: check return value of pskb_trim()
	Revert "tcp: avoid the lookup process failing to get sk in ehash table"
	fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
	llc: Don't drop packet from non-root netns.
	netfilter: nf_tables: fix spurious set element insertion failure
	netfilter: nf_tables: can't schedule in nft_chain_validate
	netfilter: nft_set_pipapo: fix improper element removal
	netfilter: nf_tables: skip bound chain in netns release path
	netfilter: nf_tables: skip bound chain on rule flush
	tcp: annotate data-races around tp->tcp_tx_delay
	tcp: annotate data-races around tp->keepalive_time
	tcp: annotate data-races around tp->keepalive_intvl
	tcp: annotate data-races around tp->keepalive_probes
	net: Introduce net.ipv4.tcp_migrate_req.
	tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries.
	tcp: annotate data-races around icsk->icsk_syn_retries
	tcp: annotate data-races around tp->linger2
	tcp: annotate data-races around rskq_defer_accept
	tcp: annotate data-races around tp->notsent_lowat
	tcp: annotate data-races around icsk->icsk_user_timeout
	tcp: annotate data-races around fastopenq.max_qlen
	net: phy: prevent stale pointer dereference in phy_init()
	tracing/histograms: Return an error if we fail to add histogram to hist_vars list
	tracing: Fix memory leak of iter->temp when reading trace_pipe
	ftrace: Store the order of pages allocated in ftrace_page
	ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
	Linux 5.10.188

Change-Id: Ibcc1adc43df5b8f649b12078eedd5d4f57de4578
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-03 11:23:27 +00:00
Amir Goldstein
714ba10a6d ovl: update of dentry revalidate flags after copy up
[ Upstream commit b07d5cc93e1b28df47a72c519d09d0a836043613 ]

After copy up, we may need to update d_flags if upper dentry is on a
remote fs and lower dentries are not.

Add helpers to allow incremental update of the revalidate flags.

Fixes: bccece1ead ("ovl: allow remote upper")
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-27 08:43:55 +02:00
Greg Kroah-Hartman
0caf8151c2 This is the 5.10.169 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmP2AtsACgkQONu9yGCS
 aT6Pow/+MC7snhMqMZKWujfijbaP4PZm2WsfkTxpiTECg50axy+TJ0mtRzvrtDXt
 DyMec3IW121OeCItZ48W8lA17Efd5CAzZd58PxwWygfxSQ6livsr2mxAoWSOfk+5
 Bc1IJnKlpxWVovC8TswZuWFsatF5C0+xL5qzw0udY6bMLgKgAl7SIFykeEX3jibW
 Zjg7DSdFeSy7iDSSc2wu0MG6yM35y4PMnO7rYFzNRaTDpESJfm9ew+NGBLT9E6Ao
 8oIP2bBGCt83W7GZx6IpcrqtkP+SkrnLZ7NUTvfQQnwcYReZnXYShXRyirSbmjkQ
 OVziXOwRA3IGyvNQVMAef8vySbNwcTaUArKw4Lc3MhE0mT1wjpyNkF3Qyq9NvDsW
 x3wPXd/cIGZHBMKqxAndXdjZEKf/E5WzAxpDBm6H9U6EBqy7xRWylH1RwTUEYnPM
 7yqEEE2qlI/PTL5q+sJbzNhTI+XzhQvAkCuPs0APr1B5nqAV3Duo/PhRMg52S4Tq
 HGEZDuPzektLljqpON9IO+4g0aLLOodJccWwEghZIcWX2N5zQ69TI0stUzq3OLiJ
 iDU+feOr0JWQ59OK6JdVpL3LvcDJ8vUs9Fm57crSSi1lt5nqE0fKS5GbNtraKpcs
 yPFwBoqiiN7Q/oi9dV3SjBuVWId6FUGcq5rD5nKNWdPzdHGo/44=
 =KOqD
 -----END PGP SIGNATURE-----

Merge 5.10.169 into android12-5.10-lts

Changes in 5.10.169
	ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
	selftests/bpf: Verify copy_register_state() preserves parent/live fields
	ALSA: hda: Do not unset preset when cleaning up codec
	ASoC: cs42l56: fix DT probe
	tools/virtio: fix the vringh test for virtio ring changes
	net/rose: Fix to not accept on connected socket
	net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
	net: sched: sch: Bounds check priority
	s390/decompressor: specify __decompress() buf len to avoid overflow
	nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
	platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match
	nvmem: core: add error handling for dev_set_name
	nvmem: core: remove nvmem_config wp_gpio
	nvmem: core: fix cleanup after dev_set_name()
	nvmem: core: fix registration vs use race
	aio: fix mremap after fork null-deref
	s390/signal: fix endless loop in do_signal
	ovl: remove privs in ovl_copyfile()
	ovl: remove privs in ovl_fallocate()
	netfilter: nft_tproxy: restrict to prerouting hook
	mmc: jz4740: Work around bug on JZ4760(B)
	mmc: sdio: fix possible resource leaks in some error paths
	mmc: mmc_spi: fix error handling in mmc_spi_probe()
	ALSA: hda/conexant: add a new hda codec SN6180
	ALSA: hda/realtek - fixed wrong gpio assigned
	sched/psi: Fix use-after-free in ep_remove_wait_queue()
	hugetlb: check for undefined shift on 32 bit architectures
	Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."
	net: Fix unwanted sign extension in netdev_stats_to_stats64()
	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
	ixgbe: allow to increase MTU to 3K with XDP enabled
	i40e: add double of VLAN header when computing the max MTU
	net: bgmac: fix BCM5358 support by setting correct flags
	sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
	net/sched: tcindex: update imperfect hash filters respecting rcu
	dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
	net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
	net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
	net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
	bnxt_en: Fix mqprio and XDP ring checking logic
	net: stmmac: Restrict warning on disabling DMA store and fwd mode
	net: mpls: fix stale pointer if allocation fails during device rename
	ixgbe: add double of VLAN header when computing the max MTU
	ipv6: Fix datagram socket connection with DSCP.
	ipv6: Fix tcp socket connection with DSCP.
	nilfs2: fix underflow in second superblock position calculations
	drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
	drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
	flow_offload: fill flags to action structure
	net/sched: act_ctinfo: use percpu stats
	i40e: Add checking for null for nlmsg_find_attr()
	net/sched: tcindex: search key must be 16 bits
	kvm: initialize all of the kvm_debugregs structure before sending it to userspace
	alarmtimer: Prevent starvation by small intervals and SIG_IGN
	ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
	net: sched: sch: Fix off by one in htb_activate_prios()
	nvmem: core: fix return value
	Linux 5.10.169

Change-Id: Id846e3a42e381eb9bc554ffb5ab1390343b72287
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-02-25 15:32:12 +00:00
Amir Goldstein
6618b0dcf2 ovl: remove privs in ovl_fallocate()
commit 23a8ce16419a3066829ad4a8b7032a75817af65b upstream.

Underlying fs doesn't remove privs because fallocate is called with
privileged mounter credentials.

This fixes some failure in fstests generic/683..687.

Fixes: aab8848cee ("ovl: add ovl_fallocate()")
Acked-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-22 12:55:55 +01:00
Amir Goldstein
f6f94837d9 ovl: remove privs in ovl_copyfile()
commit b306e90ffabdaa7e3b3350dbcd19b7663e71ab17 upstream.

Underlying fs doesn't remove privs because copy_range/remap_range are
called with privileged mounter credentials.

This fixes some failures in fstest generic/673.

Fixes: 8ede205541 ("ovl: add reflink/copyfile/dedup support")
Acked-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-22 12:55:55 +01:00
Greg Kroah-Hartman
4922049993 This is the 5.10.163 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPCczkACgkQONu9yGCS
 aT4tnRAAsW8h/ohmhP+O2lQ9Ekw6s9VB6KB4aJzLhQXqIZlrzk2DP3CiLxQ7DkFc
 AcHwFYq+sERo8O7dK6pbCW0zNvLUpbK2wJhwMHujJfSUFboXX85NR6u90U67pBKS
 p+yVkDSx8LNc7c676xQ7ey5rO1K2fQQ266gexjI9WOkjIFOfplVkZ7tkvt51VwAD
 mNvOQsZdCE6xs+T3t9YMOtAx3wW8vl1wW3QDWCHznQwOJiMEjfNEOUY/+xELnnWz
 DVONWPHTFNKQHZwIuVUFZdNuORq5WXoIaMZdaEFkhuOtRMnQ9l+wi8iMxX8zkgBn
 Ji/dPu3GdAZsJU4/rXHkY2AeZV1oJc3NLYmevoRZirTqMQCqyM+blif7Rf34kBi7
 6jlGPWOjyMNe58shfHmjWTl/u4pMDoYOnm5XO+1oL+2Xg8QWCucqAlfPFB3uMh6n
 aL4ymzo5QRy1+tx8v7o1NOjnGWydvYn3O4fwJVkYTFaJZZr9EI7gpTmEBw/gwfuf
 4TH6BC++Ai/8vgKUhpdnWuTrjomWalPTcPBgQYG4gD7ak2TM1rmgMaCl/THUe36R
 zPC8m2sIXKeI4zGi8TeqTgaRvFSKJnuEmVo5OPkG98fZkjekCzWHp0q1+PG2Ecy8
 Mu2/AOnwb1aSfOJh2Qajoke/Wed0U6qszop8C/jPRh8D1uTmRbI=
 =sOTj
 -----END PGP SIGNATURE-----

Merge 5.10.163 into android12-5.10-lts

Changes in 5.10.163
	usb: musb: remove extra check in musb_gadget_vbus_draw
	arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
	arm64: dts: qcom: msm8996: fix GPU OPP table
	ARM: dts: qcom: apq8064: fix coresight compatible
	arm64: dts: qcom: sdm630: fix UART1 pin bias
	arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
	arm64: dts: qcom: msm8916: Drop MSS fallback compatible
	objtool, kcsan: Add volatile read/write instrumentation to whitelist
	ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
	ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
	drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
	soc: qcom: llcc: make irq truly optional
	soc: qcom: apr: make code more reuseable
	soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
	arm: dts: spear600: Fix clcd interrupt
	soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
	soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
	soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
	perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
	perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
	arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
	arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
	arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
	arm64: dts: mt2712e: Fix unit address for pinctrl node
	arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
	arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
	arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
	arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
	ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: turris-omnia: Add ethernet aliases
	ARM: dts: turris-omnia: Add switch port 6 node
	arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
	pstore/ram: Fix error return code in ramoops_probe()
	ARM: mmp: fix timer_read delay
	pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
	tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
	tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
	sched/fair: Cleanup task_util and capacity type
	sched/uclamp: Fix relationship between uclamp and migration margin
	cpuidle: dt: Return the correct numbers of parsed idle states
	alpha: fix syscall entry in !AUDUT_SYSCALL case
	PM: hibernate: Fix mistake in kerneldoc comment
	fs: don't audit the capability check in simple_xattr_list()
	cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
	selftests/ftrace: event_triggers: wait longer for test_event_enable
	perf: Fix possible memleak in pmu_dev_alloc()
	lib/debugobjects: fix stat count and optimize debug_objects_mem_init
	platform/x86: huawei-wmi: fix return value calculation
	timerqueue: Use rb_entry_safe() in timerqueue_getnext()
	proc: fixup uptime selftest
	lib/fonts: fix undefined behavior in bit shift for get_default_font
	ocfs2: fix memory leak in ocfs2_stack_glue_init()
	MIPS: vpe-mt: fix possible memory leak while module exiting
	MIPS: vpe-cmp: fix possible memory leak while module exiting
	selftests/efivarfs: Add checking of the test return value
	PNP: fix name memory leak in pnp_alloc_dev()
	perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
	perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
	perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
	platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
	irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
	EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
	nfsd: don't call nfsd_file_put from client states seqfile display
	genirq/irqdesc: Don't try to remove non-existing sysfs files
	cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
	lib/notifier-error-inject: fix error when writing -errno to debugfs file
	docs: fault-injection: fix non-working usage of negative values
	debugfs: fix error when writing negative value to atomic_t debugfs file
	ocfs2: ocfs2_mount_volume does cleanup job before return error
	ocfs2: rewrite error handling of ocfs2_fill_super
	ocfs2: fix memory leak in ocfs2_mount_volume()
	rapidio: fix possible name leaks when rio_add_device() fails
	rapidio: rio: fix possible name leak in rio_register_mport()
	clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
	clocksource/drivers/sh_cmt: Access registers according to spec
	futex: Move to kernel/futex/
	futex: Resend potentially swallowed owner death notification
	cpu/hotplug: Make target_store() a nop when target == state
	clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
	ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
	uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
	x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
	x86/xen: Fix memory leak in xen_init_lock_cpu()
	xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
	PM: runtime: Improve path in rpm_idle() when no callback
	PM: runtime: Do not call __rpm_callback() from rpm_idle()
	platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
	platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
	MIPS: BCM63xx: Add check for NULL for clk in clk_enable
	MIPS: OCTEON: warn only once if deprecated link status is being used
	fs: sysv: Fix sysv_nblocks() returns wrong value
	rapidio: fix possible UAF when kfifo_alloc() fails
	eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
	relay: fix type mismatch when allocating memory in relay_create_buf()
	hfs: Fix OOB Write in hfs_asc2mac
	rapidio: devices: fix missing put_device in mport_cdev_open
	wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
	wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
	wifi: rtl8xxxu: Fix reading the vendor of combo chips
	drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
	libbpf: Fix use-after-free in btf_dump_name_dups
	libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
	pata_ipx4xx_cf: Fix unsigned comparison with less than zero
	media: coda: jpeg: Add check for kmalloc
	media: i2c: ad5820: Fix error path
	venus: pm_helpers: Fix error check in vcodec_domains_get()
	media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev
	media: exynos4-is: don't rely on the v4l2_async_subdev internals
	can: kvaser_usb: do not increase tx statistics when sending error message frames
	can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
	can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
	can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
	can: kvaser_usb_leaf: Set Warning state even without bus errors
	can: kvaser_usb_leaf: Fix improved state not being reported
	can: kvaser_usb_leaf: Fix wrong CAN state after stopping
	can: kvaser_usb_leaf: Fix bogus restart events
	can: kvaser_usb: Add struct kvaser_usb_busparams
	can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
	drm/rockchip: lvds: fix PM usage counter unbalance in poweron
	clk: renesas: r9a06g032: Repair grave increment error
	spi: Update reference to struct spi_controller
	drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
	ima: Fix fall-through warnings for Clang
	ima: Handle -ESTALE returned by ima_filter_rule_match()
	drm/msm/hdmi: switch to drm_bridge_connector
	drm/msm/hdmi: drop unused GPIO support
	bpf: Fix slot type check in check_stack_write_var_off
	media: vivid: fix compose size exceed boundary
	media: platform: exynos4-is: fix return value check in fimc_md_probe()
	bpf: propagate precision in ALU/ALU64 operations
	bpf: Check the other end of slot_type for STACK_SPILL
	bpf: propagate precision across all frames, not just the last one
	clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
	mtd: Fix device name leak when register device failed in add_mtd_device()
	Input: joystick - fix Kconfig warning for JOYSTICK_ADC
	wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
	media: camss: Clean up received buffers on failed start of streaming
	net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
	rxrpc: Fix ack.bufferSize to be 0 when generating an ack
	drm/radeon: Add the missed acpi_put_table() to fix memory leak
	drm/mediatek: Modify dpi power on/off sequence.
	ASoC: pxa: fix null-pointer dereference in filter()
	regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
	amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
	drm/fourcc: Add packed 10bit YUV 4:2:0 format
	drm/fourcc: Fix vsub/hsub for Q410 and Q401
	integrity: Fix memory leakage in keyring allocation error path
	ima: Fix misuse of dereference of pointer in template_desc_init_fields()
	wifi: ath10k: Fix return value in ath10k_pci_init()
	mtd: lpddr2_nvm: Fix possible null-ptr-deref
	Input: elants_i2c - properly handle the reset GPIO when power is off
	media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
	media: solo6x10: fix possible memory leak in solo_sysfs_init()
	media: platform: exynos4-is: Fix error handling in fimc_md_init()
	media: videobuf-dma-contig: use dma_mmap_coherent
	inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
	bpf: Move skb->len == 0 checks into __bpf_redirect
	HID: hid-sensor-custom: set fixed size for custom attributes
	ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
	ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
	regulator: core: use kfree_const() to free space conditionally
	clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
	drm/amdgpu: fix pci device refcount leak
	bonding: fix link recovery in mode 2 when updelay is nonzero
	mtd: maps: pxa2xx-flash: fix memory leak in probe
	drbd: fix an invalid memory access caused by incorrect use of list iterator
	ASoC: qcom: Add checks for devm_kcalloc
	media: vimc: Fix wrong function called when vimc_init() fails
	media: imon: fix a race condition in send_packet()
	clk: imx: replace osc_hdmi with dummy
	pinctrl: pinconf-generic: add missing of_node_put()
	media: dvb-core: Fix ignored return value in dvb_register_frontend()
	media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
	media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
	drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
	ASoC: dt-bindings: wcd9335: fix reset line polarity in example
	ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
	NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
	NFSv4.2: Fix a memory stomp in decode_attr_security_label
	NFSv4.2: Fix initialisation of struct nfs4_label
	NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
	NFS: Fix an Oops in nfs_d_automount()
	ALSA: asihpi: fix missing pci_disable_device()
	wifi: iwlwifi: mvm: fix double free on tx path.
	ASoC: mediatek: mt8173: Fix debugfs registration for components
	ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
	drm/amd/pm/smu11: BACO is supported when it's in BACO state
	drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
	drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
	ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
	netfilter: conntrack: set icmpv6 redirects as RELATED
	bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
	bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
	bonding: uninitialized variable in bond_miimon_inspect()
	spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
	wifi: mac80211: fix memory leak in ieee80211_if_add()
	wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
	wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
	regulator: core: fix module refcount leak in set_supply()
	clk: qcom: clk-krait: fix wrong div2 functions
	hsr: Add a rcu-read lock to hsr_forward_skb().
	net: hsr: generate supervision frame without HSR/PRP tag
	hsr: Disable netpoll.
	hsr: Synchronize sending frames to have always incremented outgoing seq nr.
	hsr: Synchronize sequence number updates.
	configfs: fix possible memory leak in configfs_create_dir()
	regulator: core: fix resource leak in regulator_register()
	hwmon: (jc42) Convert register access and caching to regmap/regcache
	hwmon: (jc42) Restore the min/max/critical temperatures on resume
	bpf, sockmap: fix race in sock_map_free()
	ALSA: pcm: Set missing stop_operating flag at undoing trigger start
	media: saa7164: fix missing pci_disable_device()
	ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
	xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
	SUNRPC: Fix missing release socket in rpc_sockname()
	NFSv4.x: Fail client initialisation if state manager thread can't run
	mmc: alcor: fix return value check of mmc_add_host()
	mmc: moxart: fix return value check of mmc_add_host()
	mmc: mxcmmc: fix return value check of mmc_add_host()
	mmc: pxamci: fix return value check of mmc_add_host()
	mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
	mmc: toshsd: fix return value check of mmc_add_host()
	mmc: vub300: fix return value check of mmc_add_host()
	mmc: wmt-sdmmc: fix return value check of mmc_add_host()
	mmc: atmel-mci: fix return value check of mmc_add_host()
	mmc: omap_hsmmc: fix return value check of mmc_add_host()
	mmc: meson-gx: fix return value check of mmc_add_host()
	mmc: via-sdmmc: fix return value check of mmc_add_host()
	mmc: wbsd: fix return value check of mmc_add_host()
	mmc: mmci: fix return value check of mmc_add_host()
	media: c8sectpfe: Add of_node_put() when breaking out of loop
	media: coda: Add check for dcoda_iram_alloc
	media: coda: Add check for kmalloc
	clk: samsung: Fix memory leak in _samsung_clk_register_pll()
	spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
	wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
	wifi: rtl8xxxu: Fix the channel width reporting
	wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
	blktrace: Fix output non-blktrace event when blk_classic option enabled
	clk: socfpga: clk-pll: Remove unused variable 'rc'
	clk: socfpga: use clk_hw_register for a5/c5
	clk: socfpga: Fix memory leak in socfpga_gate_init()
	net: vmw_vsock: vmci: Check memcpy_from_msg()
	net: defxx: Fix missing err handling in dfx_init()
	net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
	drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
	of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
	ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: farsync: Fix kmemleak when rmmods farsync
	net/tunnel: wait until all sk_user_data reader finish before releasing the sock
	net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
	hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: amd-xgbe: Fix logic around active and passive cables
	net: amd-xgbe: Check only the minimum speed for active/passive cables
	can: tcan4x5x: Remove invalid write in clear_interrupts
	net: lan9303: Fix read error execution path
	ntb_netdev: Use dev_kfree_skb_any() in interrupt context
	sctp: sysctl: make extra pointers netns aware
	Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
	stmmac: fix potential division by 0
	apparmor: fix a memleak in multi_transaction_new()
	apparmor: fix lockdep warning when removing a namespace
	apparmor: Fix abi check to include v8 abi
	crypto: sun8i-ss - use dma_addr instead u32
	crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
	scsi: core: Fix a race between scsi_done() and scsi_timeout()
	apparmor: Use pointer to struct aa_label for lbs_cred
	PCI: dwc: Fix n_fts[] array overrun
	RDMA/core: Fix order of nldev_exit call
	PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
	f2fs: Fix the race condition of resize flag between resizefs
	crypto: rockchip - do not do custom power management
	crypto: rockchip - do not store mode globally
	crypto: rockchip - add fallback for cipher
	crypto: rockchip - add fallback for ahash
	crypto: rockchip - better handle cipher key
	crypto: rockchip - remove non-aligned handling
	crypto: rockchip - delete unneeded variable initialization
	crypto: rockchip - rework by using crypto_engine
	apparmor: Fix memleak in alloc_ns()
	f2fs: fix normal discard process
	RDMA/siw: Fix immediate work request flush to completion queue
	RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
	RDMA/siw: Set defined status for work completion with undefined status
	scsi: scsi_debug: Fix a warning in resp_write_scat()
	crypto: ccree - Remove debugfs when platform_driver_register failed
	crypto: cryptd - Use request context instead of stack for sub-request
	crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
	RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
	RDMA/hns: Fix ext_sge num error when post send
	PCI: Check for alloc failure in pci_request_irq()
	RDMA/hfi: Decrease PCI device reference count in error path
	crypto: ccree - Make cc_debugfs_global_fini() available for module init function
	RDMA/hns: fix memory leak in hns_roce_alloc_mr()
	RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
	scsi: hpsa: Fix possible memory leak in hpsa_init_one()
	crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
	padata: Always leave BHs disabled when running ->parallel()
	padata: Fix list iterator in padata_do_serial()
	scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
	scsi: hpsa: Fix error handling in hpsa_add_sas_host()
	scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
	scsi: scsi_debug: Fix a warning in resp_verify()
	scsi: scsi_debug: Fix a warning in resp_report_zones()
	scsi: fcoe: Fix possible name leak when device_register() fails
	scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
	scsi: ipr: Fix WARNING in ipr_init()
	scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
	scsi: snic: Fix possible UAF in snic_tgt_create()
	RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
	f2fs: avoid victim selection from previous victim section
	RDMA/nldev: Fix failure to send large messages
	crypto: amlogic - Remove kcalloc without check
	crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
	riscv/mm: add arch hook arch_clear_hugepage_flags
	RDMA/hfi1: Fix error return code in parse_platform_config()
	RDMA/srp: Fix error return code in srp_parse_options()
	orangefs: Fix sysfs not cleanup when dev init failed
	RDMA/hns: Fix PBL page MTR find
	RDMA/hns: Fix page size cap from firmware
	crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
	hwrng: amd - Fix PCI device refcount leak
	hwrng: geode - Fix PCI device refcount leak
	IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
	drivers: dio: fix possible memory leak in dio_init()
	serial: tegra: Read DMA status before terminating
	class: fix possible memory leak in __class_register()
	vfio: platform: Do not pass return buffer to ACPI _RST method
	uio: uio_dmem_genirq: Fix missing unlock in irq configuration
	uio: uio_dmem_genirq: Fix deadlock between irq config and handling
	usb: fotg210-udc: Fix ages old endianness issues
	staging: vme_user: Fix possible UAF in tsi148_dma_list_add
	usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
	usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
	usb: typec: tipd: Fix spurious fwnode_handle_put in error path
	serial: amba-pl011: avoid SBSA UART accessing DMACR register
	serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
	serial: pch: Fix PCI device refcount leak in pch_request_dma()
	tty: serial: clean up stop-tx part in altera_uart_tx_chars()
	tty: serial: altera_uart_{r,t}x_chars() need only uart_port
	serial: altera_uart: fix locking in polling mode
	serial: sunsab: Fix error handling in sunsab_init()
	test_firmware: fix memory leak in test_firmware_init()
	misc: ocxl: fix possible name leak in ocxl_file_register_afu()
	ocxl: fix pci device refcount leak when calling get_function_0()
	misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
	misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
	firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
	cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
	cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
	iio: temperature: ltc2983: make bulk write buffer DMA-safe
	genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
	iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable
	iio: adis: handle devices that cannot unmask the drdy pin
	iio: adis: stylistic changes
	iio:imu:adis: Move exports into IIO_ADISLIB namespace
	iio: adis: add '__adis_enable_irq()' implementation
	counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
	usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
	usb: gadget: f_hid: optional SETUP/SET_REPORT mode
	usb: gadget: f_hid: fix f_hidg lifetime vs cdev
	usb: gadget: f_hid: fix refcount leak on error path
	drivers: mcb: fix resource leak in mcb_probe()
	mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
	chardev: fix error handling in cdev_device_add()
	i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
	staging: rtl8192u: Fix use after free in ieee80211_rx()
	staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
	vme: Fix error not catched in fake_init()
	gpiolib: Get rid of redundant 'else'
	gpiolib: cdev: fix NULL-pointer dereferences
	i2c: mux: reg: check return value after calling platform_get_resource()
	i2c: ismt: Fix an out-of-bounds bug in ismt_access()
	usb: storage: Add check for kcalloc
	tracing/hist: Fix issue of losting command info in error_log
	samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
	thermal/drivers/imx8mm_thermal: Validate temperature range
	fbdev: ssd1307fb: Drop optional dependency
	fbdev: pm2fb: fix missing pci_disable_device()
	fbdev: via: Fix error in via_core_init()
	fbdev: vermilion: decrease reference count in error path
	fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
	HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
	HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
	power: supply: fix residue sysfs file in error handle route of __power_supply_register()
	perf trace: Return error if a system call doesn't exist
	perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
	perf trace: Handle failure when trace point folder is missed
	perf symbol: correction while adjusting symbol
	HSI: omap_ssi_core: Fix error handling in ssi_init()
	power: supply: fix null pointer dereferencing in power_supply_get_battery_info
	RDMA/siw: Fix pointer cast warning
	iommu/sun50i: Fix reset release
	iommu/sun50i: Consider all fault sources for reset
	iommu/sun50i: Fix R/W permission check
	iommu/sun50i: Fix flush size
	phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
	include/uapi/linux/swab: Fix potentially missing __always_inline
	pwm: tegra: Improve required rate calculation
	dmaengine: idxd: Fix crc_val field for completion record
	rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
	rtc: cmos: Fix event handler registration ordering issue
	rtc: cmos: Fix wake alarm breakage
	rtc: cmos: fix build on non-ACPI platforms
	rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
	rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
	rtc: cmos: Eliminate forward declarations of some functions
	rtc: cmos: Rename ACPI-related functions
	rtc: cmos: Disable ACPI RTC event on removal
	rtc: snvs: Allow a time difference on clock register read
	rtc: pcf85063: Fix reading alarm
	iommu/amd: Fix pci device refcount leak in ppr_notifier()
	iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
	macintosh: fix possible memory leak in macio_add_one_device()
	macintosh/macio-adb: check the return value of ioremap()
	powerpc/52xx: Fix a resource leak in an error handling path
	cxl: Fix refcount leak in cxl_calc_capp_routing
	powerpc/xmon: Enable breakpoints on 8xx
	powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
	powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
	kbuild: remove unneeded mkdir for external modules_install
	kbuild: unify modules(_install) for in-tree and external modules
	kbuild: refactor single builds of *.ko
	powerpc/perf: callchain validate kernel stack pointer bounds
	powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
	powerpc/hv-gpci: Fix hv_gpci event list
	selftests/powerpc: Fix resource leaks
	iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
	pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
	remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
	remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
	remoteproc: qcom_q6v5_pas: detach power domains on remove
	remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
	powerpc/eeh: Drop redundant spinlock initialization
	powerpc/pseries/eeh: use correct API for error log size
	netfilter: flowtable: really fix NAT IPv6 offload
	rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
	rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
	rtc: pcf85063: fix pcf85063_clkout_control
	NFSD: Remove spurious cb_setup_err tracepoint
	nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
	net: macsec: fix net device access prior to holding a lock
	mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	nfc: pn533: Clear nfc_target before being used
	r6040: Fix kmemleak in probe and remove
	net: switch to storing KCOV handle directly in sk_buff
	net: add inline function skb_csum_is_sctp
	net: igc: use skb_csum_is_sctp instead of protocol check
	net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME
	igc: Enhance Qbv scheduling by using first flag bit
	igc: Use strict cycles for Qbv scheduling
	igc: Add checking for basetime less than zero
	igc: recalculate Qbv end_time by considering cycle time
	igc: Lift TAPRIO schedule restriction
	igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
	rtc: mxc_v2: Add missing clk_disable_unprepare()
	selftests: devlink: fix the fd redirect in dummy_reporter_test
	openvswitch: Fix flow lookup to use unmasked key
	skbuff: Account for tail adjustment during pull operations
	mailbox: zynq-ipi: fix error handling while device_register() fails
	net_sched: reject TCF_EM_SIMPLE case for complex ematch module
	rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
	myri10ge: Fix an error handling path in myri10ge_probe()
	net: stream: purge sk_error_queue in sk_stream_kill_queues()
	rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
	arm64: make is_ttbrX_addr() noinstr-safe
	video: hyperv_fb: Avoid taking busy spinlock on panic path
	x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
	binfmt_misc: fix shift-out-of-bounds in check_special_flags
	fs: jfs: fix shift-out-of-bounds in dbAllocAG
	udf: Avoid double brelse() in udf_rename()
	fs: jfs: fix shift-out-of-bounds in dbDiscardAG
	ACPICA: Fix error code path in acpi_ds_call_control_method()
	nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
	nilfs2: fix shift-out-of-bounds due to too large exponent of block size
	acct: fix potential integer overflow in encode_comp_t()
	hfs: fix OOB Read in __hfs_brec_find
	drm/etnaviv: add missing quirks for GC300
	brcmfmac: return error when getting invalid max_flowrings from dongle
	wifi: ath9k: verify the expected usb_endpoints are present
	wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
	ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
	ipmi: fix memleak when unload ipmi driver
	drm/amd/display: prevent memory leak
	qed (gcc13): use u16 for fid to be big enough
	bpf: make sure skb->len != 0 when redirecting to a tunneling device
	net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
	hamradio: baycom_epp: Fix return type of baycom_send_packet()
	wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
	igb: Do not free q_vector unless new one was allocated
	drm/amdgpu: Fix type of second parameter in trans_msg() callback
	drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
	s390/ctcm: Fix return type of ctc{mp,}m_tx()
	s390/netiucv: Fix return type of netiucv_tx()
	s390/lcs: Fix return type of lcs_start_xmit()
	drm/msm: Use drm_mode_copy()
	drm/rockchip: Use drm_mode_copy()
	drm/sti: Use drm_mode_copy()
	drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
	md/raid1: stop mdx_raid1 thread when raid1 array run failed
	drm/amd/display: fix array index out of bound error in bios parser
	net: add atomic_long_t to net_device_stats fields
	mrp: introduce active flags to prevent UAF when applicant uninit
	ppp: associate skb with a device at tx
	bpf: Prevent decl_tag from being referenced in func_proto arg
	ethtool: avoiding integer overflow in ethtool_phys_id()
	media: dvb-frontends: fix leak of memory fw
	media: dvbdev: adopts refcnt to avoid UAF
	media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
	blk-mq: fix possible memleak when register 'hctx' failed
	libbpf: Avoid enum forward-declarations in public API in C++ mode
	regulator: core: fix use_count leakage when handling boot-on
	mmc: f-sdh30: Add quirks for broken timeout clock capability
	mmc: renesas_sdhi: better reset from HS400 mode
	media: si470x: Fix use-after-free in si470x_int_in_callback()
	clk: st: Fix memory leak in st_of_quadfs_setup()
	hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
	drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
	drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
	orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
	orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
	hwmon: (jc42) Fix missing unlock on error in jc42_write()
	ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
	ALSA: hda: add snd_hdac_stop_streams() helper
	ASoC: Intel: Skylake: Fix driver hang during shutdown
	ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
	ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
	ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
	ASoC: wm8994: Fix potential deadlock
	ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
	ASoC: rt5670: Remove unbalanced pm_runtime_put()
	LoadPin: Ignore the "contents" argument of the LSM hooks
	pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
	perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
	afs: Fix lost servers_outstanding count
	pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
	ima: Simplify ima_lsm_copy_rule
	ALSA: usb-audio: add the quirk for KT0206 device
	ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
	ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
	usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
	usb: dwc3: core: defer probe on ulpi_read_id timeout
	HID: wacom: Ensure bootloader PID is usable in hidraw mode
	HID: mcp2221: don't connect hidraw
	reiserfs: Add missing calls to reiserfs_security_free()
	iio: adc: ad_sigma_delta: do not use internal iio_dev lock
	iio: adc128s052: add proper .data members in adc128_of_match table
	regulator: core: fix deadlock on regulator enable
	gcov: add support for checksum field
	ovl: fix use inode directly in rcu-walk mode
	media: dvbdev: fix build warning due to comments
	media: dvbdev: fix refcnt bug
	pwm: tegra: Fix 32 bit build
	usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
	cifs: fix oops during encryption
	nvme-pci: fix doorbell buffer value endianness
	nvme-pci: fix mempool alloc size
	nvme-pci: fix page size checks
	ata: ahci: Fix PCS quirk application for suspend
	nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
	nvmet: don't defer passthrough commands with trivial effects to the workqueue
	objtool: Fix SEGFAULT
	powerpc/rtas: avoid device tree lookups in rtas_os_term()
	powerpc/rtas: avoid scheduling in rtas_os_term()
	HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
	HID: plantronics: Additional PIDs for double volume key presses quirk
	pstore/zone: Use GFP_ATOMIC to allocate zone buffer
	hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
	binfmt: Fix error return code in load_elf_fdpic_binary()
	ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
	ALSA: line6: correct midi status byte when receiving data from podxt
	ALSA: line6: fix stack overflow in line6_midi_transmit
	pnode: terminate at peers of source
	md: fix a crash in mempool_free
	mm, compaction: fix fast_isolate_around() to stay within boundaries
	f2fs: should put a page when checking the summary info
	mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
	tpm: acpi: Call acpi_put_table() to fix memory leak
	tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
	tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
	SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
	kcsan: Instrument memcpy/memset/memmove with newer Clang
	ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
	ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
	net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow()
	wifi: rtlwifi: remove always-true condition pointed out by GCC 12
	wifi: rtlwifi: 8192de: correct checking of IQK reload
	torture: Exclude "NOHZ tick-stop error" from fatal errors
	rcu: Prevent lockdep-RCU splats on lock acquisition/release
	net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
	net/af_packet: make sure to pull mac header
	media: stv0288: use explicitly signed char
	soc: qcom: Select REMAP_MMIO for LLCC driver
	kest.pl: Fix grub2 menu handling for rebooting
	ktest.pl minconfig: Unset configs instead of just removing them
	jbd2: use the correct print format
	arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
	mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
	btrfs: fix resolving backrefs for inline extent followed by prealloc
	ARM: ux500: do not directly dereference __iomem
	arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
	selftests: Use optional USERCFLAGS and USERLDFLAGS
	PM/devfreq: governor: Add a private governor_data for governor
	cpufreq: Init completion before kobject_init_and_add()
	ALSA: patch_realtek: Fix Dell Inspiron Plus 16
	ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
	dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
	dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
	dm thin: Use last transaction's pmd->root when commit failed
	dm thin: resume even if in FAIL mode
	dm thin: Fix UAF in run_timer_softirq()
	dm integrity: Fix UAF in dm_integrity_dtr()
	dm clone: Fix UAF in clone_dtr()
	dm cache: Fix UAF in destroy()
	dm cache: set needs_check flag after aborting metadata
	tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
	perf/core: Call LSM hook after copying perf_event_attr
	KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
	x86/microcode/intel: Do not retry microcode reloading on the APs
	ftrace/x86: Add back ftrace_expected for ftrace bug reports
	x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
	tracing/hist: Fix wrong return value in parse_action_params()
	tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
	staging: media: tegra-video: fix chan->mipi value on error
	ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
	media: dvb-core: Fix double free in dvb_register_device()
	media: dvb-core: Fix UAF due to refcount races at releasing
	cifs: fix confusing debug message
	cifs: fix missing display of three mount options
	rtc: ds1347: fix value written to century register
	md/bitmap: Fix bitmap chunk size overflow issues
	efi: Add iMac Pro 2017 to uefi skip cert quirk
	wifi: wilc1000: sdio: fix module autoloading
	ASoC: jz4740-i2s: Handle independent FIFO flush bits
	ipmi: fix long wait in unload when IPMI disconnect
	mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
	ima: Fix a potential NULL pointer access in ima_restore_measurement_list
	ipmi: fix use after free in _ipmi_destroy_user()
	PCI: Fix pci_device_is_present() for VFs by checking PF
	PCI/sysfs: Fix double free in error path
	crypto: n2 - add missing hash statesize
	driver core: Fix bus_type.match() error handling in __driver_attach()
	iommu/amd: Fix ivrs_acpihid cmdline parsing code
	remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
	parisc: led: Fix potential null-ptr-deref in start_task()
	device_cgroup: Roll back to original exceptions after copy failure
	drm/connector: send hotplug uevent on connector cleanup
	drm/vmwgfx: Validate the box size for the snooped cursor
	drm/i915/dsi: fix VBT send packet port selection for dual link DSI
	drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
	ext4: silence the warning when evicting inode with dioread_nolock
	ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
	ext4: fix use-after-free in ext4_orphan_cleanup
	ext4: fix undefined behavior in bit shift for ext4_check_flag_values
	ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
	ext4: add helper to check quota inums
	ext4: fix bug_on in __es_tree_search caused by bad quota inode
	ext4: fix reserved cluster accounting in __es_remove_extent()
	ext4: check and assert if marking an no_delete evicting inode dirty
	ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
	ext4: init quota for 'old.inode' in 'ext4_rename'
	ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
	ext4: fix corruption when online resizing a 1K bigalloc fs
	ext4: fix error code return to user-space in ext4_get_branch()
	ext4: avoid BUG_ON when creating xattrs
	ext4: fix inode leak in ext4_xattr_inode_create() on an error path
	ext4: initialize quota before expanding inode in setproject ioctl
	ext4: avoid unaccounted block allocation when expanding inode
	ext4: allocate extended attribute value in vmalloc area
	drm/amdgpu: handle polaris10/11 overlap asics (v2)
	drm/amdgpu: make display pinning more flexible (v2)
	ARM: renumber bits related to _TIF_WORK_MASK
	perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure
	perf/x86/intel/uncore: Clear attr_update properly
	btrfs: replace strncpy() with strscpy()
	x86/mce: Get rid of msr_ops
	x86/MCE/AMD: Clear DFR errors found in THR handler
	media: s5p-mfc: Fix to handle reference queue during finishing
	media: s5p-mfc: Clear workbit to handle error condition
	media: s5p-mfc: Fix in register read and write for H264
	perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
	perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
	x86/kprobes: Convert to insn_decode()
	x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
	staging: media: tegra-video: fix device_node use after free
	ravb: Fix "failed to switch device to config mode" message during unbind
	riscv/stacktrace: Fix stack output without ra on the stack top
	riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument
	ext4: goto right label 'failed_mount3a'
	ext4: correct inconsistent error msg in nojournal mode
	mm/highmem: Lift memcpy_[to|from]_page to core
	ext4: use memcpy_to_page() in pagecache_write()
	fs: ext4: initialize fsdata in pagecache_write()
	ext4: move functions in super.c
	ext4: simplify ext4 error translation
	ext4: fix various seppling typos
	ext4: fix leaking uninitialized memory in fast-commit journal
	ext4: use kmemdup() to replace kmalloc + memcpy
	mbcache: don't reclaim used entries
	mbcache: add functions to delete entry if unused
	ext4: remove EA inode entry from mbcache on inode eviction
	ext4: unindent codeblock in ext4_xattr_block_set()
	ext4: fix race when reusing xattr blocks
	mbcache: automatically delete entries from cache on freeing
	ext4: fix deadlock due to mbcache entry corruption
	SUNRPC: ensure the matching upcall is in-flight upon downcall
	bpf: pull before calling skb_postpull_rcsum()
	drm/panfrost: Fix GEM handle creation ref-counting
	vmxnet3: correctly report csum_level for encapsulated packet
	veth: Fix race with AF_XDP exposing old or uninitialized descriptors
	nfsd: shut down the NFSv4 state objects before the filecache
	net: hns3: add interrupts re-initialization while doing VF FLR
	net: sched: fix memory leak in tcindex_set_parms
	qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
	nfc: Fix potential resource leaks
	vhost/vsock: Fix error handling in vhost_vsock_init()
	vringh: fix range used in iotlb_translate()
	vhost: fix range used in translate_desc()
	net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
	net/mlx5: Avoid recovery in probe flows
	net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
	net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
	net: amd-xgbe: add missed tasklet_kill
	net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
	RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
	drm/meson: Reduce the FIFO lines held when AFBC is not used
	filelock: new helper: vfs_inode_has_locks
	ceph: switch to vfs_inode_has_locks() to fix file lock bug
	gpio: sifive: Fix refcount leak in sifive_gpio_probe
	net: sched: atm: dont intepret cls results when asked to drop
	net: sched: cbq: dont intepret cls results when asked to drop
	netfilter: ipset: fix hash:net,port,net hang with /0 subnet
	netfilter: ipset: Rework long task execution when adding/deleting entries
	perf tools: Fix resources leak in perf_data__open_dir()
	drivers/net/bonding/bond_3ad: return when there's no aggregator
	usb: rndis_host: Secure rndis_query check against int overflow
	drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
	caif: fix memory leak in cfctrl_linkup_request()
	udf: Fix extension of the last extent in the file
	ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
	nvme: fix multipath crash caused by flush request when blktrace is enabled
	x86/bugs: Flush IBP in ib_prctl_set()
	nfsd: fix handling of readdir in v4root vs. mount upcall timeout
	fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
	riscv: uaccess: fix type of 0 variable on error in get_user()
	drm/i915/gvt: fix gvt debugfs destroy
	drm/i915/gvt: fix vgpu debugfs clean in remove
	ext4: don't allow journal inode to have encrypt flag
	selftests: set the BUILD variable to absolute path
	hfs/hfsplus: use WARN_ON for sanity check
	hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
	mbcache: Avoid nesting of cache->c_list_lock under bit locks
	efi: random: combine bootloader provided RNG seed with RNG protocol output
	io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
	parisc: Align parisc MADV_XXX constants with all other architectures
	ext4: disable fast-commit of encrypted dir operations
	ext4: don't set up encryption key during jbd2 transaction
	fsl_lpuart: Don't enable interrupts too early
	serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way"
	mptcp: mark ops structures as ro_after_init
	mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
	mptcp: dedicated request sock for subflow in v6
	mptcp: use proper req destructor for IPv6
	net: sched: disallow noqueue for qdisc classes
	net/ulp: prevent ULP without clone op from entering the LISTEN status
	ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
	ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
	ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
	Linux 5.10.163

Change-Id: I9026971760be8484f1e1fa607f9f91243cc87785
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-02-06 12:30:05 +00:00
Zhang Tianci
56abf8046b ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
commit 5b0db51215e895a361bc63132caa7cca36a53d6a upstream.

There is a wrong case of link() on overlay:
  $ mkdir /lower /fuse /merge
  $ mount -t fuse /fuse
  $ mkdir /fuse/upper /fuse/work
  $ mount -t overlay /merge -o lowerdir=/lower,upperdir=/fuse/upper,\
    workdir=work
  $ touch /merge/file
  $ chown bin.bin /merge/file // the file's caller becomes "bin"
  $ ln /merge/file /merge/lnkfile

Then we will get an error(EACCES) because fuse daemon checks the link()'s
caller is "bin", it denied this request.

In the changing history of ovl_link(), there are two key commits:

The first is commit bb0d2b8ad2 ("ovl: fix sgid on directory") which
overrides the cred's fsuid/fsgid using the new inode. The new inode's
owner is initialized by inode_init_owner(), and inode->fsuid is
assigned to the current user. So the override fsuid becomes the
current user. We know link() is actually modifying the directory, so
the caller must have the MAY_WRITE permission on the directory. The
current caller may should have this permission. This is acceptable
to use the caller's fsuid.

The second is commit 51f7e52dc9 ("ovl: share inode for hard link")
which removed the inode creation in ovl_link(). This commit move
inode_init_owner() into ovl_create_object(), so the ovl_link() just
give the old inode to ovl_create_or_link(). Then the override fsuid
becomes the old inode's fsuid, neither the caller nor the overlay's
mounter! So this is incorrect.

Fix this bug by using ovl mounter's fsuid/fsgid to do underlying
fs's link().

Link: https://lore.kernel.org/all/20220817102952.xnvesg3a7rbv576x@wittgenstein/T
Link: https://lore.kernel.org/lkml/20220825130552.29587-1-zhangtianci.1997@bytedance.com/t
Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com>
Signed-off-by: Jiachen Zhang <zhangjiachen.jaycee@bytedance.com>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Fixes: 51f7e52dc9 ("ovl: share inode for hard link")
Cc: <stable@vger.kernel.org> # v4.8
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-14 10:16:26 +01:00
Chen Zhongjin
740c537f52 ovl: fix use inode directly in rcu-walk mode
commit 672e4268b2863d7e4978dfed29552b31c2f9bd4e upstream.

ovl_dentry_revalidate_common() can be called in rcu-walk mode.  As document
said, "in rcu-walk mode, d_parent and d_inode should not be used without
care".

Check inode here to protect access under rcu-walk mode.

Fixes: bccece1ead ("ovl: allow remote upper")
Reported-and-tested-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Cc: <stable@vger.kernel.org> # v5.7
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-14 10:16:24 +01:00
Greg Kroah-Hartman
fbe6a13851 This is the 5.10.137 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMCMDQACgkQONu9yGCS
 aT6TwRAAvj1dnV1nLVVNET3jcelTO65SVUUpQjiyGD1npZQaQdH5PoGR0VhMWk7y
 mLUIwJyp/rR7+OLD3BMFwxDimDWHviFGdbmm/8fsyDrARuOeRd/M1fvtHXjIRQdb
 nOvfo1yTQWp4xA1k/JwJZslkvRFDsofXWHCRf+ffEryTRanFAVc7u5aFIg92W0b/
 JWYWEFe99C4TJ7LACpDoGaP9gE6WXsupaxSZBIu+Wxa+PfDmIeRRTkQn+j4Khn0h
 I6w+LkLd6ZP3l7sbe9KfS9ZGo1wWLgSng4zz742Z9IaFgxyj2ArS9tNsYCLkkhAM
 gLSXXkiPBAxUvAtDxR1tc0YROHc1bjAttSoxNXcaaacspSo/Vi0VAtp7t6boK0bI
 /8P3dh+Hq9u/Q1ClhZtVoFpp+GVj0fDbDd56qVcr2Cp6IokpqRJog1Jhgj0CVCoG
 iElr3n0+y7/IZfmE6/U1cK00SNcW86e2YduuIy4ifCawRT574zkRiSYZalpaO3qM
 z1lF9p+zUNq3v2q0wxXuBDLi/yPoJzbJgmCGScj4ryjjr6TOvR1udSVWkJ02dR4H
 s9km3lNLgoUPCYCLBMlZl7em4T49E09/+4YCrnj/Ezp+YdImf2+QzZyd/gG3ITl2
 fW7lpbK1dx3d/19JFP6Xkj9PaIlMl9e8Ne04G+Dabv67uN+0U+g=
 =Z4rz
 -----END PGP SIGNATURE-----

Merge 5.10.137 into android12-5.10-lts

Changes in 5.10.137
	Makefile: link with -z noexecstack --no-warn-rwx-segments
	x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
	Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"
	scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
	ALSA: bcd2000: Fix a UAF bug on the error path of probing
	ALSA: hda/realtek: Add quirk for Clevo NV45PZ
	ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
	wifi: mac80211_hwsim: fix race condition in pending packet
	wifi: mac80211_hwsim: add back erroneously removed cast
	wifi: mac80211_hwsim: use 32-bit skb cookie
	add barriers to buffer_uptodate and set_buffer_uptodate
	HID: wacom: Only report rotation for art pen
	HID: wacom: Don't register pad_input for touch switch
	KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
	KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case
	KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
	KVM: s390: pv: don't present the ecall interrupt twice
	KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value
	KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
	KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
	KVM: x86: Tag kvm_mmu_x86_module_init() with __init
	riscv: set default pm_power_off to NULL
	mm: Add kvrealloc()
	xfs: only set IOMAP_F_SHARED when providing a srcmap to a write
	xfs: fix I_DONTCACHE
	mm/mremap: hold the rmap lock in write mode when moving page table entries.
	ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
	ALSA: hda/cirrus - support for iMac 12,1 model
	ALSA: hda/realtek: Add quirk for another Asus K42JZ model
	ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED
	tty: vt: initialize unicode screen buffer
	vfs: Check the truncate maximum size in inode_newsize_ok()
	fs: Add missing umask strip in vfs_tmpfile
	thermal: sysfs: Fix cooling_device_stats_setup() error code path
	fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
	fbcon: Fix accelerated fbdev scrolling while logo is still shown
	usbnet: Fix linkwatch use-after-free on disconnect
	ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
	parisc: Fix device names in /proc/iomem
	parisc: Check the return value of ioremap() in lba_driver_probe()
	parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode
	drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error
	drm/vc4: hdmi: Disable audio if dmas property is present but empty
	drm/nouveau: fix another off-by-one in nvbios_addr
	drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend()
	drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime
	drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
	mtd: rawnand: arasan: Update NAND bus clock instead of system clock
	iio: light: isl29028: Fix the warning in isl29028_remove()
	scsi: sg: Allow waiting for commands to complete on removed device
	scsi: qla2xxx: Fix incorrect display of max frame size
	scsi: qla2xxx: Zero undefined mailbox IN registers
	fuse: limit nsec
	serial: mvebu-uart: uart2 error bits clearing
	md-raid: destroy the bitmap after destroying the thread
	md-raid10: fix KASAN warning
	media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator
	ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
	PCI: Add defines for normal and subtractive PCI bridges
	powerpc/fsl-pci: Fix Class Code of PCIe Root Port
	powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
	powerpc/powernv: Avoid crashing if rng is NULL
	MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	coresight: Clear the connection field properly
	usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
	USB: HCD: Fix URB giveback issue in tasklet function
	ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
	arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
	usb: dwc3: gadget: refactor dwc3_repare_one_trb
	usb: dwc3: gadget: fix high speed multiplier setting
	lockdep: Allow tuning tracing capacity constants.
	netfilter: nf_tables: do not allow SET_ID to refer to another table
	netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
	netfilter: nf_tables: do not allow RULE_ID to refer to another chain
	netfilter: nf_tables: fix null deref due to zeroed list head
	epoll: autoremove wakers even more aggressively
	x86: Handle idle=nomwait cmdline properly for x86_idle
	arm64: Do not forget syscall when starting a new thread.
	arm64: fix oops in concurrently setting insn_emulation sysctls
	ext2: Add more validity checks for inode counts
	genirq: Don't return error on missing optional irq_request_resources()
	irqchip/mips-gic: Only register IPI domain when SMP is enabled
	genirq: GENERIC_IRQ_IPI depends on SMP
	irqchip/mips-gic: Check the return value of ioremap() in gic_of_init()
	wait: Fix __wait_event_hrtimeout for RT/DL tasks
	ARM: dts: imx6ul: add missing properties for sram
	ARM: dts: imx6ul: change operating-points to uint32-matrix
	ARM: dts: imx6ul: fix keypad compatible
	ARM: dts: imx6ul: fix csi node compatible
	ARM: dts: imx6ul: fix lcdif node compatible
	ARM: dts: imx6ul: fix qspi node compatible
	ARM: dts: BCM5301X: Add DT for Meraki MR26
	spi: synquacer: Add missing clk_disable_unprepare()
	ARM: OMAP2+: display: Fix refcount leak bug
	ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks
	ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk
	ACPI: PM: save NVS memory for Lenovo G40-45
	ACPI: LPSS: Fix missing check in register_device_clock()
	arm64: dts: qcom: ipq8074: fix NAND node name
	arm64: dts: allwinner: a64: orangepi-win: Fix LED node name
	ARM: shmobile: rcar-gen2: Increase refcount for new reference
	firmware: tegra: Fix error check return value of debugfs_create_file()
	PM: hibernate: defer device probing when resuming from hibernation
	selinux: Add boundary check in put_entry()
	powerpc/64s: Disable stack variable initialisation for prom_init
	spi: spi-rspi: Fix PIO fallback on RZ platforms
	ARM: findbit: fix overflowing offset
	meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
	arm64: dts: renesas: beacon: Fix regulator node names
	ARM: bcm: Fix refcount leak in bcm_kona_smc_init
	ACPI: processor/idle: Annotate more functions to live in cpuidle section
	ARM: dts: imx7d-colibri-emmc: add cpu1 supply
	Input: atmel_mxt_ts - fix up inverted RESET handler
	soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values
	soc: amlogic: Fix refcount leak in meson-secure-pwrc.c
	arm64: dts: renesas: Fix thermal-sensors on single-zone sensors
	x86/pmem: Fix platform-device leak in error path
	ARM: dts: ast2500-evb: fix board compatible
	ARM: dts: ast2600-evb: fix board compatible
	hexagon: select ARCH_WANT_LD_ORPHAN_WARN
	arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1
	locking/lockdep: Fix lockdep_init_map_*() confusion
	soc: fsl: guts: machine variable might be unset
	block: fix infinite loop for invalid zone append
	ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg
	ARM: OMAP2+: Fix refcount leak in omapdss_init_of
	ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
	cpufreq: zynq: Fix refcount leak in zynq_get_revision
	regulator: qcom_smd: Fix pm8916_pldo range
	ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
	soc: qcom: ocmem: Fix refcount leak in of_get_ocmem
	soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register
	ARM: dts: qcom: pm8841: add required thermal-sensor-cells
	bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
	arm64: dts: mt7622: fix BPI-R64 WPS button
	arm64: tegra: Fix SDMMC1 CD on P2888
	erofs: avoid consecutive detection for Highmem memory
	blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
	hwmon: (drivetemp) Add module alias
	block: remove the request_queue to argument request based tracepoints
	blktrace: Trace remapped requests correctly
	regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
	soc: qcom: Make QCOM_RPMPD depend on PM
	arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment
	drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX
	nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
	selftests/seccomp: Fix compile warning when CC=clang
	thermal/tools/tmon: Include pthread and time headers in tmon.h
	dm: return early from dm_pr_call() if DM device is suspended
	pwm: sifive: Don't check the return code of pwmchip_remove()
	pwm: sifive: Simplify offset calculation for PWMCMP registers
	pwm: sifive: Ensure the clk is enabled exactly once per running PWM
	pwm: sifive: Shut down hardware only after pwmchip_remove() completed
	pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource()
	drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function
	drm/bridge: tc358767: Make sure Refclk clock are enabled
	ath10k: do not enforce interrupt trigger type
	drm/st7735r: Fix module autoloading for Okaya RH128128T
	wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
	ath11k: fix netdev open race
	drm/mipi-dbi: align max_chunk to 2 in spi_transfer
	ath11k: Fix incorrect debug_mask mappings
	drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
	drm/mediatek: Modify dsi funcs to atomic operations
	drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs
	drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
	i2c: npcm: Remove own slave addresses 2:10
	i2c: npcm: Correct slave role behavior
	virtio-gpu: fix a missing check to avoid NULL dereference
	drm: adv7511: override i2c address of cec before accessing it
	crypto: sun8i-ss - do not allocate memory when handling hash requests
	crypto: sun8i-ss - fix error codes in allocate_flows()
	net: fix sk_wmem_schedule() and sk_rmem_schedule() errors
	i2c: Fix a potential use after free
	crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs()
	media: tw686x: Register the irq at the end of probe
	ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
	wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
	drm/radeon: fix incorrrect SPDX-License-Identifiers
	test_bpf: fix incorrect netdev features
	crypto: ccp - During shutdown, check SEV data pointer before using
	drm: bridge: adv7511: Add check for mipi_dsi_driver_register
	drm/mcde: Fix refcount leak in mcde_dsi_bind
	media: hdpvr: fix error value returns in hdpvr_read
	media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set
	media: tw686x: Fix memory leak in tw686x_video_init
	drm/vc4: plane: Remove subpixel positioning check
	drm/vc4: plane: Fix margin calculations for the right/bottom edges
	drm/vc4: dsi: Correct DSI divider calculations
	drm/vc4: dsi: Correct pixel order for DSI0
	drm/vc4: drv: Remove the DSI pointer in vc4_drv
	drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array
	drm/vc4: dsi: Introduce a variant structure
	drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type
	drm/vc4: dsi: Fix dsi0 interrupt support
	drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration
	drm/vc4: hdmi: Remove firmware logic for MAI threshold setting
	drm/vc4: hdmi: Avoid full hdmi audio fifo writes
	drm/vc4: hdmi: Don't access the connector state in reset if kmalloc fails
	drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling
	drm/vc4: hdmi: Fix timings for interlaced modes
	drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes
	crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE
	selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0
	drm/rockchip: vop: Don't crash for invalid duplicate_state()
	drm/rockchip: Fix an error handling path rockchip_dp_probe()
	drm/mediatek: dpi: Remove output format of YUV
	drm/mediatek: dpi: Only enable dpi after the bridge is enabled
	drm: bridge: sii8620: fix possible off-by-one
	lib: bitmap: order includes alphabetically
	lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc()
	hinic: Use the bitmap API when applicable
	net: hinic: fix bug that ethtool get wrong stats
	net: hinic: avoid kernel hung in hinic_get_stats64()
	drm/msm/mdp5: Fix global state lock backoff
	crypto: hisilicon/sec - fixes some coding style
	crypto: hisilicon/sec - don't sleep when in softirq
	crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq
	media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
	mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
	mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
	drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed.
	tcp: make retransmitted SKB fit into the send window
	libbpf: Fix the name of a reused map
	selftests: timers: valid-adjtimex: build fix for newer toolchains
	selftests: timers: clocksource-switch: fix passing errors from child
	bpf: Fix subprog names in stack traces.
	fs: check FMODE_LSEEK to control internal pipe splicing
	wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
	wifi: p54: Fix an error handling path in p54spi_probe()
	wifi: p54: add missing parentheses in p54_flush()
	selftests/bpf: fix a test for snprintf() overflow
	can: pch_can: do not report txerr and rxerr during bus-off
	can: rcar_can: do not report txerr and rxerr during bus-off
	can: sja1000: do not report txerr and rxerr during bus-off
	can: hi311x: do not report txerr and rxerr during bus-off
	can: sun4i_can: do not report txerr and rxerr during bus-off
	can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off
	can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off
	can: usb_8dev: do not report txerr and rxerr during bus-off
	can: error: specify the values of data[5..7] of CAN error frames
	can: pch_can: pch_can_error(): initialize errc before using it
	Bluetooth: hci_intel: Add check for platform_driver_register
	i2c: cadence: Support PEC for SMBus block read
	i2c: mux-gpmux: Add of_node_put() when breaking out of loop
	wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
	wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
	wifi: libertas: Fix possible refcount leak in if_usb_probe()
	media: cedrus: hevc: Add check for invalid timestamp
	net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version
	net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS
	crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq
	crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
	crypto: hisilicon/sec - fix auth key size error
	inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH()
	tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if()
	ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH()
	tcp: Fix data-races around sysctl_tcp_l3mdev_accept.
	net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
	iavf: Fix max_rate limiting
	netdevsim: Avoid allocation warnings triggered from user space
	net: rose: fix netdev reference changes
	net: ionic: fix error check for vlan flags in ionic_set_nic_features()
	dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
	wireguard: ratelimiter: use hrtimer in selftest
	wireguard: allowedips: don't corrupt stack when detecting overflow
	clk: renesas: r9a06g032: Fix UART clkgrp bitsel
	mtd: maps: Fix refcount leak in of_flash_probe_versatile
	mtd: maps: Fix refcount leak in ap_flash_init
	mtd: rawnand: meson: Fix a potential double free issue
	PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
	HID: cp2112: prevent a buffer overflow in cp2112_xfer()
	mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
	mtd: partitions: Fix refcount leak in parse_redboot_of
	mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
	fpga: altera-pr-ip: fix unsigned comparison with less than zero
	usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
	usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
	usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()
	usb: xhci: tegra: Fix error check
	netfilter: xtables: Bring SPDX identifier back
	iio: accel: bma400: Fix the scale min and max macro values
	platform/chrome: cros_ec: Always expose last resume result
	iio: accel: bma400: Reordering of header files
	clk: mediatek: reset: Fix written reset bit offset
	KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
	mwifiex: Ignore BTCOEX events from the 88W8897 firmware
	mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
	dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics
	misc: rtsx: Fix an error handling path in rtsx_pci_probe()
	driver core: fix potential deadlock in __driver_attach
	clk: qcom: clk-krait: unlock spin after mux completion
	usb: host: xhci: use snprintf() in xhci_decode_trb()
	clk: qcom: ipq8074: fix NSS core PLL-s
	clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
	clk: qcom: ipq8074: fix NSS port frequency tables
	clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
	clk: qcom: camcc-sdm845: Fix topology around titan_top power domain
	PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
	PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
	PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists
	soundwire: bus_type: fix remove and shutdown support
	KVM: arm64: Don't return from void function
	dmaengine: sf-pdma: apply proper spinlock flags in sf_pdma_prep_dma_memcpy()
	dmaengine: sf-pdma: Add multithread support for a DMA channel
	PCI: endpoint: Don't stop controller when unbinding endpoint function
	intel_th: Fix a resource leak in an error handling path
	intel_th: msu-sink: Potential dereference of null pointer
	intel_th: msu: Fix vmalloced buffers
	staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback
	mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
	memstick/ms_block: Fix some incorrect memory allocation
	memstick/ms_block: Fix a memory leak
	mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
	mmc: block: Add single read for 4k sector cards
	KVM: s390: pv: leak the topmost page table when destroy fails
	PCI/portdrv: Don't disable AER reporting in get_port_device_capability()
	PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
	scsi: smartpqi: Fix DMA direction for RAID requests
	xtensa: iss/network: provide release() callback
	xtensa: iss: fix handling error cases in iss_net_configure()
	usb: gadget: udc: amd5536 depends on HAS_DMA
	usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
	usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
	usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
	usb: dwc3: qcom: fix missing optional irq warnings
	eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
	interconnect: imx: fix max_node_id
	um: random: Don't initialise hwrng struct with zero
	RDMA/rtrs: Define MIN_CHUNK_SIZE
	RDMA/rtrs: Avoid Wtautological-constant-out-of-range-compare
	RDMA/rtrs-srv: Fix modinfo output for stringify
	RDMA/qedr: Improve error logs for rdma_alloc_tid error return
	RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
	RDMA/hns: Fix incorrect clearing of interrupt status register
	RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
	RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
	gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
	HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
	mmc: cavium-octeon: Add of_node_put() when breaking out of loop
	mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
	HID: alps: Declare U1_UNICORN_LEGACY support
	PCI: tegra194: Fix Root Port interrupt handling
	PCI: tegra194: Fix link up retry sequence
	USB: serial: fix tty-port initialized comments
	usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
	platform/olpc: Fix uninitialized data in debugfs write
	RDMA/srpt: Duplicate port name members
	RDMA/srpt: Introduce a reference count in struct srpt_device
	RDMA/srpt: Fix a use-after-free
	mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
	selftests: kvm: set rax before vmcall
	RDMA/mlx5: Add missing check for return value in get namespace flow
	RDMA/rxe: Fix error unwind in rxe_create_qp()
	null_blk: fix ida error handling in null_add_dev()
	nvme: use command_id instead of req->tag in trace_nvme_complete_rq()
	jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction()
	ext4: recover csum seed of tmp_inode after migrating to extents
	jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
	usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable()
	opp: Fix error check in dev_pm_opp_attach_genpd()
	ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe
	ASoC: samsung: Fix error handling in aries_audio_probe
	ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
	ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe
	ASoC: codecs: da7210: add check for i2c_add_driver
	ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
	serial: 8250: Export ICR access helpers for internal use
	serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
	ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV
	ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
	rpmsg: mtk_rpmsg: Fix circular locking dependency
	remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
	selftests/livepatch: better synchronize test_klp_callbacks_busy
	profiling: fix shift too large makes kernel panic
	ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header
	powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable
	ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables
	tty: n_gsm: Delete gsmtty open SABM frame when config requester
	tty: n_gsm: fix user open not possible at responder until initiator open
	tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()
	tty: n_gsm: fix non flow control frames during mux flow off
	tty: n_gsm: fix packet re-transmission without open control channel
	tty: n_gsm: fix race condition in gsmld_write()
	ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe()
	remoteproc: qcom: wcnss: Fix handling of IRQs
	vfio: Remove extra put/gets around vfio_device->group
	vfio: Simplify the lifetime logic for vfio_device
	vfio: Split creation of a vfio_device into init and register ops
	vfio/mdev: Make to_mdev_device() into a static inline
	vfio/ccw: Do not change FSM state in subchannel event
	tty: n_gsm: fix wrong T1 retry count handling
	tty: n_gsm: fix DM command
	tty: n_gsm: fix missing corner cases in gsmld_poll()
	iommu/exynos: Handle failed IOMMU device registration properly
	rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
	kfifo: fix kfifo_to_user() return type
	lib/smp_processor_id: fix imbalanced instrumentation_end() call
	remoteproc: sysmon: Wait for SSCTL service to come up
	mfd: t7l66xb: Drop platform disable callback
	mfd: max77620: Fix refcount leak in max77620_initialise_fps
	iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
	perf tools: Fix dso_id inode generation comparison
	s390/dump: fix old lowcore virtual vs physical address confusion
	s390/zcore: fix race when reading from hardware system area
	ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format
	ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
	fuse: Remove the control interface for virtio-fs
	ASoC: audio-graph-card: Add of_node_put() in fail path
	watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
	video: fbdev: amba-clcd: Fix refcount leak bugs
	video: fbdev: sis: fix typos in SiS_GetModeID()
	ASoC: mchp-spdifrx: disable end of block interrupt on failures
	powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32
	powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
	f2fs: don't set GC_FAILURE_PIN for background GC
	f2fs: write checkpoint during FG_GC
	f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
	powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
	powerpc/xive: Fix refcount leak in xive_get_max_prio
	powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
	perf symbol: Fail to read phdr workaround
	kprobes: Forbid probing on trampoline and BPF code areas
	powerpc/pci: Fix PHB numbering when using opal-phbid
	genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
	scripts/faddr2line: Fix vmlinux detection on arm64
	sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy()
	sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
	x86/numa: Use cpumask_available instead of hardcoded NULL check
	video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
	tools/thermal: Fix possible path truncations
	sched: Fix the check of nr_running at queue wakelist
	x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y
	video: fbdev: vt8623fb: Check the size of screen before memset_io()
	video: fbdev: arkfb: Check the size of screen before memset_io()
	video: fbdev: s3fb: Check the size of screen before memset_io()
	scsi: zfcp: Fix missing auto port scan and thus missing target ports
	scsi: qla2xxx: Fix discovery issues in FC-AL topology
	scsi: qla2xxx: Turn off multi-queue for 8G adapters
	scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection
	scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os
	scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests
	x86/bugs: Enable STIBP for IBPB mitigated RETBleed
	ftrace/x86: Add back ftrace_expected assignment
	x86/olpc: fix 'logical not is only applied to the left hand side'
	posix-cpu-timers: Cleanup CPU timers before freeing them during exec
	Input: gscps2 - check return value of ioremap() in gscps2_probe()
	__follow_mount_rcu(): verify that mount_lock remains unchanged
	spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
	drm/i915/dg1: Update DMC_DEBUG3 register
	drm/mediatek: Allow commands to be sent during video mode
	drm/mediatek: Keep dsi as LP00 before dcs cmds transfer
	HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx
	HID: hid-input: add Surface Go battery quirk
	drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component
	mtd: rawnand: Add a helper to clarify the interface configuration
	mtd: rawnand: arasan: Check the proposed data interface is supported
	mtd: rawnand: Add NV-DDR timings
	mtd: rawnand: arasan: Fix a macro parameter
	mtd: rawnand: arasan: Support NV-DDR interface
	mtd: rawnand: arasan: Fix clock rate in NV-DDR
	usbnet: smsc95xx: Don't clear read-only PHY interrupt
	usbnet: smsc95xx: Avoid link settings race on interrupt reception
	firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
	intel_th: pci: Add Meteor Lake-P support
	intel_th: pci: Add Raptor Lake-S PCH support
	intel_th: pci: Add Raptor Lake-S CPU support
	KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors
	KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS)
	iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
	PCI/AER: Write AER Capability only when we control it
	PCI/ERR: Bind RCEC devices to the Root Port driver
	PCI/ERR: Rename reset_link() to reset_subordinates()
	PCI/ERR: Simplify by using pci_upstream_bridge()
	PCI/ERR: Simplify by computing pci_pcie_type() once
	PCI/ERR: Use "bridge" for clarity in pcie_do_recovery()
	PCI/ERR: Avoid negated conditional for clarity
	PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery()
	PCI/ERR: Recover from RCEC AER errors
	PCI/AER: Iterate over error counters instead of error strings
	serial: 8250: Dissociate 4MHz Titan ports from Oxford ports
	serial: 8250: Correct the clock for OxSemi PCIe devices
	serial: 8250_pci: Refactor the loop in pci_ite887x_init()
	serial: 8250_pci: Replace dev_*() by pci_*() macros
	serial: 8250: Fold EndRun device support into OxSemi Tornado code
	dm writecache: set a default MAX_WRITEBACK_JOBS
	kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
	dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
	timekeeping: contribute wall clock to rng on time change
	um: Allow PM with suspend-to-idle
	btrfs: reject log replay if there is unsupported RO compat flag
	btrfs: reset block group chunk force if we have to wait
	ACPI: CPPC: Do not prevent CPPC from working in the future
	KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4()
	KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4()
	KVM: SVM: Drop VMXE check from svm_set_cr4()
	KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops hook
	KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4
	KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh
	KVM: x86/pmu: Use binary search to check filtered events
	KVM: x86/pmu: Use different raw event masks for AMD and Intel
	KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter
	KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU
	KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl
	xen-blkback: fix persistent grants negotiation
	xen-blkback: Apply 'feature_persistent' parameter when connect
	xen-blkfront: Apply 'feature_persistent' parameter when connect
	KEYS: asymmetric: enforce SM2 signature use pkey algo
	tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH
	tracing: Use a struct alignof to determine trace event field alignment
	ext4: check if directory block is within i_size
	ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
	ext4: fix warning in ext4_iomap_begin as race between bmap and write
	ext4: make sure ext4_append() always allocates new block
	ext4: fix use-after-free in ext4_xattr_set_entry
	ext4: update s_overhead_clusters in the superblock during an on-line resize
	ext4: fix extent status tree race in writeback error recovery path
	ext4: correct max_inline_xattr_value_size computing
	ext4: correct the misjudgment in ext4_iget_extra_inode
	dm raid: fix address sanitizer warning in raid_resume
	dm raid: fix address sanitizer warning in raid_status
	net_sched: cls_route: remove from list when handle is 0
	KVM: Add infrastructure and macro to mark VM as bugged
	KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
	KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
	mac80211: fix a memory leak where sta_info is not freed
	tcp: fix over estimation in sk_forced_mem_schedule()
	Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
	drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function
	drm/vc4: change vc4_dma_range_matches from a global to static
	Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
	Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
	mtd: rawnand: arasan: Prevent an unsupported configuration
	kvm: x86/pmu: Fix the compare function used by the pmu event filter
	tee: add overflow check in register_shm_helper()
	net/9p: Initialize the iounit field during fid creation
	net_sched: cls_route: disallow handle of 0
	sched/fair: Fix fault in reweight_entity
	btrfs: only write the sectors in the vertical stripe which has data stripes
	btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
	Linux 5.10.137

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5775ddfad6460c5a737b1ad3f8e0b8f798338786
2022-08-29 16:53:14 +02:00
Jiachen Zhang
542d2e799d ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
commit dd524b7f317de8d31d638cbfdc7be4cf9b770e42 upstream.

Some code paths cannot guarantee the inode have any dentry alias. So
WARN_ON() all !dentry may flood the kernel logs.

For example, when an overlayfs inode is watched by inotifywait (1), and
someone is trying to read the /proc/$(pidof inotifywait)/fdinfo/INOTIFY_FD,
at that time if the dentry has been reclaimed by kernel (such as
echo 2 > /proc/sys/vm/drop_caches), there will be a WARN_ON(). The
printed call stack would be like:

    ? show_mark_fhandle+0xf0/0xf0
    show_mark_fhandle+0x4a/0xf0
    ? show_mark_fhandle+0xf0/0xf0
    ? seq_vprintf+0x30/0x50
    ? seq_printf+0x53/0x70
    ? show_mark_fhandle+0xf0/0xf0
    inotify_fdinfo+0x70/0x90
    show_fdinfo.isra.4+0x53/0x70
    seq_show+0x130/0x170
    seq_read+0x153/0x440
    vfs_read+0x94/0x150
    ksys_read+0x5f/0xe0
    do_syscall_64+0x59/0x1e0
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

So let's drop WARN_ON() to avoid kernel log flooding.

Reported-by: Hongbo Yin <yinhongbo@bytedance.com>
Signed-off-by: Jiachen Zhang <zhangjiachen.jaycee@bytedance.com>
Signed-off-by: Tianci Zhang <zhangtianci.1997@bytedance.com>
Fixes: 8ed5eec9d6 ("ovl: encode pure upper file handles")
Cc: <stable@vger.kernel.org> # v4.16
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-21 15:15:23 +02:00
Greg Kroah-Hartman
f45f895af5 Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

2c152aa329 UPSTREAM: f2fs: reduce the scope of setting fsck tag when de->name_len is zero
c29dd368ef ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
428d0bb762 ANDROID: Add initial ASUS symbol list
87a74496ed ANDROID: configfs: add proper module namespace marking
b7a6c15a6f ANDROID: Configure out the macros in android_kabi and android_vendor
bdc772adbd ANDROID: kernel: fix debug_kinfo set twice crash issue
d483eed85f ANDROID: GKI: set vfs-only exports into their own namespace
27fc5a7c69 UPSTREAM: net/packet: rx_owner_map depends on pg_vec
f70ea63f3b ANDROID: GKI: Update symbols to symbol list
a593acdae8 FROMLIST: module.h: allow #define strings to work with MODULE_IMPORT_NS
eb171b4cbe FROMLIST: export: fix string handling of namespace in EXPORT_SYMBOL_NS
05c23b7a50 ANDROID: vendor_hooks: Add hooks for binder
e99926fdfa ANDROID: mm/oom_kill: allow process_mrelease reclaim memory in parallel with exit_mmap
f4f2c619d5 FROMLIST: mm/oom_kill: allow process_mrelease to run under mmap_lock protection
2452622293 FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap
fd7af95538 UPSTREAM: mm/oom_kill.c: prevent a race between process_mrelease and exit_mmap
fe50dcab7a UPSTREAM: mm: wire up syscall process_mrelease
7fc3ac4968 UPSTREAM: mm: introduce process_mrelease system call
ac44888155 Revert "FROMGIT: mm: improve mprotect(R|W) efficiency on pages referenced once"
3a624c9ccd ANDROID: fips140: add show_invalid_inputs command to fips140_lab_util
a481d43521 ANDROID: fips140: refactor and rename fips140_lab_test
d4b5ca56b5 ANDROID: GKI: add lenovo symbol list
47874cc690 ANDROID: abi_gki_aarch64_qcom: Add rproc_set_firmware
c41767a8ec UPSTREAM: remoteproc: Add a rproc_set_firmware() API
28d62c68d1 FROMGIT: iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
99ad261273 UPSTREAM: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
282a4de8f0 UPSTREAM: sctp: validate chunk size in __rcv_asconf_lookup
fef7dba3a7 UPSTREAM: bpf: Fix integer overflow in prealloc_elems_and_freelist()
893425f545 ANDROID: GKI: Update symbol list
cef0df2218 ANDROID: ABI: update allowed list for galaxy
a7ab784f60 ANDROID: vendor_hooks: Add hooks for futex
84fc3abca0 ANDROID: dma-contiguous: Add tracehook to allow subpage allocations in dma_alloc_contiguous
d94655c43e ANDROID: Update the ABI xml and symbol list
414c32d38e UPSTREAM: ALSA: memalloc: Align buffer allocations in page size
75617df5b3 ANDROID: Fix mmu_notifier_trylock definition for !CONFIG_MMU_NOTIFIER config
7531e63661 FROMGIT: USB: gadget: bRequestType is a bitfield, not a enum
70c9301d9c ANDROID: qcom: Add flush_delayed_fput to ABI
5d8520b557 ANDROID: fix ABI breakage caused by mm_struct->mmu_notifier_lock addition
a4d26b9a4b ANDROID: fix ABI breakage caused by percpu_rw_semaphore changes
6971350406 ANDROID: fix mmu_notifier race caused by not taking mmap_lock during SPF
2fc2c66b9c ANDROID: percpu-rwsem: enable percpu_sem destruction in atomic context
f3f87608d8 FROMLIST: virtio_mmio: pm: Add notification handlers for restore and freeze
9180348b91 FROMLIST: virtio: do not reset stateful devices on resume
392cb940f6 FROMGIT: f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
ddd9e01504 UPSTREAM: mm, slub: fix incorrect memcg slab count for bulk free
82ac5b0b1d UPSTREAM: mm, slub: fix potential use-after-free in slab_debugfs_fops
e07a663f5d UPSTREAM: mm, slub: fix potential memoryleak in kmem_cache_open()
cd02f347ab UPSTREAM: mm, slub: fix mismatch between reconstructed freelist depth and cnt
6b6725f77d UPSTREAM: mm, slub: fix two bugs in slab_debug_trace_open()
791f85d16d UPSTREAM: mm, slub: allocate private object map for debugfs listings
1260b47d4f FROMGIT: dma-buf: remove restriction of IOCTL:DMA_BUF_SET_NAME
e80be54e4b UPSTREAM: usb: dwc3: core: balance phy init and exit
89137e0047 UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs.
f37b6d79f8 ANDROID: mm/memory_hotplug: Don't special case memory_block_size_bytes
8b7ffd60a5 UPSTREAM: usb: gadget: uvc: fix multiple opens
ae22ebebbb UPSTREAM: aio: fix use-after-free due to missing POLLFREE handling
b9c8788830 UPSTREAM: aio: keep poll requests on waitqueue until completed
f965176884 UPSTREAM: signalfd: use wake_up_pollfree()
49744a390d UPSTREAM: binder: use wake_up_pollfree()
e50fe1de2f UPSTREAM: wait: add wake_up_pollfree()
53afb231f5 UPSTREAM: USB: gadget: zero allocate endpoint 0 buffers
593309a377 BACKPORT: scsi: ufs: Improve SCSI abort handling further
21949c429a FROMGIT: scsi: ufs: Introduce ufshcd_release_scsi_cmd()
d600bdedac FROMGIT: scsi: ufs: Remove the 'update_scaling' local variable
5f9614157c UPSTREAM: scsi: ufs: core: Fix another task management completion race
76760a995c BACKPORT: scsi: ufs: core: Fix task management completion timeout race
dab2a8a288 ANDROID: qcom: Add android_rvh_do_ptrauth_fault to ABI
b4604acd52 UPSTREAM: USB: gadget: detect too-big endpoint 0 requests
2d6a43c036 ANDROID: ABI: Add symbols used by frame buffer driver
183905923f UPSTREAM: xhci: Add bus number to some debug messages
5b15c955a6 UPSTREAM: xhci: Add additional dynamic debug to follow URBs in cancel and error cases.
f4cbe34956 UPSTREAM: Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
c23b0e7c47 UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs.
7320fb1abd UPSTREAM: HID: check for valid USB device for many HID drivers
e98c96b8b8 UPSTREAM: HID: wacom: fix problems when device is not a valid USB device
5a72ef56c8 UPSTREAM: HID: bigbenff: prevent null pointer dereference
7b8a19b917 UPSTREAM: HID: add USB_HID dependancy on some USB HID drivers
8219b106a3 UPSTREAM: HID: add USB_HID dependancy to hid-chicony
a4909c90b7 UPSTREAM: HID: add USB_HID dependancy to hid-prodikeys
ddea17081f UPSTREAM: HID: add hid_is_usb() function to make it simpler for USB detection
81b6ea435e FROMGIT: clk: Don't parent clks until the parent is fully registered
78ea29e570 UPSTREAM: mm/gup: remove the vma allocation from gup_longterm_locked()
709fde7c61 BACKPORT: usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
ea4a92c6af ANDROID: ABI: Add iio_write_channel_raw symbol
f803f248dd ANDROID: GKI: Update symbols to symbol list
672d51b2a7 UPSTREAM: ASoC: dapm: use component prefix when checking widget names
686cd3b2d8 ANDROID: ABI: Add symbols used by clocksource driver
80c1cef2d1 ANDROID: GKI: Export clocksource_mmio_init
84881c68b1 ANDROID: GKI: Export sched_clock_register
9e5446d7de FROMGIT: f2fs: show number of pending discard commands
28de741861 ANDROID: workqueue: export symbol of the function wq_worker_comm()
71f00d64c1 ANDROID: GKI: Update symbols to symbol list
05aa93d251 ANDROID: vendor_hooks: Add hooks for binder proc transaction

Also update the .xml file for the following new symbols that are now
being tracked:

Leaf changes summary: 165 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 154 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 11 Added variables

154 Added functions:

  [A] 'function void __bforget(buffer_head*)'
  [A] 'function ssize_t __blockdev_direct_IO(kiocb*, inode*, block_device*, iov_iter*, get_block_t*, dio_iodone_t*, dio_submit_t*, int)'
  [A] 'function buffer_head* __bread_gfp(block_device*, sector_t, unsigned int, gfp_t)'
  [A] 'function void __breadahead(block_device*, sector_t, unsigned int)'
  [A] 'function void __brelse(buffer_head*)'
  [A] 'function void __cancel_dirty_page(page*)'
  [A] 'function void __cleancache_invalidate_inode(address_space*)'
  [A] 'function void __filemap_set_wb_err(address_space*, int)'
  [A] 'function void __insert_inode_hash(inode*, unsigned long int)'
  [A] 'function void __mark_inode_dirty(inode*, int)'
  [A] 'function void __pagevec_release(pagevec*)'
  [A] 'function void __remove_inode_hash(inode*)'
  [A] 'function int __set_page_dirty_buffers(page*)'
  [A] 'function int __set_page_dirty_nobuffers(page*)'
  [A] 'function int __test_set_page_writeback(page*, bool)'
  [A] 'function int __traceiter_android_vh_binder_free_proc(void*, binder_proc*)'
  [A] 'function int __traceiter_android_vh_binder_has_work_ilocked(void*, binder_thread*, bool, int*)'
  [A] 'function int __traceiter_android_vh_binder_looper_state_registered(void*, binder_thread*, binder_proc*)'
  [A] 'function int __traceiter_android_vh_binder_proc_transaction_end(void*, task_struct*, task_struct*, task_struct*, unsigned int, bool, bool)'
  [A] 'function int __traceiter_android_vh_binder_read_done(void*, binder_proc*, binder_thread*)'
  [A] 'function int __traceiter_android_vh_binder_thread_read(void*, list_head**, binder_proc*, binder_thread*)'
  [A] 'function int __traceiter_android_vh_binder_thread_release(void*, binder_proc*, binder_thread*)'
  [A] 'function int __traceiter_android_vh_futex_sleep_start(void*, task_struct*)'
  [A] 'function int __traceiter_block_bio_remap(void*, request_queue*, bio*, dev_t, sector_t)'
  [A] 'function int add_to_page_cache_locked(page*, address_space*, unsigned long int, gfp_t)'
  [A] 'function bio* bio_split(bio*, int, gfp_t, bio_set*)'
  [A] 'function wait_queue_head* bit_waitqueue(void*, int)'
  [A] 'function blk_plug_cb* blk_check_plugged(blk_plug_cb_fn, void*, int)'
  [A] 'function void blk_queue_max_write_same_sectors(request_queue*, unsigned int)'
  [A] 'function int blkdev_issue_discard(block_device*, sector_t, sector_t, gfp_t, unsigned long int)'
  [A] 'function void block_invalidatepage(page*, unsigned int, unsigned int)'
  [A] 'function int block_is_partially_uptodate(page*, unsigned long int, unsigned long int)'
  [A] 'function int buffer_migrate_page(address_space*, page*, page*, migrate_mode)'
  [A] 'function bool capable_wrt_inode_uidgid(const inode*, int)'
  [A] 'function void clean_bdev_aliases(block_device*, sector_t, sector_t)'
  [A] 'function void clear_inode(inode*)'
  [A] 'function int clear_page_dirty_for_io(page*)'
  [A] 'function int clk_set_duty_cycle(clk*, unsigned int, unsigned int)'
  [A] 'function int clocksource_mmio_init(void*, const char*, unsigned long int, int, unsigned int, typedef u64 (clocksource*)*)'
  [A] 'function u64 clocksource_mmio_readl_up(clocksource*)'
  [A] 'function void create_empty_buffers(page*, unsigned long int, unsigned long int)'
  [A] 'function int current_umask()'
  [A] 'function dentry* d_add_ci(dentry*, inode*, qstr*)'
  [A] 'function void d_instantiate(dentry*, inode*)'
  [A] 'function dentry* d_obtain_alias(inode*)'
  [A] 'function dentry* d_splice_alias(inode*, dentry*)'
  [A] 'function void delete_from_page_cache(page*)'
  [A] 'function void disk_stack_limits(gendisk*, block_device*, sector_t)'
  [A] 'function void drop_nlink(inode*)'
  [A] 'function void end_buffer_write_sync(buffer_head*, int)'
  [A] 'function void end_page_writeback(page*)'
  [A] 'function errseq_t errseq_set(errseq_t*, int)'
  [A] 'function int fb_get_options(const char*, char**)'
  [A] 'function int fiemap_fill_next_extent(fiemap_extent_info*, u64, u64, u64, u32)'
  [A] 'function int fiemap_prep(inode*, fiemap_extent_info*, u64, u64*, u32)'
  [A] 'function int file_remove_privs(file*)'
  [A] 'function int file_update_time(file*)'
  [A] 'function int file_write_and_wait_range(file*, loff_t, loff_t)'
  [A] 'function vm_fault_t filemap_fault(vm_fault*)'
  [A] 'function int filemap_fdatawait_range(address_space*, loff_t, loff_t)'
  [A] 'function int filemap_fdatawrite(address_space*)'
  [A] 'function int filemap_flush(address_space*)'
  [A] 'function int filemap_write_and_wait_range(address_space*, loff_t, loff_t)'
  [A] 'function file* filp_open(const char*, int, umode_t)'
  [A] 'function void flush_delayed_fput()'
  [A] 'function int freq_qos_remove_notifier(freq_constraints*, freq_qos_req_type, notifier_block*)'
  [A] 'function int generic_error_remove_page(address_space*, page*)'
  [A] 'function ssize_t generic_file_direct_write(kiocb*, iov_iter*)'
  [A] 'function int generic_file_mmap(file*, vm_area_struct*)'
  [A] 'function int generic_file_open(inode*, file*)'
  [A] 'function ssize_t generic_file_splice_read(file*, loff_t*, pipe_inode_info*, size_t, unsigned int)'
  [A] 'function void generic_fillattr(inode*, kstat*)'
  [A] 'function ssize_t generic_read_dir(file*, char*, size_t, loff_t*)'
  [A] 'function page* grab_cache_page_write_begin(address_space*, unsigned long int, unsigned int)'
  [A] 'function inode* iget5_locked(super_block*, unsigned long int, int (inode*, void*)*, int (inode*, void*)*, void*)'
  [A] 'function inode* igrab(inode*)'
  [A] 'function void ihold(inode*)'
  [A] 'function int iio_write_channel_raw(iio_channel*, int)'
  [A] 'function inode* ilookup5(super_block*, unsigned long int, int (inode*, void*)*, void*)'
  [A] 'function int in_group_p(kgid_t)'
  [A] 'function void inc_nlink(inode*)'
  [A] 'function void init_special_inode(inode*, umode_t, dev_t)'
  [A] 'function void inode_dio_wait(inode*)'
  [A] 'function void inode_init_once(inode*)'
  [A] 'function void inode_init_owner(inode*, const inode*, umode_t)'
  [A] 'function int inode_newsize_ok(const inode*, loff_t)'
  [A] 'function void inode_set_flags(inode*, unsigned int, unsigned int)'
  [A] 'function void io_schedule()'
  [A] 'function void iov_iter_advance(iov_iter*, size_t)'
  [A] 'function unsigned long int iov_iter_alignment(const iov_iter*)'
  [A] 'function size_t iov_iter_copy_from_user_atomic(page*, iov_iter*, unsigned long int, size_t)'
  [A] 'function int iov_iter_fault_in_readable(iov_iter*, size_t)'
  [A] 'function ssize_t iov_iter_get_pages(iov_iter*, page**, size_t, unsigned int, size_t*)'
  [A] 'function size_t iov_iter_single_seg_count(const iov_iter*)'
  [A] 'function bool is_bad_inode(inode*)'
  [A] 'function ssize_t iter_file_splice_write(pipe_inode_info*, file*, loff_t*, size_t, unsigned int)'
  [A] 'function ino_t iunique(super_block*, ino_t)'
  [A] 'function void kill_block_super(super_block*)'
  [A] 'function void ll_rw_block(int, int, int, buffer_head**)'
  [A] 'function nls_table* load_nls(char*)'
  [A] 'function nls_table* load_nls_default()'
  [A] 'function void lru_cache_add(page*)'
  [A] 'function void make_bad_inode(inode*)'
  [A] 'function void mark_buffer_async_write(buffer_head*)'
  [A] 'function void mark_buffer_dirty(buffer_head*)'
  [A] 'function void mark_buffer_write_io_error(buffer_head*)'
  [A] 'function void mark_page_accessed(page*)'
  [A] 'function void mnt_drop_write_file(file*)'
  [A] 'function int mnt_want_write_file(file*)'
  [A] 'function dentry* mount_bdev(file_system_type*, int, const char*, void*, int (super_block*, void*, int)*)'
  [A] 'function void mpage_readahead(readahead_control*, get_block_t*)'
  [A] 'function int mpage_readpage(page*, get_block_t*)'
  [A] 'function int notify_change(dentry*, iattr*, inode**)'
  [A] 'function unsigned long int page_cache_next_miss(address_space*, unsigned long int, unsigned long int)'
  [A] 'function unsigned long int page_cache_prev_miss(address_space*, unsigned long int, unsigned long int)'
  [A] 'function bool page_mapped(page*)'
  [A] 'function int page_mkclean(page*)'
  [A] 'function void page_zero_new_buffers(page*, unsigned int, unsigned int)'
  [A] 'function page* pagecache_get_page(address_space*, unsigned long int, int, gfp_t)'
  [A] 'function unsigned int pagevec_lookup_range(pagevec*, address_space*, unsigned long int*, unsigned long int)'
  [A] 'function unsigned int pagevec_lookup_range_tag(pagevec*, address_space*, unsigned long int*, unsigned long int, xa_mark_t)'
  [A] 'function void put_pages_list(list_head*)'
  [A] 'function gfp_t readahead_gfp_mask(address_space*)'
  [A] 'function int redirty_page_for_writepage(writeback_control*, page*)'
  [A] 'function int rproc_set_firmware(rproc*, const char*)'
  [A] 'function int sb_min_blocksize(super_block*, int)'
  [A] 'function int sb_set_blocksize(super_block*, int)'
  [A] 'function void sched_clock_register(typedef u64 ()*, int, unsigned long int)'
  [A] 'function int security_inode_init_security(inode*, inode*, const qstr*, const initxattrs, void*)'
  [A] 'function void set_nlink(inode*, unsigned int)'
  [A] 'function int setattr_prepare(dentry*, iattr*)'
  [A] 'function blk_qc_t submit_bio_noacct(bio*)'
  [A] 'function int sync_dirty_buffer(buffer_head*)'
  [A] 'function int sync_filesystem(super_block*)'
  [A] 'function int sync_inode_metadata(inode*, int)'
  [A] 'function void tag_pages_for_writeback(address_space*, unsigned long int, unsigned long int)'
  [A] 'function timespec64 timestamp_truncate(timespec64, inode*)'
  [A] 'function void touch_atime(const path*)'
  [A] 'function void truncate_inode_pages(address_space*, loff_t)'
  [A] 'function void truncate_inode_pages_final(address_space*)'
  [A] 'function void truncate_pagecache(inode*, loff_t)'
  [A] 'function void truncate_setsize(inode*, loff_t)'
  [A] 'function int try_to_release_page(page*, gfp_t)'
  [A] 'function void try_to_writeback_inodes_sb(super_block*, wb_reason)'
  [A] 'function void unload_nls(nls_table*)'
  [A] 'function void unlock_buffer(buffer_head*)'
  [A] 'function void unlock_new_inode(inode*)'
  [A] 'function void usbnet_cdc_unbind(usbnet*, usb_interface*)'
  [A] 'function int usbnet_generic_cdc_bind(usbnet*, usb_interface*)'
  [A] 'function void wait_on_page_bit(page*, int)'
  [A] 'function int wake_bit_function(wait_queue_entry*, unsigned int, int, void*)'
  [A] 'function void wq_worker_comm(char*, size_t, task_struct*)'
  [A] 'function int write_inode_now(inode*, int)'
  [A] 'function int write_one_page(page*)'

11 Added variables:

  [A] 'tracepoint __tracepoint_android_rvh_do_ptrauth_fault'
  [A] 'tracepoint __tracepoint_android_vh_binder_free_proc'
  [A] 'tracepoint __tracepoint_android_vh_binder_has_work_ilocked'
  [A] 'tracepoint __tracepoint_android_vh_binder_looper_state_registered'
  [A] 'tracepoint __tracepoint_android_vh_binder_proc_transaction_end'
  [A] 'tracepoint __tracepoint_android_vh_binder_read_done'
  [A] 'tracepoint __tracepoint_android_vh_binder_thread_read'
  [A] 'tracepoint __tracepoint_android_vh_binder_thread_release'
  [A] 'tracepoint __tracepoint_android_vh_futex_sleep_start'
  [A] 'tracepoint __tracepoint_android_vh_subpage_dma_contig_alloc'
  [A] 'tracepoint __tracepoint_block_bio_remap'

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I064b6ff0420cee2d64e17814f43fbff8e2d9b019

Change-Id: Ia880c70c912f2b801a770feb1fdc4f4eb390d34d
2022-01-17 18:47:02 +01:00
Greg Kroah-Hartman
d483eed85f ANDROID: GKI: set vfs-only exports into their own namespace
We have namespaces, so use them for all vfs-exported namespaces so that
filesystems can use them, but not anything else.

Some in-kernel drivers that do direct filesystem accesses (because they
serve up files) are also allowed access to these symbols to keep 'make
allmodconfig' builds working properly, but it is not needed for Android
kernel images.

Bug: 157965270
Bug: 210074446
Cc: Matthias Maennich <maennich@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iaf6140baf3a18a516ab2d5c3966235c42f3f70de
2022-01-11 09:30:47 +01:00
Greg Kroah-Hartman
ba13eb1927 This is the 5.10.88 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHC4kgACgkQONu9yGCS
 aT4l7w/8Da5EworPQ45NW5oEnNDU+tVjVft6yLyEjNhqe7/dXgden9MIhXl/rd38
 vIWHWxdR3g+h2aEBuQSFhkCYLgaiO822DWqx8XkK9F1EJWbypycb6IP/XVy7QqbX
 TyUakCg1hN0TcZ9qhkugRMqAmzt5X4K+R6LtvlfQT2GAlEchSzyAl0tvS594Oxi7
 tMo6SQfAdD+IWwg72t80odMANcoX7GIcv2Kn4UA+c8eDEdiD5MZQTbz6Xi28hKiE
 zN+GQ4wFgt0/+sWiKEGPW7hcs2hnIU/dEwmgim+mgQyMSx+d1EFNNPsOaXyuLAaE
 MLhhgyOn6ZYfAI6+2A3xDw6hnvHWT1xCDxfgfDhz24sHSQY5K96pFAB3DXsKm0nC
 LtpHZopqJ9T0t1JkPpHCqoXXmEZmvHUlYVWwvQAwDBbqEkJ/i/w9QTlSDDP1+K6r
 CLhGWo9titrpcpRLnbcrweXgjuiI13Rz5mlgKCafE/jEtR5jzZ2neBvTepzuGVrY
 OW6jVmOXmVQEl9O73uWUvTizyUq+nl78R1lr9Xva0SpX/OXKKfO3q2w36tTQNyf+
 /g7+sgTJcLax1eZh0n17xiKzQYzwn5FMYPhzUF6fc0Rrz1CUCt1nCjq28hMqG32v
 dOFYqU/CrfFMKfR0YiKI7tpSba8QNP8f0Ig+KzDE2dKA+Lty1kw=
 =fpH+
 -----END PGP SIGNATURE-----

Merge 5.10.88 into android12-5.10-lts

Changes in 5.10.88
	KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
	KVM: downgrade two BUG_ONs to WARN_ON_ONCE
	mac80211: fix regression in SSN handling of addba tx
	mac80211: mark TX-during-stop for TX in in_reconfig
	mac80211: send ADDBA requests using the tid/queue of the aggregation session
	mac80211: validate extended element ID is present
	firmware: arm_scpi: Fix string overflow in SCPI genpd driver
	bpf: Fix signed bounds propagation after mov32
	bpf: Make 32->64 bounds propagation slightly more robust
	bpf, selftests: Add test case trying to taint map value pointer
	virtio_ring: Fix querying of maximum DMA mapping size for virtio device
	vdpa: check that offsets are within bounds
	recordmcount.pl: look for jgnop instruction as well as bcrl on s390
	dm btree remove: fix use after free in rebalance_children()
	audit: improve robustness of the audit queue handling
	arm64: dts: imx8m: correct assigned clocks for FEC
	arm64: dts: imx8mp-evk: Improve the Ethernet PHY description
	arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge
	arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
	arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
	arm64: dts: rockchip: fix audio-supply for Rock Pi 4
	mac80211: track only QoS data frames for admission control
	tee: amdtee: fix an IS_ERR() vs NULL bug
	ceph: fix duplicate increment of opened_inodes metric
	ceph: initialize pathlen variable in reconnect_caps_cb
	ARM: socfpga: dts: fix qspi node compatible
	clk: Don't parent clks until the parent is fully registered
	soc: imx: Register SoC device only on i.MX boards
	virtio/vsock: fix the transport to work with VMADDR_CID_ANY
	selftests: net: Correct ping6 expected rc from 2 to 1
	s390/kexec_file: fix error handling when applying relocations
	sch_cake: do not call cake_destroy() from cake_init()
	inet_diag: fix kernel-infoleak for UDP sockets
	net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
	selftests: Add duplicate config only for MD5 VRF tests
	selftests: Fix raw socket bind tests with VRF
	selftests: Fix IPv6 address bind tests
	dmaengine: st_fdma: fix MODULE_ALIAS
	net/sched: sch_ets: don't remove idle classes from the round-robin list
	selftest/net/forwarding: declare NETIFS p9 p10
	drm/ast: potential dereference of null pointer
	mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
	mac80211: fix lookup when adding AddBA extension element
	flow_offload: return EOPNOTSUPP for the unsupported mpls action type
	rds: memory leak in __rds_conn_create()
	drm/amd/pm: fix a potential gpu_metrics_table memory leak
	mptcp: clear 'kern' flag from fallback sockets
	soc/tegra: fuse: Fix bitwise vs. logical OR warning
	igb: Fix removal of unicast MAC filters of VFs
	igbvf: fix double free in `igbvf_probe`
	igc: Fix typo in i225 LTR functions
	ixgbe: Document how to enable NBASE-T support
	ixgbe: set X550 MDIO speed before talking to PHY
	netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
	net/packet: rx_owner_map depends on pg_vec
	sfc_ef100: potential dereference of null pointer
	net: Fix double 0x prefix print in SKB dump
	net/smc: Prevent smc_release() from long blocking
	net: systemport: Add global locking for descriptor lifecycle
	sit: do not call ipip6_dev_free() from sit_init_net()
	bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
	powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
	USB: gadget: bRequestType is a bitfield, not a enum
	Revert "usb: early: convert to readl_poll_timeout_atomic()"
	KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES
	tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
	USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
	usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
	PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
	PCI/MSI: Mask MSI-X vectors only on success
	usb: xhci: Extend support for runtime power management for AMD's Yellow carp.
	USB: serial: cp210x: fix CP2105 GPIO registration
	USB: serial: option: add Telit FN990 compositions
	btrfs: fix memory leak in __add_inode_ref()
	btrfs: fix double free of anon_dev after failure to create subvolume
	zonefs: add MODULE_ALIAS_FS
	iocost: Fix divide-by-zero on donation from low hweight cgroup
	serial: 8250_fintek: Fix garbled text for console
	timekeeping: Really make sure wall_to_monotonic isn't positive
	libata: if T_LENGTH is zero, dma direction should be DMA_NONE
	drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
	Input: touchscreen - avoid bitwise vs logical OR warning
	ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
	xsk: Do not sleep in poll() when need_wakeup set
	media: mxl111sf: change mutex_init() location
	fuse: annotate lock in fuse_reverse_inval_entry()
	ovl: fix warning in ovl_create_real()
	scsi: scsi_debug: Don't call kcalloc() if size arg is zero
	scsi: scsi_debug: Fix type in min_t to avoid stack OOB
	scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
	rcu: Mark accesses to rcu_state.n_force_qs
	bus: ti-sysc: Fix variable set but not used warning for reinit_modules
	Revert "xsk: Do not sleep in poll() when need_wakeup set"
	xen/blkfront: harden blkfront against event channel storms
	xen/netfront: harden netfront against event channel storms
	xen/console: harden hvc_xen against event channel storms
	xen/netback: fix rx queue stall detection
	xen/netback: don't queue unlimited number of packages
	Linux 5.10.88

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie9143ca88b59cd27f4b2101e83e25017a5565c6a
2021-12-22 10:12:32 +01:00
Miklos Szeredi
6859985a2f ovl: fix warning in ovl_create_real()
commit 1f5573cfe7a7056e80a92c7a037a3e69f3a13d1c upstream.

Syzbot triggered the following warning in ovl_workdir_create() ->
ovl_create_real():

	if (!err && WARN_ON(!newdentry->d_inode)) {

The reason is that the cgroup2 filesystem returns from mkdir without
instantiating the new dentry.

Weird filesystems such as this will be rejected by overlayfs at a later
stage during setup, but to prevent such a warning, call ovl_mkdir_real()
directly from ovl_workdir_create() and reject this case early.

Reported-and-tested-by: syzbot+75eab84fd0af9e8bf66b@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-22 09:30:58 +01:00
Greg Kroah-Hartman
1b71a028a2 This is the 5.10.84 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGwZtwACgkQONu9yGCS
 aT7dQhAAjnlFKkXb+omHKQNkSHbD0ynEkxwtQfNFt1kcWcpJy5Df9xyNXQBohnqr
 Y0KUowpVF8gkXOelbdMrK5P6k28SpT2k+UMnUtZLNR6qMNlOY371BDasfi/dqWWR
 1JdLtQe6JVvwxo+6INRqEO27Ocyc1PbLZSo7i3Ik2+7mIRjN7+k1apFG0HOLEHIP
 3oMWDgnyQp3gTBvTFG0Vrd4f9AwrHq4JoVrhruNLqIYajlQ8dPPjuJ9alTifRddD
 eWY10Z21jAFib4WHgy6wXBVv3L5Np19liYMzv02o5pzFV1nLJCnKDA79jV7a2i2H
 lVmVpcWG0Yagyu8MW0hmOewqPXpAJH/C8g75mXeja546vCnvccNx1OXNOR4ux5Es
 IpEFAV+DnjSYgu88Cw6kF8j/B9x1n90sgywCWbRwAMJ1zX9/tvvLWSe8HpfZ2jvo
 Iuw6XDTL84DDuHY4yiK2fofxZvXp+Hk+c0Betu6GoQvoGaDRD8IWIceDWgiqy+V7
 fOrLitl8lbk1yjD7bDZMpEIgzQaaxJu6d+YWzy+PibZxQzOKHPC5gqEmajJd7ZWm
 OJ48SrNxyfjRZP/3NBgXOxje3lz3WkCdiPQrSQOQxoe+kdW5ZFuXDapWSO4dZfSe
 6XPOD/d+KVLNDQby3WnVB2MMlufHFnCs4wPgb13jfyiEbxifp+A=
 =D40k
 -----END PGP SIGNATURE-----

Merge 5.10.84 into android12-5.10-lts

Changes in 5.10.84
	NFSv42: Fix pagecache invalidation after COPY/CLONE
	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
	ovl: simplify file splice
	ovl: fix deadlock in splice write
	gfs2: release iopen glock early in evict
	gfs2: Fix length of holes reported at end-of-file
	powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory"
	drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
	mac80211: do not access the IV when it was stripped
	net/smc: Transfer remaining wait queue entries during fallback
	atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
	net: return correct error code
	platform/x86: thinkpad_acpi: Add support for dual fan control
	platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
	s390/setup: avoid using memblock_enforce_memory_limit
	btrfs: check-integrity: fix a warning on write caching disabled disk
	thermal: core: Reset previous low and high trip during thermal zone init
	scsi: iscsi: Unblock session then wake up error handler
	drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
	drm/amd/amdgpu: fix potential memleak
	ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
	ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
	ipv6: check return value of ipv6_skip_exthdr
	net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
	net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
	perf inject: Fix ARM SPE handling
	perf hist: Fix memory leak of a perf_hpp_fmt
	perf report: Fix memory leaks around perf_tip()
	net/smc: Avoid warning of possible recursive locking
	ACPI: Add stubs for wakeup handler functions
	vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
	kprobes: Limit max data_size of the kretprobe instances
	rt2x00: do not mark device gone on EPROTO errors during start
	ipmi: Move remove_work to dedicated workqueue
	cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
	s390/pci: move pseudo-MMIO to prevent MIO overlap
	fget: check that the fd still exists after getting a ref to it
	sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
	sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
	ipv6: fix memory leak in fib6_rule_suppress
	drm/amd/display: Allow DSC on supported MST branch devices
	KVM: Disallow user memslot with size that exceeds "unsigned long"
	KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
	KVM: x86: Use a stable condition around all VT-d PI paths
	KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
	KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
	tracing/histograms: String compares should not care about signed values
	wireguard: selftests: increase default dmesg log size
	wireguard: allowedips: add missing __rcu annotation to satisfy sparse
	wireguard: selftests: actually test for routing loops
	wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
	wireguard: device: reset peer src endpoint when netns exits
	wireguard: receive: use ring buffer for incoming handshakes
	wireguard: receive: drop handshakes if queue lock is contended
	wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
	i2c: stm32f7: flush TX FIFO upon transfer errors
	i2c: stm32f7: recover the bus on access timeout
	i2c: stm32f7: stop dma transfer in case of NACK
	i2c: cbus-gpio: set atomic transfer callback
	natsemi: xtensa: fix section mismatch warnings
	tcp: fix page frag corruption on page fault
	net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
	net: mpls: Fix notifications when deleting a device
	siphash: use _unaligned version by default
	arm64: ftrace: add missing BTIs
	net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
	selftests: net: Correct case name
	mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
	ASoC: tegra: Fix wrong value type in ADMAIF
	ASoC: tegra: Fix wrong value type in I2S
	ASoC: tegra: Fix wrong value type in DMIC
	ASoC: tegra: Fix wrong value type in DSPK
	ASoC: tegra: Fix kcontrol put callback in ADMAIF
	ASoC: tegra: Fix kcontrol put callback in I2S
	ASoC: tegra: Fix kcontrol put callback in DMIC
	ASoC: tegra: Fix kcontrol put callback in DSPK
	ASoC: tegra: Fix kcontrol put callback in AHUB
	rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
	ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
	net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available
	net: marvell: mvpp2: Fix the computation of shared CPUs
	dpaa2-eth: destroy workqueue at the end of remove function
	net: annotate data-races on txq->xmit_lock_owner
	ipv4: convert fib_num_tclassid_users to atomic_t
	net/smc: fix wrong list_del in smc_lgr_cleanup_early
	net/rds: correct socket tunable error in rds_tcp_tune()
	net/smc: Keep smc_close_final rc during active close
	drm/msm/a6xx: Allocate enough space for GMU registers
	drm/msm: Do hw_init() before capturing GPU state
	atlantic: Increase delay for fw transactions
	atlatnic: enable Nbase-t speeds with base-t
	atlantic: Fix to display FW bundle version instead of FW mac version.
	atlantic: Add missing DIDs and fix 115c.
	Remove Half duplex mode speed capabilities.
	atlantic: Fix statistics logic for production hardware
	atlantic: Remove warn trace message.
	KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
	KVM: VMX: Set failure code in prepare_vmcs02()
	x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
	x86/entry: Use the correct fence macro after swapgs in kernel CR3
	x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
	sched/uclamp: Fix rq->uclamp_max not set on first enqueue
	x86/pv: Switch SWAPGS to ALTERNATIVE
	x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
	parisc: Fix KBUILD_IMAGE for self-extracting kernel
	parisc: Fix "make install" on newer debian releases
	vgacon: Propagate console boot parameters before calling `vc_resize'
	xhci: Fix commad ring abort, write all 64 bits to CRCR register.
	USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
	usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
	x86/tsc: Add a timer to make sure TSC_adjust is always checked
	x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
	x86/64/mm: Map all kernel memory into trampoline_pgd
	tty: serial: msm_serial: Deactivate RX DMA for polling support
	serial: pl011: Add ACPI SBSA UART match id
	serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30
	serial: core: fix transmit-buffer reset and memleak
	serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
	serial: 8250_pci: rewrite pericom_do_set_divisor()
	serial: 8250: Fix RTS modem control while in rs485 mode
	iwlwifi: mvm: retry init flow if failed
	parisc: Mark cr16 CPU clocksource unstable on all SMP machines
	net/tls: Fix authentication failure in CCM mode
	ipmi: msghandler: Make symbol 'remove_work_wq' static
	Linux 5.10.84

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iad592da28c6425dea7dca35b229d14c44edb412d
2021-12-08 09:41:05 +01:00
Miklos Szeredi
bcce010f92 ovl: fix deadlock in splice write
commit 9b91b6b019fda817eb52f728eb9c79b3579760bc upstream.

There's possibility of an ABBA deadlock in case of a splice write to an
overlayfs file and a concurrent splice write to a corresponding real file.

The call chain for splice to an overlay file:

 -> do_splice                     [takes sb_writers on overlay file]
   -> do_splice_from
     -> iter_file_splice_write    [takes pipe->mutex]
       -> vfs_iter_write
         ...
         -> ovl_write_iter        [takes sb_writers on real file]

And the call chain for splice to a real file:

 -> do_splice                     [takes sb_writers on real file]
   -> do_splice_from
     -> iter_file_splice_write    [takes pipe->mutex]

Syzbot successfully bisected this to commit 82a763e61e2b ("ovl: simplify
file splice").

Fix by reverting the write part of the above commit and by adding missing
bits from ovl_write_iter() into ovl_splice_write().

Fixes: 82a763e61e2b ("ovl: simplify file splice")
Reported-and-tested-by: syzbot+579885d1a9a833336209@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: Stan Hu <stanhu@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08 09:03:18 +01:00
Miklos Szeredi
dca4f9a581 ovl: simplify file splice
commit 82a763e61e2b601309d696d4fa514c77d64ee1be upstream.

generic_file_splice_read() and iter_file_splice_write() will call back into
f_op->iter_read() and f_op->iter_write() respectively.  These already do
the real file lookup and cred override.  So the code in ovl_splice_read()
and ovl_splice_write() is redundant.

In addition the ovl_file_accessed() call in ovl_splice_write() is
incorrect, though probably harmless.

Fix by calling generic_file_splice_read() and iter_file_splice_write()
directly.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: Stan Hu <stanhu@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08 09:03:17 +01:00
Greg Kroah-Hartman
c553d9a246 This is the 5.10.80 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGWT+QACgkQONu9yGCS
 aT5mYw//ZXKzugaeJjuIaFqr7tcM7x8EefbKd2H4oMr8SW3IFElJIbNPJGMJAG/C
 tLZVWZvIum7QzZoxTL+JCCKpDzBERNTo4e5u7UwzAdVqiEX69YkNU0FBOzb4qXJ7
 gOZMBhy4UMIKdKD12CSXXf7ZspocsNXfzdmulRQ7CQcPoPrIMKpc4vuagN1Fy/Dz
 JgXYvRUAkLxtFHoQ/TeXvR4Gv9+w2ToMdb02mI48QBO+YYrFaGt+Rza2eHTv75H+
 Lydz37Nv1Pk32tA1q2jWxCzz16+Kzn+AviKiCfQK0Fb9IqnJksUIWLHSiODlVIcf
 kQHejanPn/p1BnBl8puPk1KFtDW45p2GwYhXG7hjGh08DGlR7QLHBS5Aa3xPYfdd
 uOy4ctygSVTx5nLjPH5vr3OE0wk/TuSSf/eyk2fmcUCspwAgBOnSYSmnJOem7LTK
 VqIgXFdCRplsqN415D35ddruP2BLCKqBu4KjwJ1LGIwgsx/Pmz4hlc5YcpLm8uRg
 XMqGTdcieQFOGmZJjJ2q3ecaCjfb0nmTrOylP5b55/74TFwFo042YR1ua0fEtpD4
 euoHLfYv3BY1dCp34TOUFGX0l+J1kAtf//vfD/JgJx/nX+ksdFBHhYwdbSi2oQG/
 9CceXYJ5duEnG+JmDOWJvcZ3T49K5XaIDNfY2zGpcSu1VZKubWg=
 =tQ0m
 -----END PGP SIGNATURE-----

Merge 5.10.80 into android12-5.10-lts

Changes in 5.10.80
	xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
	usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
	binder: use euid from cred instead of using task
	binder: use cred instead of task for selinux checks
	binder: use cred instead of task for getsecid
	Input: iforce - fix control-message timeout
	Input: elantench - fix misreporting trackpoint coordinates
	Input: i8042 - Add quirk for Fujitsu Lifebook T725
	libata: fix read log timeout value
	ocfs2: fix data corruption on truncate
	scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
	scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
	scsi: qla2xxx: Fix use after free in eh_abort path
	mmc: mtk-sd: Add wait dma stop done flow
	mmc: dw_mmc: Dont wait for DRTO on Write RSP error
	exfat: fix incorrect loading of i_blocks for large files
	parisc: Fix set_fixmap() on PA1.x CPUs
	parisc: Fix ptrace check on syscall return
	tpm: Check for integer overflow in tpm2_map_response_body()
	firmware/psci: fix application of sizeof to pointer
	crypto: s5p-sss - Add error handling in s5p_aes_probe()
	media: rkvdec: Do not override sizeimage for output format
	media: ite-cir: IR receiver stop working after receive overflow
	media: rkvdec: Support dynamic resolution changes
	media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
	media: v4l2-ioctl: Fix check_ext_ctrls
	ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
	ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
	ALSA: hda/realtek: Add quirk for Clevo PC70HS
	ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
	ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
	ALSA: hda/realtek: Add quirk for ASUS UX550VE
	ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
	ALSA: ua101: fix division by zero at probe
	ALSA: 6fire: fix control and bulk message timeouts
	ALSA: line6: fix control and interrupt message timeouts
	ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
	ALSA: usb-audio: Add registration quirk for JBL Quantum 400
	ALSA: hda: Free card instance properly at probe errors
	ALSA: synth: missing check for possible NULL after the call to kstrdup
	ALSA: timer: Fix use-after-free problem
	ALSA: timer: Unconditionally unlink slave instances, too
	ext4: fix lazy initialization next schedule time computation in more granular unit
	ext4: ensure enough credits in ext4_ext_shift_path_extents
	ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
	fuse: fix page stealing
	x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
	x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
	x86/irq: Ensure PI wakeup handler is unregistered before module unload
	ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked()
	ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers
	cavium: Return negative value when pci_alloc_irq_vectors() fails
	scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
	scsi: qla2xxx: Fix unmap of already freed sgl
	mISDN: Fix return values of the probe function
	cavium: Fix return values of the probe function
	sfc: Export fibre-specific supported link modes
	sfc: Don't use netif_info before net_device setup
	hyperv/vmbus: include linux/bitops.h
	ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode
	reset: socfpga: add empty driver allowing consumers to probe
	mmc: winbond: don't build on M68K
	drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
	fcnal-test: kill hanging ping/nettest binaries on cleanup
	bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT
	bpf: Prevent increasing bpf_jit_limit above max
	gpio: mlxbf2.c: Add check for bgpio_init failure
	xen/netfront: stop tx queues during live migration
	nvmet-tcp: fix a memory leak when releasing a queue
	spi: spl022: fix Microwire full duplex mode
	net: multicast: calculate csum of looped-back and forwarded packets
	watchdog: Fix OMAP watchdog early handling
	drm: panel-orientation-quirks: Add quirk for GPD Win3
	block: schedule queue restart after BLK_STS_ZONE_RESOURCE
	nvmet-tcp: fix header digest verification
	r8169: Add device 10ec:8162 to driver r8169
	vmxnet3: do not stop tx queues after netif_device_detach()
	nfp: bpf: relax prog rejection for mtu check through max_pkt_offset
	net/smc: Fix smc_link->llc_testlink_time overflow
	net/smc: Correct spelling mistake to TCPF_SYN_RECV
	rds: stop using dmapool
	btrfs: clear MISSING device status bit in btrfs_close_one_device
	btrfs: fix lost error handling when replaying directory deletes
	btrfs: call btrfs_check_rw_degradable only if there is a missing device
	KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
	ia64: kprobes: Fix to pass correct trampoline address to the handler
	selinux: fix race condition when computing ocontext SIDs
	hwmon: (pmbus/lm25066) Add offset coefficients
	regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
	regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
	EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
	mwifiex: fix division by zero in fw download path
	ath6kl: fix division by zero in send path
	ath6kl: fix control-message timeout
	ath10k: fix control-message timeout
	ath10k: fix division by zero in send path
	PCI: Mark Atheros QCA6174 to avoid bus reset
	rtl8187: fix control-message timeouts
	evm: mark evm_fixmode as __ro_after_init
	ifb: Depend on netfilter alternatively to tc
	wcn36xx: Fix HT40 capability for 2Ghz band
	wcn36xx: Fix tx_status mechanism
	wcn36xx: Fix (QoS) null data frame bitrate/modulation
	PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions
	mwifiex: Read a PCI register after writing the TX ring write pointer
	mwifiex: Try waking the firmware until we get an interrupt
	libata: fix checking of DMA state
	wcn36xx: handle connection loss indication
	rsi: fix occasional initialisation failure with BT coex
	rsi: fix key enabled check causing unwanted encryption for vap_id > 0
	rsi: fix rate mask set leading to P2P failure
	rsi: Fix module dev_oper_mode parameter description
	perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
	perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
	RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
	signal: Remove the bogus sigkill_pending in ptrace_stop
	memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
	signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
	soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
	soc: fsl: dpio: use the combined functions to protect critical zone
	mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
	power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
	power: supply: max17042_battery: use VFSOC for capacity when no rsns
	KVM: arm64: Extract ESR_ELx.EC only
	KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
	can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
	can: j1939: j1939_can_recv(): ignore messages with invalid source address
	powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
	ring-buffer: Protect ring_buffer_reset() from reentrancy
	serial: core: Fix initializing and restoring termios speed
	ifb: fix building without CONFIG_NET_CLS_ACT
	ALSA: mixer: oss: Fix racy access to slots
	ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
	xen/balloon: add late_initcall_sync() for initial ballooning done
	ovl: fix use after free in struct ovl_aio_req
	PCI: pci-bridge-emul: Fix emulation of W1C bits
	PCI: cadence: Add cdns_plat_pcie_probe() missing return
	PCI: aardvark: Do not clear status bits of masked interrupts
	PCI: aardvark: Fix checking for link up via LTSSM state
	PCI: aardvark: Do not unmask unused interrupts
	PCI: aardvark: Fix reporting Data Link Layer Link Active
	PCI: aardvark: Fix configuring Reference clock
	PCI: aardvark: Fix return value of MSI domain .alloc() method
	PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
	PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge
	PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
	PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
	PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
	quota: check block number when reading the block in quota file
	quota: correct error number in free_dqentry()
	pinctrl: core: fix possible memory leak in pinctrl_enable()
	coresight: cti: Correct the parameter for pm_runtime_put
	iio: dac: ad5446: Fix ad5622_write() return value
	iio: ad5770r: make devicetree property reading consistent
	USB: serial: keyspan: fix memleak on probe errors
	serial: 8250: fix racy uartclk update
	most: fix control-message timeouts
	USB: iowarrior: fix control-message timeouts
	USB: chipidea: fix interrupt deadlock
	power: supply: max17042_battery: Clear status bits in interrupt handler
	dma-buf: WARN on dmabuf release with pending attachments
	drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
	drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
	drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
	Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
	Bluetooth: fix use-after-free error in lock_sock_nested()
	drm/panel-orientation-quirks: add Valve Steam Deck
	rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
	platform/x86: wmi: do not fail if disabling fails
	MIPS: lantiq: dma: add small delay after reset
	MIPS: lantiq: dma: reset correct number of channel
	locking/lockdep: Avoid RCU-induced noinstr fail
	net: sched: update default qdisc visibility after Tx queue cnt changes
	rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
	smackfs: Fix use-after-free in netlbl_catmap_walk()
	ath11k: Align bss_chan_info structure with firmware
	x86: Increase exception stack sizes
	mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
	mwifiex: Properly initialize private structure on interface type changes
	fscrypt: allow 256-bit master keys with AES-256-XTS
	drm/amdgpu: Fix MMIO access page fault
	ath11k: Avoid reg rules update during firmware recovery
	ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
	ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
	ath10k: high latency fixes for beacon buffer
	media: mt9p031: Fix corrupted frame after restarting stream
	media: netup_unidvb: handle interrupt properly according to the firmware
	media: atomisp: Fix error handling in probe
	media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
	media: uvcvideo: Set capability in s_param
	media: uvcvideo: Return -EIO for control errors
	media: uvcvideo: Set unique vdev name based in type
	media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
	media: s5p-mfc: Add checking to s5p_mfc_probe().
	media: imx: set a media_device bus_info string
	media: mceusb: return without resubmitting URB in case of -EPROTO error.
	ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
	rtw88: fix RX clock gate setting while fifo dump
	brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
	media: rcar-csi2: Add checking to rcsi2_start_receiver()
	ipmi: Disable some operations during a panic
	fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
	ACPICA: Avoid evaluating methods too early during system resume
	media: ipu3-imgu: imgu_fmt: Handle properly try
	media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
	media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
	net-sysfs: try not to restart the syscall if it will fail eventually
	tracefs: Have tracefs directories not set OTH permission bits by default
	ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
	mmc: moxart: Fix reference count leaks in moxart_probe
	iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
	ACPI: battery: Accept charges over the design capacity as full
	drm/amdkfd: fix resume error when iommu disabled in Picasso
	net: phy: micrel: make *-skew-ps check more lenient
	leaking_addresses: Always print a trailing newline
	drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
	block: bump max plugged deferred size from 16 to 32
	md: update superblock after changing rdev flags in state_store
	memstick: r592: Fix a UAF bug when removing the driver
	lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
	lib/xz: Validate the value before assigning it to an enum variable
	workqueue: make sysfs of unbound kworker cpumask more clever
	tracing/cfi: Fix cmp_entries_* functions signature mismatch
	mt76: mt7915: fix an off-by-one bound check
	mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
	block: remove inaccurate requeue check
	media: allegro: ignore interrupt if mailbox is not initialized
	nvmet: fix use-after-free when a port is removed
	nvmet-rdma: fix use-after-free when a port is removed
	nvmet-tcp: fix use-after-free when a port is removed
	nvme: drop scan_lock and always kick requeue list when removing namespaces
	PM: hibernate: Get block device exclusively in swsusp_check()
	selftests: kvm: fix mismatched fclose() after popen()
	selftests/bpf: Fix perf_buffer test on system with offline cpus
	iwlwifi: mvm: disable RX-diversity in powersave
	smackfs: use __GFP_NOFAIL for smk_cipso_doi()
	ARM: clang: Do not rely on lr register for stacktrace
	gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
	gfs2: Cancel remote delete work asynchronously
	gfs2: Fix glock_hash_walk bugs
	ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
	vrf: run conntrack only in context of lower/physdev for locally generated packets
	net: annotate data-race in neigh_output()
	ACPI: AC: Quirk GK45 to skip reading _PSR
	btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
	btrfs: do not take the uuid_mutex in btrfs_rm_device
	spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
	wcn36xx: Correct band/freq reporting on RX
	x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
	drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
	selftests/core: fix conflicting types compile error for close_range()
	parisc: fix warning in flush_tlb_all
	task_stack: Fix end_of_stack() for architectures with upwards-growing stack
	erofs: don't trigger WARN() when decompression fails
	parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
	parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
	netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state
	selftests/bpf: Fix strobemeta selftest regression
	Bluetooth: fix init and cleanup of sco_conn.timeout_work
	rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
	MIPS: lantiq: dma: fix burst length for DEU
	objtool: Add xen_start_kernel() to noreturn list
	x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
	objtool: Fix static_call list generation
	drm/v3d: fix wait for TMU write combiner flush
	virtio-gpu: fix possible memory allocation failure
	lockdep: Let lock_is_held_type() detect recursive read as read
	net: net_namespace: Fix undefined member in key_remove_domain()
	cgroup: Make rebind_subsystems() disable v2 controllers all at once
	wcn36xx: Fix Antenna Diversity Switching
	wilc1000: fix possible memory leak in cfg_scan_result()
	Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
	crypto: caam - disable pkc for non-E SoCs
	rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
	net: dsa: rtl8366rb: Fix off-by-one bug
	ath11k: fix some sleeping in atomic bugs
	ath11k: Avoid race during regd updates
	ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
	ath11k: Fix memory leak in ath11k_qmi_driver_event_work
	ath10k: Fix missing frame timestamp for beacon/probe-resp
	ath10k: sdio: Add missing BH locking around napi_schdule()
	drm/ttm: stop calling tt_swapin in vm_access
	arm64: mm: update max_pfn after memory hotplug
	drm/amdgpu: fix warning for overflow check
	media: em28xx: add missing em28xx_close_extension
	media: cxd2880-spi: Fix a null pointer dereference on error handling path
	media: dvb-usb: fix ununit-value in az6027_rc_query
	media: v4l2-ioctl: S_CTRL output the right value
	media: TDA1997x: handle short reads of hdmi info frame.
	media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
	media: radio-wl1273: Avoid card name truncation
	media: si470x: Avoid card name truncation
	media: tm6000: Avoid card name truncation
	media: cx23885: Fix snd_card_free call on null card pointer
	kprobes: Do not use local variable when creating debugfs file
	crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
	cpuidle: Fix kobject memory leaks in error paths
	media: em28xx: Don't use ops->suspend if it is NULL
	ath9k: Fix potential interrupt storm on queue reset
	PM: EM: Fix inefficient states detection
	EDAC/amd64: Handle three rank interleaving mode
	rcu: Always inline rcu_dynticks_task*_{enter,exit}()
	netfilter: nft_dynset: relax superfluous check on set updates
	media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
	crypto: qat - detect PFVF collision after ACK
	crypto: qat - disregard spurious PFVF interrupts
	hwrng: mtk - Force runtime pm ops for sleep ops
	b43legacy: fix a lower bounds test
	b43: fix a lower bounds test
	gve: Recover from queue stall due to missed IRQ
	mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
	mmc: sdhci-omap: Fix context restore
	memstick: avoid out-of-range warning
	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
	net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
	hwmon: Fix possible memleak in __hwmon_device_register()
	hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
	ath10k: fix max antenna gain unit
	kernel/sched: Fix sched_fork() access an invalid sched_task_group
	tcp: switch orphan_count to bare per-cpu counters
	drm/msm: potential error pointer dereference in init()
	drm/msm: uninitialized variable in msm_gem_import()
	net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
	media: ir_toy: assignment to be16 should be of correct type
	mmc: mxs-mmc: disable regulator on error and in the remove function
	platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
	mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
	mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
	mt76: mt7915: fix possible infinite loop release semaphore
	mt76: mt7915: fix sta_rec_wtbl tag len
	mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
	rsi: stop thread firstly in rsi_91x_init() error handling
	mwifiex: Send DELBA requests according to spec
	net: enetc: unmap DMA in enetc_send_cmd()
	phy: micrel: ksz8041nl: do not use power down mode
	nvme-rdma: fix error code in nvme_rdma_setup_ctrl
	PM: hibernate: fix sparse warnings
	clocksource/drivers/timer-ti-dm: Select TIMER_OF
	x86/sev: Fix stack type check in vc_switch_off_ist()
	drm/msm: Fix potential NULL dereference in DPU SSPP
	smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
	KVM: selftests: Add operand to vmsave/vmload/vmrun in svm.c
	KVM: selftests: Fix nested SVM tests when built with clang
	bpftool: Avoid leaking the JSON writer prepared for program metadata
	libbpf: Fix BTF data layout checks and allow empty BTF
	libbpf: Allow loading empty BTFs
	libbpf: Fix overflow in BTF sanity checks
	libbpf: Fix BTF header parsing checks
	s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
	KVM: s390: pv: avoid double free of sida page
	KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
	irq: mips: avoid nested irq_enter()
	tpm: fix Atmel TPM crash caused by too frequent queries
	tpm_tis_spi: Add missing SPI ID
	libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
	tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
	spi: spi-rpc-if: Check return value of rpcif_sw_init()
	samples/kretprobes: Fix return value if register_kretprobe() failed
	KVM: s390: Fix handle_sske page fault handling
	libertas_tf: Fix possible memory leak in probe and disconnect
	libertas: Fix possible memory leak in probe and disconnect
	wcn36xx: add proper DMA memory barriers in rx path
	wcn36xx: Fix discarded frames due to wrong sequence number
	drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
	selftests: bpf: Convert sk_lookup ctx access tests to PROG_TEST_RUN
	selftests/bpf: Fix fd cleanup in sk_lookup test
	net: amd-xgbe: Toggle PLL settings during rate change
	net: phylink: avoid mvneta warning when setting pause parameters
	crypto: pcrypt - Delay write to padata->info
	selftests/bpf: Fix fclose/pclose mismatch in test_progs
	udp6: allow SO_MARK ctrl msg to affect routing
	ibmvnic: don't stop queue in xmit
	ibmvnic: Process crqs after enabling interrupts
	cgroup: Fix rootcg cpu.stat guest double counting
	bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
	bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
	of: unittest: fix EXPECT text for gpio hog errors
	iio: st_sensors: Call st_sensors_power_enable() from bus drivers
	iio: st_sensors: disable regulators after device unregistration
	RDMA/rxe: Fix wrong port_cap_flags
	ARM: dts: BCM5301X: Fix memory nodes names
	clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
	ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
	arm64: dts: rockchip: Fix GPU register width for RK3328
	ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
	RDMA/bnxt_re: Fix query SRQ failure
	arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
	arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
	arm64: dts: meson-g12a: Fix the pwm regulator supply properties
	arm64: dts: meson-g12b: Fix the pwm regulator supply properties
	bus: ti-sysc: Fix timekeeping_suspended warning on resume
	ARM: dts: at91: tse850: the emac<->phy interface is rmii
	scsi: dc395: Fix error case unwinding
	MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
	JFS: fix memleak in jfs_mount
	arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
	arm64: dts: renesas: beacon: Fix Ethernet PHY mode
	arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
	ALSA: hda: Reduce udelay() at SKL+ position reporting
	ALSA: hda: Release controller display power during shutdown/reboot
	ALSA: hda: Fix hang during shutdown due to link reset
	ALSA: hda: Use position buffer for SKL+ again
	soundwire: debugfs: use controller id and link_id for debugfs
	scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
	driver core: Fix possible memory leak in device_link_add()
	arm: dts: omap3-gta04a4: accelerometer irq fix
	ASoC: SOF: topology: do not power down primary core during topology removal
	soc/tegra: Fix an error handling path in tegra_powergate_power_up()
	memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
	clk: at91: check pmc node status before registering syscore ops
	video: fbdev: chipsfb: use memset_io() instead of memset()
	powerpc: Refactor is_kvm_guest() declaration to new header
	powerpc: Rename is_kvm_guest() to check_kvm_guest()
	powerpc: Reintroduce is_kvm_guest() as a fast-path check
	powerpc: Fix is_kvm_guest() / kvm_para_available()
	powerpc: fix unbalanced node refcount in check_kvm_guest()
	serial: 8250_dw: Drop wrong use of ACPI_PTR()
	usb: gadget: hid: fix error code in do_config()
	power: supply: rt5033_battery: Change voltage values to µV
	power: supply: max17040: fix null-ptr-deref in max17040_probe()
	scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
	RDMA/mlx4: Return missed an error if device doesn't support steering
	usb: musb: select GENERIC_PHY instead of depending on it
	staging: most: dim2: do not double-register the same device
	staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
	pinctrl: renesas: checker: Fix off-by-one bug in drive register check
	ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
	ARM: dts: stm32: fix SAI sub nodes register range
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	ASoC: cs42l42: Correct some register default values
	ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
	soc: qcom: rpmhpd: Provide some missing struct member descriptions
	soc: qcom: rpmhpd: Make power_on actually enable the domain
	usb: typec: STUSB160X should select REGMAP_I2C
	iio: adis: do not disabe IRQs in 'adis_init()'
	scsi: ufs: Refactor ufshcd_setup_clocks() to remove skip_ref_clk
	scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
	serial: imx: fix detach/attach of serial console
	usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
	usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
	usb: dwc2: drd: reset current session before setting the new one
	firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
	soc: qcom: apr: Add of_node_put() before return
	pinctrl: equilibrium: Fix function addition in multiple groups
	phy: qcom-qusb2: Fix a memory leak on probe
	phy: ti: gmii-sel: check of_get_address() for failure
	phy: qcom-snps: Correct the FSEL_MASK
	serial: xilinx_uartps: Fix race condition causing stuck TX
	clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
	HID: u2fzero: clarify error check and length calculations
	HID: u2fzero: properly handle timeouts in usb_submit_urb
	powerpc/44x/fsp2: add missing of_node_put
	ASoC: cs42l42: Disable regulators if probe fails
	ASoC: cs42l42: Use device_property API instead of of_property
	ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
	virtio_ring: check desc == NULL when using indirect with packed
	mips: cm: Convert to bitfield API to fix out-of-bounds access
	power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
	apparmor: fix error check
	rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
	nfsd: don't alloc under spinlock in rpc_parse_scope_id
	i2c: mediatek: fixing the incorrect register offset
	NFS: Fix dentry verifier races
	pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
	drm/plane-helper: fix uninitialized variable reference
	PCI: aardvark: Don't spam about PIO Response Status
	PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
	opp: Fix return in _opp_add_static_v2()
	NFS: Fix deadlocks in nfs_scan_commit_list()
	fs: orangefs: fix error return code of orangefs_revalidate_lookup()
	mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
	PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
	mtd: core: don't remove debugfs directory if device is in use
	remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()'
	rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
	dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
	NFS: Fix up commit deadlocks
	NFS: Fix an Oops in pnfs_mark_request_commit()
	Fix user namespace leak
	auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
	auxdisplay: ht16k33: Connect backlight to fbdev
	auxdisplay: ht16k33: Fix frame buffer device blanking
	soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read
	netfilter: nfnetlink_queue: fix OOB when mac header was cleared
	dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
	signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
	m68k: set a default value for MEMORY_RESERVE
	watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
	ar7: fix kernel builds for compiler test
	scsi: qla2xxx: Changes to support FCP2 Target
	scsi: qla2xxx: Relogin during fabric disturbance
	scsi: qla2xxx: Fix gnl list corruption
	scsi: qla2xxx: Turn off target reset during issue_lip
	NFSv4: Fix a regression in nfs_set_open_stateid_locked()
	i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
	xen-pciback: Fix return in pm_ctrl_init()
	net: davinci_emac: Fix interrupt pacing disable
	ethtool: fix ethtool msg len calculation for pause stats
	openrisc: fix SMP tlb flush NULL pointer dereference
	net: vlan: fix a UAF in vlan_dev_real_dev()
	ice: Fix replacing VF hardware MAC to existing MAC filter
	ice: Fix not stopping Tx queues for VFs
	ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
	drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
	net: phy: fix duplex out of sync problem while changing settings
	bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
	mfd: core: Add missing of_node_put for loop iteration
	can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable()
	mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
	zram: off by one in read_block_state()
	perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
	llc: fix out-of-bound array index in llc_sk_dev_hash()
	nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
	arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
	bpf, sockmap: Remove unhash handler for BPF sockmap usage
	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
	gve: Fix off by one in gve_tx_timeout()
	seq_file: fix passing wrong private data
	net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
	net: hns3: fix kernel crash when unload VF while it is being reset
	net: hns3: allow configure ETS bandwidth of all TCs
	net: stmmac: allow a tc-taprio base-time of zero
	vsock: prevent unnecessary refcnt inc for nonblocking connect
	net/smc: fix sk_refcnt underflow on linkdown and fallback
	cxgb4: fix eeprom len when diagnostics not implemented
	selftests/net: udpgso_bench_rx: fix port argument
	ARM: 9155/1: fix early early_iounmap()
	ARM: 9156/1: drop cc-option fallbacks for architecture selection
	parisc: Fix backtrace to always include init funtion names
	MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
	x86/mce: Add errata workaround for Skylake SKX37
	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
	irqchip/sifive-plic: Fixup EOI failed when masked
	f2fs: should use GFP_NOFS for directory inodes
	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
	9p/net: fix missing error check in p9_check_errors
	memcg: prohibit unconditional exceeding the limit of dying tasks
	powerpc/lib: Add helper to check if offset is within conditional branch range
	powerpc/bpf: Validate branch ranges
	powerpc/security: Add a helper to query stf_barrier type
	powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
	mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
	mm, oom: do not trigger out_of_memory from the #PF
	mfd: dln2: Add cell for initializing DLN2 ADC
	video: backlight: Drop maximum brightness override for brightness zero
	s390/cio: check the subchannel validity for dev_busid
	s390/tape: fix timer initialization in tape_std_assign()
	s390/ap: Fix hanging ioctl caused by orphaned replies
	s390/cio: make ccw_device_dma_* more robust
	mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
	powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
	powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
	drm/sun4i: Fix macros in sun8i_csc.h
	PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
	PCI: aardvark: Fix PCIe Max Payload Size setting
	SUNRPC: Partial revert of commit 6f9f17287e
	ath10k: fix invalid dma_addr_t token assignment
	mmc: moxart: Fix null pointer dereference on pointer host
	selftests/bpf: Fix also no-alu32 strobemeta selftest
	arch/cc: Introduce a function to check for confidential computing features
	x86/sev: Add an x86 version of cc_platform_has()
	x86/sev: Make the #VC exception stacks part of the default stacks storage
	soc/tegra: pmc: Fix imbalanced clock disabling in error code path
	Linux 5.10.80

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I21c750863965fbf584251fa2de3c941ae5922d3f
2021-11-19 11:50:41 +01:00
yangerkun
4fd9f0509a ovl: fix use after free in struct ovl_aio_req
commit 9a254403760041528bc8f69fe2f5e1ef86950991 upstream.

Example for triggering use after free in a overlay on ext4 setup:

aio_read
  ovl_read_iter
    vfs_iter_read
      ext4_file_read_iter
        ext4_dio_read_iter
          iomap_dio_rw -> -EIOCBQUEUED
          /*
	   * Here IO is completed in a separate thread,
	   * ovl_aio_cleanup_handler() frees aio_req which has iocb embedded
	   */
          file_accessed(iocb->ki_filp); /**BOOM**/

Fix by introducing a refcount in ovl_aio_req similarly to aio_kiocb.  This
guarantees that iocb is only freed after vfs_read/write_iter() returns on
underlying fs.

Fixes: 2406a307ac ("ovl: implement async IO routines")
Signed-off-by: yangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20210930032228.3199690-3-yangerkun@huawei.com/
Cc: <stable@vger.kernel.org> # v5.6
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-18 14:03:49 +01:00
Greg Kroah-Hartman
4b3fd2a81e This is the 5.10.73 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFmkzIACgkQONu9yGCS
 aT4JMQ//UzSABXNFMAhQ9jv/46vo+yE71XXFQ0CVrx8h5/C18UvAGMGTrkzfgeiS
 OJ6ID9jf5WS/OlOD0vRMasKgQh06eGlnsglEKfUSCN126mN+rrhE6zZWDMyzIIkl
 +GIRkDlto0DhclBRH6LMpo7jnrgDHdqqq0KWv1TwwM72qJve0oI9/xKytN2P1qBp
 gqHzk9V428ZshehaMlaKf8tg8TvPTcs1XeB5Dipt1x1LwaavQtqmsWLDbrLSU4OJ
 kKIX8OXHx0CCi5IsYtNJinrXFpgvT9YMlS2HhgzLzTYZZfCrurAwvbAmCUzCCKYO
 uiwTgo2ta8lj8C6NfjqfZxKMnSdia4Yxgxizn0XpISEbfJY4xzmGKNJDDFTnfsIW
 9eeNWn4C0XkzKGcF2GXmEorqUbUyxl8rTI67jFB1a1kt22O28j9ygmnXfw2vpqRS
 r8Bb3aYzIstcG3EaUywA+X+7zbrAjIj6Nv4AUI4+M+4CVP01nOwmQKz1xyBH3Iub
 GINtiRvRUxBsIuPWL/B9IA8uWsgA6gOL9UncEHoAfqxj5RxLkH3jD2Yk7Dn3jfnH
 Fhm4Jps3OG3UkvP/R27LYbI+Cug/GOlW0m2dDx7aJErcfrlVspA97Ss/WiAX9PiG
 sUHWM9282FDpZbdzxxmtzqOE3IOu3ylY0Paykps3rYVLqUSk4xM=
 =HeAT
 -----END PGP SIGNATURE-----

Merge 5.10.73 into android12-5.10-lts

Changes in 5.10.73
	Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
	usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
	USB: cdc-acm: fix racy tty buffer accesses
	USB: cdc-acm: fix break reporting
	usb: typec: tcpm: handle SRC_STARTUP state if cc changes
	drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
	xen/privcmd: fix error handling in mmap-resource processing
	mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
	mmc: sdhci-of-at91: wait for calibration done before proceed
	mmc: sdhci-of-at91: replace while loop with read_poll_timeout
	ovl: fix missing negative dentry check in ovl_rename()
	ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
	nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
	nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
	SUNRPC: fix sign error causing rpcsec_gss drops
	xen/balloon: fix cancelled balloon action
	ARM: dts: omap3430-sdp: Fix NAND device node
	ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe
	ARM: dts: qcom: apq8064: use compatible which contains chipid
	riscv: Flush current cpu icache before other cpus
	bus: ti-sysc: Add break in switch statement in sysc_init_soc()
	soc: qcom: socinfo: Fixed argument passed to platform_set_data()
	ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference
	ARM: at91: pm: do not panic if ram controllers are not enabled
	soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
	ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo
	ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo
	ARM: dts: imx6qdl-pico: Fix Ethernet support
	PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus
	ath5k: fix building with LEDS=m
	arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding
	xtensa: use CONFIG_USE_OF instead of CONFIG_OF
	xtensa: call irqchip_init only when CONFIG_USE_OF is selected
	iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15
	bpf, arm: Fix register clobbering in div/mod implementation
	soc: ti: omap-prm: Fix external abort for am335x pruss
	bpf: Fix integer overflow in prealloc_elems_and_freelist()
	net/mlx5e: IPSEC RX, enable checksum complete
	net/mlx5: E-Switch, Fix double allocation of acl flow counter
	phy: mdio: fix memory leak
	net_sched: fix NULL deref in fifo_set_limit()
	powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
	ptp_pch: Load module automatically if ID matches
	arm64: dts: ls1028a: add missing CAN nodes
	dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value
	ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
	net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
	net: bridge: fix under estimation in br_get_linkxstats_size()
	net/sched: sch_taprio: properly cancel timer from taprio_destroy()
	net: sfp: Fix typo in state machine debug string
	netlink: annotate data races around nlk->bound
	perf jevents: Tidy error handling
	bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
	drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
	video: fbdev: gbefb: Only instantiate device when built for IP32
	drm/nouveau: avoid a use-after-free when BO init fails
	drm/nouveau/kms/nv50-: fix file release memory leak
	drm/nouveau/debugfs: fix file release memory leak
	gve: Correct available tx qpl check
	gve: Avoid freeing NULL pointer
	rtnetlink: fix if_nlmsg_stats_size() under estimation
	gve: fix gve_get_stats()
	gve: report 64bit tx_bytes counter from gve_handle_report_stats()
	i40e: fix endless loop under rtnl
	i40e: Fix freeing of uninitialized misc IRQ vector
	net: prefer socket bound to interface when not in VRF
	powerpc/iommu: Report the correct most efficient DMA mask for PCI devices
	i2c: acpi: fix resource leak in reconfiguration device addition
	i2c: mediatek: Add OFFSET_EXT_CONF setting back
	riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable
	bpf, s390: Fix potential memory leak about jit_data
	RISC-V: Include clone3() on rv32
	powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
	powerpc/64s: fix program check interrupt emergency stack path
	pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init
	x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI
	x86/Kconfig: Correct reference to MWINCHIP3D
	x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0]
	x86/entry: Correct reference to intended CONFIG_64_BIT
	x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n
	x86/hpet: Use another crystalball to evaluate HPET usability
	Linux 5.10.73

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib837d28b5ab0510121c16791823806a287c81926
2021-10-13 10:28:21 +02:00
Miklos Szeredi
1bc2f315a2 ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
commit 1dc1eed46f9fa4cb8a07baa24fb44c96d6dd35c9 upstream.

Normally the check at open time suffices, but e.g loop device does set
IOCB_DIRECT after doing its own checks (which are not sufficent for
overlayfs).

Make sure we don't call the underlying filesystem read/write method with
the IOCB_DIRECT if it's not supported.

Reported-by: Huang Jianan <huangjianan@oppo.com>
Fixes: 16914e6fc7 ("ovl: add ovl_read_iter()")
Cc: <stable@vger.kernel.org> # v4.19
Tested-by: Huang Jianan <huangjianan@oppo.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-13 10:04:23 +02:00
Zheng Liang
9763ffd4da ovl: fix missing negative dentry check in ovl_rename()
commit a295aef603e109a47af355477326bd41151765b6 upstream.

The following reproducer

  mkdir lower upper work merge
  touch lower/old
  touch lower/new
  mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
  rm merge/new
  mv merge/old merge/new & unlink upper/new

may result in this race:

PROCESS A:
  rename("merge/old", "merge/new");
  overwrite=true,ovl_lower_positive(old)=true,
  ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE

PROCESS B:
  unlink("upper/new");

PROCESS A:
  lookup newdentry in new_upperdir
  call vfs_rename() with negative newdentry and RENAME_EXCHANGE

Fix by adding the missing check for negative newdentry.

Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
Fixes: e9be9d5e76 ("overlay filesystem")
Cc: <stable@vger.kernel.org> # v3.18
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-13 10:04:23 +02:00
Greg Kroah-Hartman
08ed4cb090 Merge 5.10.67 into android12-5.10-lts
Changes in 5.10.67
	rtc: tps65910: Correct driver module alias
	io_uring: limit fixed table size by RLIMIT_NOFILE
	io_uring: place fixed tables under memcg limits
	io_uring: add ->splice_fd_in checks
	io_uring: fail links of cancelled timeouts
	io-wq: fix wakeup race when adding new work
	btrfs: wake up async_delalloc_pages waiters after submit
	btrfs: reset replace target device to allocation state on close
	blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
	blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
	PCI/MSI: Skip masking MSI-X on Xen PV
	powerpc/perf/hv-gpci: Fix counter value parsing
	xen: fix setting of max_pfn in shared_info
	9p/xen: Fix end of loop tests for list_for_each_entry
	ceph: fix dereference of null pointer cf
	selftests/ftrace: Fix requirement check of README file
	tools/thermal/tmon: Add cross compiling support
	clk: socfpga: agilex: fix the parents of the psi_ref_clk
	clk: socfpga: agilex: fix up s2f_user0_clk representation
	clk: socfpga: agilex: add the bypass register for s2f_usr0 clock
	pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast
	pinctrl: ingenic: Fix incorrect pull up/down info
	soc: qcom: aoss: Fix the out of bound usage of cooling_devs
	soc: aspeed: lpc-ctrl: Fix boundary check for mmap
	soc: aspeed: p2a-ctrl: Fix boundary check for mmap
	arm64: mm: Fix TLBI vs ASID rollover
	arm64: head: avoid over-mapping in map_memory
	iio: ltc2983: fix device probe
	wcn36xx: Ensure finish scan is not requested before start scan
	crypto: public_key: fix overflow during implicit conversion
	block: bfq: fix bfq_set_next_ioprio_data()
	power: supply: max17042: handle fails of reading status register
	dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
	crypto: ccp - shutdown SEV firmware on kexec
	VMCI: fix NULL pointer dereference when unmapping queue pair
	media: uvc: don't do DMA on stack
	media: rc-loopback: return number of emitters rather than error
	s390/qdio: fix roll-back after timeout on ESTABLISH ccw
	s390/qdio: cancel the ESTABLISH ccw after timeout
	Revert "dmaengine: imx-sdma: refine to load context only once"
	dmaengine: imx-sdma: remove duplicated sdma_load_context
	libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
	ARM: 9105/1: atags_to_fdt: don't warn about stack size
	f2fs: fix to do sanity check for sb/cp fields correctly
	PCI/portdrv: Enable Bandwidth Notification only if port supports it
	PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
	PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
	PCI: xilinx-nwl: Enable the clock through CCF
	PCI: aardvark: Configure PCIe resources from 'ranges' DT property
	PCI: Export pci_pio_to_address() for module use
	PCI: aardvark: Fix checking for PIO status
	PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
	HID: input: do not report stylus battery state as "full"
	f2fs: quota: fix potential deadlock
	pinctrl: remove empty lines in pinctrl subsystem
	pinctrl: armada-37xx: Correct PWM pins definitions
	scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
	clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types
	IB/hfi1: Adjust pkey entry in index 0
	RDMA/iwcm: Release resources if iw_cm module initialization fails
	docs: Fix infiniband uverbs minor number
	scsi: BusLogic: Use %X for u32 sized integer rather than %lX
	pinctrl: samsung: Fix pinctrl bank pin count
	vfio: Use config not menuconfig for VFIO_NOIOMMU
	scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
	cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards
	powerpc/stacktrace: Include linux/delay.h
	RDMA/efa: Remove double QP type assignment
	RDMA/mlx5: Delete not-available udata check
	cpuidle: pseries: Mark pseries_idle_proble() as __init
	f2fs: reduce the scope of setting fsck tag when de->name_len is zero
	openrisc: don't printk() unconditionally
	dma-debug: fix debugfs initialization order
	NFSv4/pNFS: Fix a layoutget livelock loop
	NFSv4/pNFS: Always allow update of a zero valued layout barrier
	NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid
	SUNRPC: Fix potential memory corruption
	SUNRPC/xprtrdma: Fix reconnection locking
	SUNRPC query transport's source port
	sunrpc: Fix return value of get_srcport()
	scsi: fdomain: Fix error return code in fdomain_probe()
	pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
	powerpc/numa: Consider the max NUMA node for migratable LPAR
	scsi: smartpqi: Fix an error code in pqi_get_raid_map()
	scsi: qedi: Fix error codes in qedi_alloc_global_queues()
	scsi: qedf: Fix error codes in qedf_alloc_global_queues()
	powerpc/config: Renable MTD_PHYSMAP_OF
	iommu/vt-d: Update the virtual command related registers
	HID: i2c-hid: Fix Elan touchpad regression
	clk: imx8m: fix clock tree update of TF-A managed clocks
	KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines
	scsi: ufs: ufs-exynos: Fix static checker warning
	KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live
	platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
	powerpc/smp: Update cpu_core_map on all PowerPc systems
	RDMA/hns: Fix QP's resp incomplete assignment
	fscache: Fix cookie key hashing
	clk: at91: clk-generated: Limit the requested rate to our range
	KVM: PPC: Fix clearing never mapped TCEs in realmode
	soc: mediatek: cmdq: add address shift in jump
	f2fs: fix to account missing .skipped_gc_rwsem
	f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
	f2fs: fix to unmap pages from userspace process in punch_hole()
	f2fs: deallocate compressed pages when error happens
	f2fs: should put a page beyond EOF when preparing a write
	MIPS: Malta: fix alignment of the devicetree buffer
	kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y
	userfaultfd: prevent concurrent API initialization
	drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET
	drm/amdgpu: Fix amdgpu_ras_eeprom_init()
	ASoC: atmel: ATMEL drivers don't need HAS_DMA
	media: dib8000: rewrite the init prbs logic
	libbpf: Fix reuse of pinned map on older kernel
	x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable
	crypto: mxs-dcp - Use sg_mapping_iter to copy data
	PCI: Use pci_update_current_state() in pci_enable_device_flags()
	tipc: keep the skb in rcv queue until the whole data is read
	net: phy: Fix data type in DP83822 dp8382x_disable_wol()
	iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
	iavf: do not override the adapter state in the watchdog task
	iavf: fix locking of critical sections
	ARM: dts: qcom: apq8064: correct clock names
	video: fbdev: kyro: fix a DoS bug by restricting user input
	netlink: Deal with ESRCH error in nlmsg_notify()
	Smack: Fix wrong semantics in smk_access_entry()
	drm: avoid blocking in drm_clients_info's rcu section
	drm: serialize drm_file.master with a new spinlock
	drm: protect drm_master pointers in drm_lease.c
	rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
	igc: Check if num of q_vectors is smaller than max before array access
	usb: host: fotg210: fix the endpoint's transactional opportunities calculation
	usb: host: fotg210: fix the actual_length of an iso packet
	usb: gadget: u_ether: fix a potential null pointer dereference
	USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
	usb: gadget: composite: Allow bMaxPower=0 if self-powered
	staging: board: Fix uninitialized spinlock when attaching genpd
	tty: serial: jsm: hold port lock when reporting modem line changes
	bus: fsl-mc: fix mmio base address for child DPRCs
	selftests: firmware: Fix ignored return val of asprintf() warn
	drm/amd/display: Fix timer_per_pixel unit error
	media: hantro: vp8: Move noisy WARN_ON to vpu_debug
	media: platform: stm32: unprepare clocks at handling errors in probe
	media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe
	media: atomisp: pci: fix error return code in atomisp_pci_probe()
	nfp: fix return statement in nfp_net_parse_meta()
	ethtool: improve compat ioctl handling
	drm/amdgpu: Fix a printing message
	drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex
	bpf/tests: Fix copy-and-paste error in double word test
	bpf/tests: Do not PASS tests without actually testing the result
	drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit
	arm64: dts: allwinner: h6: tanix-tx6: Fix regulator node names
	video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
	video: fbdev: kyro: Error out if 'pixclock' equals zero
	video: fbdev: riva: Error out if 'pixclock' equals zero
	ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
	flow_dissector: Fix out-of-bounds warnings
	s390/jump_label: print real address in a case of a jump label bug
	s390: make PCI mio support a machine flag
	serial: 8250: Define RX trigger levels for OxSemi 950 devices
	xtensa: ISS: don't panic in rs_init
	hvsi: don't panic on tty_register_driver failure
	serial: 8250_pci: make setup_port() parameters explicitly unsigned
	staging: ks7010: Fix the initialization of the 'sleep_status' structure
	samples: bpf: Fix tracex7 error raised on the missing argument
	libbpf: Fix race when pinning maps in parallel
	ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
	Bluetooth: skip invalid hci_sync_conn_complete_evt
	workqueue: Fix possible memory leaks in wq_numa_init()
	ARM: dts: stm32: Set {bitclock,frame}-master phandles on DHCOM SoM
	ARM: dts: stm32: Set {bitclock,frame}-master phandles on ST DKx
	ARM: dts: stm32: Update AV96 adv7513 node per dtbs_check
	bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
	ARM: dts: at91: use the right property for shutdown controller
	arm64: tegra: Fix Tegra194 PCIe EP compatible string
	ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
	ASoC: Intel: update sof_pcm512x quirks
	media: imx258: Rectify mismatch of VTS value
	media: imx258: Limit the max analogue gain to 480
	media: v4l2-dv-timings.c: fix wrong condition in two for-loops
	media: TDA1997x: fix tda1997x_query_dv_timings() return value
	media: tegra-cec: Handle errors of clk_prepare_enable()
	gfs2: Fix glock recursion in freeze_go_xmote_bh
	arm64: dts: qcom: sdm630: Rewrite memory map
	arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl configuration
	serial: 8250_omap: Handle optional overrun-throttle-ms property
	ARM: dts: imx53-ppd: Fix ACHC entry
	arm64: dts: qcom: ipq8074: fix pci node reg property
	arm64: dts: qcom: sdm660: use reg value for memory node
	arm64: dts: qcom: ipq6018: drop '0x' from unit address
	arm64: dts: qcom: sdm630: don't use underscore in node name
	arm64: dts: qcom: msm8994: don't use underscore in node name
	arm64: dts: qcom: msm8996: don't use underscore in node name
	arm64: dts: qcom: sm8250: Fix epss_l3 unit address
	nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering
	net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
	drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
	drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660
	drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock
	drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers
	thunderbolt: Fix port linking by checking all adapters
	drm/amd/display: fix missing writeback disablement if plane is removed
	drm/amd/display: fix incorrect CM/TF programming sequence in dwb
	selftests/bpf: Fix xdp_tx.c prog section name
	drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
	Bluetooth: schedule SCO timeouts with delayed_work
	Bluetooth: avoid circular locks in sco_sock_connect
	drm/msm/dp: return correct edid checksum after corrupted edid checksum read
	net/mlx5: Fix variable type to match 64bit
	gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
	drm/display: fix possible null-pointer dereference in dcn10_set_clock()
	mac80211: Fix monitor MTU limit so that A-MSDUs get through
	ARM: tegra: acer-a500: Remove bogus USB VBUS regulators
	ARM: tegra: tamonten: Fix UART pad setting
	arm64: tegra: Fix compatible string for Tegra132 CPUs
	arm64: dts: ls1046a: fix eeprom entries
	nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
	nvme: code command_id with a genctr for use-after-free validation
	Bluetooth: Fix handling of LE Enhanced Connection Complete
	opp: Don't print an error if required-opps is missing
	serial: sh-sci: fix break handling for sysrq
	iomap: pass writeback errors to the mapping
	tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
	rpc: fix gss_svc_init cleanup on failure
	selftests/bpf: Fix flaky send_signal test
	hwmon: (pmbus/ibm-cffps) Fix write bits for LED control
	staging: rts5208: Fix get_ms_information() heap buffer size
	net: Fix offloading indirect devices dependency on qdisc order creation
	kselftest/arm64: mte: Fix misleading output when skipping tests
	kselftest/arm64: pac: Fix skipping of tests on systems without PAC
	gfs2: Don't call dlm after protocol is unmounted
	usb: chipidea: host: fix port index underflow and UBSAN complains
	lockd: lockd server-side shouldn't set fl_ops
	drm/exynos: Always initialize mapping in exynos_drm_register_dma()
	rtl8xxxu: Fix the handling of TX A-MPDU aggregation
	rtw88: use read_poll_timeout instead of fixed sleep
	rtw88: wow: build wow function only if CONFIG_PM is on
	rtw88: wow: fix size access error of probe request
	octeontx2-pf: Fix NIX1_RX interface backpressure
	m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch
	btrfs: tree-log: check btrfs_lookup_data_extent return value
	soundwire: intel: fix potential race condition during power down
	ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
	ASoC: Intel: Skylake: Fix passing loadable flag for module
	of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
	mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for ZynqMP
	mmc: sdhci-of-arasan: Check return value of non-void funtions
	mmc: rtsx_pci: Fix long reads when clock is prescaled
	selftests/bpf: Enlarge select() timeout for test_maps
	mmc: core: Return correct emmc response in case of ioctl error
	cifs: fix wrong release in sess_alloc_buffer() failed path
	Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
	usb: musb: musb_dsps: request_irq() after initializing musb
	usbip: give back URBs for unsent unlink requests during cleanup
	usbip:vhci_hcd USB port can get stuck in the disabled state
	ASoC: rockchip: i2s: Fix regmap_ops hang
	ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
	drm/amdkfd: Account for SH/SE count when setting up cu masks.
	nfsd: fix crash on LOCKT on reexported NFSv3
	iwlwifi: pcie: free RBs during configure
	iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
	iwlwifi: mvm: avoid static queue number aliasing
	iwlwifi: mvm: fix access to BSS elements
	iwlwifi: fw: correctly limit to monitor dump
	iwlwifi: mvm: Fix scan channel flags settings
	net/mlx5: DR, fix a potential use-after-free bug
	net/mlx5: DR, Enable QP retransmission
	parport: remove non-zero check on count
	selftests/bpf: Fix potential unreleased lock
	wcn36xx: Fix missing frame timestamp for beacon/probe-resp
	ath9k: fix OOB read ar9300_eeprom_restore_internal
	ath9k: fix sleeping in atomic context
	net: fix NULL pointer reference in cipso_v4_doi_free
	fix array-index-out-of-bounds in taprio_change
	net: w5100: check return value after calling platform_get_resource()
	net: hns3: clean up a type mismatch warning
	fs/io_uring Don't use the return value from import_iovec().
	io_uring: remove duplicated io_size from rw
	parisc: fix crash with signals and alloca
	ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
	scsi: BusLogic: Fix missing pr_cont() use
	scsi: qla2xxx: Changes to support kdump kernel
	scsi: qla2xxx: Sync queue idx with queue_pair_map idx
	cpufreq: powernv: Fix init_chip_info initialization in numa=off
	s390/pv: fix the forcing of the swiotlb
	hugetlb: fix hugetlb cgroup refcounting during vma split
	mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled
	mm/hugetlb: initialize hugetlb_usage in mm_init
	mm,vmscan: fix divide by zero in get_scan_count
	memcg: enable accounting for pids in nested pid namespaces
	libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
	platform/chrome: cros_ec_proto: Send command again when timeout occurs
	lib/test_stackinit: Fix static initializer test
	net: dsa: lantiq_gswip: fix maximum frame length
	drm/mgag200: Select clock in PLL update functions
	drm/msi/mdp4: populate priv->kms in mdp4_kms_init
	drm/dp_mst: Fix return code on sideband message failure
	drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv
	drm/amdgpu: Fix BUG_ON assert
	drm/amd/display: Update number of DCN3 clock states
	drm/amd/display: Update bounding box states (v2)
	drm/panfrost: Simplify lock_region calculation
	drm/panfrost: Use u64 for size in lock_region
	drm/panfrost: Clamp lock region to Bifrost minimum
	fanotify: limit number of event merge attempts
	Linux 5.10.67

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic8df59518265d0cdf724e93e8922cde48fc85ce9
2021-09-30 12:21:03 +02:00
chenying
69775e4e17 ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
commit 52d5a0c6bd8a89f460243ed937856354f8f253a3 upstream.

If function ovl_instantiate() returns an error, ovl_cleanup will be called
and try to remove newdentry from wdir, but the newdentry has been moved to
udir at this time.  This will causes BUG_ON(victim->d_parent->d_inode !=
dir) in fs/namei.c:may_delete.

Signed-off-by: chenying <chenying.kernel@bytedance.com>
Fixes: 01b39dcc95 ("ovl: use inode_insert5() to hash a newly created inode")
Link: https://lore.kernel.org/linux-unionfs/e6496a94-a161-dc04-c38a-d2544633acb4@bytedance.com/
Cc: <stable@vger.kernel.org> # v4.18
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-18 13:40:35 +02:00
Greg Kroah-Hartman
77b971b479 This is the 5.10.63 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmE4XPEACgkQONu9yGCS
 aT7h3xAAm2VWUt7gt5QUxJWfooEZAlnzYBYiS6bDRuOgVm9KylI7afB+lIfUjMI8
 JeOGqlB1rvwDXNwWMh88omWK95KQw2CgF57npuavR070fhZ7bGJ/f7KENYI6BDlg
 7affMvHu7iH8Knm3nANTqfcOSdW5T+p8vKRc66ocO8qdB8is6cUP71cK/1Kq86/Q
 EWJizvRWv+Rz+j+r6rcjwyObSkgilnqXUllzqGxmh2ZBmN8ayH+0jDY765FI8wmO
 AjFXKr9YuaTDnKEwmfH036dVyNpkpV+YlNK1UhBTVm/uVGxmbBn2HZ5Z2/V89xVY
 Y+1B4mvXyuhpe5zWPpjiJQPna3wC++WjhpJu5mT6HMMD2wb5aooc5Fh9ruoPrnPP
 fKTy4ju2N3IZ0gN6OePKViXWTWEG+xy53xqnO3vtD6brJXF9PRiILLlj5qkrTWTR
 F9xbdHzakhbsx/CfmbD4FZa5rI7wGlR4QYznDIb7E9hb4mkqFC0U7V8zJgqnLDwH
 ljSElISxG7AL3RhnOiTi4ZAhsNAlBhhS1RqXl6yLuQ0QpwJiC8/wcGsJSqI931lP
 Gj6WjwJz7H31g3NYF7vbklaEkw6Y66NrtQgIcNxqSccVev0SCGzdIx75/3TygBuv
 AC2PeQLk3TGeJKKHPRlg8Ui96nSgyFlT9xQkZL7Jelux8qlZo0E=
 =u0UQ
 -----END PGP SIGNATURE-----

Merge 5.10.63 into android12-5.10-lts

Changes in 5.10.63
	ext4: fix race writing to an inline_data file while its xattrs are changing
	fscrypt: add fscrypt_symlink_getattr() for computing st_size
	ext4: report correct st_size for encrypted symlinks
	f2fs: report correct st_size for encrypted symlinks
	ubifs: report correct st_size for encrypted symlinks
	Revert "ucounts: Increase ucounts reference counter before the security hook"
	Revert "cred: add missing return error code when set_cred_ucounts() failed"
	Revert "Add a reference to ucounts for each cred"
	static_call: Fix unused variable warn w/o MODULE
	xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
	ARM: OMAP1: ams-delta: remove unused function ams_delta_camera_power
	gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
	reset: reset-zynqmp: Fixed the argument data type
	qed: Fix the VF msix vectors flow
	net: macb: Add a NULL check on desc_ptp
	qede: Fix memset corruption
	perf/x86/intel/pt: Fix mask of num_address_ranges
	ceph: fix possible null-pointer dereference in ceph_mdsmap_decode()
	perf/x86/amd/ibs: Work around erratum #1197
	perf/x86/amd/power: Assign pmu.module
	cryptoloop: add a deprecation warning
	ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
	ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
	ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
	serial: 8250: 8250_omap: Fix possible array out of bounds access
	spi: Switch to signed types for *_native_cs SPI controller fields
	new helper: inode_wrong_type()
	fuse: fix illegal access to inode with reused nodeid
	media: stkwebcam: fix memory leak in stk_camera_probe
	Linux 5.10.63

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5d461fa0b4dd5ba2457663bd20da1001936feaca
2021-09-08 09:08:09 +02:00
Al Viro
40ba433a85 new helper: inode_wrong_type()
commit 6e3e2c4362e41a2f18e3f7a5ad81bd2f49a47b85 upstream.

inode_wrong_type(inode, mode) returns true if setting inode->i_mode
to given value would've changed the inode type.  We have enough of
those checks open-coded to make a helper worthwhile.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-08 08:49:01 +02:00
Greg Kroah-Hartman
674d2ac211 This is the 5.10.62 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEx2IsACgkQONu9yGCS
 aT6bihAA1pqL2x40IIk7nmu3XW/lNJxt4WLRjT7kGehDYE5gNz5VTQDaccb/+PiM
 18XjLN0RcSkhiai8410A/SNoHBvPSMWrNvf093NpFcGm0WcvsZVyNUfRgdXfs1N8
 FM1DAgA5eVowL+CthZyJIIRX6VllLAg1b3Z61frNO/t1nOUsS26enoxMSeaziqjz
 BuvajftaRGtJBMA3iNB1iKR3EEHRqfuWMT4swfQGDshdHlzXbdDOs0KV4bTYRo+f
 76n1bvftiMH4vRONIR3T+ZeJWeaL6IfW01v7qYx+06hBa6TtkwDc+Ofw5zxWFtj1
 7abou5U46gHIp4Ce8ANJzmnvd7iOssFk7+6y8Z7lZgUQCdwHFLP70VX9Jd3bRlsK
 UIwG0qiIG0jdLgUvjgritDWIcxuSniWIbecLr1xfHIzJAIvVr6bjRNyOz3gXgaa/
 h16oHZRhprC3+4baUQPjPiSb54z+y0Xrx8x9ZSvgHe4gQmctjzoKMVr9Fy7NSpQv
 MVVNi9GvqRI+o+Tu7/N3yxShdXvuRvOOFgeOcyvA7BigrxMb+LvOsPcISFIBva6a
 6+vKuRY79TMwEbDJkURnSNqkVyvMuqKhH5OGiKVHkQrp3AkltpDyDuap+6i2oar4
 ba20HaVstcSdCfx8iCmiy/l0g16vOyNC8cVVdB4WoX1fU6aiv9Y=
 =g+cC
 -----END PGP SIGNATURE-----

Merge 5.10.62 into android12-5.10-lts

Changes in 5.10.62
	net: qrtr: fix another OOB Read in qrtr_endpoint_post
	bpf: Fix ringbuf helper function compatibility
	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
	ASoC: rt5682: Adjust headset volume button threshold
	ASoC: component: Remove misplaced prefix handling in pin control functions
	ARC: Fix CONFIG_STACKDEPOT
	netfilter: conntrack: collect all entries in one cycle
	once: Fix panic when module unload
	blk-iocost: fix lockdep warning on blkcg->lock
	ovl: fix uninitialized pointer read in ovl_lookup_real_one()
	net: mscc: Fix non-GPL export of regmap APIs
	can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
	ceph: correctly handle releasing an embedded cap flush
	riscv: Ensure the value of FP registers in the core dump file is up to date
	Revert "btrfs: compression: don't try to compress if we don't have enough pages"
	drm/amdgpu: Cancel delayed work when GFXOFF is disabled
	Revert "USB: serial: ch341: fix character loss at high transfer rates"
	USB: serial: option: add new VID/PID to support Fibocom FG150
	usb: renesas-xhci: Prefer firmware loading on unknown ROM state
	usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
	usb: dwc3: gadget: Stop EP0 transfers during pullup disable
	scsi: core: Fix hang of freezing queue between blocking and running device
	RDMA/bnxt_re: Add missing spin lock initialization
	IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
	RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init()
	ice: do not abort devlink info if board identifier can't be found
	net: usb: pegasus: fixes of set_register(s) return value evaluation;
	igc: fix page fault when thunderbolt is unplugged
	igc: Use num_tx_queues when iterating over tx_ring queue
	e1000e: Fix the max snoop/no-snoop latency for 10M
	e1000e: Do not take care about recovery NVM checksum
	RDMA/efa: Free IRQ vectors on error flow
	ip_gre: add validation for csum_start
	xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
	net: marvell: fix MVNETA_TX_IN_PRGRS bit number
	ucounts: Increase ucounts reference counter before the security hook
	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
	ipv6: use siphash in rt6_exception_hash()
	ipv4: use siphash instead of Jenkins in fnhe_hashfun()
	cxgb4: dont touch blocked freelist bitmap after free
	rtnetlink: Return correct error on changing device netns
	net: hns3: clear hardware resource when loading driver
	net: hns3: add waiting time before cmdq memory is released
	net: hns3: fix duplicate node in VLAN list
	net: hns3: fix get wrong pfc_en when query PFC configuration
	Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711"
	net: stmmac: add mutex lock to protect est parameters
	net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
	drm/i915: Fix syncmap memory leak
	usb: gadget: u_audio: fix race condition on endpoint stop
	dt-bindings: sifive-l2-cache: Fix 'select' matching
	perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
	clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference
	iwlwifi: pnvm: accept multiple HW-type TLVs
	opp: remove WARN when no valid OPPs remain
	cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
	virtio: Improve vq->broken access to avoid any compiler optimization
	virtio_pci: Support surprise removal of virtio pci device
	virtio_vdpa: reject invalid vq indices
	vringh: Use wiov->used to check for read/write desc order
	tools/virtio: fix build
	qed: qed ll2 race condition fixes
	qed: Fix null-pointer dereference in qed_rdma_create_qp()
	Revert "drm/amd/pm: fix workload mismatch on vega10"
	drm/amd/pm: change the workload type for some cards
	blk-mq: don't grab rq's refcount in blk_mq_check_expired()
	drm: Copy drm_wait_vblank to user before returning
	drm/nouveau/disp: power down unused DP links during init
	drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences
	net/rds: dma_map_sg is entitled to merge entries
	btrfs: fix race between marking inode needs to be logged and log syncing
	pipe: avoid unnecessary EPOLLET wakeups under normal loads
	pipe: do FASYNC notifications for every pipe IO, not just state changes
	mtd: spinand: Fix incorrect parameters for on-die ECC
	tipc: call tipc_wait_for_connect only when dlen is not 0
	vt_kdsetmode: extend console locking
	Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
	riscv: Fixup wrong ftrace remove cflag
	riscv: Fixup patch_text panic in ftrace
	perf env: Fix memory leak of bpf_prog_info_linear member
	perf symbol-elf: Fix memory leak by freeing sdt_note.args
	perf record: Fix memory leak in vDSO found using ASAN
	perf tools: Fix arm64 build error with gcc-11
	perf annotate: Fix jump parsing for C++ code.
	powerpc/perf: Invoke per-CPU variable access with disabled interrupts
	srcu: Provide internal interface to start a Tree SRCU grace period
	srcu: Provide polling interfaces for Tree SRCU grace periods
	srcu: Provide internal interface to start a Tiny SRCU grace period
	srcu: Make Tiny SRCU use multi-bit grace-period counter
	srcu: Provide polling interfaces for Tiny SRCU grace periods
	tracepoint: Use rcu get state and cond sync for static call updates
	usb: typec: ucsi: acpi: Always decode connector change information
	usb: typec: ucsi: Work around PPM losing change information
	usb: typec: ucsi: Clear pending after acking connector change
	net: dsa: mt7530: fix VLAN traffic leaks again
	lkdtm: Enable DOUBLE_FAULT on all architectures
	arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
	btrfs: fix NULL pointer dereference when deleting device by invalid id
	kthread: Fix PF_KTHREAD vs to_kthread() race
	Revert "floppy: reintroduce O_NDELAY fix"
	Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
	audit: move put_tree() to avoid trim_trees refcount underflow and UAF
	bpf: Fix potentially incorrect results with bpf_get_local_storage()
	Linux 5.10.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3
2021-09-03 10:51:56 +02:00
Miklos Szeredi
ef2d68ef9a ovl: fix uninitialized pointer read in ovl_lookup_real_one()
[ Upstream commit 580c610429b3994e8db24418927747cf28443cde ]

One error path can result in release_dentry_name_snapshot() being called
before "name" was initialized by take_dentry_name_snapshot().

Fix by moving the release_dentry_name_snapshot() to immediately after the
only use.

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:22 +02:00
Greg Kroah-Hartman
e054456ced Merge 5.10.37 into android12-5.10
Changes in 5.10.37
	Bluetooth: verify AMP hci_chan before amp_destroy
	bluetooth: eliminate the potential race condition when removing the HCI controller
	net/nfc: fix use-after-free llcp_sock_bind/connect
	io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
	Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
	usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
	tty: moxa: fix TIOCSSERIAL jiffies conversions
	tty: amiserial: fix TIOCSSERIAL permission check
	USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
	staging: greybus: uart: fix TIOCSSERIAL jiffies conversions
	USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL jiffies conversions
	tty: moxa: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL permission check
	drm: bridge: fix LONTIUM use of mipi_dsi_() functions
	usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply
	usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply
	usb: typec: tcpm: update power supply once partner accepts
	usb: xhci-mtk: remove or operator for setting schedule parameters
	usb: xhci-mtk: improve bandwidth scheduling with TT
	ASoC: samsung: tm2_wm5110: check of of_parse return value
	ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function
	ASoC: tlv320aic32x4: Register clocks before registering component
	ASoC: tlv320aic32x4: Increase maximum register in regmap
	MIPS: pci-mt7620: fix PLL lock check
	MIPS: pci-rt2880: fix slot 0 configuration
	FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
	PCI: Allow VPD access for QLogic ISP2722
	KVM: x86: Defer the MMU unload to the normal path on an global INVPCID
	PCI: xgene: Fix cfg resource mapping
	PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c
	PM / devfreq: Unlock mutex and free devfreq struct in error path
	soc/tegra: regulators: Fix locking up when voltage-spread is out of range
	iio: inv_mpu6050: Fully validate gyro and accel scale writes
	iio:accel:adis16201: Fix wrong axis assignment that prevents loading
	iio:adc:ad7476: Fix remove handling
	sc16is7xx: Defer probe if device read fails
	phy: cadence: Sierra: Fix PHY power_on sequence
	misc: lis3lv02d: Fix false-positive WARN on various HP models
	phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create()
	misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
	misc: vmw_vmci: explicitly initialize vmci_datagram payload
	selinux: add proper NULL termination to the secclass_map permissions
	x86, sched: Treat Intel SNC topology as default, COD as exception
	async_xor: increase src_offs when dropping destination page
	md/bitmap: wait for external bitmap writes to complete during tear down
	md-cluster: fix use-after-free issue when removing rdev
	md: split mddev_find
	md: factor out a mddev_find_locked helper from mddev_find
	md: md_open returns -EBUSY when entering racing area
	md: Fix missing unused status line of /proc/mdstat
	mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put()
	ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
	cfg80211: scan: drop entry from hidden_list on overflow
	rtw88: Fix array overrun in rtw_get_tx_power_params()
	mt76: fix potential DMA mapping leak
	FDDI: defxx: Make MMIO the configuration default except for EISA
	drm/i915/gvt: Fix virtual display setup for BXT/APL
	drm/i915/gvt: Fix vfio_edid issue for BXT/APL
	drm/qxl: use ttm bo priorities
	drm/panfrost: Clear MMU irqs before handling the fault
	drm/panfrost: Don't try to map pages that are already mapped
	drm/radeon: fix copy of uninitialized variable back to userspace
	drm/dp_mst: Revise broadcast msg lct & lcr
	drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
	drm: bridge/panel: Cleanup connector on bridge detach
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
	ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
	ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
	ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
	ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
	ALSA: hda/realtek: Re-order ALC662 quirk table entries
	ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
	ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
	ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
	KVM: s390: VSIE: correctly handle MVPG when in VSIE
	KVM: s390: split kvm_s390_logical_to_effective
	KVM: s390: fix guarded storage control register handling
	s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility
	KVM: s390: VSIE: fix MVPG handling for prefixing and MSO
	KVM: s390: split kvm_s390_real_to_abs
	KVM: s390: extend kvm_s390_shadow_fault to return entry pointer
	KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit
	KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads
	KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
	KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
	KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created
	KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported
	KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
	KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit
	KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
	KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
	KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
	KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
	KVM: arm64: Fully zero the vcpu state on reset
	KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
	Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
	Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
	ovl: fix missing revert_creds() on error path
	Revert "drm/qxl: do not run release if qxl failed to init"
	usb: gadget: pch_udc: Revert d3cb25a121 completely
	Revert "tools/power turbostat: adjust for temperature offset"
	firmware: xilinx: Fix dereferencing freed memory
	firmware: xilinx: Add a blank line after function declaration
	firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
	fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
	crypto: sun8i-ss - fix result memory leak on error path
	memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family
	ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
	ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
	ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
	ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family
	ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files
	arm64: dts: renesas: Add mmc aliases into board dts files
	x86/platform/uv: Set section block size for hubless architectures
	serial: stm32: fix code cleaning warnings and checks
	serial: stm32: add "_usart" prefix in functions name
	serial: stm32: fix probe and remove order for dma
	serial: stm32: Use of_device_get_match_data()
	serial: stm32: fix startup by enabling usart for reception
	serial: stm32: fix incorrect characters on console
	serial: stm32: fix TX and RX FIFO thresholds
	serial: stm32: fix a deadlock condition with wakeup event
	serial: stm32: fix wake-up flag handling
	serial: stm32: fix a deadlock in set_termios
	serial: stm32: fix tx dma completion, release channel
	serial: stm32: call stm32_transmit_chars locked
	serial: stm32: fix FIFO flush in startup and set_termios
	serial: stm32: add FIFO flush when port is closed
	serial: stm32: fix tx_empty condition
	usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
	usb: typec: tps6598x: Fix return value check in tps6598x_probe()
	usb: typec: stusb160x: fix return value check in stusb160x_probe()
	regmap: set debugfs_name to NULL after it is freed
	spi: rockchip: avoid objtool warning
	mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
	mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
	mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
	mtd: rawnand: qcom: Return actual error code instead of -ENODEV
	mtd: don't lock when recursively deleting partitions
	mtd: maps: fix error return code of physmap_flash_remove()
	ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control
	arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity
	arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer
	arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x
	crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map
	spi: stm32: drop devres version of spi_register_master
	regulator: bd9576: Fix return from bd957x_probe()
	arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding
	spi: stm32: Fix use-after-free on unbind
	x86/microcode: Check for offline CPUs before requesting new microcode
	devtmpfs: fix placement of complete() call
	usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
	usb: gadget: pch_udc: Check if driver is present before calling ->setup()
	usb: gadget: pch_udc: Check for DMA mapping error
	usb: gadget: pch_udc: Initialize device pointer before use
	usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1)
	crypto: ccp - fix command queuing to TEE ring buffer
	crypto: qat - don't release uninitialized resources
	crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
	fotg210-udc: Fix DMA on EP0 for length > max packet size
	fotg210-udc: Fix EP0 IN requests bigger than two packets
	fotg210-udc: Remove a dubious condition leading to fotg210_done
	fotg210-udc: Mask GRP2 interrupts we don't handle
	fotg210-udc: Don't DMA more than the buffer can take
	fotg210-udc: Complete OUT requests on short packets
	usb: gadget: s3c: Fix incorrect resources releasing
	usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()'
	dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties'
	mtd: require write permissions for locking and badblock ioctls
	arm64: dts: renesas: r8a779a0: Fix PMU interrupt
	bus: qcom: Put child node before return
	soundwire: bus: Fix device found flag correctly
	phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup
	phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally
	arm64: dts: mediatek: fix reset GPIO level on pumpkin
	NFSD: Fix sparse warning in nfs4proc.c
	NFSv4.2: fix copy stateid copying for the async copy
	crypto: poly1305 - fix poly1305_core_setkey() declaration
	crypto: qat - fix error path in adf_isr_resource_alloc()
	usb: gadget: aspeed: fix dma map failure
	USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
	drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
	driver core: platform: Declare early_platform_cleanup() prototype
	memory: pl353: fix mask of ECC page_size config register
	soundwire: stream: fix memory leak in stream config error path
	m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
	firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool
	firmware: qcom_scm: Reduce locking section for __get_convention()
	firmware: qcom_scm: Workaround lack of "is available" call on SC7180
	iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol
	mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
	irqchip/gic-v3: Fix OF_BAD_ADDR error handling
	staging: comedi: tests: ni_routes_test: Fix compilation error
	staging: rtl8192u: Fix potential infinite loop
	staging: fwserial: fix TIOCSSERIAL implementation
	staging: fwserial: fix TIOCGSERIAL implementation
	staging: greybus: uart: fix unprivileged TIOCCSERIAL
	soc: qcom: pdr: Fix error return code in pdr_register_listener
	PM / devfreq: Use more accurate returned new_freq as resume_freq
	clocksource/drivers/timer-ti-dm: Fix posted mode status check order
	clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped
	clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe()
	spi: Fix use-after-free with devm_spi_alloc_*
	spi: fsl: add missing iounmap() on error in of_fsl_spi_probe()
	soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
	soc: qcom: mdt_loader: Detect truncated read of segments
	PM: runtime: Replace inline function pm_runtime_callbacks_present()
	cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration
	ACPI: CPPC: Replace cppc_attr with kobj_attribute
	crypto: allwinner - add missing CRYPTO_ prefix
	crypto: sun8i-ss - Fix memory leak of pad
	crypto: sa2ul - Fix memory leak of rxd
	crypto: qat - Fix a double free in adf_create_ring
	cpufreq: armada-37xx: Fix setting TBG parent for load levels
	clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock
	cpufreq: armada-37xx: Fix the AVS value for load L1
	clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz
	clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0
	cpufreq: armada-37xx: Fix driver cleanup when registration failed
	cpufreq: armada-37xx: Fix determining base CPU frequency
	spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible
	spi: spi-zynqmp-gqspi: add mutex locking for exec_op
	spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality
	spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op
	spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()
	usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
	USB: cdc-acm: fix unprivileged TIOCCSERIAL
	USB: cdc-acm: fix TIOCGSERIAL implementation
	tty: actually undefine superseded ASYNC flags
	tty: fix return value for unsupported ioctls
	tty: Remove dead termiox code
	tty: fix return value for unsupported termiox ioctls
	serial: core: return early on unsupported ioctls
	firmware: qcom-scm: Fix QCOM_SCM configuration
	node: fix device cleanups in error handling code
	crypto: chelsio - Read rxchannel-id from firmware
	usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
	m68k: Add missing mmap_read_lock() to sys_cacheflush()
	spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op()
	memory: renesas-rpc-if: fix possible NULL pointer dereference of resource
	memory: samsung: exynos5422-dmc: handle clk_set_parent() failure
	security: keys: trusted: fix TPM2 authorizations
	platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table
	ARM: dts: aspeed: Rainier: Fix humidity sensor bus address
	Drivers: hv: vmbus: Use after free in __vmbus_open()
	spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue
	spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume
	spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
	spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails
	x86/platform/uv: Fix !KEXEC build failure
	hwmon: (pmbus/pxe1610) don't bail out when not all pages are active
	Drivers: hv: vmbus: Increase wait time for VMbus unload
	PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check
	usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
	usb: dwc2: Fix hibernation between host and device modes.
	ttyprintk: Add TTY hangup callback.
	serial: omap: don't disable rs485 if rts gpio is missing
	serial: omap: fix rs485 half-duplex filtering
	xen-blkback: fix compatibility bug with single page rings
	soc: aspeed: fix a ternary sign expansion bug
	drm/tilcdc: send vblank event when disabling crtc
	drm/stm: Fix bus_flags handling
	drm/amd/display: Fix off by one in hdmi_14_process_transaction()
	drm/mcde/panel: Inverse misunderstood flag
	sched/fair: Fix shift-out-of-bounds in load_balance()
	afs: Fix updating of i_mode due to 3rd party change
	rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
	media: vivid: fix assignment of dev->fbuf_out_flags
	media: saa7134: use sg_dma_len when building pgtable
	media: saa7146: use sg_dma_len when building pgtable
	media: omap4iss: return error code when omap4iss_get() failed
	media: rkisp1: rsz: crash fix when setting src format
	media: aspeed: fix clock handling logic
	drm/probe-helper: Check epoch counter in output_poll_execute()
	media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'
	media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming()
	media: m88ds3103: fix return value check in m88ds3103_probe()
	media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30
	media: [next] staging: media: atomisp: fix memory leak of object flash
	media: atomisp: Fixed error handling path
	media: m88rs6000t: avoid potential out-of-bounds reads on arrays
	media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
	drm/amdkfd: fix build error with AMD_IOMMU_V2=m
	of: overlay: fix for_each_child.cocci warnings
	x86/kprobes: Fix to check non boostable prefixes correctly
	selftests: fix prepending $(OUTPUT) to $(TEST_PROGS)
	pata_arasan_cf: fix IRQ check
	pata_ipx4xx_cf: fix IRQ check
	sata_mv: add IRQ checks
	ata: libahci_platform: fix IRQ check
	seccomp: Fix CONFIG tests for Seccomp_filters
	nvme-tcp: block BH in sk state_change sk callback
	nvmet-tcp: fix incorrect locking in state_change sk callback
	clk: imx: Fix reparenting of UARTs not associated with stdout
	power: supply: bq25980: Move props from battery node
	nvme: retrigger ANA log update if group descriptor isn't found
	media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream
	media: i2c: imx219: Balance runtime PM use-count
	media: v4l2-ctrls.c: fix race condition in hdl->requests list
	vfio/fsl-mc: Re-order vfio_fsl_mc_probe()
	vfio/pci: Move VGA and VF initialization to functions
	vfio/pci: Re-order vfio_pci_probe()
	vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
	clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback
	clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable
	drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()
	clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
	clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE
	drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
	drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
	clk: uniphier: Fix potential infinite loop
	scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
	scsi: pm80xx: Fix potential infinite loop
	scsi: ufs: ufshcd-pltfrm: Fix deferred probing
	scsi: hisi_sas: Fix IRQ checks
	scsi: jazz_esp: Add IRQ check
	scsi: sun3x_esp: Add IRQ check
	scsi: sni_53c710: Add IRQ check
	scsi: ibmvfc: Fix invalid state machine BUG_ON()
	mailbox: sprd: Introduce refcnt when clients requests/free channels
	mfd: stm32-timers: Avoid clearing auto reload register
	nvmet-tcp: fix a segmentation fault during io parsing error
	nvme-pci: don't simple map sgl when sgls are disabled
	media: cedrus: Fix H265 status definitions
	HSI: core: fix resource leaks in hsi_add_client_from_dt()
	x86/events/amd/iommu: Fix sysfs type mismatch
	perf/amd/uncore: Fix sysfs type mismatch
	io_uring: fix overflows checks in provide buffers
	sched/debug: Fix cgroup_path[] serialization
	drivers/block/null_blk/main: Fix a double free in null_init.
	xsk: Respect device's headroom and tailroom on generic xmit path
	HID: plantronics: Workaround for double volume key presses
	perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars
	ASoC: Intel: boards: sof-wm8804: add check for PLL setting
	ASoC: Intel: Skylake: Compile when any configuration is selected
	RDMA/mlx5: Fix mlx5 rates to IB rates map
	wilc1000: write value to WILC_INTR2_ENABLE register
	KVM: x86/mmu: Retry page faults that hit an invalid memslot
	Bluetooth: avoid deadlock between hci_dev->lock and socket lock
	net: lapbether: Prevent racing when checking whether the netif is running
	libbpf: Add explicit padding to bpf_xdp_set_link_opts
	bpftool: Fix maybe-uninitialized warnings
	iommu: Check dev->iommu in iommu_dev_xxx functions
	iommu/vt-d: Reject unsupported page request modes
	selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed
	libbpf: Add explicit padding to btf_dump_emit_type_decl_opts
	powerpc/fadump: Mark fadump_calculate_reserve_size as __init
	powerpc/prom: Mark identical_pvr_fixup as __init
	MIPS: fix local_irq_{disable,enable} in asmmacro.h
	ima: Fix the error code for restoring the PCR value
	inet: use bigger hash table for IP ID generation
	pinctrl: pinctrl-single: remove unused parameter
	pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero
	MIPS: loongson64: fix bug when PAGE_SIZE > 16KB
	ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk
	iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK
	RDMA/mlx5: Fix drop packet rule in egress table
	IB/isert: Fix a use after free in isert_connect_request
	powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
	MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again
	gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
	ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
	net: phy: lan87xx: fix access to wrong register of LAN87xx
	udp: never accept GSO_FRAGLIST packets
	powerpc/pseries: Only register vio drivers if vio bus exists
	net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()
	bug: Remove redundant condition check in report_bug
	RDMA/core: Fix corrupted SL on passive side
	nfc: pn533: prevent potential memory corruption
	net: hns3: Limiting the scope of vector_ring_chain variable
	mips: bmips: fix syscon-reboot nodes
	iommu/vt-d: Don't set then clear private data in prq_event_thread()
	iommu: Fix a boundary issue to avoid performance drop
	iommu/vt-d: Report right snoop capability when using FL for IOVA
	iommu/vt-d: Report the right page fault address
	iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
	iommu/vt-d: Remove WO permissions on second-level paging entries
	iommu/vt-d: Invalidate PASID cache when root/context entry changed
	ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
	HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness
	HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
	HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
	HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
	KVM: arm64: Initialize VCPU mdcr_el2 before loading it
	ASoC: simple-card: fix possible uninitialized single_cpu local variable
	liquidio: Fix unintented sign extension of a left shift of a u16
	IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
	powerpc/64s: Fix pte update for kernel memory on radix
	powerpc/perf: Fix PMU constraint check for EBB events
	powerpc: iommu: fix build when neither PCI or IBMVIO is set
	mac80211: bail out if cipher schemes are invalid
	perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
	xfs: fix return of uninitialized value in variable error
	rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
	mt7601u: fix always true expression
	mt76: mt7615: fix tx skb dma unmap
	mt76: mt7915: fix tx skb dma unmap
	mt76: mt7915: fix aggr len debugfs node
	mt76: mt7615: fix mib stats counter reporting to mac80211
	mt76: mt7915: fix mib stats counter reporting to mac80211
	mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation
	mt76: mt7663s: fix the possible device hang in high traffic
	KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
	ovl: invalidate readdir cache on changes to dir with origin
	RDMA/qedr: Fix error return code in qedr_iw_connect()
	IB/hfi1: Fix error return code in parse_platform_config()
	RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()
	cxgb4: Fix unintentional sign extension issues
	net: thunderx: Fix unintentional sign extension issue
	RDMA/srpt: Fix error return code in srpt_cm_req_recv()
	RDMA/rtrs-clt: destroy sysfs after removing session from active list
	i2c: cadence: fix reference leak when pm_runtime_get_sync fails
	i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
	i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
	i2c: imx: fix reference leak when pm_runtime_get_sync fails
	i2c: omap: fix reference leak when pm_runtime_get_sync fails
	i2c: sprd: fix reference leak when pm_runtime_get_sync fails
	i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
	i2c: xiic: fix reference leak when pm_runtime_get_sync fails
	i2c: cadence: add IRQ check
	i2c: emev2: add IRQ check
	i2c: jz4780: add IRQ check
	i2c: mlxbf: add IRQ check
	i2c: rcar: make sure irq is not threaded on Gen2 and earlier
	i2c: rcar: protect against supurious interrupts on V3U
	i2c: rcar: add IRQ check
	i2c: sh7760: add IRQ check
	powerpc/xive: Drop check on irq_data in xive_core_debug_show()
	powerpc/xive: Fix xmon command "dxi"
	ASoC: ak5558: correct reset polarity
	net/mlx5: Fix bit-wise and with zero
	net/packet: make packet_fanout.arr size configurable up to 64K
	net/packet: remove data races in fanout operations
	drm/i915/gvt: Fix error code in intel_gvt_init_device()
	iommu/amd: Put newline after closing bracket in warning
	perf beauty: Fix fsconfig generator
	drm/amd/pm: fix error code in smu_set_power_limit()
	MIPS: pci-legacy: stop using of_pci_range_to_resource
	powerpc/pseries: extract host bridge from pci_bus prior to bus removal
	powerpc/smp: Reintroduce cpu_core_mask
	KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
	rtlwifi: 8821ae: upgrade PHY and RF parameters
	wlcore: fix overlapping snprintf arguments in debugfs
	i2c: sh7760: fix IRQ error path
	i2c: mediatek: Fix wrong dma sync flag
	mwl8k: Fix a double Free in mwl8k_probe_hw
	netfilter: nft_payload: fix C-VLAN offload support
	netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
	netfilter: nftables_offload: special ethertype handling for VLAN
	vsock/vmci: log once the failed queue pair allocation
	libbpf: Initialize the bpf_seq_printf parameters array field by field
	net: ethernet: ixp4xx: Set the DMA masks explicitly
	gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
	RDMA/cxgb4: add missing qpid increment
	RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
	ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
	sfc: ef10: fix TX queue lookup in TX event handling
	vsock/virtio: free queued packets when closing socket
	net: marvell: prestera: fix port event handling on init
	net: davinci_emac: Fix incorrect masking of tx and rx error channel
	mt76: mt7615: fix memleak when mt7615_unregister_device()
	crypto: ccp: Detect and reject "invalid" addresses destined for PSP
	nfp: devlink: initialize the devlink port attribute "lanes"
	net: stmmac: fix TSO and TBS feature enabling during driver open
	net: renesas: ravb: Fix a stuck issue when a lot of frames are received
	net: phy: intel-xway: enable integrated led functions
	RDMA/rxe: Fix a bug in rxe_fill_ip_info()
	RDMA/core: Add CM to restrack after successful attachment to a device
	powerpc/64: Fix the definition of the fixmap area
	ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
	ath10k: Fix a use after free in ath10k_htc_send_bundle
	ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
	wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
	powerpc/perf: Fix the threshold event selection for memory events in power10
	powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')
	net: phy: marvell: fix m88e1011_set_downshift
	net: phy: marvell: fix m88e1111_set_downshift
	net: enetc: fix link error again
	bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
	ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
	selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
	selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test
	bnxt_en: Fix RX consumer index logic in the error path.
	KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
	net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
	selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
	selftests/bpf: Fix field existence CO-RE reloc tests
	selftests/bpf: Fix core_reloc test runner
	bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
	RDMA/siw: Fix a use after free in siw_alloc_mr
	RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
	net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
	perf tools: Change fields type in perf_record_time_conv
	perf jit: Let convert_timestamp() to be backwards-compatible
	perf session: Add swap operation for event TIME_CONV
	ia64: fix EFI_DEBUG build
	kfifo: fix ternary sign extension bugs
	mm/sl?b.c: remove ctor argument from kmem_cache_flags
	mm: memcontrol: slab: fix obtain a reference to a freeing memcg
	mm/sparse: add the missing sparse_buffer_fini() in error branch
	mm/memory-failure: unnecessary amount of unmapping
	afs: Fix speculative status fetches
	bpf: Fix alu32 const subreg bound tracking on bitwise operations
	bpf, ringbuf: Deny reserve of buffers larger than ringbuf
	bpf: Prevent writable memory-mapping of read-only ringbuf pages
	arm64: Remove arm64_dma32_phys_limit and its uses
	net: Only allow init netns to set default tcp cong to a restricted algo
	smp: Fix smp_call_function_single_async prototype
	Revert "net/sctp: fix race condition in sctp_destroy_sock"
	sctp: delay auto_asconf init until binding the first addr
	Linux 5.10.37

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5bee89c285d9dd72de967b0e70d96951ae4e06ae
2021-05-15 09:28:55 +02:00
Amir Goldstein
0f8528c78f ovl: invalidate readdir cache on changes to dir with origin
[ Upstream commit 65cd913ec9d9d71529665924c81015b7ab7d9381 ]

The test in ovl_dentry_version_inc() was out-dated and did not include
the case where readdir cache is used on a non-merge dir that has origin
xattr, indicating that it may contain leftover whiteouts.

To make the code more robust, use the same helper ovl_dir_is_real()
to determine if readdir cache should be used and if readdir cache should
be invalidated.

Fixes: b79e05aaa1 ("ovl: no direct iteration for dir with origin xattr")
Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxht70nODhNHNwGFMSqDyOKLXOKrY0H6g849os4BQ7cokA@mail.gmail.com/
Cc: Chris Murphy <lists@colorremedies.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:35 +02:00
Dan Carpenter
06f414e5c9 ovl: fix missing revert_creds() on error path
commit 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 upstream.

Smatch complains about missing that the ovl_override_creds() doesn't
have a matching revert_creds() if the dentry is disconnected.  Fix this
by moving the ovl_override_creds() until after the disconnected check.

Fixes: aa3ff3c152 ("ovl: copy up of disconnected dentries")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-14 09:50:05 +02:00
Greg Kroah-Hartman
bfac7b85a0 Merge 5.10.35 into android12-5.10
Changes in 5.10.35
	mips: Do not include hi and lo in clobber list for R6
	netfilter: conntrack: Make global sysctls readonly in non-init netns
	net: usb: ax88179_178a: initialize local variables before use
	igb: Enable RSS for Intel I211 Ethernet Controller
	bpf: Fix masking negation logic upon negative dst register
	bpf: Fix leakage of uninitialized bpf stack under speculation
	net: qrtr: Avoid potential use after free in MHI send
	perf data: Fix error return code in perf_data__create_dir()
	capabilities: require CAP_SETFCAP to map uid 0
	perf ftrace: Fix access to pid in array when setting a pid filter
	tools/cgroup/slabinfo.py: updated to work on current kernel
	driver core: add a min_align_mask field to struct device_dma_parameters
	swiotlb: add a IO_TLB_SIZE define
	swiotlb: factor out an io_tlb_offset helper
	swiotlb: factor out a nr_slots helper
	swiotlb: clean up swiotlb_tbl_unmap_single
	swiotlb: refactor swiotlb_tbl_map_single
	swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single
	swiotlb: respect min_align_mask
	nvme-pci: set min_align_mask
	ovl: fix leaked dentry
	ovl: allow upperdir inside lowerdir
	ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
	USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
	USB: Add reset-resume quirk for WD19's Realtek Hub
	platform/x86: thinkpad_acpi: Correct thermal sensor allocation
	perf/core: Fix unconditional security_locked_down() call
	vfio: Depend on MMU
	Linux 5.10.35

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iff7d5abe7b821f453bbe4d9dad94dfd35fe0a082
2021-05-08 12:45:00 +02:00
Miklos Szeredi
27c1936af5 ovl: allow upperdir inside lowerdir
commit 708fa01597fa002599756bf56a96d0de1677375c upstream.

Commit 146d62e5a5 ("ovl: detect overlapping layers") made sure we don't
have overlapping layers, but it also broke the arguably valid use case of

 mount -olowerdir=/,upperdir=/subdir,..

where upperdir overlaps lowerdir on the same filesystem.  This has been
causing regressions.

Revert the check, but only for the specific case where upperdir and/or
workdir are subdirectories of lowerdir.  Any other overlap (e.g. lowerdir
is subdirectory of upperdir, etc) case is crazy, so leave the check in
place for those.

Overlaps are detected at lookup time too, so reverting the mount time check
should be safe.

Fixes: 146d62e5a5 ("ovl: detect overlapping layers")
Cc: <stable@vger.kernel.org> # v5.2
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-07 11:04:33 +02:00
Mickaël Salaün
71d58457a8 ovl: fix leaked dentry
commit eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41 upstream.

Since commit 6815f479ca ("ovl: use only uppermetacopy state in
ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a
metacopy error, which leads to dentry leaks when shutting down the related
superblock:

  overlayfs: refusing to follow metacopy origin for (/file0)
  ...
  BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]
  ...
  WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d
  CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1
  ...
  RIP: 0010:umount_check.cold+0x107/0x14d
  ...
  Call Trace:
   d_walk+0x28c/0x950
   ? dentry_lru_isolate+0x2b0/0x2b0
   ? __kasan_slab_free+0x12/0x20
   do_one_tree+0x33/0x60
   shrink_dcache_for_umount+0x78/0x1d0
   generic_shutdown_super+0x70/0x440
   kill_anon_super+0x3e/0x70
   deactivate_locked_super+0xc4/0x160
   deactivate_super+0xfa/0x140
   cleanup_mnt+0x22e/0x370
   __cleanup_mnt+0x1a/0x30
   task_work_run+0x139/0x210
   do_exit+0xb0c/0x2820
   ? __kasan_check_read+0x1d/0x30
   ? find_held_lock+0x35/0x160
   ? lock_release+0x1b6/0x660
   ? mm_update_next_owner+0xa20/0xa20
   ? reacquire_held_locks+0x3f0/0x3f0
   ? __sanitizer_cov_trace_const_cmp4+0x22/0x30
   do_group_exit+0x135/0x380
   __do_sys_exit_group.isra.0+0x20/0x20
   __x64_sys_exit_group+0x3c/0x50
   do_syscall_64+0x45/0x70
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  ...
  VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

This fix has been tested with a syzkaller reproducer.

Cc: Amir Goldstein <amir73il@gmail.com>
Cc: <stable@vger.kernel.org> # v5.8+
Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 6815f479ca ("ovl: use only uppermetacopy state in ovl_lookup()")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Link: https://lore.kernel.org/r/20210329164907.2133175-1-mic@digikod.net
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-07 11:04:32 +02:00
Greg Kroah-Hartman
b129c98dc6 Merge 5.10.17 into android12-5.10
Changes in 5.10.17
	objtool: Fix seg fault with Clang non-section symbols
	Revert "dts: phy: add GPIO number and active state used for phy reset"
	gpio: mxs: GPIO_MXS should not default to y unconditionally
	gpio: ep93xx: fix BUG_ON port F usage
	gpio: ep93xx: Fix single irqchip with multi gpiochips
	tracing: Do not count ftrace events in top level enable output
	tracing: Check length before giving out the filter buffer
	drm/i915: Fix overlay frontbuffer tracking
	arm/xen: Don't probe xenbus as part of an early initcall
	cgroup: fix psi monitor for root cgroup
	Revert "drm/amd/display: Update NV1x SR latency values"
	drm/i915/tgl+: Make sure TypeC FIA is powered up when initializing it
	drm/dp_mst: Don't report ports connected if nothing is attached to them
	dmaengine: move channel device_node deletion to driver
	tmpfs: disallow CONFIG_TMPFS_INODE64 on s390
	tmpfs: disallow CONFIG_TMPFS_INODE64 on alpha
	soc: ti: omap-prm: Fix boot time errors for rst_map_012 bits 0 and 1
	arm64: dts: rockchip: Fix PCIe DT properties on rk3399
	arm64: dts: qcom: sdm845: Reserve LPASS clocks in gcc
	ARM: OMAP2+: Fix suspcious RCU usage splats for omap_enter_idle_coupled
	arm64: dts: rockchip: remove interrupt-names property from rk3399 vdec node
	platform/x86: hp-wmi: Disable tablet-mode reporting by default
	arm64: dts: rockchip: Disable display for NanoPi R2S
	ovl: perform vfs_getxattr() with mounter creds
	cap: fix conversions on getxattr
	ovl: skip getxattr of security labels
	scsi: lpfc: Fix EEH encountering oops with NVMe traffic
	x86/split_lock: Enable the split lock feature on another Alder Lake CPU
	nvme-pci: ignore the subsysem NQN on Phison E16
	drm/amd/display: Fix DPCD translation for LTTPR AUX_RD_INTERVAL
	drm/amd/display: Add more Clock Sources to DCN2.1
	drm/amd/display: Release DSC before acquiring
	drm/amd/display: Fix dc_sink kref count in emulated_link_detect
	drm/amd/display: Free atomic state after drm_atomic_commit
	drm/amd/display: Decrement refcount of dc_sink before reassignment
	riscv: virt_addr_valid must check the address belongs to linear mapping
	bfq-iosched: Revert "bfq: Fix computation of shallow depth"
	ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
	kallsyms: fix nonconverging kallsyms table with lld
	ARM: ensure the signal page contains defined contents
	ARM: kexec: fix oops after TLB are invalidated
	ubsan: implement __ubsan_handle_alignment_assumption
	Revert "lib: Restrict cpumask_local_spread to houskeeping CPUs"
	x86/efi: Remove EFI PGD build time checks
	lkdtm: don't move ctors to .rodata
	KVM: x86: cleanup CR3 reserved bits checks
	cgroup-v1: add disabled controller check in cgroup1_parse_param()
	dmaengine: idxd: fix misc interrupt completion
	ath9k: fix build error with LEDS_CLASS=m
	mt76: dma: fix a possible memory leak in mt76_add_fragment()
	drm/vc4: hvs: Fix buffer overflow with the dlist handling
	dmaengine: idxd: check device state before issue command
	bpf: Unbreak BPF_PROG_TYPE_KPROBE when kprobe is called via do_int3
	bpf: Check for integer overflow when using roundup_pow_of_two()
	netfilter: xt_recent: Fix attempt to update deleted entry
	selftests: netfilter: fix current year
	netfilter: nftables: fix possible UAF over chains from packet path in netns
	netfilter: flowtable: fix tcp and udp header checksum update
	xen/netback: avoid race in xenvif_rx_ring_slots_available()
	net: hdlc_x25: Return meaningful error code in x25_open
	net: ipa: set error code in gsi_channel_setup()
	hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in netvsc_receive()
	net: enetc: initialize the RFS and RSS memories
	selftests: txtimestamp: fix compilation issue
	net: stmmac: set TxQ mode back to DCB after disabling CBS
	ibmvnic: Clear failover_pending if unable to schedule
	netfilter: conntrack: skip identical origin tuple in same zone only
	scsi: scsi_debug: Fix a memory leak
	x86/build: Disable CET instrumentation in the kernel for 32-bit too
	net: dsa: felix: implement port flushing on .phylink_mac_link_down
	net: hns3: add a check for queue_id in hclge_reset_vf_queue()
	net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()
	net: hns3: add a check for index in hclge_get_rss_key()
	firmware_loader: align .builtin_fw to 8
	drm/sun4i: tcon: set sync polarity for tcon1 channel
	drm/sun4i: dw-hdmi: always set clock rate
	drm/sun4i: Fix H6 HDMI PHY configuration
	drm/sun4i: dw-hdmi: Fix max. frequency for H6
	clk: sunxi-ng: mp: fix parent rate change flag check
	i2c: stm32f7: fix configuration of the digital filter
	h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
	scripts: set proper OpenSSL include dir also for sign-file
	x86/pci: Create PCI/MSI irqdomain after x86_init.pci.arch_init()
	arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page
	rxrpc: Fix clearance of Tx/Rx ring when releasing a call
	udp: fix skb_copy_and_csum_datagram with odd segment sizes
	net: dsa: call teardown method on probe failure
	cpufreq: ACPI: Extend frequency tables to cover boost frequencies
	cpufreq: ACPI: Update arch scale-invariance max perf ratio if CPPC is not there
	net: gro: do not keep too many GRO packets in napi->rx_list
	net: fix iteration for sctp transport seq_files
	net/vmw_vsock: fix NULL pointer dereference
	net/vmw_vsock: improve locking in vsock_connect_timeout()
	net: watchdog: hold device global xmit lock during tx disable
	bridge: mrp: Fix the usage of br_mrp_port_switchdev_set_state
	switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT
	vsock/virtio: update credit only if socket is not closed
	vsock: fix locking in vsock_shutdown()
	net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
	net/qrtr: restrict user-controlled length in qrtr_tun_write_iter()
	ovl: expand warning in ovl_d_real()
	kcov, usb: only collect coverage from __usb_hcd_giveback_urb in softirq
	Linux 5.10.17

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id0300681f52b51d3f466f1e66ec3a6c25f65f4d3
2021-02-18 11:21:01 +01:00