lineage-22.0
16961 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Greg Kroah-Hartman
|
851de32d27 |
Merge tag 'android12-5.10.177_r00' into android12-5.10
This is the merge of the upstream LTS release of 5.10.177 into the android12-5.10 branch. It contains the following commits: 289d29ddbfdb Merge tag 'android12-5.10.177_r00' into android12-5.10 |
||
Tetsuo Handa
|
a992c387b4 |
mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
commit 1007843a91909a4995ee78a538f62d8665705b66 upstream.
syzbot is reporting circular locking dependency which involves
zonelist_update_seq seqlock [1], for this lock is checked by memory
allocation requests which do not need to be retried.
One deadlock scenario is kmalloc(GFP_ATOMIC) from an interrupt handler.
CPU0
----
__build_all_zonelists() {
write_seqlock(&zonelist_update_seq); // makes zonelist_update_seq.seqcount odd
// e.g. timer interrupt handler runs at this moment
some_timer_func() {
kmalloc(GFP_ATOMIC) {
__alloc_pages_slowpath() {
read_seqbegin(&zonelist_update_seq) {
// spins forever because zonelist_update_seq.seqcount is odd
}
}
}
}
// e.g. timer interrupt handler finishes
write_sequnlock(&zonelist_update_seq); // makes zonelist_update_seq.seqcount even
}
This deadlock scenario can be easily eliminated by not calling
read_seqbegin(&zonelist_update_seq) from !__GFP_DIRECT_RECLAIM allocation
requests, for retry is applicable to only __GFP_DIRECT_RECLAIM allocation
requests. But Michal Hocko does not know whether we should go with this
approach.
Another deadlock scenario which syzbot is reporting is a race between
kmalloc(GFP_ATOMIC) from tty_insert_flip_string_and_push_buffer() with
port->lock held and printk() from __build_all_zonelists() with
zonelist_update_seq held.
CPU0 CPU1
---- ----
pty_write() {
tty_insert_flip_string_and_push_buffer() {
__build_all_zonelists() {
write_seqlock(&zonelist_update_seq);
build_zonelists() {
printk() {
vprintk() {
vprintk_default() {
vprintk_emit() {
console_unlock() {
console_flush_all() {
console_emit_next_record() {
con->write() = serial8250_console_write() {
spin_lock_irqsave(&port->lock, flags);
tty_insert_flip_string() {
tty_insert_flip_string_fixed_flag() {
__tty_buffer_request_room() {
tty_buffer_alloc() {
kmalloc(GFP_ATOMIC | __GFP_NOWARN) {
__alloc_pages_slowpath() {
zonelist_iter_begin() {
read_seqbegin(&zonelist_update_seq); // spins forever because zonelist_update_seq.seqcount is odd
spin_lock_irqsave(&port->lock, flags); // spins forever because port->lock is held
}
}
}
}
}
}
}
}
spin_unlock_irqrestore(&port->lock, flags);
// message is printed to console
spin_unlock_irqrestore(&port->lock, flags);
}
}
}
}
}
}
}
}
}
write_sequnlock(&zonelist_update_seq);
}
}
}
This deadlock scenario can be eliminated by
preventing interrupt context from calling kmalloc(GFP_ATOMIC)
and
preventing printk() from calling console_flush_all()
while zonelist_update_seq.seqcount is odd.
Since Petr Mladek thinks that __build_all_zonelists() can become a
candidate for deferring printk() [2], let's address this problem by
disabling local interrupts in order to avoid kmalloc(GFP_ATOMIC)
and
disabling synchronous printk() in order to avoid console_flush_all()
.
As a side effect of minimizing duration of zonelist_update_seq.seqcount
being odd by disabling synchronous printk(), latency at
read_seqbegin(&zonelist_update_seq) for both !__GFP_DIRECT_RECLAIM and
__GFP_DIRECT_RECLAIM allocation requests will be reduced. Although, from
lockdep perspective, not calling read_seqbegin(&zonelist_update_seq) (i.e.
do not record unnecessary locking dependency) from interrupt context is
still preferable, even if we don't allow calling kmalloc(GFP_ATOMIC)
inside
write_seqlock(&zonelist_update_seq)/write_sequnlock(&zonelist_update_seq)
section...
Link: https://lkml.kernel.org/r/8796b95c-3da3-5885-fddd-6ef55f30e4d3@I-love.SAKURA.ne.jp
Fixes: 3d36424b3b58 ("mm/page_alloc: fix race condition between build_all_zonelists and page allocation")
Link: https://lkml.kernel.org/r/ZCrs+1cDqPWTDFNM@alley [2]
Reported-by: syzbot <syzbot+223c7461c58c58a4cb10@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=223c7461c58c58a4cb10 [1]
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Cc: Petr Mladek <pmladek@suse.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Cc: John Ogness <john.ogness@linutronix.de>
Cc: Patrick Daly <quic_pdaly@quicinc.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Baokun Li
|
2b00b2a0e6 |
writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
[ Upstream commit 1ba1199ec5747f475538c0d25a32804e5ba1dfde ] KASAN report null-ptr-deref: ================================================================== BUG: KASAN: null-ptr-deref in bdi_split_work_to_wbs+0x5c5/0x7b0 Write of size 8 at addr 0000000000000000 by task sync/943 CPU: 5 PID: 943 Comm: sync Tainted: 6.3.0-rc5-next-20230406-dirty #461 Call Trace: <TASK> dump_stack_lvl+0x7f/0xc0 print_report+0x2ba/0x340 kasan_report+0xc4/0x120 kasan_check_range+0x1b7/0x2e0 __kasan_check_write+0x24/0x40 bdi_split_work_to_wbs+0x5c5/0x7b0 sync_inodes_sb+0x195/0x630 sync_inodes_one_sb+0x3a/0x50 iterate_supers+0x106/0x1b0 ksys_sync+0x98/0x160 [...] ================================================================== The race that causes the above issue is as follows: cpu1 cpu2 -------------------------|------------------------- inode_switch_wbs INIT_WORK(&isw->work, inode_switch_wbs_work_fn) queue_rcu_work(isw_wq, &isw->work) // queue_work async inode_switch_wbs_work_fn wb_put_many(old_wb, nr_switched) percpu_ref_put_many ref->data->release(ref) cgwb_release queue_work(cgwb_release_wq, &wb->release_work) // queue_work async &wb->release_work cgwb_release_workfn ksys_sync iterate_supers sync_inodes_one_sb sync_inodes_sb bdi_split_work_to_wbs kmalloc(sizeof(*work), GFP_ATOMIC) // alloc memory failed percpu_ref_exit ref->data = NULL kfree(data) wb_get(wb) percpu_ref_get(&wb->refcnt) percpu_ref_get_many(ref, 1) atomic_long_add(nr, &ref->data->count) atomic64_add(i, v) // trigger null-ptr-deref bdi_split_work_to_wbs() traverses &bdi->wb_list to split work into all wbs. If the allocation of new work fails, the on-stack fallback will be used and the reference count of the current wb is increased afterwards. If cgroup writeback membership switches occur before getting the reference count and the current wb is released as old_wd, then calling wb_get() or wb_put() will trigger the null pointer dereference above. This issue was introduced in v4.3-rc7 (see fix tag1). Both sync_inodes_sb() and __writeback_inodes_sb_nr() calls to bdi_split_work_to_wbs() can trigger this issue. For scenarios called via sync_inodes_sb(), originally commit |
||
Lee Jones
|
e36eef3783 |
Revert "Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse""
This reverts commit 4f35cec76058557d9eaec0d501d03c7657eb56b4 and does so
in an abi-safe way.
This is done by adding the new fields only to the end of the structure
and this structure is only passed around to other functions as a
pointer, the internal structure layout is only touched by the core
kernel, so adding it to the end is safe.
Update ABI using The Button:
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
'struct anon_vma at rmap.h:33:1' changed:
type size changed from 832 to 960 (in bits)
2 data member insertions:
'unsigned long int num_children', at offset 832 (in bits) at rmap.h:74:1
'unsigned long int num_active_vmas', at offset 896 (in bits) at rmap.h:76:1
5406 impacted interfaces
Bug: 260678056
Bug: 253167854
Change-Id: Ib1d45625cbc2e0b21330ca3dc2aa7aff34666d31
Signed-off-by: Lee Jones <joneslee@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Srinivasarao Pathipati
|
166f433ac6 |
Merge keystone/android12-5.10-keystone-qcom-release.168+ (60b964d) into msm-5.10
* refs/heads/tmp-60b964d:
BACKPORT: f2fs: introduce gc_urgent_mid mode
ANDROID: clear memory trylock-bit when page_locked.
UPSTREAM: ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
ANDROID: GKI: Update symbols to symbol list
ANDROID: incremental fs: Evict inodes before freeing mount data
UPSTREAM: mm: memcontrol: set the correct memcg swappiness restriction
UPSTREAM: media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
ANDROID: Fix kernelci break: eventfd_signal_mask redefined
ANDROID: dm-default-key: update for blk_crypto_evict_key() returning void
BACKPORT: FROMGIT: blk-crypto: make blk_crypto_evict_key() more robust
BACKPORT: FROMGIT: blk-crypto: make blk_crypto_evict_key() return void
BACKPORT: FROMGIT: blk-mq: release crypto keyslot before reporting I/O complete
BACKPORT: of: base: Skip CPU nodes with "fail"/"fail-..." status
UPSTREAM: hid: bigben_probe(): validate report count
UPSTREAM: HID: bigben: use spinlock to safely schedule workers
UPSTREAM: HID: bigben_worker() remove unneeded check on report_field
UPSTREAM: HID: bigben: use spinlock to protect concurrent accesses
BACKPORT: USB: gadget: Fix use-after-free during usb config switch
ANDROID: ABI: Add page_pinner_inited into symbols list
ANDROID: page_pinner: prevent pp_buffer access before initialization
UPSTREAM: hwrng: virtio - add an internal buffer
ANDROID: fix ABI by undoing atomic64_t -> u64 type conversion
UPSTREAM: net: retrieve netns cookie via getsocketopt
UPSTREAM: net: initialize net->net_cookie at netns setup
UPSTREAM: ext4: fix another off-by-one fsmap error on 1k block filesystems
UPSTREAM: ext4: block range must be validated before use in ext4_mb_clear_bb()
UPSTREAM: ext4: add strict range checks while freeing blocks
UPSTREAM: ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid()
UPSTREAM: ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb()
UPSTREAM: usb: dwc3: core: do not use 3.0 clock when operating in 2.0 mode
ANDROID: GKI: rockchip: Add symbols for clk api
BACKPORT: arm64: mte: move register initialization to C
UPSTREAM: rcu: Remove __read_mostly annotations from rcu_scheduler_active externs
ANDROID: GKI: Update symbol list for mtk
Revert "nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property"
Revert "xhci: Add update_hub_device override for PCI xHCI hosts"
Revert "xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables"
Revert "xhci: Add a flag to disable USB3 lpm on a xhci root port level."
Revert "xhci: Prevent infinite loop in transaction errors recovery for streams"
Revert "ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire"
Revert "ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio"
Linux 5.10.168
Fix page corruption caused by racy check in __free_pages
arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive
arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
ceph: flush cap releases when the session is flushed
usb: typec: altmodes/displayport: Fix probe pin assign check
usb: core: add quirk for Alcor Link AK9563 smartcard reader
btrfs: free device in btrfs_close_devices for a single device filesystem
net: USB: Fix wrong-direction WARNING in plusb.c
cifs: Fix use-after-free in rdata->read_into_pages()
pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
spi: dw: Fix wrong FIFO level setting for long xfers
pinctrl: single: fix potential NULL dereference
pinctrl: aspeed: Fix confusing types in return value
ALSA: pci: lx6464es: fix a debug loop
selftests: forwarding: lib: quote the sysctl values
rds: rds_rm_zerocopy_callback() use list_first_entry()
net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
net/mlx5e: IPoIB, Show unknown speed instead of error
net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q"
ice: Do not use WQ_MEM_RECLAIM flag for workqueue
uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
ionic: clean interrupt before enabling queue to avoid credit race
net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
bonding: fix error checking in bond_debug_reregister()
xfrm: fix bug with DSCP copy to v6 from v4 tunnel
RDMA/usnic: use iommu_map_atomic() under spin_lock()
IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
IB/hfi1: Restore allocated resources on failed copyout
xfrm: compat: change expression for switch in xfrm_xlate64
can: j1939: do not wait 250 ms if the same addr was already claimed
of/address: Return an error when no valid dma-ranges are found
tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
ALSA: hda/realtek: Add Positivo N14KP6-TG
btrfs: zlib: zero-initialize zlib workspace
btrfs: limit device extents to the device size
migrate: hugetlb: check for hugetlb shared PMD in node migration
mm/migration: return errno when isolate_huge_page failed
iio:adc:twl6030: Enable measurement of VAC
bpf: Do not reject when the stack read size is different from the tracked scalar size
nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
f2fs: fix to do sanity check on i_extra_isize in is_alive()
fbdev: smscufx: fix error handling code in ufx_usb_probe
serial: 8250_dma: Fix DMA Rx rearm race
serial: 8250_dma: Fix DMA Rx completion race
nvmem: core: fix cell removal on error
nvmem: core: initialise nvmem->id early
drm/i915: Fix potential bit_17 double-free
Squashfs: fix handling and sanity checking of xattr_ids count
mm/swapfile: add cond_resched() in get_swap_pages()
fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses
mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
riscv: disable generation of unwind tables
parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
parisc: Fix return code of pdc_iodc_print()
nvmem: qcom-spmi-sdam: fix module autoloading
iio: imu: fxos8700: fix MAGN sensor scale and unit
iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
iio: imu: fxos8700: fix failed initialization ODR mode assignment
iio: imu: fxos8700: fix incorrect ODR mode readback
iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
iio: imu: fxos8700: fix map label of channel type to MAGN sensor
iio: imu: fxos8700: fix IMU data bits returned to user space
iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
iio: imu: fxos8700: fix ACCEL measurement range selection
iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
iio: adc: berlin2-adc: Add missing of_node_put() in error path
iio: hid: fix the retval in accel_3d_capture_sample
efi: Accept version 2 of memory attributes table
ALSA: hda/realtek: Add Acer Predator PH315-54
watchdog: diag288_wdt: fix __diag288() inline assembly
watchdog: diag288_wdt: do not use stack buffers for hardware data
net: qrtr: free memory on error path in radix_tree_insert()
fbcon: Check font dimension limits
Input: i8042 - add Clevo PCX0DX to i8042 quirk table
Input: i8042 - add TUXEDO devices to i8042 quirk tables
Input: i8042 - merge quirk tables
Input: i8042 - move __initconst to fix code styling warning
vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
usb: dwc3: qcom: enable vbus override when in OTG dr-mode
usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
iio: adc: stm32-dfsdm: fill module aliases
net/x25: Fix to not accept on connected socket
platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table
i2c: rk3x: fix a bunch of kernel-doc warnings
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
scsi: target: core: Fix warning on RT kernels
i2c: mxs: suppress probe-deferral error message
qede: execute xdp_do_flush() before napi_complete_done()
qede: add netpoll support for qede driver
efi: fix potential NULL deref in efi_mem_reserve_persistent
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
virtio-net: Keep stop() to follow mirror sequence of open()
selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
ata: libata: Fix sata_down_spd_limit() when no link speed is reported
can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp()
net: phy: meson-gxl: Add generic dummy stubs for MMD register access
squashfs: harden sanity check in squashfs_read_xattr_id_table
netfilter: br_netfilter: disable sabotage_in hook after first suppression
netrom: Fix use-after-free caused by accept on already connected socket
net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
sfc: correctly advertise tunneled IPv6 segmentation
virtio-net: execute xdp_do_flush() before napi_complete_done()
fix "direction" argument of iov_iter_kvec()
fix iov_iter_bvec() "direction" argument
READ is "data destination", not source...
WRITE is "data source", not destination...
vhost/net: Clear the pending messages when the backend is removed
scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
drm/vc4: hdmi: make CEC adapter name unique
arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
bpf: Fix to preserve reg parent/live fields when copying range info
bpf: Support <8-byte scalar spill and refill
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers
powerpc/imc-pmu: Revert nest_init_lock to being a mutex
bpf: Fix incorrect state pruning for <8B spill/fill
bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
Revert "net: add atomic_long_t to net_device_stats fields"
Revert "PM/devfreq: governor: Add a private governor_data for governor"
Linux 5.10.167
net: fix NULL pointer in skb_segment_list
Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems
dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
blk-cgroup: fix missing pd_online_fn() while activating policy
bpf: Skip task with pid=1 in send_signal_common()
arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
ARM: dts: vf610: Fix pca9548 i2c-mux node names
ARM: dts: imx: Fix pca9547 i2c-mux node name
ANDROID: Update .xml due to ABI preservation fix
ANDROID: struct io_uring ABI preservation hack for 5.10.162 changes
ANDROID: fix up struct task_struct ABI change in 5.10.162
ANDROID: add flags variable back to struct proto_ops
Linux 5.10.166
clk: Fix pointer casting to prevent oops in devm_clk_release()
perf/x86/amd: fix potential integer overflow on shift of a int
netfilter: conntrack: unify established states for SCTP paths
x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
block: fix and cleanup bio_check_ro
Revert "selftests/ftrace: Update synthetic event syntax errors"
nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
tools: gpio: fix -c option of gpio-event-mon
net: mdio-mux-meson-g12a: force internal PHY off on mux switch
net/tg3: resolve deadlock in tg3_reset_task() during EEH
thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
net: ravb: Fix possible hang if RIS2_QFF1 happen
sctp: fail if no bound addresses can be used for a given scope
net/sched: sch_taprio: do not schedule in taprio_reset()
netrom: Fix use-after-free of a listening socket.
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
netlink: annotate data races around sk_state
netlink: annotate data races around dst_portid and dst_group
netlink: annotate data races around nlk->portid
netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
net: fix UaF in netns ops registration error path
netlink: prevent potential spectre v1 gadgets
i2c: designware: use casting of u64 in clock multiplication to avoid overflow
i2c: designware: Use DIV_ROUND_CLOSEST() macro
units: Add SI metric prefix definitions
units: Add Watt units
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
EDAC/device: Respect any driver-supplied workqueue polling value
ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
thermal: intel: int340x: Protect trip temperature from concurrent updates
KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
cifs: Fix oops due to uncleared server->smbd_conn in reconnect
ftrace/scripts: Update the instructions for ftrace-bisect.sh
trace_events_hist: add check for return value of 'create_hist_field'
tracing: Make sure trace_printk() can output as soon as it can be used
module: Don't wait for GOING modules
scsi: hpsa: Fix allocation size for scsi_host_alloc()
xhci: Set HCD flag to defer primary roothub registration
Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
exit: Use READ_ONCE() for all oops/warn limit reads
docs: Fix path paste-o for /sys/kernel/warn_count
panic: Expose "warn_count" to sysfs
panic: Introduce warn_limit
panic: Consolidate open-coded panic_on_warn checks
exit: Allow oops_limit to be disabled
exit: Expose "oops_count" to sysfs
exit: Put an upper limit on how often we can oops
panic: Separate sysctl logic from CONFIG_SMP
ia64: make IA64_MCA_RECOVERY bool instead of tristate
csky: Fix function name in csky_alignment() and die()
h8300: Fix build errors from do_exit() to make_task_dead() transition
hexagon: Fix function name in die()
objtool: Add a missing comma to avoid string concatenation
exit: Add and use make_task_dead.
kasan: no need to unset panic_on_warn in end_report()
ubsan: no need to unset panic_on_warn in ubsan_epilogue()
panic: unset panic_on_warn inside panic()
kernel/panic: move panic sysctls to its own file
sysctl: add a new register_sysctl_init() interface
fs: reiserfs: remove useless new_opts in reiserfs_remount
x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
lockref: stop doing cpu_relax in the cmpxchg loop
platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
spi: spidev: remove debug messages that access spidev->spi without locking
ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
cpufreq: armada-37xx: stop using 0 as NULL pointer
s390/debug: add _ASM_S390_ prefix to header guard
drm: Add orientation quirk for Lenovo ideapad D330-10IGL
ASoC: fsl_micfil: Correct the number of steps on SX controls
kcsan: test: don't put the expect array on the stack
cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
tcp: fix rate_app_limited to default to 1
net: dsa: microchip: ksz9477: port map correction in ALU table entry register
driver core: Fix test_async_probe_init saves device in wrong array
w1: fix WARNING after calling w1_process()
w1: fix deadloop in __w1_remove_master_device()
tcp: avoid the lookup process failing to get sk in ehash table
nvme-pci: fix timeout request state check
dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
HID: betop: check shape of output reports
l2tp: prevent lockdep issue in l2tp_tunnel_register()
net: macb: fix PTP TX timestamp failure due to packet padding
dmaengine: Fix double increment of client_count in dma_chan_get()
drm/panfrost: fix GENERIC_ATOMIC64 dependency
net: mlx5: eliminate anonymous module_init & module_exit
usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
HID: revert CHERRY_MOUSE_000C quirk
net: stmmac: fix invalid call to mdiobus_get_phy()
HID: check empty report_list in bigben_probe()
HID: check empty report_list in hid_validate_values()
net: mdio: validate parameter addr in mdiobus_get_phy()
net: usb: sr9700: Handle negative len
l2tp: close all race conditions in l2tp_tunnel_register()
l2tp: convert l2tp_tunnel_list to idr
l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
l2tp: Serialize access to sk_user_data with sk_callback_lock
net/sched: sch_taprio: fix possible use-after-free
wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
net: nfc: Fix use-after-free in local_cleanup()
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
amd-xgbe: Delay AN timeout during KR training
amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
phy: ti: fix Kconfig warning and operator precedence
PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
affs: initialize fsdata in affs_truncate()
IB/hfi1: Remove user expected buffer invalidate race
IB/hfi1: Immediately remove invalid memory from hardware
IB/hfi1: Fix expected receive setup error exit issues
IB/hfi1: Reserve user expected TIDs
IB/hfi1: Reject a zero-length user expected buffer
RDMA/core: Fix ib block iterator counter overflow
tomoyo: fix broken dependency on *.conf.default
firmware: arm_scmi: Harden shared memory access in fetch_notification
firmware: arm_scmi: Harden shared memory access in fetch_response
EDAC/highbank: Fix memory leak in highbank_mc_probe()
HID: intel_ish-hid: Add check for ishtp_dma_tx_map
ARM: imx: add missing of_node_put()
arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux
ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
ARM: dts: imx7d-pico: Use 'clock-frequency'
ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency'
memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
clk: Provide new devm_clk helpers for prepared and enabled clocks
clk: generalize devm_clk_get() a bit
Linux 5.10.165
io_uring/rw: remove leftover debug statement
io_uring/rw: ensure kiocb_end_write() is always called
io_uring: fix double poll leak on repolling
io_uring: Clean up a false-positive warning from GCC 9.3.0
mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
Bluetooth: hci_qca: Fixed issue during suspend
Bluetooth: hci_qca: check for SSR triggered flag while suspend
Bluetooth: hci_qca: Wait for SSR completion during suspend
soc: qcom: apr: Make qcom,protection-domain optional again
Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
net/ulp: use consistent error code when blocking ULP
io_uring/net: fix fast_iov assignment in io_setup_async_msg()
io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
tracing: Use alignof__(struct {type b;}) instead of offsetof()
x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
Revert "drm/amdgpu: make display pinning more flexible (v2)"
efi: rt-wrapper: Add missing include
arm64: efi: Execute runtime services from a dedicated stack
drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
drm/amd/display: Calculate output_color_space after pixel encoding adjustment
drm/amd/display: Fix set scaling doesn's work
drm/i915: re-disable RC6p on Sandy Bridge
mei: me: add meteor lake point M DID
gsmi: fix null-deref in gsmi_get_variable
serial: atmel: fix incorrect baudrate setup
dmaengine: tegra210-adma: fix global intr clear
serial: pch_uart: Pass correct sg to dma_unmap_sg()
dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
usb: gadget: g_webcam: Send color matching descriptor per frame
usb: typec: altmodes/displayport: Fix pin assignment calculation
usb: typec: altmodes/displayport: Add pin assignment helper
usb: host: ehci-fsl: Fix module alias
USB: serial: cp210x: add SCALANCE LPE-9000 device id
USB: gadgetfs: Fix race between mounting and unmounting
tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
thunderbolt: Use correct function to calculate maximum USB3 link rate
cifs: do not include page data when checking signature
btrfs: fix race between quota rescan and disable leading to NULL pointer deref
mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
comedi: adv_pci1760: Fix PWM instruction handling
usb: core: hub: disable autosuspend for TI TUSB8041
misc: fastrpc: Fix use-after-free race condition for maps
misc: fastrpc: Don't remove map on creater_process and device_release
USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
staging: vchiq_arm: fix enum vchiq_status return types
USB: serial: option: add Quectel EM05CN modem
USB: serial: option: add Quectel EM05CN (SG) modem
USB: serial: option: add Quectel EC200U modem
USB: serial: option: add Quectel EM05-G (RS) modem
USB: serial: option: add Quectel EM05-G (CS) modem
USB: serial: option: add Quectel EM05-G (GR) modem
prlimit: do_prlimit needs to have a speculation check
xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
usb: acpi: add helper to check port lpm capability using acpi _DSM
xhci: Add a flag to disable USB3 lpm on a xhci root port level.
xhci: Add update_hub_device override for PCI xHCI hosts
xhci: Fix null pointer dereference when host dies
usb: xhci: Check endpoint is valid before dereferencing it
xhci-pci: set the dma max_seg_size
io_uring/rw: defer fsnotify calls to task context
io_uring: do not recalculate ppos unnecessarily
io_uring: update kiocb->ki_pos at execution time
io_uring: remove duplicated calls to io_kiocb_ppos
io_uring: ensure that cached task references are always put on exit
io_uring: fix CQ waiting timeout handling
io_uring: lock overflowing for IOPOLL
io_uring: check for valid register opcode earlier
io_uring: fix async accept on O_NONBLOCK sockets
io_uring: allow re-poll if we made progress
io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
io_uring: add flag for disabling provided buffer recycling
io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
io_uring: improve send/recv error handling
io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
Bluetooth: hci_qca: Fix driver shutdown on closed serdev
Bluetooth: hci_qca: Wait for timeout during suspend
drm/i915/gt: Reset twice
ALSA: hda/realtek - Turn on power early
efi: fix userspace infinite retry read efivars after EFI runtime services page fault
nilfs2: fix general protection fault in nilfs_btree_insert()
zonefs: Detect append writes at invalid locations
Add exception protection processing for vd in axi_chan_handle_err function
wifi: mac80211: sdata can be NULL during AMPDU start
wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
f2fs: let's avoid panic if extent_tree is not created
x86/asm: Fix an assembler warning with current binutils
btrfs: always report error in run_one_delayed_ref()
RDMA/srp: Move large values to a new enum for gcc13
net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
tools/virtio: initialize spinlocks in vring_test.c
selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
pNFS/filelayout: Fix coalescing test for single DS
btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
Linux 5.10.164
Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
io_uring/io-wq: only free worker if it was allocated for creation
io_uring/io-wq: free worker if task_work creation is canceled
drm/virtio: Fix GEM handle creation UAF
efi: fix NULL-deref in init error path
arm64: cmpxchg_double*: hazard against entire exchange variable
arm64: atomics: remove LL/SC trampolines
arm64: atomics: format whitespace consistently
x86/resctrl: Fix task CLOSID/RMID update race
x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI
KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
Documentation: KVM: add API issues section
iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
iommu/mediatek-v1: Add error handle for mtk_iommu_probe
mm: Always release pages to the buddy allocator in memblock_free_late().
net/mlx5e: Don't support encap rules with gbp option
net/mlx5: Fix ptp max frequency adjustment range
net/sched: act_mpls: Fix warning during failed attribute validation
nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
hvc/xen: lock console list traversal
octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
octeontx2-af: Map NIX block from CGX connection
octeontx2-af: Update get/set resource count functions
tipc: fix unexpected link reset due to discovery messages
ASoC: wm8904: fix wrong outputs volume after power reactivation
regulator: da9211: Use irq handler when ready
EDAC/device: Fix period calculation in edac_device_reset_delay_period()
x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
xfrm: fix rcu lock in xfrm_notify_userpolicy()
ext4: fix uninititialized value in 'ext4_evict_inode'
usb: ulpi: defer ulpi_register on ulpi_read_id timeout
xhci: Prevent infinite loop in transaction errors recovery for streams
xhci: move and rename xhci_cleanup_halted_endpoint()
xhci: store TD status in the td struct instead of passing it along
xhci: move xhci_td_cleanup so it can be called by more functions
xhci: Add xhci_reset_halted_ep() helper function
xhci: adjust parameters passed to cleanup_halted_endpoint()
xhci: get isochronous ring directly from endpoint structure
xhci: Avoid parsing transfer events several times
clk: imx: imx8mp: add shared clk gate for usb suspend clk
dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
clk: imx8mp: add clkout1/2 support
clk: imx8mp: Add DISP2 pixel clock
iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
bus: mhi: host: Fix race between channel preparation and M0 event
ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
ixgbe: fix pci device refcount leak
platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
drm/msm/adreno: Make adreno quirks not overwrite each other
cifs: Fix uninitialized memory read for smb311 posix symlink create
s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
s390/kexec: fix ipl report address for kdump
perf auxtrace: Fix address filter duplicate symbol selection
docs: Fix the docs build with Sphinx 6.0
efi: tpm: Avoid READ_ONCE() for accessing the event log
KVM: arm64: Fix S1PTW handling on RO memslots
ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
Linux 5.10.163
ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
net/ulp: prevent ULP without clone op from entering the LISTEN status
net: sched: disallow noqueue for qdisc classes
mptcp: use proper req destructor for IPv6
mptcp: dedicated request sock for subflow in v6
mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
mptcp: mark ops structures as ro_after_init
serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way"
fsl_lpuart: Don't enable interrupts too early
ext4: don't set up encryption key during jbd2 transaction
ext4: disable fast-commit of encrypted dir operations
parisc: Align parisc MADV_XXX constants with all other architectures
io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
efi: random: combine bootloader provided RNG seed with RNG protocol output
mbcache: Avoid nesting of cache->c_list_lock under bit locks
hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
hfs/hfsplus: use WARN_ON for sanity check
selftests: set the BUILD variable to absolute path
ext4: don't allow journal inode to have encrypt flag
drm/i915/gvt: fix vgpu debugfs clean in remove
drm/i915/gvt: fix gvt debugfs destroy
riscv: uaccess: fix type of 0 variable on error in get_user()
fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
nfsd: fix handling of readdir in v4root vs. mount upcall timeout
x86/bugs: Flush IBP in ib_prctl_set()
nvme: fix multipath crash caused by flush request when blktrace is enabled
ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
udf: Fix extension of the last extent in the file
caif: fix memory leak in cfctrl_linkup_request()
drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
usb: rndis_host: Secure rndis_query check against int overflow
drivers/net/bonding/bond_3ad: return when there's no aggregator
perf tools: Fix resources leak in perf_data__open_dir()
netfilter: ipset: Rework long task execution when adding/deleting entries
netfilter: ipset: fix hash:net,port,net hang with /0 subnet
net: sched: cbq: dont intepret cls results when asked to drop
net: sched: atm: dont intepret cls results when asked to drop
gpio: sifive: Fix refcount leak in sifive_gpio_probe
ceph: switch to vfs_inode_has_locks() to fix file lock bug
filelock: new helper: vfs_inode_has_locks
drm/meson: Reduce the FIFO lines held when AFBC is not used
RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
net: amd-xgbe: add missed tasklet_kill
net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
net/mlx5: Avoid recovery in probe flows
net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
vhost: fix range used in translate_desc()
vringh: fix range used in iotlb_translate()
vhost/vsock: Fix error handling in vhost_vsock_init()
nfc: Fix potential resource leaks
qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
net: sched: fix memory leak in tcindex_set_parms
net: hns3: add interrupts re-initialization while doing VF FLR
nfsd: shut down the NFSv4 state objects before the filecache
veth: Fix race with AF_XDP exposing old or uninitialized descriptors
vmxnet3: correctly report csum_level for encapsulated packet
drm/panfrost: Fix GEM handle creation ref-counting
bpf: pull before calling skb_postpull_rcsum()
SUNRPC: ensure the matching upcall is in-flight upon downcall
ext4: fix deadlock due to mbcache entry corruption
mbcache: automatically delete entries from cache on freeing
ext4: fix race when reusing xattr blocks
ext4: unindent codeblock in ext4_xattr_block_set()
ext4: remove EA inode entry from mbcache on inode eviction
mbcache: add functions to delete entry if unused
mbcache: don't reclaim used entries
ext4: use kmemdup() to replace kmalloc + memcpy
ext4: fix leaking uninitialized memory in fast-commit journal
ext4: fix various seppling typos
ext4: simplify ext4 error translation
ext4: move functions in super.c
fs: ext4: initialize fsdata in pagecache_write()
ext4: use memcpy_to_page() in pagecache_write()
mm/highmem: Lift memcpy_[to|from]_page to core
ext4: correct inconsistent error msg in nojournal mode
ext4: goto right label 'failed_mount3a'
riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument
riscv/stacktrace: Fix stack output without ra on the stack top
ravb: Fix "failed to switch device to config mode" message during unbind
staging: media: tegra-video: fix device_node use after free
x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
x86/kprobes: Convert to insn_decode()
perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
media: s5p-mfc: Fix in register read and write for H264
media: s5p-mfc: Clear workbit to handle error condition
media: s5p-mfc: Fix to handle reference queue during finishing
x86/MCE/AMD: Clear DFR errors found in THR handler
x86/mce: Get rid of msr_ops
btrfs: replace strncpy() with strscpy()
perf/x86/intel/uncore: Clear attr_update properly
perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure
ARM: renumber bits related to _TIF_WORK_MASK
drm/amdgpu: make display pinning more flexible (v2)
drm/amdgpu: handle polaris10/11 overlap asics (v2)
ext4: allocate extended attribute value in vmalloc area
ext4: avoid unaccounted block allocation when expanding inode
ext4: initialize quota before expanding inode in setproject ioctl
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
ext4: avoid BUG_ON when creating xattrs
ext4: fix error code return to user-space in ext4_get_branch()
ext4: fix corruption when online resizing a 1K bigalloc fs
ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
ext4: init quota for 'old.inode' in 'ext4_rename'
ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
ext4: check and assert if marking an no_delete evicting inode dirty
ext4: fix reserved cluster accounting in __es_remove_extent()
ext4: fix bug_on in __es_tree_search caused by bad quota inode
ext4: add helper to check quota inums
ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
ext4: fix undefined behavior in bit shift for ext4_check_flag_values
ext4: fix use-after-free in ext4_orphan_cleanup
ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
ext4: silence the warning when evicting inode with dioread_nolock
drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
drm/i915/dsi: fix VBT send packet port selection for dual link DSI
drm/vmwgfx: Validate the box size for the snooped cursor
drm/connector: send hotplug uevent on connector cleanup
device_cgroup: Roll back to original exceptions after copy failure
parisc: led: Fix potential null-ptr-deref in start_task()
remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
iommu/amd: Fix ivrs_acpihid cmdline parsing code
driver core: Fix bus_type.match() error handling in __driver_attach()
crypto: n2 - add missing hash statesize
PCI/sysfs: Fix double free in error path
PCI: Fix pci_device_is_present() for VFs by checking PF
ipmi: fix use after free in _ipmi_destroy_user()
ima: Fix a potential NULL pointer access in ima_restore_measurement_list
mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
ipmi: fix long wait in unload when IPMI disconnect
ASoC: jz4740-i2s: Handle independent FIFO flush bits
wifi: wilc1000: sdio: fix module autoloading
efi: Add iMac Pro 2017 to uefi skip cert quirk
md/bitmap: Fix bitmap chunk size overflow issues
rtc: ds1347: fix value written to century register
cifs: fix missing display of three mount options
cifs: fix confusing debug message
media: dvb-core: Fix UAF due to refcount races at releasing
media: dvb-core: Fix double free in dvb_register_device()
ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
staging: media: tegra-video: fix chan->mipi value on error
tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
tracing/hist: Fix wrong return value in parse_action_params()
x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
ftrace/x86: Add back ftrace_expected for ftrace bug reports
x86/microcode/intel: Do not retry microcode reloading on the APs
KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
perf/core: Call LSM hook after copying perf_event_attr
tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
dm cache: set needs_check flag after aborting metadata
dm cache: Fix UAF in destroy()
dm clone: Fix UAF in clone_dtr()
dm integrity: Fix UAF in dm_integrity_dtr()
dm thin: Fix UAF in run_timer_softirq()
dm thin: resume even if in FAIL mode
dm thin: Use last transaction's pmd->root when commit failed
dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
ALSA: patch_realtek: Fix Dell Inspiron Plus 16
cpufreq: Init completion before kobject_init_and_add()
PM/devfreq: governor: Add a private governor_data for governor
selftests: Use optional USERCFLAGS and USERLDFLAGS
arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
ARM: ux500: do not directly dereference __iomem
btrfs: fix resolving backrefs for inline extent followed by prealloc
mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
jbd2: use the correct print format
ktest.pl minconfig: Unset configs instead of just removing them
kest.pl: Fix grub2 menu handling for rebooting
soc: qcom: Select REMAP_MMIO for LLCC driver
media: stv0288: use explicitly signed char
net/af_packet: make sure to pull mac header
net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
rcu: Prevent lockdep-RCU splats on lock acquisition/release
torture: Exclude "NOHZ tick-stop error" from fatal errors
wifi: rtlwifi: 8192de: correct checking of IQK reload
wifi: rtlwifi: remove always-true condition pointed out by GCC 12
net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow()
ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
kcsan: Instrument memcpy/memset/memmove with newer Clang
SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
tpm: acpi: Call acpi_put_table() to fix memory leak
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
f2fs: should put a page when checking the summary info
mm, compaction: fix fast_isolate_around() to stay within boundaries
md: fix a crash in mempool_free
pnode: terminate at peers of source
ALSA: line6: fix stack overflow in line6_midi_transmit
ALSA: line6: correct midi status byte when receiving data from podxt
ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
binfmt: Fix error return code in load_elf_fdpic_binary()
hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
pstore/zone: Use GFP_ATOMIC to allocate zone buffer
HID: plantronics: Additional PIDs for double volume key presses quirk
HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
powerpc/rtas: avoid scheduling in rtas_os_term()
powerpc/rtas: avoid device tree lookups in rtas_os_term()
objtool: Fix SEGFAULT
nvmet: don't defer passthrough commands with trivial effects to the workqueue
nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
ata: ahci: Fix PCS quirk application for suspend
nvme-pci: fix page size checks
nvme-pci: fix mempool alloc size
nvme-pci: fix doorbell buffer value endianness
cifs: fix oops during encryption
usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
pwm: tegra: Fix 32 bit build
media: dvbdev: fix refcnt bug
media: dvbdev: fix build warning due to comments
ovl: fix use inode directly in rcu-walk mode
gcov: add support for checksum field
regulator: core: fix deadlock on regulator enable
iio: adc128s052: add proper .data members in adc128_of_match table
iio: adc: ad_sigma_delta: do not use internal iio_dev lock
reiserfs: Add missing calls to reiserfs_security_free()
HID: mcp2221: don't connect hidraw
HID: wacom: Ensure bootloader PID is usable in hidraw mode
usb: dwc3: core: defer probe on ulpi_read_id timeout
usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
ALSA: usb-audio: add the quirk for KT0206 device
ima: Simplify ima_lsm_copy_rule
pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
afs: Fix lost servers_outstanding count
perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
LoadPin: Ignore the "contents" argument of the LSM hooks
ASoC: rt5670: Remove unbalanced pm_runtime_put()
ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
ASoC: wm8994: Fix potential deadlock
ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
ASoC: Intel: Skylake: Fix driver hang during shutdown
ALSA: hda: add snd_hdac_stop_streams() helper
ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
hwmon: (jc42) Fix missing unlock on error in jc42_write()
orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
clk: st: Fix memory leak in st_of_quadfs_setup()
media: si470x: Fix use-after-free in si470x_int_in_callback()
mmc: renesas_sdhi: better reset from HS400 mode
mmc: f-sdh30: Add quirks for broken timeout clock capability
regulator: core: fix use_count leakage when handling boot-on
libbpf: Avoid enum forward-declarations in public API in C++ mode
blk-mq: fix possible memleak when register 'hctx' failed
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
media: dvbdev: adopts refcnt to avoid UAF
media: dvb-frontends: fix leak of memory fw
ethtool: avoiding integer overflow in ethtool_phys_id()
bpf: Prevent decl_tag from being referenced in func_proto arg
ppp: associate skb with a device at tx
mrp: introduce active flags to prevent UAF when applicant uninit
net: add atomic_long_t to net_device_stats fields
drm/amd/display: fix array index out of bound error in bios parser
md/raid1: stop mdx_raid1 thread when raid1 array run failed
drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
drm/sti: Use drm_mode_copy()
drm/rockchip: Use drm_mode_copy()
drm/msm: Use drm_mode_copy()
s390/lcs: Fix return type of lcs_start_xmit()
s390/netiucv: Fix return type of netiucv_tx()
s390/ctcm: Fix return type of ctc{mp,}m_tx()
drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
drm/amdgpu: Fix type of second parameter in trans_msg() callback
igb: Do not free q_vector unless new one was allocated
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
hamradio: baycom_epp: Fix return type of baycom_send_packet()
net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
bpf: make sure skb->len != 0 when redirecting to a tunneling device
qed (gcc13): use u16 for fid to be big enough
drm/amd/display: prevent memory leak
ipmi: fix memleak when unload ipmi driver
ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
wifi: ath9k: verify the expected usb_endpoints are present
brcmfmac: return error when getting invalid max_flowrings from dongle
drm/etnaviv: add missing quirks for GC300
hfs: fix OOB Read in __hfs_brec_find
acct: fix potential integer overflow in encode_comp_t()
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
ACPICA: Fix error code path in acpi_ds_call_control_method()
fs: jfs: fix shift-out-of-bounds in dbDiscardAG
udf: Avoid double brelse() in udf_rename()
fs: jfs: fix shift-out-of-bounds in dbAllocAG
binfmt_misc: fix shift-out-of-bounds in check_special_flags
x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
video: hyperv_fb: Avoid taking busy spinlock on panic path
arm64: make is_ttbrX_addr() noinstr-safe
rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
net: stream: purge sk_error_queue in sk_stream_kill_queues()
myri10ge: Fix an error handling path in myri10ge_probe()
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
net_sched: reject TCF_EM_SIMPLE case for complex ematch module
mailbox: zynq-ipi: fix error handling while device_register() fails
skbuff: Account for tail adjustment during pull operations
openvswitch: Fix flow lookup to use unmasked key
selftests: devlink: fix the fd redirect in dummy_reporter_test
rtc: mxc_v2: Add missing clk_disable_unprepare()
igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
igc: Lift TAPRIO schedule restriction
igc: recalculate Qbv end_time by considering cycle time
igc: Add checking for basetime less than zero
igc: Use strict cycles for Qbv scheduling
igc: Enhance Qbv scheduling by using first flag bit
net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME
net: igc: use skb_csum_is_sctp instead of protocol check
net: add inline function skb_csum_is_sctp
net: switch to storing KCOV handle directly in sk_buff
r6040: Fix kmemleak in probe and remove
nfc: pn533: Clear nfc_target before being used
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
net: macsec: fix net device access prior to holding a lock
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
NFSD: Remove spurious cb_setup_err tracepoint
rtc: pcf85063: fix pcf85063_clkout_control
rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
netfilter: flowtable: really fix NAT IPv6 offload
powerpc/pseries/eeh: use correct API for error log size
powerpc/eeh: Drop redundant spinlock initialization
remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
remoteproc: qcom_q6v5_pas: detach power domains on remove
remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
selftests/powerpc: Fix resource leaks
powerpc/hv-gpci: Fix hv_gpci event list
powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
powerpc/perf: callchain validate kernel stack pointer bounds
kbuild: refactor single builds of *.ko
kbuild: unify modules(_install) for in-tree and external modules
kbuild: remove unneeded mkdir for external modules_install
powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
powerpc/xmon: Enable breakpoints on 8xx
cxl: Fix refcount leak in cxl_calc_capp_routing
powerpc/52xx: Fix a resource leak in an error handling path
macintosh/macio-adb: check the return value of ioremap()
macintosh: fix possible memory leak in macio_add_one_device()
iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
iommu/amd: Fix pci device refcount leak in ppr_notifier()
rtc: pcf85063: Fix reading alarm
rtc: snvs: Allow a time difference on clock register read
rtc: cmos: Disable ACPI RTC event on removal
rtc: cmos: Rename ACPI-related functions
rtc: cmos: Eliminate forward declarations of some functions
rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
rtc: cmos: fix build on non-ACPI platforms
rtc: cmos: Fix wake alarm breakage
rtc: cmos: Fix event handler registration ordering issue
rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
dmaengine: idxd: Fix crc_val field for completion record
pwm: tegra: Improve required rate calculation
include/uapi/linux/swab: Fix potentially missing __always_inline
phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
iommu/sun50i: Fix flush size
iommu/sun50i: Fix R/W permission check
iommu/sun50i: Consider all fault sources for reset
iommu/sun50i: Fix reset release
RDMA/siw: Fix pointer cast warning
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
HSI: omap_ssi_core: Fix error handling in ssi_init()
perf symbol: correction while adjusting symbol
perf trace: Handle failure when trace point folder is missed
perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
perf trace: Return error if a system call doesn't exist
power: supply: fix residue sysfs file in error handle route of __power_supply_register()
HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
fbdev: vermilion: decrease reference count in error path
fbdev: via: Fix error in via_core_init()
fbdev: pm2fb: fix missing pci_disable_device()
fbdev: ssd1307fb: Drop optional dependency
thermal/drivers/imx8mm_thermal: Validate temperature range
samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
tracing/hist: Fix issue of losting command info in error_log
usb: storage: Add check for kcalloc
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
i2c: mux: reg: check return value after calling platform_get_resource()
gpiolib: cdev: fix NULL-pointer dereferences
gpiolib: Get rid of redundant 'else'
vme: Fix error not catched in fake_init()
staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
staging: rtl8192u: Fix use after free in ieee80211_rx()
i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
chardev: fix error handling in cdev_device_add()
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
drivers: mcb: fix resource leak in mcb_probe()
usb: gadget: f_hid: fix refcount leak on error path
usb: gadget: f_hid: fix f_hidg lifetime vs cdev
usb: gadget: f_hid: optional SETUP/SET_REPORT mode
usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
iio: adis: add '__adis_enable_irq()' implementation
iio:imu:adis: Move exports into IIO_ADISLIB namespace
iio: adis: stylistic changes
iio: adis: handle devices that cannot unmask the drdy pin
iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable
genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
iio: temperature: ltc2983: make bulk write buffer DMA-safe
cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
ocxl: fix pci device refcount leak when calling get_function_0()
misc: ocxl: fix possible name leak in ocxl_file_register_afu()
test_firmware: fix memory leak in test_firmware_init()
serial: sunsab: Fix error handling in sunsab_init()
serial: altera_uart: fix locking in polling mode
tty: serial: altera_uart_{r,t}x_chars() need only uart_port
tty: serial: clean up stop-tx part in altera_uart_tx_chars()
serial: pch: Fix PCI device refcount leak in pch_request_dma()
serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
serial: amba-pl011: avoid SBSA UART accessing DMACR register
usb: typec: tipd: Fix spurious fwnode_handle_put in error path
usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
staging: vme_user: Fix possible UAF in tsi148_dma_list_add
usb: fotg210-udc: Fix ages old endianness issues
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
uio: uio_dmem_genirq: Fix missing unlock in irq configuration
vfio: platform: Do not pass return buffer to ACPI _RST method
class: fix possible memory leak in __class_register()
serial: tegra: Read DMA status before terminating
drivers: dio: fix possible memory leak in dio_init()
IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
hwrng: geode - Fix PCI device refcount leak
hwrng: amd - Fix PCI device refcount leak
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
RDMA/hns: Fix page size cap from firmware
RDMA/hns: Fix PBL page MTR find
orangefs: Fix sysfs not cleanup when dev init failed
RDMA/srp: Fix error return code in srp_parse_options()
RDMA/hfi1: Fix error return code in parse_platform_config()
riscv/mm: add arch hook arch_clear_hugepage_flags
crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
crypto: amlogic - Remove kcalloc without check
RDMA/nldev: Fix failure to send large messages
f2fs: avoid victim selection from previous victim section
RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
scsi: snic: Fix possible UAF in snic_tgt_create()
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
scsi: ipr: Fix WARNING in ipr_init()
scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
scsi: fcoe: Fix possible name leak when device_register() fails
scsi: scsi_debug: Fix a warning in resp_report_zones()
scsi: scsi_debug: Fix a warning in resp_verify()
scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
scsi: hpsa: Fix error handling in hpsa_add_sas_host()
scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
padata: Fix list iterator in padata_do_serial()
padata: Always leave BHs disabled when running ->parallel()
crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
scsi: hpsa: Fix possible memory leak in hpsa_init_one()
RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
RDMA/hns: fix memory leak in hns_roce_alloc_mr()
crypto: ccree - Make cc_debugfs_global_fini() available for module init function
RDMA/hfi: Decrease PCI device reference count in error path
PCI: Check for alloc failure in pci_request_irq()
RDMA/hns: Fix ext_sge num error when post send
RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
crypto: cryptd - Use request context instead of stack for sub-request
crypto: ccree - Remove debugfs when platform_driver_register failed
scsi: scsi_debug: Fix a warning in resp_write_scat()
RDMA/siw: Set defined status for work completion with undefined status
RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
RDMA/siw: Fix immediate work request flush to completion queue
f2fs: fix normal discard process
apparmor: Fix memleak in alloc_ns()
crypto: rockchip - rework by using crypto_engine
crypto: rockchip - delete unneeded variable initialization
crypto: rockchip - remove non-aligned handling
crypto: rockchip - better handle cipher key
crypto: rockchip - add fallback for ahash
crypto: rockchip - add fallback for cipher
crypto: rockchip - do not store mode globally
crypto: rockchip - do not do custom power management
f2fs: Fix the race condition of resize flag between resizefs
PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
RDMA/core: Fix order of nldev_exit call
PCI: dwc: Fix n_fts[] array overrun
apparmor: Use pointer to struct aa_label for lbs_cred
scsi: core: Fix a race between scsi_done() and scsi_timeout()
crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
crypto: sun8i-ss - use dma_addr instead u32
apparmor: Fix abi check to include v8 abi
apparmor: fix lockdep warning when removing a namespace
apparmor: fix a memleak in multi_transaction_new()
stmmac: fix potential division by 0
Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
sctp: sysctl: make extra pointers netns aware
ntb_netdev: Use dev_kfree_skb_any() in interrupt context
net: lan9303: Fix read error execution path
can: tcan4x5x: Remove invalid write in clear_interrupts
net: amd-xgbe: Check only the minimum speed for active/passive cables
net: amd-xgbe: Fix logic around active and passive cables
net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
net: farsync: Fix kmemleak when rmmods farsync
ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
net: defxx: Fix missing err handling in dfx_init()
net: vmw_vsock: vmci: Check memcpy_from_msg()
clk: socfpga: Fix memory leak in socfpga_gate_init()
clk: socfpga: use clk_hw_register for a5/c5
clk: socfpga: clk-pll: Remove unused variable 'rc'
blktrace: Fix output non-blktrace event when blk_classic option enabled
wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
wifi: rtl8xxxu: Fix the channel width reporting
wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
clk: samsung: Fix memory leak in _samsung_clk_register_pll()
media: coda: Add check for kmalloc
media: coda: Add check for dcoda_iram_alloc
media: c8sectpfe: Add of_node_put() when breaking out of loop
mmc: mmci: fix return value check of mmc_add_host()
mmc: wbsd: fix return value check of mmc_add_host()
mmc: via-sdmmc: fix return value check of mmc_add_host()
mmc: meson-gx: fix return value check of mmc_add_host()
mmc: omap_hsmmc: fix return value check of mmc_add_host()
mmc: atmel-mci: fix return value check of mmc_add_host()
mmc: wmt-sdmmc: fix return value check of mmc_add_host()
mmc: vub300: fix return value check of mmc_add_host()
mmc: toshsd: fix return value check of mmc_add_host()
mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
mmc: pxamci: fix return value check of mmc_add_host()
mmc: mxcmmc: fix return value check of mmc_add_host()
mmc: moxart: fix return value check of mmc_add_host()
mmc: alcor: fix return value check of mmc_add_host()
NFSv4.x: Fail client initialisation if state manager thread can't run
SUNRPC: Fix missing release socket in rpc_sockname()
xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
media: saa7164: fix missing pci_disable_device()
ALSA: pcm: Set missing stop_operating flag at undoing trigger start
bpf, sockmap: fix race in sock_map_free()
hwmon: (jc42) Restore the min/max/critical temperatures on resume
hwmon: (jc42) Convert register access and caching to regmap/regcache
regulator: core: fix resource leak in regulator_register()
configfs: fix possible memory leak in configfs_create_dir()
hsr: Synchronize sequence number updates.
hsr: Synchronize sending frames to have always incremented outgoing seq nr.
hsr: Disable netpoll.
net: hsr: generate supervision frame without HSR/PRP tag
hsr: Add a rcu-read lock to hsr_forward_skb().
clk: qcom: clk-krait: fix wrong div2 functions
regulator: core: fix module refcount leak in set_supply()
wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
wifi: mac80211: fix memory leak in ieee80211_if_add()
spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
bonding: uninitialized variable in bond_miimon_inspect()
bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
netfilter: conntrack: set icmpv6 redirects as RELATED
ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
drm/amd/pm/smu11: BACO is supported when it's in BACO state
ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
ASoC: mediatek: mt8173: Fix debugfs registration for components
wifi: iwlwifi: mvm: fix double free on tx path.
ALSA: asihpi: fix missing pci_disable_device()
NFS: Fix an Oops in nfs_d_automount()
NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
NFSv4.2: Fix initialisation of struct nfs4_label
NFSv4.2: Fix a memory stomp in decode_attr_security_label
NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
ASoC: dt-bindings: wcd9335: fix reset line polarity in example
drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
media: dvb-core: Fix ignored return value in dvb_register_frontend()
pinctrl: pinconf-generic: add missing of_node_put()
clk: imx: replace osc_hdmi with dummy
media: imon: fix a race condition in send_packet()
media: vimc: Fix wrong function called when vimc_init() fails
ASoC: qcom: Add checks for devm_kcalloc
drbd: fix an invalid memory access caused by incorrect use of list iterator
mtd: maps: pxa2xx-flash: fix memory leak in probe
bonding: fix link recovery in mode 2 when updelay is nonzero
drm/amdgpu: fix pci device refcount leak
clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
regulator: core: use kfree_const() to free space conditionally
ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
HID: hid-sensor-custom: set fixed size for custom attributes
bpf: Move skb->len == 0 checks into __bpf_redirect
inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
media: videobuf-dma-contig: use dma_mmap_coherent
media: platform: exynos4-is: Fix error handling in fimc_md_init()
media: solo6x10: fix possible memory leak in solo_sysfs_init()
media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
Input: elants_i2c - properly handle the reset GPIO when power is off
mtd: lpddr2_nvm: Fix possible null-ptr-deref
wifi: ath10k: Fix return value in ath10k_pci_init()
ima: Fix misuse of dereference of pointer in template_desc_init_fields()
integrity: Fix memory leakage in keyring allocation error path
drm/fourcc: Fix vsub/hsub for Q410 and Q401
drm/fourcc: Add packed 10bit YUV 4:2:0 format
amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
ASoC: pxa: fix null-pointer dereference in filter()
drm/mediatek: Modify dpi power on/off sequence.
drm/radeon: Add the missed acpi_put_table() to fix memory leak
rxrpc: Fix ack.bufferSize to be 0 when generating an ack
net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
media: camss: Clean up received buffers on failed start of streaming
wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
Input: joystick - fix Kconfig warning for JOYSTICK_ADC
mtd: Fix device name leak when register device failed in add_mtd_device()
clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
bpf: propagate precision across all frames, not just the last one
bpf: Check the other end of slot_type for STACK_SPILL
bpf: propagate precision in ALU/ALU64 operations
media: platform: exynos4-is: fix return value check in fimc_md_probe()
media: vivid: fix compose size exceed boundary
bpf: Fix slot type check in check_stack_write_var_off
drm/msm/hdmi: drop unused GPIO support
drm/msm/hdmi: switch to drm_bridge_connector
ima: Handle -ESTALE returned by ima_filter_rule_match()
ima: Fix fall-through warnings for Clang
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
spi: Update reference to struct spi_controller
clk: renesas: r9a06g032: Repair grave increment error
drm/rockchip: lvds: fix PM usage counter unbalance in poweron
can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
can: kvaser_usb: Add struct kvaser_usb_busparams
can: kvaser_usb_leaf: Fix bogus restart events
can: kvaser_usb_leaf: Fix wrong CAN state after stopping
can: kvaser_usb_leaf: Fix improved state not being reported
can: kvaser_usb_leaf: Set Warning state even without bus errors
can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
can: kvaser_usb: do not increase tx statistics when sending error message frames
media: exynos4-is: don't rely on the v4l2_async_subdev internals
media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev
venus: pm_helpers: Fix error check in vcodec_domains_get()
media: i2c: ad5820: Fix error path
media: coda: jpeg: Add check for kmalloc
pata_ipx4xx_cf: Fix unsigned comparison with less than zero
libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
libbpf: Fix use-after-free in btf_dump_name_dups
drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
wifi: rtl8xxxu: Fix reading the vendor of combo chips
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
rapidio: devices: fix missing put_device in mport_cdev_open
hfs: Fix OOB Write in hfs_asc2mac
relay: fix type mismatch when allocating memory in relay_create_buf()
eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
rapidio: fix possible UAF when kfifo_alloc() fails
fs: sysv: Fix sysv_nblocks() returns wrong value
MIPS: OCTEON: warn only once if deprecated link status is being used
MIPS: BCM63xx: Add check for NULL for clk in clk_enable
platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
PM: runtime: Do not call __rpm_callback() from rpm_idle()
PM: runtime: Improve path in rpm_idle() when no callback
xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
x86/xen: Fix memory leak in xen_init_lock_cpu()
x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
cpu/hotplug: Make target_store() a nop when target == state
futex: Resend potentially swallowed owner death notification
futex: Move to kernel/futex/
clocksource/drivers/sh_cmt: Access registers according to spec
clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
rapidio: rio: fix possible name leak in rio_register_mport()
rapidio: fix possible name leaks when rio_add_device() fails
ocfs2: fix memory leak in ocfs2_mount_volume()
ocfs2: rewrite error handling of ocfs2_fill_super
ocfs2: ocfs2_mount_volume does cleanup job before return error
debugfs: fix error when writing negative value to atomic_t debugfs file
docs: fault-injection: fix non-working usage of negative values
lib/notifier-error-inject: fix error when writing -errno to debugfs file
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
genirq/irqdesc: Don't try to remove non-existing sysfs files
nfsd: don't call nfsd_file_put from client states seqfile display
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
PNP: fix name memory leak in pnp_alloc_dev()
selftests/efivarfs: Add checking of the test return value
MIPS: vpe-cmp: fix possible memory leak while module exiting
MIPS: vpe-mt: fix possible memory leak while module exiting
ocfs2: fix memory leak in ocfs2_stack_glue_init()
lib/fonts: fix undefined behavior in bit shift for get_default_font
proc: fixup uptime selftest
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
platform/x86: huawei-wmi: fix return value calculation
lib/debugobjects: fix stat count and optimize debug_objects_mem_init
perf: Fix possible memleak in pmu_dev_alloc()
selftests/ftrace: event_triggers: wait longer for test_event_enable
cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
fs: don't audit the capability check in simple_xattr_list()
PM: hibernate: Fix mistake in kerneldoc comment
alpha: fix syscall entry in !AUDUT_SYSCALL case
cpuidle: dt: Return the correct numbers of parsed idle states
sched/uclamp: Fix relationship between uclamp and migration margin
sched/fair: Cleanup task_util and capacity type
tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
ARM: mmp: fix timer_read delay
pstore/ram: Fix error return code in ramoops_probe()
arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
ARM: dts: turris-omnia: Add switch port 6 node
ARM: dts: turris-omnia: Add ethernet aliases
ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
arm64: dts: mt2712e: Fix unit address for pinctrl node
arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
arm: dts: spear600: Fix clcd interrupt
soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
soc: qcom: apr: make code more reuseable
soc: qcom: llcc: make irq truly optional
drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
objtool, kcsan: Add volatile read/write instrumentation to whitelist
arm64: dts: qcom: msm8916: Drop MSS fallback compatible
arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
arm64: dts: qcom: sdm630: fix UART1 pin bias
ARM: dts: qcom: apq8064: fix coresight compatible
arm64: dts: qcom: msm8996: fix GPU OPP table
arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
usb: musb: remove extra check in musb_gadget_vbus_draw
Linux 5.10.162
io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups
eventfd: provide a eventfd_signal_mask() helper
eventpoll: add EPOLL_URING_WAKE poll wakeup flag
Revert "proc: don't allow async path resolution of /proc/self components"
Revert "proc: don't allow async path resolution of /proc/thread-self components"
net: remove cmsg restriction from io_uring based send/recvmsg calls
task_work: unconditionally run task_work from get_signal()
signal: kill JOBCTL_TASK_WORK
io_uring: import 5.15-stable io_uring
task_work: add helper for more targeted task_work canceling
kernel: don't call do_exit() for PF_IO_WORKER threads
kernel: stop masking signals in create_io_thread()
x86/process: setup io_threads more like normal user space threads
arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
arch: setup PF_IO_WORKER threads like PF_KTHREAD
entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set
kernel: allow fork with TIF_NOTIFY_SIGNAL pending
coredump: Limit what can interrupt coredumps
kernel: remove checking for TIF_NOTIFY_SIGNAL
task_work: remove legacy TWA_SIGNAL path
alpha: fix TIF_NOTIFY_SIGNAL handling
ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling
ia64: don't call handle_signal() unless there's actually a signal queued
sparc: add support for TIF_NOTIFY_SIGNAL
riscv: add support for TIF_NOTIFY_SIGNAL
nds32: add support for TIF_NOTIFY_SIGNAL
ia64: add support for TIF_NOTIFY_SIGNAL
h8300: add support for TIF_NOTIFY_SIGNAL
c6x: add support for TIF_NOTIFY_SIGNAL
alpha: add support for TIF_NOTIFY_SIGNAL
xtensa: add support for TIF_NOTIFY_SIGNAL
arm: add support for TIF_NOTIFY_SIGNAL
microblaze: add support for TIF_NOTIFY_SIGNAL
hexagon: add support for TIF_NOTIFY_SIGNAL
csky: add support for TIF_NOTIFY_SIGNAL
openrisc: add support for TIF_NOTIFY_SIGNAL
sh: add support for TIF_NOTIFY_SIGNAL
um: add support for TIF_NOTIFY_SIGNAL
s390: add support for TIF_NOTIFY_SIGNAL
mips: add support for TIF_NOTIFY_SIGNAL
powerpc: add support for TIF_NOTIFY_SIGNAL
parisc: add support for TIF_NOTIFY_SIGNAL
nios32: add support for TIF_NOTIFY_SIGNAL
m68k: add support for TIF_NOTIFY_SIGNAL
arm64: add support for TIF_NOTIFY_SIGNAL
arc: add support for TIF_NOTIFY_SIGNAL
x86: Wire up TIF_NOTIFY_SIGNAL
task_work: Use TIF_NOTIFY_SIGNAL if available
entry: Add support for TIF_NOTIFY_SIGNAL
fs: provide locked helper variant of close_fd_get_file()
file: Rename __close_fd_get_file close_fd_get_file
fs: make do_renameat2() take struct filename
signal: Add task_sigpending() helper
net: add accept helper not installing fd
net: provide __sys_shutdown_sock() that takes a socket
tools headers UAPI: Sync openat2.h with the kernel sources
fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
Make sure nd->path.mnt and nd->path.dentry are always valid pointers
fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
fs: add support for LOOKUP_CACHED
saner calling conventions for unlazy_child()
iov_iter: add helper to save iov_iter state
kernel: provide create_io_thread() helper
Linux 5.10.161
net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
Bluetooth: L2CAP: Fix u8 overflow
HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk
HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10
HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E
HID: ite: Add support for Acer S1002 keyboard-dock
igb: Initialize mailbox message for VF reset
xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
USB: serial: f81534: fix division by zero on line-speed change
USB: serial: f81232: fix division by zero on line-speed change
USB: serial: cp210x: add Kamstrup RF sniffer PIDs
USB: serial: option: add Quectel EM05-G modem
usb: gadget: uvc: Prevent buffer overflow in setup handler
udf: Fix extending file within last block
udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size
udf: Fix preallocation discarding at indirect extent boundary
udf: Discard preallocation before extending file with a hole
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml
Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml
Documentation/devicetree/bindings/sound/qcom,wcd9335.txt
drivers/cpufreq/qcom-cpufreq-hw.c
drivers/remoteproc/qcom_q6v5_pas.c
drivers/soc/qcom/llcc-qcom.c
net/qrtr/ns.c
Change-Id: Ic972b7c946b804f910715bd2def82725a42d266e
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
|
||
Deyao Ren
|
67c54bb03a |
Merge remote-tracking branch into HEAD
* keystone/mirror-android12-5.10-2023-04: (1365 commits) ANDROID: clear memory trylock-bit when page_locked. UPSTREAM: ext4: fix kernel BUG in 'ext4_write_inline_data_end()' ANDROID: GKI: Update symbols to symbol list ANDROID: incremental fs: Evict inodes before freeing mount data UPSTREAM: mm: memcontrol: set the correct memcg swappiness restriction UPSTREAM: media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() ANDROID: Fix kernelci break: eventfd_signal_mask redefined ANDROID: dm-default-key: update for blk_crypto_evict_key() returning void BACKPORT: FROMGIT: blk-crypto: make blk_crypto_evict_key() more robust BACKPORT: FROMGIT: blk-crypto: make blk_crypto_evict_key() return void BACKPORT: FROMGIT: blk-mq: release crypto keyslot before reporting I/O complete BACKPORT: of: base: Skip CPU nodes with "fail"/"fail-..." status UPSTREAM: hid: bigben_probe(): validate report count UPSTREAM: HID: bigben: use spinlock to safely schedule workers UPSTREAM: HID: bigben_worker() remove unneeded check on report_field UPSTREAM: HID: bigben: use spinlock to protect concurrent accesses BACKPORT: USB: gadget: Fix use-after-free during usb config switch ANDROID: ABI: Add page_pinner_inited into symbols list ANDROID: page_pinner: prevent pp_buffer access before initialization UPSTREAM: hwrng: virtio - add an internal buffer ... Change-Id: I4e2fd36b3b6cb214344f4aef55e4441cbb156a5b |
||
Peter Xu
|
2523d9d7bb |
mm/khugepaged: check again on anon uffd-wp during isolation
commit dd47ac428c3f5f3bcabe845f36be870fe6c20784 upstream. Khugepaged collapse an anonymous thp in two rounds of scans. The 2nd round done in __collapse_huge_page_isolate() after hpage_collapse_scan_pmd(), during which all the locks will be released temporarily. It means the pgtable can change during this phase before 2nd round starts. It's logically possible some ptes got wr-protected during this phase, and we can errornously collapse a thp without noticing some ptes are wr-protected by userfault. |
||
|
Greg Kroah-Hartman
|
2d6a4ad08c |
This is the 5.10.178 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRBD58ACgkQONu9yGCS
aT5BTxAApbYtClwFI1KGwlvnh9elm2m6NYDZcBleAT8bps1ofI50Bpca0CKgkX8f
HLzRid8WE5BW6+3tpDJxBwqEGEGG1Z8bgleaM62PxiNU3CRFKtUuDmS2DiVAK30d
PfdvjhOxlwf4f6e+WHSvGXvqxV9w1DtjqG+Lz1jA37sAAj6IithDuSkNrYcsojFF
u+zA+17M2KVG8vrTCHZVH/ij9A1w4gWOkhYVCKaC7hKafTsU613YjFTGpqelhvTS
6AfMSTI15E01Qy6FM5OjqmVM4k8UWIydA1WBV7aHLn3y2MzXeaYza8xsg90Qu2V2
49F4Yu53WLkuNV0aDOURnaQ7M1m+Sj8IL/MD7G5iLIDwjN3PDwY5IqwKyYueZ/2P
TdlNTTffCC66MiYjAy/A5gPg4bjxvs7aaQkjgahluzWnXUWSdyUvJDg1XYGdhf1l
W4E2OcWH0Al6se56255O2eKbvmeOe+IHW22oRoDaAC9+14Lp6KWP9sAh4/zrEcgf
/x0YxZekOoWVdVtoP4oS1CE3Rj9v4HmtPT2QVltE7Dag7sn3FtGWTQ+SxZ34gmwY
RYCvoCpBF5SNg3tkW/eIwl+6fRryiT/LS9OsUmz+5g0L6mkK5m6ScleIbAGYq6BZ
4mu6CwHuSBX0O/EvRgmVpZpPsKsHypVu86krtTlW/+HcKBrXSuY=
=hM8w
-----END PGP SIGNATURE-----
Merge 5.10.178 into android12-5.10-lts
Changes in 5.10.178
gpio: GPIO_REGMAP: select REGMAP instead of depending on it
Drivers: vmbus: Check for channel allocation before looking up relids
pwm: cros-ec: Explicitly set .polarity in .get_state()
pwm: sprd: Explicitly set .polarity in .get_state()
KVM: s390: pv: fix external interruption loop not always detected
wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
net: qrtr: combine nameservice into main module
net: qrtr: Fix a refcount bug in qrtr_recvmsg()
icmp: guard against too small mtu
net: don't let netpoll invoke NAPI if in xmit context
sctp: check send stream number after wait_for_sndbuf
net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
gpio: davinci: Add irq chip flag to skip set wake
net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe
net: stmmac: fix up RX flow hash indirection table when setting channels
sunrpc: only free unix grouplist after RCU settles
NFSD: callback request does not use correct credential for AUTH_SYS
usb: xhci: tegra: fix sleep in atomic call
xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
usb: typec: altmodes/displayport: Fix configure initial pin assignment
USB: serial: option: add Telit FE990 compositions
USB: serial: option: add Quectel RM500U-CN modem
iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
iio: dac: cio-dac: Fix max DAC write value check for 12-bit
iio: light: cm32181: Unregister second I2C client if present
tty: serial: sh-sci: Fix transmit end interrupt handler
tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
nilfs2: fix sysfs interface lifetime
dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
ALSA: hda/realtek: Add quirk for Clevo X370SNW
iio: adc: ad7791: fix IRQ flags
scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
perf/core: Fix the same task check in perf_event_set_output
ftrace: Mark get_lock_parent_ip() __always_inline
ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
tracing: Free error logs of tracing instances
ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
drm/nouveau/disp: Support more modes by checking with lower bpc
ring-buffer: Fix race while reader and writer are on the same page
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
selftests: intel_pstate: ftime() is deprecated
drm/bridge: lt9611: Fix PLL being unable to lock
Revert "media: ti: cal: fix possible memory leak in cal_ctx_create()"
ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
bpftool: Print newline before '}' for struct with padding only fields
Revert "pinctrl: amd: Disable and mask interrupts on resume"
ALSA: emu10k1: fix capture interrupt handler unlinking
ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
ALSA: i2c/cs8427: fix iec958 mixer control deactivation
ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex()
ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
Bluetooth: Fix race condition in hidp_session_thread
btrfs: print checksum type and implementation at mount time
btrfs: fix fast csum implementation detection
fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
mtdblock: tolerate corrected bit-flips
mtd: rawnand: meson: fix bitmask for length in command word
mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min
clk: sprd: set max_register according to mapping range
IB/mlx5: Add support for NDR link speed
IB/mlx5: Add support for 400G_8X lane speed
RDMA/cma: Allow UD qp_type to join multicast only
9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
niu: Fix missing unwind goto in niu_alloc_channels()
sysctl: add proc_dou8vec_minmax()
ipv4: shrink netns_ipv4 with sysctl conversions
tcp: convert elligible sysctls to u8
tcp: restrict net.ipv4.tcp_app_win
drm/armada: Fix a potential double free in an error handling path
qlcnic: check pci_reset_function result
net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
sctp: fix a potential overflow in sctp_ifwdtsn_skip
RDMA/core: Fix GID entry ref leak when create_ah fails
udp6: fix potential access to stale information
net: macb: fix a memory corruption in extended buffer descriptor mode
libbpf: Fix single-line struct definition output in btf_dump
power: supply: cros_usbpd: reclassify "default case!" as debug
wifi: mwifiex: mark OF related data as maybe unused
i2c: imx-lpi2c: clean rx/tx buffers upon new message
efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
verify_pefile: relax wrapper length check
asymmetric_keys: log on fatal failures in PE/pkcs7
riscv: add icache flush for nommu sigreturn trampoline
net: sfp: initialize sfp->i2c_block_size at sfp allocation
scsi: ses: Handle enclosure with just a primary component gracefully
x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
mtd: ubi: wl: Fix a couple of kernel-doc issues
ubi: Fix deadlock caused by recursively holding work_sem
powerpc/pseries: rename min_common_depth to primary_domain_index
powerpc/pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY
powerpc/pseries: Consolidate different NUMA distance update code paths
powerpc/pseries: Add a helper for form1 cpu distance
powerpc/pseries: Add support for FORM2 associativity
powerpc/papr_scm: Update the NUMA distance table for the target node
sched/fair: Move calculate of avg_load to a better location
sched/fair: Fix imbalance overflow
x86/rtc: Remove __init for runtime functions
i2c: ocores: generate stop condition after timeout in polling mode
watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
kbuild: check the minimum assembler version in Kconfig
kbuild: Switch to 'f' variants of integrated assembler flag
kbuild: check CONFIG_AS_IS_LLVM instead of LLVM_IAS
riscv: Handle zicsr/zifencei issues between clang and binutils
kexec: move locking into do_kexec_load
kexec: turn all kexec_mutex acquisitions into trylocks
panic, kexec: make __crash_kexec() NMI safe
sysctl: Fix data-races in proc_dou8vec_minmax().
Linux 5.10.178
Change-Id: I34107ee680c7b081bb0c2782483cbb7ec62252ca
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Rongwei Wang
|
ea8c42b3b6 |
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
commit 6fe7d6b992113719e96744d974212df3fcddc76c upstream.
The si->lock must be held when deleting the si from the available list.
Otherwise, another thread can re-add the si to the available list, which
can lead to memory corruption. The only place we have found where this
happens is in the swapoff path. This case can be described as below:
core 0 core 1
swapoff
del_from_avail_list(si) waiting
try lock si->lock acquire swap_avail_lock
and re-add si into
swap_avail_head
acquire si->lock but missing si already being added again, and continuing
to clear SWP_WRITEOK, etc.
It can be easily found that a massive warning messages can be triggered
inside get_swap_pages() by some special cases, for example, we call
madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile,
run much swapon-swapoff operations (e.g. stress-ng-swap).
However, in the worst case, panic can be caused by the above scene. In
swapoff(), the memory used by si could be kept in swap_info[] after
turning off a swap. This means memory corruption will not be caused
immediately until allocated and reset for a new swap in the swapon path.
A panic message caused: (with CONFIG_PLIST_DEBUG enabled)
------------[ cut here ]------------
top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a
prev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d
next: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a
WARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70
Modules linked in: rfkill(E) crct10dif_ce(E)...
CPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+
Hardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015
pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
pc : plist_check_prev_next_node+0x50/0x70
lr : plist_check_prev_next_node+0x50/0x70
sp : ffff0018009d3c30
x29: ffff0018009d3c40 x28: ffff800011b32a98
x27: 0000000000000000 x26: ffff001803908000
x25: ffff8000128ea088 x24: ffff800011b32a48
x23: 0000000000000028 x22: ffff001800875c00
x21: ffff800010f9e520 x20: ffff001800875c00
x19: ffff001800fdc6e0 x18: 0000000000000030
x17: 0000000000000000 x16: 0000000000000000
x15: 0736076307640766 x14: 0730073007380731
x13: 0736076307640766 x12: 0730073007380731
x11: 000000000004058d x10: 0000000085a85b76
x9 : ffff8000101436e4 x8 : ffff800011c8ce08
x7 : 0000000000000000 x6 : 0000000000000001
x5 : ffff0017df9ed338 x4 : 0000000000000001
x3 : ffff8017ce62a000 x2 : ffff0017df9ed340
x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
plist_check_prev_next_node+0x50/0x70
plist_check_head+0x80/0xf0
plist_add+0x28/0x140
add_to_avail_list+0x9c/0xf0
_enable_swap_info+0x78/0xb4
__do_sys_swapon+0x918/0xa10
__arm64_sys_swapon+0x20/0x30
el0_svc_common+0x8c/0x220
do_el0_svc+0x2c/0x90
el0_svc+0x1c/0x30
el0_sync_handler+0xa8/0xb0
el0_sync+0x148/0x180
irq event stamp: 2082270
Now, si->lock locked before calling 'del_from_avail_list()' to make sure
other thread see the si had been deleted and SWP_WRITEOK cleared together,
will not reinsert again.
This problem exists in versions after stable 5.10.y.
Link: https://lkml.kernel.org/r/20230404154716.23058-1-rongwei.wang@linux.alibaba.com
Fixes:
|
||
James Houghton
|
43390f1621 |
BACKPORT: hugetlb: unshare some PMDs when splitting VMAs
PMD sharing can only be done in PUD_SIZE-aligned pieces of VMAs; however, it is possible that HugeTLB VMAs are split without unsharing the PMDs first. Without this fix, it is possible to hit the uffd-wp-related WARN_ON_ONCE in hugetlb_change_protection [1]. The key there is that hugetlb_unshare_all_pmds will not attempt to unshare PMDs in non-PUD_SIZE-aligned sections of the VMA. It might seem ideal to unshare in hugetlb_vm_op_open, but we need to unshare in both the new and old VMAs, so unsharing in hugetlb_vm_op_split seems natural. [1]: https://lore.kernel.org/linux-mm/CADrL8HVeOkj0QH5VZZbRzybNE8CG-tEGFshnA+bG9nMgcWtBSg@mail.gmail.com/ Bug: 254441685 Link: https://lkml.kernel.org/r/20230104231910.1464197-1-jthoughton@google.com Fixes: 6dfeaff93be1 ("hugetlb/userfaultfd: unshare all pmds for hugetlbfs when register wp") Signed-off-by: James Houghton <jthoughton@google.com> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com> Acked-by: Peter Xu <peterx@redhat.com> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Muchun Song <songmuchun@bytedance.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit b30c14cd61025eeea2f2e8569606cd167ba9ad2d) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ic7b61e7fd00369f17d26164c187a148d09ffd9ae |
||
Charan Teja Kalla
|
9a595405c4 |
UPSTREAM: mm/page_exit: fix kernel doc warning in page_ext_put()
Fix the below compiler warnings reported with 'make W=1 mm/'. mm/page_ext.c:178: warning: Function parameter or member 'page_ext' not described in 'page_ext_put'. Bug: 254441685 [quic_pkondeti@quicinc.com: better patch title] Link: https://lkml.kernel.org/r/1667884582-2465-1-git-send-email-quic_charante@quicinc.com Fixes: b1d5488a252dc9 ("mm: fix use-after free of page_ext after race with memory-offline") Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com> Reported-by: Vlastimil Babka <vbabka@suse.cz> Tested-by: Vlastimil Babka <vbabka@suse.cz> Cc: Pavan Kondeti <quic_pkondeti@quicinc.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit ed86b74874f839f0e579bdf92ea0a5aabdfabebb) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ia1facd5591e04a41d03f9c9a65ea2ef506db2b3f |
||
SeongJae Park
|
d11c3f780c |
UPSTREAM: mm/damon/dbgfs: check if rm_contexts input is for a real context
A user could write a name of a file under 'damon/' debugfs directory, which is not a user-created context, to 'rm_contexts' file. In the case, 'dbgfs_rm_context()' just assumes it's the valid DAMON context directory only if a file of the name exist. As a result, invalid memory access could happen as below. Fix the bug by checking if the given input is for a directory. This check can filter out non-context inputs because directories under 'damon/' debugfs directory can be created via only 'mk_contexts' file. This bug has found by syzbot[1]. [1] https://lore.kernel.org/damon/000000000000ede3ac05ec4abf8e@google.com/ Bug: 254441685 Link: https://lkml.kernel.org/r/20221107165001.5717-2-sj@kernel.org Fixes: 75c1c2b53c78 ("mm/damon/dbgfs: support multiple contexts") Signed-off-by: SeongJae Park <sj@kernel.org> Reported-by: syzbot+6087eafb76a94c4ac9eb@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> [5.15.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 1de09a7281edecfdba19b3a07417f6d65243ab5f) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I038612db15c0a46089a5e1a52a4750fff6ba3bf6 |
||
|
Peter Xu
|
8eb30a41f5 |
UPSTREAM: mm/shmem: use page_mapping() to detect page cache for uffd continue
mfill_atomic_install_pte() checks page->mapping to detect whether one page is used in the page cache. However as pointed out by Matthew, the page can logically be a tail page rather than always the head in the case of uffd minor mode with UFFDIO_CONTINUE. It means we could wrongly install one pte with shmem thp tail page assuming it's an anonymous page. It's not that clear even for anonymous page, since normally anonymous pages also have page->mapping being setup with the anon vma. It's safe here only because the only such caller to mfill_atomic_install_pte() is always passing in a newly allocated page (mcopy_atomic_pte()), whose page->mapping is not yet setup. However that's not extremely obvious either. For either of above, use page_mapping() instead. Bug: 254441685 Link: https://lkml.kernel.org/r/Y2K+y7wnhC4vbnP2@x1n Fixes: 153132571f02 ("userfaultfd/shmem: support UFFDIO_CONTINUE for shmem") Signed-off-by: Peter Xu <peterx@redhat.com> Reported-by: Matthew Wilcox <willy@infradead.org> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Hugh Dickins <hughd@google.com> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 93b0d9178743a68723babe8448981f658aebc58e) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I5635ee1a81087e8022169ad1bda1e6d98fe5835f |
||
Peifeng Li
|
61344663df |
ANDROID: clear memory trylock-bit when page_locked.
Clearing trylock-bit of page shrinked by shrnk_page_list in advance
which avoids page in other scene with the trylock-bit.
The page with trylock-bit will be added ret_pages and handled in
trace_android_vh_handle_failed_page_trylock. In the progress[unlock_page, handled],
the page carried with trylock-bit will cause some error-issues in other
scene, so clear trylock-bit here.
trace_android_vh_page_trylock_get_result will clear trylock-bit and return
if page tyrlock failed in reclaim-process. Here we just want to clear
trylock-bit so that ignore page_trylock_result.
Fixes: 309a6bf81a20 ("ANDROID: vendor_hook: Add hook to not be stuck ro rmap lock in kswapd or direct_reclaim")
Bug: 240003372
Signed-off-by: Peifeng Li <lipeifeng@oppo.com>
Change-Id: Ifecd308573ef37a51e33856a0b3bb93cd67289ac
|
||
Baolin Wang
|
b7b3a636ad |
UPSTREAM: mm: memcontrol: set the correct memcg swappiness restriction
Since commit |
||
|
Greg Kroah-Hartman
|
df23049a96 |
This is the 5.10.176 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQa9NgACgkQONu9yGCS aT4Iew//X/3+Bpiu+FyaYe0NZ4I95rQvNh4fG6wXCFd/PVbCRpxVOAKQ91GnkU+D iMeuGBPqkpPhHvesRybsq0u8GmJ+fJj58+fgy1ABI7UzkWihzNDu1n2RntYmuRvl TEEsAIS+6/lhVKosDhyYcXAL5eT8F06zFOI9HspWRe+lYoRBIQyykcLgZQwt5mBX qyKAFkvhH0Z77ATiID5alRkVArgi/t3qBUANTrJ7LqOlhtY42EOS0Sp7wpZWskqI 7Mpb6pfODsOq5d+6zNvZzdrtMaKRBal0Inxj2+zLEYdSv+xbTqp4Cb6UI18gJTA7 zsvItAzTRxp+7KiZVS2HP3uMRRV4lQ5HxgMJhSsONHSSRh7ndhkW7NQq/o/dRFm2 IgVf1beHk2pE+LN0Plf2oQCOMV8h/vQRZLCejoQEbFy6oNQ6bA4btJaXZnfluqDb KXONyDqXZ3uX3DSrKO4pCNCTsm5JhinkFHhO125kjSkPp/k2YWXdnBftQT1mWPYf dbWu1z/E+3qvObedwNn+icuu/MUznZMTYwDOD31tJp+1iEBgeBQWI+IRaIaWbDyD dxSoV8cScNZz+X4M70EFlwJMYL/VcIzDljeH2EA3CImDycDH0tspo6z8Z+xFhsrg D1wshmaT9XkSEJ92xDMw82B/1noOati75HpkUW1W/PKTqvjH/uU= =/t/A -----END PGP SIGNATURE----- Merge 5.10.176 into android12-5.10-lts Changes in 5.10.176 xfrm: Allow transport-mode states with AF_UNSPEC selector drm/panfrost: Don't sync rpm suspension after mmu flushing cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_nat: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Fix a comment in function scsi_host_dev_release() scsi: core: Fix a procfs host directory removal regression tcp: tcp_make_synack() can be called from process context nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() qed/qed_dev: guard against a possible division by zero net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition net/smc: fix deadlock triggered by cancel_delayed_work_syn() net: usb: smsc75xx: Limit packet length to skb->len drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc null_blk: Move driver into its own directory block: null_blk: Fix handling of fake timeout request nvme: fix handling single range discard request nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL ice: xsk: disable txq irq before flushing hw net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net/iucv: Fix size of interrupt data selftests: net: devlink_port_split.py: skip test if no suitable device available qed/qed_mng_tlv: correctly zero out ->min instead of ->hour ethernet: sun: add check for the mdesc_grab() hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: tmp512: drop of_match_ptr for ID table hwmon: (adm1266) Set `can_sleep` flag for GPIO chip media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command jffs2: correct logic when creating a hole in jffs2_write_begin ext4: fail ext4_iget if special inode unallocated ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access sh: intc: Avoid spurious sizeof-pointer-div warning drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes ext4: fix possible double unlock when moving a directory tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted serial: 8250_em: Fix UART port type firmware: xilinx: don't make a sleepable memory allocation from an atomic context interconnect: fix mem leak when freeing nodes tracing: Make splice_read available again tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something cifs: Fix smb2_set_path_size() KVM: nVMX: add missing consistency checks for CR0 and CR4 ALSA: hda: intel-dsp-config: add MTL PCI id ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro drm/shmem-helper: Remove another errant put in error path mptcp: avoid setting TCP_CLOSE state twice ftrace: Fix invalid address access in lookup_rec() when index is 0 mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mmc: sdhci_am654: lower power-on failed message severity fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks cpuidle: psci: Iterate backwards over list in psci_pd_remove() x86/mce: Make sure logged MCEs are processed after sysfs update x86/mm: Fix use of uninitialized buffer in sme_enable() drm/i915: Don't use stolen memory for ring buffers with LLC drm/i915/active: Fix misuse of non-idle barriers as fence trackers io_uring: avoid null-ptr-deref in io_arm_poll_handler s390/ipl: add missing intersection check to ipl_report handling PCI: Unify delay handling for reset and resume PCI/DPC: Await readiness of secondary bus after reset xfs: don't assert fail on perag references on teardown xfs: purge dquots after inode walk fails during quotacheck xfs: don't leak btree cursor when insrec fails after a split xfs: remove XFS_PREALLOC_SYNC xfs: fallocate() should call file_modified() xfs: set prealloc flag in xfs_alloc_file_space() xfs: use setattr_copy to set vfs inode attributes fs: add mode_strip_sgid() helper fs: move S_ISGID stripping into the vfs_*() helpers attr: add in_group_or_capable() fs: move should_remove_suid() attr: add setattr_should_drop_sgid() attr: use consistent sgid stripping checks fs: use consistent setgid checks in is_sxid() xfs: remove xfs_setattr_time() declaration HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own Linux 5.10.176 Change-Id: Icd45189f4182c749d1758c13e18705abb4ea9c5a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
fe51d37c6c |
Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits: |
||
Suren Baghdasaryan
|
16c2b1d94f |
ANDROID: page_pinner: prevent pp_buffer access before initialization
If page_pinner is configured with page_pinner_enabled=false and
failure_tracking=true, pp_buffer will be accessed without being
initialized. Prevent this by adding page_pinner_inited checks in
functions that access it.
Fixes: 898cfbf094a2 ("ANDROID: mm: introduce page_pinner")
Bug: 259024332
Bug: 260179017
Change-Id: I8f612cae3e74d36e8a4eee5edec25281246cbe5e
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
(cherry picked from commit 23fb3111f63e5fe239a769668275c20493a5849c)
|
||
|
Greg Kroah-Hartman
|
fb0cece721 |
Merge tag 'android12-5.10.168_r00' into android12-5.10
This is the merge of the upstream LTS release of 5.10.168 into the android12-5.10 branch. It contains the following commits: * |
||
David Hildenbrand
|
b2747b690c |
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
commit 42b2af2c9b7eede8ef21d0943f84d135e21a32a3 upstream.
Currently, we'd lose the userfaultfd-wp marker when PTE-mapping a huge
zeropage, resulting in the next write faults in the PMD range not
triggering uffd-wp events.
Various actions (partial MADV_DONTNEED, partial mremap, partial munmap,
partial mprotect) could trigger this. However, most importantly,
un-protecting a single sub-page from the userfaultfd-wp handler when
processing a uffd-wp event will PTE-map the shared huge zeropage and lose
the uffd-wp bit for the remainder of the PMD.
Let's properly propagate the uffd-wp bit to the PMDs.
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <inttypes.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <poll.h>
#include <pthread.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <linux/userfaultfd.h>
static size_t pagesize;
static int uffd;
static volatile bool uffd_triggered;
#define barrier() __asm__ __volatile__("": : :"memory")
static void uffd_wp_range(char *start, size_t size, bool wp)
{
struct uffdio_writeprotect uffd_writeprotect;
uffd_writeprotect.range.start = (unsigned long) start;
uffd_writeprotect.range.len = size;
if (wp) {
uffd_writeprotect.mode = UFFDIO_WRITEPROTECT_MODE_WP;
} else {
uffd_writeprotect.mode = 0;
}
if (ioctl(uffd, UFFDIO_WRITEPROTECT, &uffd_writeprotect)) {
fprintf(stderr, "UFFDIO_WRITEPROTECT failed: %d\n", errno);
exit(1);
}
}
static void *uffd_thread_fn(void *arg)
{
static struct uffd_msg msg;
ssize_t nread;
while (1) {
struct pollfd pollfd;
int nready;
pollfd.fd = uffd;
pollfd.events = POLLIN;
nready = poll(&pollfd, 1, -1);
if (nready == -1) {
fprintf(stderr, "poll() failed: %d\n", errno);
exit(1);
}
nread = read(uffd, &msg, sizeof(msg));
if (nread <= 0)
continue;
if (msg.event != UFFD_EVENT_PAGEFAULT ||
!(msg.arg.pagefault.flags & UFFD_PAGEFAULT_FLAG_WP)) {
printf("FAIL: wrong uffd-wp event fired\n");
exit(1);
}
/* un-protect the single page. */
uffd_triggered = true;
uffd_wp_range((char *)(uintptr_t)msg.arg.pagefault.address,
pagesize, false);
}
return arg;
}
static int setup_uffd(char *map, size_t size)
{
struct uffdio_api uffdio_api;
struct uffdio_register uffdio_register;
pthread_t thread;
uffd = syscall(__NR_userfaultfd,
O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY);
if (uffd < 0) {
fprintf(stderr, "syscall() failed: %d\n", errno);
return -errno;
}
uffdio_api.api = UFFD_API;
uffdio_api.features = UFFD_FEATURE_PAGEFAULT_FLAG_WP;
if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) {
fprintf(stderr, "UFFDIO_API failed: %d\n", errno);
return -errno;
}
if (!(uffdio_api.features & UFFD_FEATURE_PAGEFAULT_FLAG_WP)) {
fprintf(stderr, "UFFD_FEATURE_WRITEPROTECT missing\n");
return -ENOSYS;
}
uffdio_register.range.start = (unsigned long) map;
uffdio_register.range.len = size;
uffdio_register.mode = UFFDIO_REGISTER_MODE_WP;
if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) {
fprintf(stderr, "UFFDIO_REGISTER failed: %d\n", errno);
return -errno;
}
pthread_create(&thread, NULL, uffd_thread_fn, NULL);
return 0;
}
int main(void)
{
const size_t size = 4 * 1024 * 1024ull;
char *map, *cur;
pagesize = getpagesize();
map = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
if (map == MAP_FAILED) {
fprintf(stderr, "mmap() failed\n");
return -errno;
}
if (madvise(map, size, MADV_HUGEPAGE)) {
fprintf(stderr, "MADV_HUGEPAGE failed\n");
return -errno;
}
if (setup_uffd(map, size))
return 1;
/* Read the whole range, populating zeropages. */
madvise(map, size, MADV_POPULATE_READ);
/* Write-protect the whole range. */
uffd_wp_range(map, size, true);
/* Make sure uffd-wp triggers on each page. */
for (cur = map; cur < map + size; cur += pagesize) {
uffd_triggered = false;
barrier();
/* Trigger a write fault. */
*cur = 1;
barrier();
if (!uffd_triggered) {
printf("FAIL: uffd-wp did not trigger\n");
return 1;
}
}
printf("PASS: uffd-wp triggered\n");
return 0;
}
Link: https://lkml.kernel.org/r/20230302175423.589164-1-david@redhat.com
Fixes:
|
||
|
Greg Kroah-Hartman
|
0847230e9b |
This is the 5.10.173 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQMoPMACgkQONu9yGCS
aT4a1Q//WHnQOEgEykqbHMree6UQD5F6crB0kUcJTSDB5lblviYGxpOadw2j+670
AGsFg00cm8Sb8p78v3SA+X2UzScGnY5Cwhe+B/JucUSr+4rDlZ9FjOGXbKdlYFc2
sOTp9j/9KrETf0K/VVuCa48rKBPUFvrT7pZUAblZ0vVmk6cSzPW/1iBa4W6Ho6Ec
LxqNzCDtyTWX0JCzdv5DvjW7WALvPiEiw8CX8+psZTD8RHdAjtnW2DKp8ZnznzJS
YVBf2ulsD1g3zKEqDm5nMcUyN3fSEWci97bmbEzIeMTULfsj+aQF5a7JoXIkj7Yb
QIvZ1fG6RSviVplt5SoT5ucDN2cGqLt7+4b3v6DKQX1dMTDrAPdU+T1VU0LRxB6h
5M3ZZ925ktJu2YTmKi4QvgP01ZVJv0dNWytbmAnIVvJRGY3gHQt5tx0W2lnQdHE9
mJeW2MXcLKeho7d5p3wRl6yEWAJuAoioZCd95NPyNnVZMMhYRu6iTIIzY8EdNegQ
5ve9Rsda9uobvWRCWefyS0pHvuJ2HJrJONnU92MHKSojEC9oAjURvRGWpXYcQFM/
EiywE1oBRA6NrGI7BomAH6khVoTi01yBsQ0QEt30mTOuyxa6j/oR9iEsNv7bmjZC
SoApcWDPNy6RpHX7SDtch0Qj1l7YfYDNNj66Y94o5E70eHebU9Q=
=vHOd
-----END PGP SIGNATURE-----
Merge 5.10.173 into android12-5.10-lts
Changes in 5.10.173
HID: asus: Remove check for same LED brightness on set
HID: asus: use spinlock to protect concurrent accesses
HID: asus: use spinlock to safely schedule workers
powerpc/mm: Rearrange if-else block to avoid clang warning
ARM: OMAP2+: Fix memory leak in realtime_counter_init()
arm64: dts: qcom: qcs404: use symbol names for PCIe resets
ARM: zynq: Fix refcount leak in zynq_early_slcr_init
arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
arm64: dts: qcom: sc7180: correct SPMI bus address cells
arm64: dts: meson-gx: Fix Ethernet MAC address unit name
arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
ARM: s3c: fix s3c64xx_set_timer_source prototype
arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
ARM: imx: Call ida_simple_remove() for ida_simple_get
arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
ARM: dts: imx7s: correct iomuxc gpr mux controller cells
arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
blk-mq: avoid sleep in blk_mq_alloc_request_hctx
blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
blk-mq: correct stale comment of .get_budget
s390/dasd: Prepare for additional path event handling
s390/dasd: Fix potential memleak in dasd_eckd_init()
sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
sched/rt: pick_next_rt_entity(): check list_entry
x86/perf/zhaoxin: Add stepping check for ZXC
block: bio-integrity: Copy flags when bio_integrity_payload is cloned
wifi: rsi: Fix memory leak in rsi_coex_attach()
wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
wifi: libertas: fix memory leak in lbs_init_adapter()
wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
rtlwifi: fix -Wpointer-sign warning
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
libbpf: Fix btf__align_of() by taking into account field offsets
wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
wifi: ipw2200: fix memory leak in ipw_wdev_init()
wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
crypto: x86/ghash - fix unaligned access in ghash_setkey()
ACPICA: Drop port I/O validation for some regions
genirq: Fix the return type of kstat_cpu_irqs_sum()
rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
lib/mpi: Fix buffer overrun when SG is too long
crypto: ccp: Use the stack for small SEV command buffers
crypto: ccp: Use the stack and common buffer for status commands
crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
ACPICA: nsrepair: handle cases without a return value correctly
thermal/drivers/tsens: Drop msm8976-specific defines
thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976
thermal/drivers/tsens: Add compat string for the qcom,msm8960
thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
wifi: orinoco: check return value of hermes_write_wordrec()
wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
ath9k: hif_usb: simplify if-if to if-else
ath9k: htc: clean up statistics macros
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
ACPI: battery: Fix missing NUL-termination with large strings
crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
crypto: essiv - Handle EBUSY correctly
crypto: seqiv - Handle EBUSY correctly
powercap: fix possible name leak in powercap_register_zone()
x86/cpu: Init AP exception handling from cpu_init_secondary()
x86/microcode: Replace deprecated CPU-hotplug functions.
x86: Mark stop_this_cpu() __noreturn
x86/microcode: Rip out the OLD_INTERFACE
x86/microcode: Default-disable late loading
x86/microcode: Print previous version of microcode after reload
x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
x86/microcode: Check CPU capabilities after late microcode update correctly
x86/microcode: Adjust late loading result reporting message
net: ethernet: ti: am65-cpsw: fix tx csum offload for multi mac mode
net: ethernet: ti: am65-cpsw: handle deferred probe with dev_err_probe()
net: ethernet: ti: add missing of_node_put before return
crypto: xts - Handle EBUSY correctly
leds: led-class: Add missing put_device() to led_put()
crypto: ccp - Refactor out sev_fw_alloc()
crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
bpftool: profile online CPUs instead of possible
net/mlx5: Enhance debug print in page allocation failure
irqchip: Fix refcount leak in platform_irqchip_probe
irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
s390/vmem: fix empty page tables cleanup under KASAN
net: add sock_init_data_uid()
tun: tun_chr_open(): correctly initialize socket uid
tap: tap_open(): correctly initialize socket uid
OPP: fix error checking in opp_migrate_dentry()
Bluetooth: L2CAP: Fix potential user-after-free
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
crypto: rsa-pkcs1pad - Use akcipher_request_complete
m68k: /proc/hardware should depend on PROC_FS
RISC-V: time: initialize hrtimer based broadcast clock event device
wifi: iwl3945: Add missing check for create_singlethread_workqueue
wifi: iwl4965: Add missing check for create_singlethread_workqueue()
wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
selftests/bpf: Fix out-of-srctree build
crypto: crypto4xx - Call dma_unmap_page when done
wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
thermal/drivers/hisi: Drop second sensor hi3660
can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
bpf: Fix global subprog context argument resolution logic
irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
selftests/net: Interpret UDP_GRO cmsg data as an int value
l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
net: bcmgenet: fix MoCA LED control
selftest: fib_tests: Always cleanup before exit
sefltests: netdevsim: wait for devlink instance after netns removal
drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
drm/bridge: megachips: Fix error handling in i2c_register_driver()
drm/vkms: Fix null-ptr-deref in vkms_release()
drm/vc4: dpi: Add option for inverting pixel clock and output enable
drm/vc4: dpi: Fix format mapping for RGB565
drm: tidss: Fix pixel format definition
gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
pinctrl: rockchip: add support for rk3568
pinctrl: rockchip: do coding style for mux route struct
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
drm/vc4: hvs: Set AXI panic modes
drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
drm/vc4: hdmi: Correct interlaced timings again
ASoC: fsl_sai: initialize is_dsp_mode flag
drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
ALSA: hda/ca0132: minor fix for allocation size
drm/msm/dpu: Disallow unallocated resources to be returned
drm/bridge: lt9611: fix sleep mode setup
drm/bridge: lt9611: fix HPD reenablement
drm/bridge: lt9611: fix polarity programming
drm/bridge: lt9611: fix programming of video modes
drm/bridge: lt9611: fix clock calculation
drm/bridge: lt9611: pass a pointer to the of node
drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
drm/msm: use strscpy instead of strncpy
drm/msm/dpu: Add check for cstate
drm/msm/dpu: Add check for pstates
drm/msm/mdp5: Add check for kzalloc
pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
pinctrl: mediatek: Initialize variable pullen and pullup to zero
pinctrl: mediatek: Initialize variable *buf to zero
gpu: host1x: Don't skip assigning syncpoints to channels
drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
drm/mediatek: Use NULL instead of 0 for NULL pointer
drm/mediatek: Drop unbalanced obj unref
drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
drm/mediatek: Clean dangling pointer on bind error path
ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
gpio: vf610: connect GPIO label to dev name
spi: dw_bt1: fix MUX_MMIO dependencies
ASoC: mchp-spdifrx: fix controls which rely on rsr register
ASoC: atmel: fix spelling mistakes
ASoC: mchp-spdifrx: fix return value in case completion times out
ASoC: mchp-spdifrx: fix controls that works with completion mechanism
ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
ASoC: dt-bindings: meson: fix gx-card codec node regex
hwmon: (ltc2945) Handle error case in ltc2945_value_store
drm/amdgpu: fix enum odm_combine_mode mismatch
scsi: mpt3sas: Fix a memory leak
scsi: aic94xx: Add missing check for dma_map_single()
spi: bcm63xx-hsspi: fix pm_runtime
spi: bcm63xx-hsspi: Fix multi-bit mode setting
hwmon: (mlxreg-fan) Return zero speed for broken fan
ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
dm: remove flush_scheduled_work() during local_exit()
NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
NFSv4: keep state manager thread active if swap is enabled
nfs4trace: fix state manager flag printing
NFS: fix disabling of swap
spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
HID: bigben: use spinlock to protect concurrent accesses
HID: bigben_worker() remove unneeded check on report_field
HID: bigben: use spinlock to safely schedule workers
hid: bigben_probe(): validate report count
nfsd: fix race to check ls_layouts
cifs: Fix lost destroy smbd connection when MR allocate failed
cifs: Fix warning and UAF when destroy the MR list
gfs2: jdata writepage fix
perf llvm: Fix inadvertent file creation
leds: led-core: Fix refcount leak in of_led_get()
perf tools: Fix auto-complete on aarch64
sparc: allow PM configs for sparc32 COMPILE_TEST
selftests/ftrace: Fix bash specific "==" operator
printf: fix errname.c list
objtool: add UACCESS exceptions for __tsan_volatile_read/write
mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
RISC-V: fix funct4 definition for c.jalr in parse_asm.h
mtd: rawnand: sunxi: Fix the size of the last OOB region
Input: iqs269a - drop unused device node references
Input: iqs269a - increase interrupt handler return delay
Input: iqs269a - configure device with a single block write
linux/kconfig.h: replace IF_ENABLED() with PTR_IF() in <linux/kernel.h>
clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
clk: renesas: cpg-mssr: Remove superfluous check in resume code
clk: imx: avoid memory leak
Input: ads7846 - don't report pressure for ads7845
Input: ads7846 - convert to full duplex
Input: ads7846 - convert to one message
Input: ads7846 - always set last command to PWRDOWN
Input: ads7846 - don't check penirq immediately for 7845
clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC
clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
powerpc/perf/hv-24x7: add missing RTAS retry status handling
powerpc/pseries/lpar: add missing RTAS retry status handling
powerpc/pseries/lparcfg: add missing RTAS retry status handling
powerpc/rtas: make all exports GPL
powerpc/rtas: ensure 4KB alignment for rtas_data_buf
powerpc/eeh: Small refactor of eeh_handle_normal_event()
powerpc/eeh: Set channel state after notifying the drivers
MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
MIPS: vpe-mt: drop physical_memsize
vdpa/mlx5: Don't clear mr struct on destroy MR
alpha/boot/tools/objstrip: fix the check for ELF header
Input: iqs269a - do not poll during suspend or resume
Input: iqs269a - do not poll during ATI
remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
media: ti: cal: fix possible memory leak in cal_ctx_create()
media: platform: ti: Add missing check for devm_regulator_get
powerpc: Remove linker flag from KBUILD_AFLAGS
builddeb: clean generated package content
media: max9286: Fix memleak in max9286_v4l2_register()
media: ov2740: Fix memleak in ov2740_init_controls()
media: ov5675: Fix memleak in ov5675_init_controls()
media: i2c: ov772x: Fix memleak in ov772x_probe()
media: i2c: imx219: remove redundant writes
media: i2c: imx219: Split common registers from mode tables
media: i2c: imx219: Fix binning for RAW8 capture
media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
media: i2c: ov7670: 0 instead of -EINVAL was returned
media: usb: siano: Fix use after free bugs caused by do_submit_urb
media: saa7134: Use video_unregister_device for radio_dev
rpmsg: glink: Avoid infinite loop on intent for missing channel
udf: Define EFSCORRUPTED error code
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
blk-iocost: fix divide by 0 error in calc_lcoefs()
wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
wifi: ath11k: debugfs: fix to work with multiple PCI devices
thermal: intel: Fix unsigned comparison with less than zero
timers: Prevent union confusion from unexpected restart_syscall()
x86/bugs: Reset speculation control settings on init
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
wifi: mt7601u: fix an integer underflow
inet: fix fast path in __inet_hash_connect()
ice: add missing checks for PF vsi type
ACPI: Don't build ACPICA with '-Os'
clocksource: Suspend the watchdog temporarily when high read latency detected
crypto: hisilicon: Wipe entire pool on error
net: bcmgenet: Add a check for oversized packets
m68k: Check syscall_trace_enter() return code
wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
net/mlx5: fw_tracer: Fix debug print
coda: Avoid partial allocation of sig_inputArgs
uaccess: Add minimum bounds check on kernel buffer size
PM: EM: fix memory leak with using debugfs_lookup()
Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
drm/amd/display: Fix potential null-deref in dm_resume
drm/omap: dsi: Fix excessive stack usage
HID: Add Mapping for System Microphone Mute
drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
drm/radeon: free iio for atombios when driver shutdown
drm: amd: display: Fix memory leakage
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
docs/scripts/gdb: add necessary make scripts_gdb step
ASoC: kirkwood: Iterate over array indexes instead of using pointer math
regulator: max77802: Bounds check regulator id against opmode
regulator: s5m8767: Bounds check id indexing into arrays
gfs2: Improve gfs2_make_fs_rw error handling
hwmon: (coretemp) Simplify platform device handling
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
HID: logitech-hidpp: Don't restart communication if not necessary
drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
dm thin: add cond_resched() to various workqueue loops
dm cache: add cond_resched() to various workqueue loops
nfsd: zero out pointers after putting nfsd_files on COPY setup error
wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
firmware: coreboot: framebuffer: Ignore reserved pixel color bits
rtc: pm8xxx: fix set-alarm race
ipmi_ssif: Rename idle state and check
s390/extmem: return correct segment type in __segment_load()
s390: discard .interp section
s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
s390/kprobes: fix current_kprobe never cleared after kprobes reenter
cifs: Fix uninitialized memory read in smb3_qfs_tcon()
ARM: dts: exynos: correct HDMI phy compatible in Exynos4
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
fs: hfsplus: fix UAF issue in hfsplus_put_super
exfat: fix reporting fs error when reading dir beyond EOF
exfat: fix unexpected EOF while reading dir
exfat: redefine DIR_DELETED as the bad cluster number
exfat: fix inode->i_blocks for non-512 byte sector size device
f2fs: fix information leak in f2fs_move_inline_dirents()
f2fs: fix cgroup writeback accounting with fs-layer encryption
ocfs2: fix defrag path triggering jbd2 ASSERT
ocfs2: fix non-auto defrag path not working issue
udf: Truncate added extents on failed expansion
udf: Do not bother merging very long extents
udf: Do not update file length for failed writes to inline files
udf: Preserve link count of system files
udf: Detect system inodes linked into directory hierarchy
udf: Fix file corruption when appending just after end of preallocated extent
KVM: Destroy target device if coalesced MMIO unregistration fails
KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
KVM: s390: disable migration mode when dirty tracking is disabled
x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
x86/reboot: Disable virtualization in an emergency if SVM is supported
x86/reboot: Disable SVM, not just VMX, when stopping CPUs
x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
x86/microcode/AMD: Add a @cpu parameter to the reloading functions
x86/microcode/AMD: Fix mixed steppings support
x86/speculation: Allow enabling STIBP with legacy IBRS
Documentation/hw-vuln: Document the interaction between IBRS and STIBP
brd: return 0/-error from brd_insert_page()
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
irqdomain: Fix association race
irqdomain: Fix disassociation race
irqdomain: Drop bogus fwspec-mapping error handling
io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
io_uring: mark task TASK_RUNNING before handling resume/task work
io_uring: add a conditional reschedule to the IOPOLL cancelation loop
io_uring/rsrc: disallow multi-source reg buffers
io_uring: remove MSG_NOSIGNAL from recvmsg
io_uring/poll: allow some retries for poll triggering spuriously
ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
jbd2: fix data missing when reusing bh which is ready to be checkpointed
ext4: optimize ea_inode block expansion
ext4: refuse to create ea block when umounted
mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
dm: add cond_resched() to dm_wq_work()
wifi: rtl8xxxu: Use a longer retry limit of 48
wifi: cfg80211: Fix use after free for wext
thermal: intel: powerclamp: Fix cur_state for multi package system
dm flakey: fix logic when corrupting a bio
dm flakey: don't corrupt the zero page
ARM: dts: exynos: correct TMU phandle in Exynos4210
ARM: dts: exynos: correct TMU phandle in Exynos4
ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
ARM: dts: exynos: correct TMU phandle in Exynos5250
ARM: dts: exynos: correct TMU phandle in Odroid XU
ARM: dts: exynos: correct TMU phandle in Odroid HC1
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
alpha: fix FEN fault handling
dax/kmem: Fix leak of memory-hotplug resources
mips: fix syscall_get_nr
media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
remoteproc/mtk_scp: Move clk ops outside send_lock
docs: gdbmacros: print newest record
mm: memcontrol: deprecate charge moving
mm/thp: check and bail out if page in deferred queue already
ktest.pl: Give back console on Ctrt^C on monitor
ktest.pl: Fix missing "end_monitor" when machine check fails
ktest.pl: Add RUN_TIMEOUT option with default unlimited
ring-buffer: Handle race between rb_move_tail and rb_check_pages
scsi: qla2xxx: Fix link failure in NPIV environment
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
scsi: qla2xxx: Fix erroneous link down
scsi: ses: Don't attach if enclosure has no components
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
riscv: jump_label: Fixup unaligned arch_static_branch function
PCI/PM: Observe reset delay irrespective of bridge_d3
PCI: hotplug: Allow marking devices as disconnected during bind/unbind
PCI: Avoid FLR for AMD FCH AHCI adapters
vfio/type1: prevent underflow of locked_vm via exec()
drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
drm/radeon: Fix eDP for single-display iMac11,2
drm/edid: fix AVI infoframe aspect ratio handling
arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
wifi: ath9k: use proper statements in conditionals
pinctrl: rockchip: fix mux route data for rk3568
pinctrl: rockchip: fix reading pull type on rk3568
kbuild: Port silent mode detection to future gnu make.
net/sched: Retire tcindex classifier
fs/jfs: fix shift exponent db_agl2size negative
objtool: Fix memory leak in create_static_call_sections()
pwm: sifive: Reduce time the controller lock is held
pwm: sifive: Always let the first pwm_apply_state succeed
pwm: stm32-lp: fix the check on arr and cmp registers update
f2fs: use memcpy_{to,from}_page() where possible
fs: f2fs: initialize fsdata in pagecache_write()
um: vector: Fix memory leak in vector_config
ubi: ensure that VID header offset + VID header size <= alloc, size
ubifs: Fix build errors as symbol undefined
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
ubifs: Rectify space budget for ubifs_xrename()
ubifs: Fix wrong dirty space budget for dirty inode
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
ubifs: Reserve one leb for each journal head while doing budget
ubi: Fix use-after-free when volume resizing failed
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
ubifs: Fix memory leak in alloc_wbufs()
ubi: Fix possible null-ptr-deref in ubi_free_volume()
ubifs: Re-statistic cleaned znode count if commit failed
ubifs: dirty_cow_znode: Fix memleak in error handling path
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
watchdog: Fix kmemleak in watchdog_cdev_register
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
netfilter: ebtables: fix table blob use-after-free
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
net: fix __dev_kfree_skb_any() vs drop monitor
9p/xen: fix version parsing
9p/xen: fix connection sequence
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
net/mlx5: Geneve, Fix handling of Geneve object id as error code
nfc: fix memory leak of se_io context in nfc_genl_se_io
net/sched: act_sample: fix action bind logic
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
tcp: tcp_check_req() can be called from process context
vc_screen: modify vcs_size() handling in vcs_read()
rtc: sun6i: Always export the internal oscillator
scsi: ipr: Work around fortify-string warning
loop: loop_set_status_from_info() check before assignment
ASoC: adau7118: don't disable regulators on device unbind
ASoC: zl38060: Remove spurious gpiolib select
ASoC: zl38060 add gpiolib dependency
thermal: intel: quark_dts: fix error pointer dereference
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
IB/hfi1: Update RMT size calculation
media: uvcvideo: Handle cameras with invalid descriptors
media: uvcvideo: Handle errors from calls to usb_string
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
media: uvcvideo: Silence memcpy() run-time false positive warnings
staging: emxx_udc: Add checks for dma_alloc_coherent()
tty: fix out-of-bounds access in tty_driver_lookup_tty()
tty: serial: fsl_lpuart: disable the CTS when send break signal
serial: sc16is7xx: setup GPIO controller later in probe
mei: bus-fixup:upon error print return values of send and receive
tools/iio/iio_utils:fix memory leak
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
PCI: loongson: Prevent LS7A MRRS increases
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
USB: ene_usb6250: Allocate enough memory for full object
usb: uvc: Enumerate valid values for color matching
usb: gadget: uvc: Make bSourceID read/write
PCI: Align extra resources for hotplug bridges properly
PCI: Take other bus devices into account when distributing resources
kernel/fail_function: fix memory leak with using debugfs_lookup()
PCI: loongson: Add more devices that need MRRS quirk
PCI: Add ACS quirk for Wangxun NICs
phy: rockchip-typec: Fix unsigned comparison with less than zero
soundwire: cadence: Remove wasted space in response_buf
soundwire: cadence: Drain the RX FIFO after an IO timeout
net: tls: avoid hanging tasks on the tx_lock
x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid}
x86/resctl: fix scheduler confusion with 'current'
drm/display/dp_mst: Fix down/up message handling after sink disconnect
drm/display/dp_mst: Fix down message handling after a packet reception error
Bluetooth: hci_sock: purge socket queues in the destruct() callback
tcp: Fix listen() regression in 5.10.163
drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
media: uvcvideo: Provide sync and async uvc_ctrl_status_event
media: uvcvideo: Fix race condition with usb_kill_urb
Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
scsi: mpt3sas: Don't change DMA mask while reallocating pools
scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
scsi: mpt3sas: Remove usage of dma_get_required_mask() API
malidp: Fix NULL vs IS_ERR() checking
usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
Linux 5.10.173
Change-Id: Iedcbc093feb171d48c70976d0aa99e972fac3ad1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Srinivasarao Pathipati
|
ea066b15fa |
Merge keystone/android12-5.10-keystone-qcom-release.160+ (d88a616) into msm-5.10
* refs/heads/tmp-d88a616:
ANDROID: mm/filemap: Fix missing put_page() for speculative page fault
UPSTREAM: io_uring: ensure that io_init_req() passes in the right issue_flags
UPSTREAM: io_uring: ensure that io_init_req() passes in the right issue_flags
UPSTREAM: io_uring: add missing lock in io_get_file_fixed
UPSTREAM: io_uring: add missing lock in io_get_file_fixed
ANDROID: ABI: Update allowed list for QCOM
BACKPORT: iommu: Avoid races around device probe
UPSTREAM: io_uring/rw: remove leftover debug statement
UPSTREAM: io_uring/rw: ensure kiocb_end_write() is always called
UPSTREAM: io_uring: fix double poll leak on repolling
UPSTREAM: io_uring: Clean up a false-positive warning from GCC 9.3.0
UPSTREAM: io_uring/net: fix fast_iov assignment in io_setup_async_msg()
UPSTREAM: io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
UPSTREAM: io_uring/rw: defer fsnotify calls to task context
UPSTREAM: io_uring: do not recalculate ppos unnecessarily
UPSTREAM: io_uring: update kiocb->ki_pos at execution time
UPSTREAM: io_uring: remove duplicated calls to io_kiocb_ppos
UPSTREAM: io_uring: ensure that cached task references are always put on exit
UPSTREAM: io_uring: fix CQ waiting timeout handling
UPSTREAM: io_uring: lock overflowing for IOPOLL
UPSTREAM: io_uring: check for valid register opcode earlier
UPSTREAM: io_uring: fix async accept on O_NONBLOCK sockets
UPSTREAM: io_uring: allow re-poll if we made progress
UPSTREAM: io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
UPSTREAM: io_uring: add flag for disabling provided buffer recycling
UPSTREAM: io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
UPSTREAM: io_uring: improve send/recv error handling
UPSTREAM: io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
UPSTREAM: io_uring/io-wq: only free worker if it was allocated for creation
UPSTREAM: io_uring/io-wq: free worker if task_work creation is canceled
UPSTREAM: io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
ANDROID: GKI: Enable ARM64_ERRATUM_2454944
ANDROID: dma-ops: Add restricted vendor hook
ANDROID: arm64: Work around Cortex-A510 erratum 2454944
ANDROID: mm/vmalloc: Add override for lazy vunmap
ANDROID: cpuidle-psci: Fix suspicious RCU usage
ANDROID: ABI: update allowed list for galaxy
FROMGIT: f2fs: add sysfs nodes to set last_age_weight
FROMGIT: f2fs: fix wrong calculation of block age
ANDROID: struct io_uring ABI preservation hack for 5.10.162 changes
ANDROID: fix up struct task_struct ABI change in 5.10.162
ANDROID: add flags variable back to struct proto_ops
UPSTREAM: io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups
UPSTREAM: eventfd: provide a eventfd_signal_mask() helper
UPSTREAM: eventpoll: add EPOLL_URING_WAKE poll wakeup flag
UPSTREAM: Revert "proc: don't allow async path resolution of /proc/self components"
UPSTREAM: Revert "proc: don't allow async path resolution of /proc/thread-self components"
UPSTREAM: net: remove cmsg restriction from io_uring based send/recvmsg calls
UPSTREAM: task_work: unconditionally run task_work from get_signal()
UPSTREAM: signal: kill JOBCTL_TASK_WORK
UPSTREAM: io_uring: import 5.15-stable io_uring
UPSTREAM: task_work: add helper for more targeted task_work canceling
UPSTREAM: kernel: don't call do_exit() for PF_IO_WORKER threads
UPSTREAM: kernel: stop masking signals in create_io_thread()
UPSTREAM: x86/process: setup io_threads more like normal user space threads
UPSTREAM: arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
UPSTREAM: arch: setup PF_IO_WORKER threads like PF_KTHREAD
UPSTREAM: entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set
UPSTREAM: kernel: allow fork with TIF_NOTIFY_SIGNAL pending
UPSTREAM: coredump: Limit what can interrupt coredumps
UPSTREAM: kernel: remove checking for TIF_NOTIFY_SIGNAL
UPSTREAM: task_work: remove legacy TWA_SIGNAL path
UPSTREAM: alpha: fix TIF_NOTIFY_SIGNAL handling
UPSTREAM: ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling
UPSTREAM: ia64: don't call handle_signal() unless there's actually a signal queued
UPSTREAM: sparc: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: riscv: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: nds32: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: ia64: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: h8300: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: c6x: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: alpha: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: xtensa: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: arm: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: microblaze: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: hexagon: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: csky: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: openrisc: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: sh: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: um: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: s390: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: mips: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: powerpc: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: parisc: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: nios32: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: m68k: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: arm64: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: arc: add support for TIF_NOTIFY_SIGNAL
UPSTREAM: x86: Wire up TIF_NOTIFY_SIGNAL
UPSTREAM: task_work: Use TIF_NOTIFY_SIGNAL if available
UPSTREAM: entry: Add support for TIF_NOTIFY_SIGNAL
UPSTREAM: fs: provide locked helper variant of close_fd_get_file()
UPSTREAM: file: Rename __close_fd_get_file close_fd_get_file
UPSTREAM: fs: make do_renameat2() take struct filename
UPSTREAM: signal: Add task_sigpending() helper
UPSTREAM: net: add accept helper not installing fd
UPSTREAM: net: provide __sys_shutdown_sock() that takes a socket
UPSTREAM: tools headers UAPI: Sync openat2.h with the kernel sources
UPSTREAM: fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
UPSTREAM: Make sure nd->path.mnt and nd->path.dentry are always valid pointers
UPSTREAM: fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
UPSTREAM: fs: add support for LOOKUP_CACHED
UPSTREAM: saner calling conventions for unlazy_child()
UPSTREAM: iov_iter: add helper to save iov_iter state
UPSTREAM: kernel: provide create_io_thread() helper
UPSTREAM: net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
UPSTREAM: Bluetooth: L2CAP: Fix u8 overflow
UPSTREAM: HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk
UPSTREAM: HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10
UPSTREAM: HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E
UPSTREAM: HID: ite: Add support for Acer S1002 keyboard-dock
UPSTREAM: igb: Initialize mailbox message for VF reset
UPSTREAM: xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
UPSTREAM: USB: serial: f81534: fix division by zero on line-speed change
UPSTREAM: USB: serial: f81232: fix division by zero on line-speed change
UPSTREAM: USB: serial: cp210x: add Kamstrup RF sniffer PIDs
UPSTREAM: USB: serial: option: add Quectel EM05-G modem
UPSTREAM: usb: gadget: uvc: Prevent buffer overflow in setup handler
BACKPORT: f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED
BACKPORT: f2fs: handle decompress only post processing in softirq
BACKPORT: f2fs: introduce memory mode
BACKPORT: f2fs: allow compression for mmap files in compress_mode=user
UPSTREAM: iommu/iova: Fix alloc iova overflows issue
UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing
ANDROID: GKI: Add Tuxera symbol list
UPSTREAM: usb: dwc3: gadget: Skip waiting for CMDACT cleared during endxfer
UPSTREAM: usb: dwc3: Increase DWC3 controller halt timeout
UPSTREAM: usb: dwc3: Remove DWC3 locking during gadget suspend/resume
UPSTREAM: usb: dwc3: Avoid unmapping USB requests if endxfer is not complete
UPSTREAM: usb: dwc3: gadget: Continue handling EP0 xfercomplete events
UPSTREAM: usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect
UPSTREAM: usb: dwc3: gadget: Force sending delayed status during soft disconnect
UPSTREAM: usb: dwc3: Do not service EP0 and conndone events if soft disconnected
UPSTREAM: efi: rt-wrapper: Add missing include
UPSTREAM: arm64: efi: Execute runtime services from a dedicated stack
ANDROID: cpu: correct dl_cpu_busy() calls
UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
UPSTREAM: firmware: tegra: Reduce stack usage
UPSTREAM: scsi: bfa: Move a large struct from the stack onto the heap
ANDROID: mm: page_pinner: ensure do_div() arguments matches with respect to type
ANDROID: Revert "ANDROID: allmodconfig: disable WERROR"
FROMGIT: scsi: ufs: Modify Tactive time setting conditions
UPSTREAM: remoteproc: core: Fix rproc->firmware free in rproc_set_firmware()
UPSTREAM: usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdev
UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT mode
ANDROID: GKI: add symbol list file for honor
ANDROID: add TEST_MAPPING for net/, include/net
BACKPORT: arm64/bpf: Remove 128MB limit for BPF JIT programs
ANDROID: usb: f_accessory: Check buffer size when initialised via composite
BACKPORT: mm: make minimum slab alignment a runtime property
BACKPORT: printk: stop including cache.h from printk.h
UPSTREAM: kasan: fix a missing header include of static_keys.h
BACKPORT: kasan: split kasan_*enabled() functions into a separate header
UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
UPSTREAM: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
UPSTREAM: usb: dwc3: gadget: conditionally remove requests
UPSTREAM: usb: dwc3: ep0: Properly handle setup_packet_pending scenario in data stage
UPSTREAM: usb: dwc3: gadget: Fix IN endpoint max packet size allocation
UPSTREAM: usb: dwc3: gadget: Delay issuing End Transfer
UPSTREAM: usb: dwc3: gadget: Only End Transfer for ep0 data phase
UPSTREAM: usb: dwc3: ep0: Don't prepare beyond Setup stage
UPSTREAM: usb: dwc3: gadget: move cmd_endtransfer to extra function
UPSTREAM: usb: dwc3: gadget: ep_queue simplify isoc start condition
UPSTREAM: usb: dwc3: gadget: Skip reading GEVNTSIZn
UPSTREAM: usb: dwc3: gadget: Ignore Update Transfer cmd params
UPSTREAM: usb: dwc3: gadget: Skip checking Update Transfer status
UPSTREAM: pstore: Properly assign mem_type property
Linux 5.10.160
ASoC: ops: Correct bounds check for second channel on SX controls
nvme-pci: clear the prp2 field when not used
ASoC: cs42l51: Correct PGA Volume minimum value
can: mcba_usb: Fix termination command argument
can: sja1000: fix size of OCR_MODE_MASK define
pinctrl: meditatek: Startup with the IRQs disabled
libbpf: Use page size as max_entries when probing ring buffer map
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
ASoC: fsl_micfil: explicitly clear CHnF flags
ASoC: fsl_micfil: explicitly clear software reset bit
io_uring: add missing item types for splice request
fuse: always revalidate if exclusive create
nfp: fix use-after-free in area_cache_get()
vfs: fix copy_file_range() averts filesystem freeze protection
vfs: fix copy_file_range() regression in cross-fs copies
x86/smpboot: Move rcu_cpu_starting() earlier
ANDROID: usb: gadget: uvc: remove duplicate code in unbind
Linux 5.10.159
can: esd_usb: Allow REC and TEC to return to zero
macsec: add missing attribute validation for offload
net: mvneta: Fix an out of bounds check
ipv6: avoid use-after-free in ip6_fragment()
net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
xen/netback: fix build warning
ethernet: aeroflex: fix potential skb leak in greth_init_rings()
tipc: call tipc_lxc_xmit without holding node_read_lock
net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
ipv4: Fix incorrect route flushing when table ID 0 is used
ipv4: Fix incorrect route flushing when source address is deleted
tipc: Fix potential OOB in tipc_link_proto_rcv()
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
ip_gre: do not report erspan version on GRE interface
net: stmmac: fix "snps,axi-config" node property parsing
nvme initialize core quirks before calling nvme_init_subsystem
NFC: nci: Bounds check struct nfc_target arrays
i40e: Disallow ip4 and ip6 l4_4_bytes
i40e: Fix for VF MAC address 0
i40e: Fix not setting default xps_cpus after reset
net: mvneta: Prevent out of bounds read in mvneta_config_rss()
xen-netfront: Fix NULL sring after live migration
net: encx24j600: Fix invalid logic in reading of MISTAT register
net: encx24j600: Add parentheses to fix precedence
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
net: dsa: ksz: Check return value
Bluetooth: Fix not cleanup led when bt_init fails
Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
vmxnet3: correctly report encapsulated LRO packet
af_unix: Get user_ns from in_skb in unix_diag_get_exact().
drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420
igb: Allocate MSI-X vector when testing
e1000e: Fix TX dispatch condition
gpio: amd8111: Fix PCI device reference count leak
drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
ca8210: Fix crash by zero initializing data
ieee802154: cc2520: Fix error return code in cc2520_hw_init()
netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
rtc: mc146818-lib: fix signedness bug in mc146818_get_time()
rtc: mc146818-lib: fix locking in mc146818_set_time
rtc: cmos: Disable irq around direct invocation of cmos_interrupt()
mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
can: af_can: fix NULL pointer dereference in can_rcv_filter
HID: core: fix shift-out-of-bounds in hid_report_raw_event
HID: hid-lg4ff: Add check for empty lbuf
HID: usbhid: Add ALWAYS_POLL quirk for some mice
drm/shmem-helper: Avoid vm_open error paths
drm/shmem-helper: Remove errant put in error path
drm/vmwgfx: Don't use screen objects when SEV is active
KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
Bluetooth: Fix crash when replugging CSR fake controllers
Bluetooth: btusb: Add debug message for CSR controllers
mm/gup: fix gup_pud_range() for dax
memcg: fix possible use-after-free in memcg_write_event_control()
media: v4l2-dv-timings.c: fix too strict blanking sanity checks
Revert "ARM: dts: imx7: Fix NAND controller size-cells"
media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
xen/netback: don't call kfree_skb() with interrupts disabled
xen/netback: do some code cleanup
xen/netback: Ensure protocol headers don't fall in the non-linear area
rtc: mc146818: Reduce spinlock section in mc146818_set_time()
rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ
rtc: cmos: avoid UIP when reading alarm time
rtc: cmos: avoid UIP when writing alarm time
rtc: mc146818-lib: extract mc146818_avoid_UIP
rtc: mc146818-lib: fix RTC presence check
rtc: Check return value from mc146818_get_time()
rtc: mc146818-lib: change return values of mc146818_get_time()
rtc: cmos: remove stale REVISIT comments
rtc: mc146818: Dont test for bit 0-5 in Register D
rtc: mc146818: Detect and handle broken RTCs
rtc: mc146818: Prevent reading garbage
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
mm/khugepaged: fix GUP-fast interaction by sending IPI
mm/khugepaged: take the right locks for page table retraction
net: usb: qmi_wwan: add u-blox 0x1342 composition
9p/xen: check logical size for buffer size
usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer
fbcon: Use kzalloc() in fbcon_prepare_logo()
regulator: twl6030: fix get status of twl6032 regulators
ASoC: soc-pcm: Add NULL check in BE reparenting
btrfs: send: avoid unaligned encoded writes when attempting to clone range
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
regulator: slg51000: Wait after asserting CS pin
9p/fd: Use P9_HDRSZ for header size
ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
arm64: dts: rockchip: fix ir-receiver node names
ARM: dts: rockchip: fix ir-receiver node names
arm: dts: rockchip: fix node name for hym8563 rtc
arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
Revert "mmc: sdhci: Fix voltage switch delay"
ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION
Linux 5.10.158
ipc/sem: Fix dangling sem_array access in semtimedop race
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
proc: proc_skip_spaces() shouldn't think it is working on C strings
proc: avoid integer type confusion in get_proc_long
block: unhash blkdev part inode when the part is deleted
Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
char: tpm: Protect tpm_pm_suspend with locks
Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
ACPI: HMAT: Fix initiator registration for single-initiator systems
ACPI: HMAT: remove unnecessary variable initialization
i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
i2c: npcm7xx: Fix error handling in npcm_i2c_init()
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/tsx: Add a feature bit for TSX control MSR support
Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
ipv4: Fix route deletion when nexthop info is not specified
ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
selftests: net: fix nexthop warning cleanup double ip typo
selftests: net: add delete nexthop route warning test
Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
parisc: Increase FRAME_WARN to 2048 bytes on parisc
xtensa: increase size of gcc stack frame check
parisc: Increase size of gcc stack frame check
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
pinctrl: single: Fix potential division by zero
ASoC: ops: Fix bounds check for _sx controls
io_uring: don't hold uring_lock when calling io_run_task_work*
tracing: Free buffers when a used dynamic event is removed
drm/i915: Never return 0 if not all requests retired
drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
mmc: sdhci: Fix voltage switch delay
mmc: sdhci-sprd: Fix no reset data and command after voltage switch
mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
mmc: core: Fix ambiguous TRIM and DISCARD arg
mmc: mmc_test: Fix removal of debugfs file
net: stmmac: Set MAC's flow control register to reflect current settings
pinctrl: intel: Save and restore pins in "direct IRQ" mode
x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
error-injection: Add prompt for function error injection
riscv: vdso: fix section overlapping under some conditions
net/mlx5: DR, Fix uninitialized var warning
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
hwmon: (coretemp) Check for null before removing sysfs attrs
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
sctp: fix memory leak in sctp_stream_outq_migrate()
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
net: tun: Fix use-after-free in tun_detach()
afs: Fix fileserver probe RTT handling
net: hsr: Fix potential use-after-free
tipc: re-fetch skb cb after tipc_msg_validate
dsa: lan9303: Correct stat name
net: ethernet: nixge: fix NULL dereference
net/9p: Fix a potential socket leak in p9_socket_open
net: net_netdev: Fix error handling in ntb_netdev_init_module()
net: phy: fix null-ptr-deref while probe() failed
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
wifi: cfg80211: don't allow multi-BSSID in S1G
wifi: cfg80211: fix buffer overflow in elem comparison
aquantia: Do not purge addresses when setting the number of rings
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
net/mlx5e: Fix use-after-free when reverting termination table
net/mlx5: Fix uninitialized variable bug in outlen_write()
e100: Fix possible use after free in e100_xmit_prepare
e100: switch from 'pci_' to 'dma_' API
iavf: Fix error handling in iavf_init_module()
iavf: remove redundant ret variable
fm10k: Fix error handling in fm10k_init_module()
i40e: Fix error handling in i40e_init_module()
ixgbevf: Fix resource leak in ixgbevf_init_module()
of: property: decrement node refcount in of_fwnode_get_reference_args()
bpf: Do not copy spin lock field from user in bpf_selem_alloc
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
hwmon: (i5500_temp) fix missing pci_disable_device()
hwmon: (ina3221) Fix shunt sum critical calculation
hwmon: (ltc2947) fix temperature scaling
libbpf: Handle size overflow for ringbuf mmap
ARM: at91: rm9200: fix usb device clock id
scripts/faddr2line: Fix regression in name resolution on ppc64le
bpf, perf: Use subprog name when reporting subprog ksymbol
iio: light: rpr0521: add missing Kconfig dependencies
iio: health:
|
||
Yin Fengwei
|
ed77831e69 |
mm/thp: check and bail out if page in deferred queue already
commit 81e506bec9be1eceaf5a2c654e28ba5176ef48d8 upstream. Kernel build regression with LLVM was reported here: https://lore.kernel.org/all/Y1GCYXGtEVZbcv%2F5@dev-arch.thelio-3990X/ with commit f35b5d7d676e ("mm: align larger anonymous mappings on THP boundaries"). And the commit f35b5d7d676e was reverted. It turned out the regression is related with madvise(MADV_DONTNEED) was used by ld.lld. But with none PMD_SIZE aligned parameter len. trace-bpfcc captured: 531607 531732 ld.lld do_madvise.part.0 start: 0x7feca9000000, len: 0x7fb000, behavior: 0x4 531607 531793 ld.lld do_madvise.part.0 start: 0x7fec86a00000, len: 0x7fb000, behavior: 0x4 If the underneath physical page is THP, the madvise(MADV_DONTNEED) can trigger split_queue_lock contention raised significantly. perf showed following data: 14.85% 0.00% ld.lld [kernel.kallsyms] [k] entry_SYSCALL_64_after_hwframe 11.52% entry_SYSCALL_64_after_hwframe do_syscall_64 __x64_sys_madvise do_madvise.part.0 zap_page_range unmap_single_vma unmap_page_range page_remove_rmap deferred_split_huge_page __lock_text_start native_queued_spin_lock_slowpath If THP can't be removed from rmap as whole THP, partial THP will be removed from rmap by removing sub-pages from rmap. Even the THP head page is added to deferred queue already, the split_queue_lock will be acquired and check whether the THP head page is in the queue already. Thus, the contention of split_queue_lock is raised. Before acquire split_queue_lock, check and bail out early if the THP head page is in the queue already. The checking without holding split_queue_lock could race with deferred_split_scan, but it doesn't impact the correctness here. Test result of building kernel with ld.lld: commit 7b5a0b664ebe (parent commit of f35b5d7d676e): time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all 6:07.99 real, 26367.77 user, 5063.35 sys commit f35b5d7d676e: time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all 7:22.15 real, 26235.03 user, 12504.55 sys commit f35b5d7d676e with the fixing patch: time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all 6:08.49 real, 26520.15 user, 5047.91 sys Link: https://lkml.kernel.org/r/20221223135207.2275317-1-fengwei.yin@intel.com Signed-off-by: Yin Fengwei <fengwei.yin@intel.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Acked-by: David Rientjes <rientjes@google.com> Reviewed-by: "Huang, Ying" <ying.huang@intel.com> Cc: Feng Tang <feng.tang@intel.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Rik van Riel <riel@surriel.com> Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com> Cc: Yang Shi <shy828301@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Johannes Weiner
|
e6d20325f4 |
mm: memcontrol: deprecate charge moving
commit da34a8484d162585e22ed8c1e4114aa2f60e3567 upstream. Charge moving mode in cgroup1 allows memory to follow tasks as they migrate between cgroups. This is, and always has been, a questionable thing to do - for several reasons. First, it's expensive. Pages need to be identified, locked and isolated from various MM operations, and reassigned, one by one. Second, it's unreliable. Once pages are charged to a cgroup, there isn't always a clear owner task anymore. Cache isn't moved at all, for example. Mapped memory is moved - but if trylocking or isolating a page fails, it's arbitrarily left behind. Frequent moving between domains may leave a task's memory scattered all over the place. Third, it isn't really needed. Launcher tasks can kick off workload tasks directly in their target cgroup. Using dedicated per-workload groups allows fine-grained policy adjustments - no need to move tasks and their physical pages between control domains. The feature was never forward-ported to cgroup2, and it hasn't been missed. Despite it being a niche usecase, the maintenance overhead of supporting it is enormous. Because pages are moved while they are live and subject to various MM operations, the synchronization rules are complicated. There are lock_page_memcg() in MM and FS code, which non-cgroup people don't understand. In some cases we've been able to shift code and cgroup API calls around such that we can rely on native locking as much as possible. But that's fragile, and sometimes we need to hold MM locks for longer than we otherwise would (pte lock e.g.). Mark the feature deprecated. Hopefully we can remove it soon. And backport into -stable kernels so that people who develop against earlier kernels are warned about this deprecation as early as possible. [akpm@linux-foundation.org: fix memory.rst underlining] Link: https://lkml.kernel.org/r/Y5COd+qXwk/S+n8N@cmpxchg.org Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Acked-by: Shakeel Butt <shakeelb@google.com> Acked-by: Hugh Dickins <hughd@google.com> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
deyaoren@google.com
|
935aa170ab |
Merge remote-tracking branch into HEAD
* keystone/mirror-android12-5.10-2023-02: (1475 commits) ANDROID: mm/filemap: Fix missing put_page() for speculative page fault UPSTREAM: io_uring: ensure that io_init_req() passes in the right issue_flags UPSTREAM: io_uring: add missing lock in io_get_file_fixed ANDROID: ABI: Update allowed list for QCOM BACKPORT: iommu: Avoid races around device probe UPSTREAM: io_uring/rw: remove leftover debug statement UPSTREAM: io_uring/rw: ensure kiocb_end_write() is always called UPSTREAM: io_uring: fix double poll leak on repolling UPSTREAM: io_uring: Clean up a false-positive warning from GCC 9.3.0 UPSTREAM: io_uring/net: fix fast_iov assignment in io_setup_async_msg() UPSTREAM: io_uring: io_kiocb_update_pos() should not touch file for non -1 offset UPSTREAM: io_uring/rw: defer fsnotify calls to task context UPSTREAM: io_uring: do not recalculate ppos unnecessarily UPSTREAM: io_uring: update kiocb->ki_pos at execution time UPSTREAM: io_uring: remove duplicated calls to io_kiocb_ppos UPSTREAM: io_uring: ensure that cached task references are always put on exit UPSTREAM: io_uring: fix CQ waiting timeout handling UPSTREAM: io_uring: lock overflowing for IOPOLL UPSTREAM: io_uring: check for valid register opcode earlier UPSTREAM: io_uring: fix async accept on O_NONBLOCK sockets ... Change-Id: I06183d86fc02e3434a4a9d2a5da89986743842b5 |
||
Patrick Daly
|
52836ddd51 |
ANDROID: mm/filemap: Fix missing put_page() for speculative page fault
find_get_page() returns a page with increased refcount, assuming a page exists at the given index. Ensure this refcount is dropped on error. Bug: 271079833 Bug: 271204963 Fixes: |
||
Sivasri Kumar, Vanka
|
ab0dd5020b |
Merge keystone/android12-5.10-keystone-qcom-release.149+ (d7eb21e) into msm-5.10
* refs/heads/tmp-d7eb21e: ANDROID: mm/filemap: Fix missing put_page() for speculative page fault Change-Id: I6cff35f18c8f1e6d1178113c39e67be9ba624119 Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com> Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com> |
||
keystone-kernel-automerger
|
7bd470d3ac |
Merge remote-tracking branch into HEAD
* keystone/mirror-android12-5.10-2023-01: ANDROID: mm/filemap: Fix missing put_page() for speculative page fault Change-Id: I2d83005b0d62aa437f66ecaf4e57b9fa9a1e5601 Signed-off-by: keystone-kernel-automerger <keystone-kernel-automerger@google.com> |
||
|
Patrick Daly
|
3fc09c682a |
ANDROID: mm/filemap: Fix missing put_page() for speculative page fault
find_get_page() returns a page with increased refcount, assuming a page exists at the given index. Ensure this refcount is dropped on error. Bug: 271079833 Bug: 271204963 Fixes: |
||
|
Patrick Daly
|
1d05213028 |
ANDROID: mm/filemap: Fix missing put_page() for speculative page fault
find_get_page() returns a page with increased refcount, assuming a page
exists at the given index. Ensure this refcount is dropped on error.
Bug: 271079833
Fixes:
|
||
|
Greg Kroah-Hartman
|
0caf8151c2 |
This is the 5.10.169 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmP2AtsACgkQONu9yGCS aT6Pow/+MC7snhMqMZKWujfijbaP4PZm2WsfkTxpiTECg50axy+TJ0mtRzvrtDXt DyMec3IW121OeCItZ48W8lA17Efd5CAzZd58PxwWygfxSQ6livsr2mxAoWSOfk+5 Bc1IJnKlpxWVovC8TswZuWFsatF5C0+xL5qzw0udY6bMLgKgAl7SIFykeEX3jibW Zjg7DSdFeSy7iDSSc2wu0MG6yM35y4PMnO7rYFzNRaTDpESJfm9ew+NGBLT9E6Ao 8oIP2bBGCt83W7GZx6IpcrqtkP+SkrnLZ7NUTvfQQnwcYReZnXYShXRyirSbmjkQ OVziXOwRA3IGyvNQVMAef8vySbNwcTaUArKw4Lc3MhE0mT1wjpyNkF3Qyq9NvDsW x3wPXd/cIGZHBMKqxAndXdjZEKf/E5WzAxpDBm6H9U6EBqy7xRWylH1RwTUEYnPM 7yqEEE2qlI/PTL5q+sJbzNhTI+XzhQvAkCuPs0APr1B5nqAV3Duo/PhRMg52S4Tq HGEZDuPzektLljqpON9IO+4g0aLLOodJccWwEghZIcWX2N5zQ69TI0stUzq3OLiJ iDU+feOr0JWQ59OK6JdVpL3LvcDJ8vUs9Fm57crSSi1lt5nqE0fKS5GbNtraKpcs yPFwBoqiiN7Q/oi9dV3SjBuVWId6FUGcq5rD5nKNWdPzdHGo/44= =KOqD -----END PGP SIGNATURE----- Merge 5.10.169 into android12-5.10-lts Changes in 5.10.169 ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers selftests/bpf: Verify copy_register_state() preserves parent/live fields ALSA: hda: Do not unset preset when cleaning up codec ASoC: cs42l56: fix DT probe tools/virtio: fix the vringh test for virtio ring changes net/rose: Fix to not accept on connected socket net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC net: sched: sch: Bounds check priority s390/decompressor: specify __decompress() buf len to avoid overflow nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match nvmem: core: add error handling for dev_set_name nvmem: core: remove nvmem_config wp_gpio nvmem: core: fix cleanup after dev_set_name() nvmem: core: fix registration vs use race aio: fix mremap after fork null-deref s390/signal: fix endless loop in do_signal ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() netfilter: nft_tproxy: restrict to prerouting hook mmc: jz4740: Work around bug on JZ4760(B) mmc: sdio: fix possible resource leaks in some error paths mmc: mmc_spi: fix error handling in mmc_spi_probe() ALSA: hda/conexant: add a new hda codec SN6180 ALSA: hda/realtek - fixed wrong gpio assigned sched/psi: Fix use-after-free in ep_remove_wait_queue() hugetlb: check for undefined shift on 32 bit architectures Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." net: Fix unwanted sign extension in netdev_stats_to_stats64() revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" ixgbe: allow to increase MTU to 3K with XDP enabled i40e: add double of VLAN header when computing the max MTU net: bgmac: fix BCM5358 support by setting correct flags sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list net/sched: tcindex: update imperfect hash filters respecting rcu dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence bnxt_en: Fix mqprio and XDP ring checking logic net: stmmac: Restrict warning on disabling DMA store and fwd mode net: mpls: fix stale pointer if allocation fails during device rename ixgbe: add double of VLAN header when computing the max MTU ipv6: Fix datagram socket connection with DSCP. ipv6: Fix tcp socket connection with DSCP. nilfs2: fix underflow in second superblock position calculations drm/i915/gen11: Moving WAs to icl_gt_workarounds_init() drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list flow_offload: fill flags to action structure net/sched: act_ctinfo: use percpu stats i40e: Add checking for null for nlmsg_find_attr() net/sched: tcindex: search key must be 16 bits kvm: initialize all of the kvm_debugregs structure before sending it to userspace alarmtimer: Prevent starvation by small intervals and SIG_IGN ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak net: sched: sch: Fix off by one in htb_activate_prios() nvmem: core: fix return value Linux 5.10.169 Change-Id: Id846e3a42e381eb9bc554ffb5ab1390343b72287 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Aaron Thompson
|
1933be146c |
Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."
commit 647037adcad00f2bab8828d3d41cd0553d41f3bd upstream.
This reverts commit 115d9d77bb0f9152c60b6e8646369fa7f6167593.
The pages being freed by memblock_free_late() have already been
initialized, but if they are in the deferred init range,
__free_one_page() might access nearby uninitialized pages when trying to
coalesce buddies. This can, for example, trigger this BUG:
BUG: unable to handle page fault for address: ffffe964c02580c8
RIP: 0010:__list_del_entry_valid+0x3f/0x70
<TASK>
__free_one_page+0x139/0x410
__free_pages_ok+0x21d/0x450
memblock_free_late+0x8c/0xb9
efi_free_boot_services+0x16b/0x25c
efi_enter_virtual_mode+0x403/0x446
start_kernel+0x678/0x714
secondary_startup_64_no_verify+0xd2/0xdb
</TASK>
A proper fix will be more involved so revert this change for the time
being.
Fixes: 115d9d77bb0f ("mm: Always release pages to the buddy allocator in memblock_free_late().")
Signed-off-by: Aaron Thompson <dev@aaront.org>
Link: https://lore.kernel.org/r/20230207082151.1303-1-dev@aaront.org
Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
570621d64f |
Merge 5.10.168 into android12-5.10-lts
Changes in 5.10.168 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() bpf: Fix incorrect state pruning for <8B spill/fill powerpc/imc-pmu: Revert nest_init_lock to being a mutex bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() bpf: Support <8-byte scalar spill and refill bpf: Fix to preserve reg parent/live fields when copying range info bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX drm/vc4: hdmi: make CEC adapter name unique scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" vhost/net: Clear the pending messages when the backend is removed WRITE is "data source", not destination... READ is "data destination", not source... fix iov_iter_bvec() "direction" argument fix "direction" argument of iov_iter_kvec() virtio-net: execute xdp_do_flush() before napi_complete_done() sfc: correctly advertise tunneled IPv6 segmentation net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices netrom: Fix use-after-free caused by accept on already connected socket netfilter: br_netfilter: disable sabotage_in hook after first suppression squashfs: harden sanity check in squashfs_read_xattr_id_table net: phy: meson-gxl: Add generic dummy stubs for MMD register access igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ata: libata: Fix sata_down_spd_limit() when no link speed is reported selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking virtio-net: Keep stop() to follow mirror sequence of open() net: openvswitch: fix flow memory leak in ovs_flow_cmd_new efi: fix potential NULL deref in efi_mem_reserve_persistent qede: add netpoll support for qede driver qede: execute xdp_do_flush() before napi_complete_done() i2c: mxs: suppress probe-deferral error message scsi: target: core: Fix warning on RT kernels scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress i2c: rk3x: fix a bunch of kernel-doc warnings platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table net/x25: Fix to not accept on connected socket iio: adc: stm32-dfsdm: fill module aliases usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Input: i8042 - move __initconst to fix code styling warning Input: i8042 - merge quirk tables Input: i8042 - add TUXEDO devices to i8042 quirk tables Input: i8042 - add Clevo PCX0DX to i8042 quirk table fbcon: Check font dimension limits net: qrtr: free memory on error path in radix_tree_insert() watchdog: diag288_wdt: do not use stack buffers for hardware data watchdog: diag288_wdt: fix __diag288() inline assembly ALSA: hda/realtek: Add Acer Predator PH315-54 efi: Accept version 2 of memory attributes table iio: hid: fix the retval in accel_3d_capture_sample iio: adc: berlin2-adc: Add missing of_node_put() in error path iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix incorrect ODR mode readback iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix MAGN sensor scale and unit nvmem: qcom-spmi-sdam: fix module autoloading parisc: Fix return code of pdc_iodc_print() parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case riscv: disable generation of unwind tables mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm/swapfile: add cond_resched() in get_swap_pages() Squashfs: fix handling and sanity checking of xattr_ids count drm/i915: Fix potential bit_17 double-free nvmem: core: initialise nvmem->id early nvmem: core: fix cell removal on error serial: 8250_dma: Fix DMA Rx completion race serial: 8250_dma: Fix DMA Rx rearm race fbdev: smscufx: fix error handling code in ufx_usb_probe f2fs: fix to do sanity check on i_extra_isize in is_alive() wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property bpf: Do not reject when the stack read size is different from the tracked scalar size iio:adc:twl6030: Enable measurement of VAC mm/migration: return errno when isolate_huge_page failed migrate: hugetlb: check for hugetlb shared PMD in node migration btrfs: limit device extents to the device size btrfs: zlib: zero-initialize zlib workspace ALSA: hda/realtek: Add Positivo N14KP6-TG ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw of/address: Return an error when no valid dma-ranges are found can: j1939: do not wait 250 ms if the same addr was already claimed xfrm: compat: change expression for switch in xfrm_xlate64 IB/hfi1: Restore allocated resources on failed copyout xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() IB/IPoIB: Fix legacy IPoIB due to wrong number of queues RDMA/usnic: use iommu_map_atomic() under spin_lock() xfrm: fix bug with DSCP copy to v6 from v4 tunnel bonding: fix error checking in bond_debug_reregister() net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY ionic: clean interrupt before enabling queue to avoid credit race uapi: add missing ip/ipv6 header dependencies for linux/stddef.h ice: Do not use WQ_MEM_RECLAIM flag for workqueue net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" net/mlx5e: IPoIB, Show unknown speed instead of error net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers net/mlx5: fw_tracer, Zero consumer index when reloading the tracer rds: rds_rm_zerocopy_callback() use list_first_entry() selftests: forwarding: lib: quote the sysctl values ALSA: pci: lx6464es: fix a debug loop pinctrl: aspeed: Fix confusing types in return value pinctrl: single: fix potential NULL dereference spi: dw: Fix wrong FIFO level setting for long xfers pinctrl: intel: Restore the pins that used to be in Direct IRQ mode cifs: Fix use-after-free in rdata->read_into_pages() net: USB: Fix wrong-direction WARNING in plusb.c btrfs: free device in btrfs_close_devices for a single device filesystem usb: core: add quirk for Alcor Link AK9563 smartcard reader usb: typec: altmodes/displayport: Fix probe pin assign check ceph: flush cap releases when the session is flushed riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive Fix page corruption caused by racy check in __free_pages Linux 5.10.168 Change-Id: I98d1e73edfaab3ce45c15283ae0964527d5e547e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
0ddb73d446 |
Merge 5.10.166 into android12-5.10-lts
Changes in 5.10.166 clk: generalize devm_clk_get() a bit clk: Provide new devm_clk helpers for prepared and enabled clocks memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux ARM: imx: add missing of_node_put() HID: intel_ish-hid: Add check for ishtp_dma_tx_map EDAC/highbank: Fix memory leak in highbank_mc_probe() firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Harden shared memory access in fetch_notification tomoyo: fix broken dependency on *.conf.default RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Remove user expected buffer invalidate race affs: initialize fsdata in affs_truncate() PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() phy: ti: fix Kconfig warning and operator precedence ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid net/sched: sch_taprio: fix possible use-after-free l2tp: Serialize access to sk_user_data with sk_callback_lock l2tp: Don't sleep and disable BH under writer-side sk_callback_lock l2tp: convert l2tp_tunnel_list to idr l2tp: close all race conditions in l2tp_tunnel_register() net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() HID: revert CHERRY_MOUSE_000C quirk usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding l2tp: prevent lockdep issue in l2tp_tunnel_register() HID: betop: check shape of output reports dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() nvme-pci: fix timeout request state check tcp: avoid the lookup process failing to get sk in ehash table w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array net: dsa: microchip: ksz9477: port map correction in ALU table entry register tcp: fix rate_app_limited to default to 1 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist kcsan: test: don't put the expect array on the stack ASoC: fsl_micfil: Correct the number of steps on SX controls drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK lockref: stop doing cpu_relax in the cmpxchg loop Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state x86: ACPI: cstate: Optimize C3 entry on AMD CPUs fs: reiserfs: remove useless new_opts in reiserfs_remount sysctl: add a new register_sysctl_init() interface kernel/panic: move panic sysctls to its own file panic: unset panic_on_warn inside panic() ubsan: no need to unset panic_on_warn in ubsan_epilogue() kasan: no need to unset panic_on_warn in end_report() exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() ia64: make IA64_MCA_RECOVERY bool instead of tristate panic: Separate sysctl logic from CONFIG_SMP exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Bluetooth: hci_sync: cancel cmd_timer if hci_open failed xhci: Set HCD flag to defer primary roothub registration scsi: hpsa: Fix allocation size for scsi_host_alloc() module: Don't wait for GOING modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect KVM: x86/vmx: Do not skip segment attributes if unusable bit is set thermal: intel: int340x: Protect trip temperature from concurrent updates ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info units: Add Watt units units: Add SI metric prefix definitions i2c: designware: Use DIV_ROUND_CLOSEST() macro i2c: designware: use casting of u64 in clock multiplication to avoid overflow netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope net: ravb: Fix possible hang if RIS2_QFF1 happen thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net/tg3: resolve deadlock in tg3_reset_task() during EEH net: mdio-mux-meson-g12a: force internal PHY off on mux switch tools: gpio: fix -c option of gpio-event-mon Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted Revert "selftests/ftrace: Update synthetic event syntax errors" block: fix and cleanup bio_check_ro x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int clk: Fix pointer casting to prevent oops in devm_clk_release() Linux 5.10.166 Change-Id: Ibf582f7504221c6ee1648da95c49b45e3678708c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
78da590924 |
Merge 5.10.165 into android12-5.10-lts
Changes in 5.10.165
btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
pNFS/filelayout: Fix coalescing test for single DS
selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
tools/virtio: initialize spinlocks in vring_test.c
net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
RDMA/srp: Move large values to a new enum for gcc13
btrfs: always report error in run_one_delayed_ref()
x86/asm: Fix an assembler warning with current binutils
f2fs: let's avoid panic if extent_tree is not created
wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
wifi: mac80211: sdata can be NULL during AMPDU start
Add exception protection processing for vd in axi_chan_handle_err function
zonefs: Detect append writes at invalid locations
nilfs2: fix general protection fault in nilfs_btree_insert()
efi: fix userspace infinite retry read efivars after EFI runtime services page fault
ALSA: hda/realtek - Turn on power early
drm/i915/gt: Reset twice
Bluetooth: hci_qca: Wait for timeout during suspend
Bluetooth: hci_qca: Fix driver shutdown on closed serdev
io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
io_uring: improve send/recv error handling
io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
io_uring: add flag for disabling provided buffer recycling
io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
io_uring: allow re-poll if we made progress
io_uring: fix async accept on O_NONBLOCK sockets
io_uring: check for valid register opcode earlier
io_uring: lock overflowing for IOPOLL
io_uring: fix CQ waiting timeout handling
io_uring: ensure that cached task references are always put on exit
io_uring: remove duplicated calls to io_kiocb_ppos
io_uring: update kiocb->ki_pos at execution time
io_uring: do not recalculate ppos unnecessarily
io_uring/rw: defer fsnotify calls to task context
xhci-pci: set the dma max_seg_size
usb: xhci: Check endpoint is valid before dereferencing it
xhci: Fix null pointer dereference when host dies
xhci: Add update_hub_device override for PCI xHCI hosts
xhci: Add a flag to disable USB3 lpm on a xhci root port level.
usb: acpi: add helper to check port lpm capability using acpi _DSM
xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
prlimit: do_prlimit needs to have a speculation check
USB: serial: option: add Quectel EM05-G (GR) modem
USB: serial: option: add Quectel EM05-G (CS) modem
USB: serial: option: add Quectel EM05-G (RS) modem
USB: serial: option: add Quectel EC200U modem
USB: serial: option: add Quectel EM05CN (SG) modem
USB: serial: option: add Quectel EM05CN modem
staging: vchiq_arm: fix enum vchiq_status return types
USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
misc: fastrpc: Don't remove map on creater_process and device_release
misc: fastrpc: Fix use-after-free race condition for maps
usb: core: hub: disable autosuspend for TI TUSB8041
comedi: adv_pci1760: Fix PWM instruction handling
mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
btrfs: fix race between quota rescan and disable leading to NULL pointer deref
cifs: do not include page data when checking signature
thunderbolt: Use correct function to calculate maximum USB3 link rate
tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
USB: gadgetfs: Fix race between mounting and unmounting
USB: serial: cp210x: add SCALANCE LPE-9000 device id
usb: host: ehci-fsl: Fix module alias
usb: typec: altmodes/displayport: Add pin assignment helper
usb: typec: altmodes/displayport: Fix pin assignment calculation
usb: gadget: g_webcam: Send color matching descriptor per frame
usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
serial: pch_uart: Pass correct sg to dma_unmap_sg()
dmaengine: tegra210-adma: fix global intr clear
serial: atmel: fix incorrect baudrate setup
gsmi: fix null-deref in gsmi_get_variable
mei: me: add meteor lake point M DID
drm/i915: re-disable RC6p on Sandy Bridge
drm/amd/display: Fix set scaling doesn's work
drm/amd/display: Calculate output_color_space after pixel encoding adjustment
drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
arm64: efi: Execute runtime services from a dedicated stack
efi: rt-wrapper: Add missing include
Revert "drm/amdgpu: make display pinning more flexible (v2)"
x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
tracing: Use alignof__(struct {type b;}) instead of offsetof()
io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
io_uring/net: fix fast_iov assignment in io_setup_async_msg()
net/ulp: use consistent error code when blocking ULP
net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
soc: qcom: apr: Make qcom,protection-domain optional again
Bluetooth: hci_qca: Wait for SSR completion during suspend
Bluetooth: hci_qca: check for SSR triggered flag while suspend
Bluetooth: hci_qca: Fixed issue during suspend
mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
io_uring: Clean up a false-positive warning from GCC 9.3.0
io_uring: fix double poll leak on repolling
io_uring/rw: ensure kiocb_end_write() is always called
io_uring/rw: remove leftover debug statement
Linux 5.10.165
Change-Id: Icb91157d9fa1b56cd79eedb8a9cc6118d0705244
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Greg Kroah-Hartman
|
b0d4a37a43 |
This is the 5.10.164 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPHzb8ACgkQONu9yGCS aT5DUxAAvqTdbbizm4D4EV4ZtdE/N0IJ63VhREMdR1Y21hCuvv5V4Zeh0gpGFKKy RljvUXxDXaZjVzJsTPgsmPaEJOrftzZNU1Mq3ucviCXYFl3tWFiJy/FuTaCNCY+r YhvjnZWFjwh+mvHyV3wzFdn41XG2GKxq2vgqUFI9BGCM9tw5T4Z6moLPTvcibt2X yldJ9U76NgxNDVV0IYilQrMjPe3Pm819Z3ZP9S0O6LJEPjmssB6omlFHyLxUcpC+ 8DiRb49Iild6HJsrbqqv0oHMNSiykx+VDMid/vQtTk4HrAL+eD2Ym17yRnlLzots dmuUSdZEpZriH2bCIbNeBDV300x8atLhELtA885wEYj0BKe1QBJMyA0q1PFdKip3 73wPyi/MCVtCxv752O//PaxynUwZaWlQFH1G8Ry2VpSeiK5A7ZiWWkBDTqLhkRJL b0e3crODlZM0ng4nRRMrXZZAw+FKzghVSO8ae/4+q5Y9vyj6iadd7UcwXG4cmZXN ZYXT3+3O7P08dyHW4EL8tD7AmxprP7ccePyKsMu6T7wQPuEgFltaJUDHsGnJ68Jx I+5QzrVED3OTjt9jpYVbYjJ1HjL0jQHxfuBNKCgC34wMzwdlZhHUQVbi0DECk2Qf 40MCrjEsAXJWlX/Rr2bsVeYFSyi4aCI1kckXKxRQznOnFZirA5M= =WjXh -----END PGP SIGNATURE----- Merge 5.10.164 into android12-5.10-lts Changes in 5.10.164 netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx KVM: arm64: Fix S1PTW handling on RO memslots efi: tpm: Avoid READ_ONCE() for accessing the event log docs: Fix the docs build with Sphinx 6.0 perf auxtrace: Fix address filter duplicate symbol selection s390/kexec: fix ipl report address for kdump ASoC: qcom: lpass-cpu: Fix fallback SD line index handling s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() cifs: Fix uninitialized memory read for smb311 posix symlink create drm/msm/adreno: Make adreno quirks not overwrite each other drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe ixgbe: fix pci device refcount leak ipv6: raw: Deduct extension header length in rawv6_push_pending_frames bus: mhi: host: Fix race between channel preparation and M0 event iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options clk: imx8mp: Add DISP2 pixel clock clk: imx8mp: add clkout1/2 support dt-bindings: clocks: imx8mp: Add ID for usb suspend clock clk: imx: imx8mp: add shared clk gate for usb suspend clk xhci: Avoid parsing transfer events several times xhci: get isochronous ring directly from endpoint structure xhci: adjust parameters passed to cleanup_halted_endpoint() xhci: Add xhci_reset_halted_ep() helper function xhci: move xhci_td_cleanup so it can be called by more functions xhci: store TD status in the td struct instead of passing it along xhci: move and rename xhci_cleanup_halted_endpoint() xhci: Prevent infinite loop in transaction errors recovery for streams usb: ulpi: defer ulpi_register on ulpi_read_id timeout ext4: fix uninititialized value in 'ext4_evict_inode' xfrm: fix rcu lock in xfrm_notify_userpolicy() netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. powerpc/imc-pmu: Fix use of mutex in IRQs disabled section x86/boot: Avoid using Intel mnemonics in AT&T syntax asm EDAC/device: Fix period calculation in edac_device_reset_delay_period() regulator: da9211: Use irq handler when ready ASoC: wm8904: fix wrong outputs volume after power reactivation tipc: fix unexpected link reset due to discovery messages octeontx2-af: Update get/set resource count functions octeontx2-af: Map NIX block from CGX connection octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable hvc/xen: lock console list traversal nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() net/sched: act_mpls: Fix warning during failed attribute validation net/mlx5: Fix ptp max frequency adjustment range net/mlx5e: Don't support encap rules with gbp option mm: Always release pages to the buddy allocator in memblock_free_late(). iommu/mediatek-v1: Add error handle for mtk_iommu_probe iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() Documentation: KVM: add API issues section KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI x86/resctrl: Fix task CLOSID/RMID update race arm64: atomics: format whitespace consistently arm64: atomics: remove LL/SC trampolines arm64: cmpxchg_double*: hazard against entire exchange variable efi: fix NULL-deref in init error path drm/virtio: Fix GEM handle creation UAF io_uring/io-wq: free worker if task_work creation is canceled io_uring/io-wq: only free worker if it was allocated for creation Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" Linux 5.10.164 Change-Id: I049d9a56837b18c20b2245687f03eb75d3413e0f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
David Chen
|
0a626e27f9 |
Fix page corruption caused by racy check in __free_pages
commit 462a8e08e0e6287e5ce13187257edbf24213ed03 upstream. When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad page state in process ganesha.nfsd pfn:1304ca page:0000000022261c55 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1304ca flags: 0x17ffffc0000000() raw: 0017ffffc0000000 ffff8a513ffd4c98 ffffeee24b35ec08 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount CPU: 0 PID: 15567 Comm: ganesha.nfsd Kdump: loaded Tainted: P B O 5.10.158-1.nutanix.20221209.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 Call Trace: dump_stack+0x74/0x96 bad_page.cold+0x63/0x94 check_new_page_bad+0x6d/0x80 rmqueue+0x46e/0x970 get_page_from_freelist+0xcb/0x3f0 ? _cond_resched+0x19/0x40 __alloc_pages_nodemask+0x164/0x300 alloc_pages_current+0x87/0xf0 skb_page_frag_refill+0x84/0x110 ... Sometimes, it would also show up as corruption in the free list pointer and cause crashes. After bisecting the issue, we found the issue started from commit |
||
Mike Kravetz
|
dbe5a11954 |
migrate: hugetlb: check for hugetlb shared PMD in node migration
[ Upstream commit 73bdf65ea74857d7fb2ec3067a3cec0e261b1462 ]
migrate_pages/mempolicy semantics state that CAP_SYS_NICE is required to
move pages shared with another process to a different node. page_mapcount
> 1 is being used to determine if a hugetlb page is shared. However, a
hugetlb page will have a mapcount of 1 if mapped by multiple processes via
a shared PMD. As a result, hugetlb pages shared by multiple processes and
mapped with a shared PMD can be moved by a process without CAP_SYS_NICE.
To fix, check for a shared PMD if mapcount is 1. If a shared PMD is found
consider the page shared.
Link: https://lkml.kernel.org/r/20230126222721.222195-3-mike.kravetz@oracle.com
Fixes:
|
||
Miaohe Lin
|
97a5104d64 |
mm/migration: return errno when isolate_huge_page failed
[ Upstream commit 7ce82f4c3f3ead13a9d9498768e3b1a79975c4d8 ]
We might fail to isolate huge page due to e.g. the page is under
migration which cleared HPageMigratable. We should return errno in this
case rather than always return 1 which could confuse the user, i.e. the
caller might think all of the memory is migrated while the hugetlb page is
left behind. We make the prototype of isolate_huge_page consistent with
isolate_lru_page as suggested by Huang Ying and rename isolate_huge_page
to isolate_hugetlb as suggested by Muchun to improve the readability.
Link: https://lkml.kernel.org/r/20220530113016.16663-4-linmiaohe@huawei.com
Fixes:
|
||
Longlong Xia
|
30187be290 |
mm/swapfile: add cond_resched() in get_swap_pages()
commit 7717fc1a12f88701573f9ed897cc4f6699c661e3 upstream. The softlockup still occurs in get_swap_pages() under memory pressure. 64 CPU cores, 64GB memory, and 28 zram devices, the disksize of each zram device is 50MB with same priority as si. Use the stress-ng tool to increase memory pressure, causing the system to oom frequently. The plist_for_each_entry_safe() loops in get_swap_pages() could reach tens of thousands of times to find available space (extreme case: cond_resched() is not called in scan_swap_map_slots()). Let's add cond_resched() into get_swap_pages() when failed to find available space to avoid softlockup. Link: https://lkml.kernel.org/r/20230128094757.1060525-1-xialonglong1@huawei.com Signed-off-by: Longlong Xia <xialonglong1@huawei.com> Reviewed-by: "Huang, Ying" <ying.huang@intel.com> Cc: Chen Wandun <chenwandun@huawei.com> Cc: Huang Ying <ying.huang@intel.com> Cc: Kefeng Wang <wangkefeng.wang@huawei.com> Cc: Nanyong Sun <sunnanyong@huawei.com> Cc: Hugh Dickins <hughd@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Robin Murphy
|
865f370bf9 |
ANDROID: mm/vmalloc: Add override for lazy vunmap
Add an interface to disable lazy vunmap by forcing the threshold to zero. This might be interesting for debugging/testing in general, but primarily helps a horrible situation which needs to guarantee that vmalloc aliases are up-to-date from atomic context, wherein the only practical solution is to never let them get stale in the first place. Bug: 223346425 (cherry picked from commit 2a34c1503b85f49dd472dfd932dfcd16cab8ee8a https://git.gitlab.arm.com/linux-arm/linux-rm.git arm64/2454944-dev) Change-Id: I12fbbe3903f76a028ceea91ed078f0de2abe3815 Signed-off-by: Robin Murphy <robin.murphy@arm.com> [BM: Convert to a flag that can be explicitly modified at runtime instead of relying on arch specific bits] Signed-off-by: Beata Michalska <beata.michalska@arm.com> |
||
|
Srinivasarao Pathipati
|
5eb7909028 |
Merge keystone/android12-5.10-keystone-qcom-release.149+ (f29e4ad) into msm-5.10
* refs/heads/tmp-f29e4ad: ANDROID: cpu: correct dl_cpu_busy() calls BACKPORT: ext4: fix use-after-free in ext4_rename_dir_prepare ANDROID: GKI: rockchip: Update symbols BACKPORT: f2fs: let's avoid panic if extent_tree is not created BACKPORT: f2fs: should use a temp extent_info for lookup BACKPORT: f2fs: don't mix to use union values in extent_info BACKPORT: f2fs: initialize extent_cache parameter BACKPORT: f2fs: add block_age-based extent cache BACKPORT: f2fs: allocate the extent_cache by default BACKPORT: f2fs: refactor extent_cache to support for read and more BACKPORT: f2fs: remove unnecessary __init_extent_tree BACKPORT: f2fs: move internal functions into extent_cache.c BACKPORT: f2fs: specify extent cache for read explicitly BACKPORT: f2fs: add "c_len" into trace_f2fs_update_extent_tree_range for compressed file BACKPORT: f2fs: fix race condition on setting FI_NO_EXTENT flag BACKPORT: f2fs: extent cache: support unaligned extent UPSTREAM: io_uring: kill goto error handling in io_sqpoll_wait_sq() ANDROID: allmodconfig: disable WERROR UPSTREAM: Enable '-Werror' by default for all kernel builds ANDROID: GKI: VIVO: Add a symbol to symbol list ANDROID: fips140: add crypto_memneq() back to the module ANDROID: GKI: rockchip: Update module fragment and symbol list ANDROID: GKI: rockchip: Enable symbols for HDMIRX ANDROID: GKI: rockchip: Enable symbols for Ethernet ANDROID: Re-enable fast mremap and fix UAF with SPF Revert "ANDROID: Make SPF aware of fast mremaps" ANDROID: GKI: Update symbols to symbol list ANDROID: fips140: add dump_jitterentropy command to fips140_lab_util UPSTREAM: io_uring: add missing item types for splice request ANDROID: GKI: update xiaomi symbol list Revert "Revert "ANDROID: vendor_hooks:vendor hook for mmput"" Revert "Revert "ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath."" ANDROID: GKI: rockchip: Add symbol clk_hw_set_parent UPSTREAM: usb: dwc3: core: Add error log when core soft reset failed FROMLIST: fuse: give wakeup hints to the scheduler ANDROID: Make SPF aware of fast mremaps ANDROID: GKI: enable mulitcolor-led UPSTREAM: HID: playstation: support updated DualSense rumble mode. UPSTREAM: HID: playstation: add initial DualSense Edge controller support UPSTREAM: HID: playstation: stop DualSense output work on remove. UPSTREAM: HID: playstation: convert to use dev_groups UPSTREAM: HID: playstation: fix return from dualsense_player_led_set_brightness() UPSTREAM: HID: playstation: expose DualSense player LEDs through LED class. UPSTREAM: leds: add new LED_FUNCTION_PLAYER for player LEDs for game controllers. UPSTREAM: HID: playstation: expose DualSense lightbar through a multi-color LED. UPSTREAM: Documentation: leds: standartizing LED names ANDROID: usb: gadget: uvc: remove duplicate code in unbind ANDROID: dma-buf: Fix build breakage with !CONFIG_DMABUF_SYSFS_STATS ANDROID: dma-buf: don't re-purpose kobject as work_struct UPSTREAM: drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame BACKPORT: Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled Change-Id: Ie1154752931ac285427f153f71d861387628b321 Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com> |
||
|
Greg Kroah-Hartman
|
4922049993 |
This is the 5.10.163 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPCczkACgkQONu9yGCS
aT4tnRAAsW8h/ohmhP+O2lQ9Ekw6s9VB6KB4aJzLhQXqIZlrzk2DP3CiLxQ7DkFc
AcHwFYq+sERo8O7dK6pbCW0zNvLUpbK2wJhwMHujJfSUFboXX85NR6u90U67pBKS
p+yVkDSx8LNc7c676xQ7ey5rO1K2fQQ266gexjI9WOkjIFOfplVkZ7tkvt51VwAD
mNvOQsZdCE6xs+T3t9YMOtAx3wW8vl1wW3QDWCHznQwOJiMEjfNEOUY/+xELnnWz
DVONWPHTFNKQHZwIuVUFZdNuORq5WXoIaMZdaEFkhuOtRMnQ9l+wi8iMxX8zkgBn
Ji/dPu3GdAZsJU4/rXHkY2AeZV1oJc3NLYmevoRZirTqMQCqyM+blif7Rf34kBi7
6jlGPWOjyMNe58shfHmjWTl/u4pMDoYOnm5XO+1oL+2Xg8QWCucqAlfPFB3uMh6n
aL4ymzo5QRy1+tx8v7o1NOjnGWydvYn3O4fwJVkYTFaJZZr9EI7gpTmEBw/gwfuf
4TH6BC++Ai/8vgKUhpdnWuTrjomWalPTcPBgQYG4gD7ak2TM1rmgMaCl/THUe36R
zPC8m2sIXKeI4zGi8TeqTgaRvFSKJnuEmVo5OPkG98fZkjekCzWHp0q1+PG2Ecy8
Mu2/AOnwb1aSfOJh2Qajoke/Wed0U6qszop8C/jPRh8D1uTmRbI=
=sOTj
-----END PGP SIGNATURE-----
Merge 5.10.163 into android12-5.10-lts
Changes in 5.10.163
usb: musb: remove extra check in musb_gadget_vbus_draw
arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
arm64: dts: qcom: msm8996: fix GPU OPP table
ARM: dts: qcom: apq8064: fix coresight compatible
arm64: dts: qcom: sdm630: fix UART1 pin bias
arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
arm64: dts: qcom: msm8916: Drop MSS fallback compatible
objtool, kcsan: Add volatile read/write instrumentation to whitelist
ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
soc: qcom: llcc: make irq truly optional
soc: qcom: apr: make code more reuseable
soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
arm: dts: spear600: Fix clcd interrupt
soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
arm64: dts: mt2712e: Fix unit address for pinctrl node
arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: turris-omnia: Add ethernet aliases
ARM: dts: turris-omnia: Add switch port 6 node
arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
pstore/ram: Fix error return code in ramoops_probe()
ARM: mmp: fix timer_read delay
pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
sched/fair: Cleanup task_util and capacity type
sched/uclamp: Fix relationship between uclamp and migration margin
cpuidle: dt: Return the correct numbers of parsed idle states
alpha: fix syscall entry in !AUDUT_SYSCALL case
PM: hibernate: Fix mistake in kerneldoc comment
fs: don't audit the capability check in simple_xattr_list()
cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
selftests/ftrace: event_triggers: wait longer for test_event_enable
perf: Fix possible memleak in pmu_dev_alloc()
lib/debugobjects: fix stat count and optimize debug_objects_mem_init
platform/x86: huawei-wmi: fix return value calculation
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
proc: fixup uptime selftest
lib/fonts: fix undefined behavior in bit shift for get_default_font
ocfs2: fix memory leak in ocfs2_stack_glue_init()
MIPS: vpe-mt: fix possible memory leak while module exiting
MIPS: vpe-cmp: fix possible memory leak while module exiting
selftests/efivarfs: Add checking of the test return value
PNP: fix name memory leak in pnp_alloc_dev()
perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
nfsd: don't call nfsd_file_put from client states seqfile display
genirq/irqdesc: Don't try to remove non-existing sysfs files
cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
lib/notifier-error-inject: fix error when writing -errno to debugfs file
docs: fault-injection: fix non-working usage of negative values
debugfs: fix error when writing negative value to atomic_t debugfs file
ocfs2: ocfs2_mount_volume does cleanup job before return error
ocfs2: rewrite error handling of ocfs2_fill_super
ocfs2: fix memory leak in ocfs2_mount_volume()
rapidio: fix possible name leaks when rio_add_device() fails
rapidio: rio: fix possible name leak in rio_register_mport()
clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
clocksource/drivers/sh_cmt: Access registers according to spec
futex: Move to kernel/futex/
futex: Resend potentially swallowed owner death notification
cpu/hotplug: Make target_store() a nop when target == state
clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
x86/xen: Fix memory leak in xen_init_lock_cpu()
xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
PM: runtime: Improve path in rpm_idle() when no callback
PM: runtime: Do not call __rpm_callback() from rpm_idle()
platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
MIPS: BCM63xx: Add check for NULL for clk in clk_enable
MIPS: OCTEON: warn only once if deprecated link status is being used
fs: sysv: Fix sysv_nblocks() returns wrong value
rapidio: fix possible UAF when kfifo_alloc() fails
eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
relay: fix type mismatch when allocating memory in relay_create_buf()
hfs: Fix OOB Write in hfs_asc2mac
rapidio: devices: fix missing put_device in mport_cdev_open
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
wifi: rtl8xxxu: Fix reading the vendor of combo chips
drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
libbpf: Fix use-after-free in btf_dump_name_dups
libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
pata_ipx4xx_cf: Fix unsigned comparison with less than zero
media: coda: jpeg: Add check for kmalloc
media: i2c: ad5820: Fix error path
venus: pm_helpers: Fix error check in vcodec_domains_get()
media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev
media: exynos4-is: don't rely on the v4l2_async_subdev internals
can: kvaser_usb: do not increase tx statistics when sending error message frames
can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
can: kvaser_usb_leaf: Set Warning state even without bus errors
can: kvaser_usb_leaf: Fix improved state not being reported
can: kvaser_usb_leaf: Fix wrong CAN state after stopping
can: kvaser_usb_leaf: Fix bogus restart events
can: kvaser_usb: Add struct kvaser_usb_busparams
can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
drm/rockchip: lvds: fix PM usage counter unbalance in poweron
clk: renesas: r9a06g032: Repair grave increment error
spi: Update reference to struct spi_controller
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
ima: Fix fall-through warnings for Clang
ima: Handle -ESTALE returned by ima_filter_rule_match()
drm/msm/hdmi: switch to drm_bridge_connector
drm/msm/hdmi: drop unused GPIO support
bpf: Fix slot type check in check_stack_write_var_off
media: vivid: fix compose size exceed boundary
media: platform: exynos4-is: fix return value check in fimc_md_probe()
bpf: propagate precision in ALU/ALU64 operations
bpf: Check the other end of slot_type for STACK_SPILL
bpf: propagate precision across all frames, not just the last one
clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
mtd: Fix device name leak when register device failed in add_mtd_device()
Input: joystick - fix Kconfig warning for JOYSTICK_ADC
wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
media: camss: Clean up received buffers on failed start of streaming
net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
rxrpc: Fix ack.bufferSize to be 0 when generating an ack
drm/radeon: Add the missed acpi_put_table() to fix memory leak
drm/mediatek: Modify dpi power on/off sequence.
ASoC: pxa: fix null-pointer dereference in filter()
regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
drm/fourcc: Add packed 10bit YUV 4:2:0 format
drm/fourcc: Fix vsub/hsub for Q410 and Q401
integrity: Fix memory leakage in keyring allocation error path
ima: Fix misuse of dereference of pointer in template_desc_init_fields()
wifi: ath10k: Fix return value in ath10k_pci_init()
mtd: lpddr2_nvm: Fix possible null-ptr-deref
Input: elants_i2c - properly handle the reset GPIO when power is off
media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
media: solo6x10: fix possible memory leak in solo_sysfs_init()
media: platform: exynos4-is: Fix error handling in fimc_md_init()
media: videobuf-dma-contig: use dma_mmap_coherent
inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
bpf: Move skb->len == 0 checks into __bpf_redirect
HID: hid-sensor-custom: set fixed size for custom attributes
ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
regulator: core: use kfree_const() to free space conditionally
clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
drm/amdgpu: fix pci device refcount leak
bonding: fix link recovery in mode 2 when updelay is nonzero
mtd: maps: pxa2xx-flash: fix memory leak in probe
drbd: fix an invalid memory access caused by incorrect use of list iterator
ASoC: qcom: Add checks for devm_kcalloc
media: vimc: Fix wrong function called when vimc_init() fails
media: imon: fix a race condition in send_packet()
clk: imx: replace osc_hdmi with dummy
pinctrl: pinconf-generic: add missing of_node_put()
media: dvb-core: Fix ignored return value in dvb_register_frontend()
media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
ASoC: dt-bindings: wcd9335: fix reset line polarity in example
ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
NFSv4.2: Fix a memory stomp in decode_attr_security_label
NFSv4.2: Fix initialisation of struct nfs4_label
NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
NFS: Fix an Oops in nfs_d_automount()
ALSA: asihpi: fix missing pci_disable_device()
wifi: iwlwifi: mvm: fix double free on tx path.
ASoC: mediatek: mt8173: Fix debugfs registration for components
ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
drm/amd/pm/smu11: BACO is supported when it's in BACO state
drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
netfilter: conntrack: set icmpv6 redirects as RELATED
bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
bonding: uninitialized variable in bond_miimon_inspect()
spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
wifi: mac80211: fix memory leak in ieee80211_if_add()
wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
regulator: core: fix module refcount leak in set_supply()
clk: qcom: clk-krait: fix wrong div2 functions
hsr: Add a rcu-read lock to hsr_forward_skb().
net: hsr: generate supervision frame without HSR/PRP tag
hsr: Disable netpoll.
hsr: Synchronize sending frames to have always incremented outgoing seq nr.
hsr: Synchronize sequence number updates.
configfs: fix possible memory leak in configfs_create_dir()
regulator: core: fix resource leak in regulator_register()
hwmon: (jc42) Convert register access and caching to regmap/regcache
hwmon: (jc42) Restore the min/max/critical temperatures on resume
bpf, sockmap: fix race in sock_map_free()
ALSA: pcm: Set missing stop_operating flag at undoing trigger start
media: saa7164: fix missing pci_disable_device()
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
SUNRPC: Fix missing release socket in rpc_sockname()
NFSv4.x: Fail client initialisation if state manager thread can't run
mmc: alcor: fix return value check of mmc_add_host()
mmc: moxart: fix return value check of mmc_add_host()
mmc: mxcmmc: fix return value check of mmc_add_host()
mmc: pxamci: fix return value check of mmc_add_host()
mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
mmc: toshsd: fix return value check of mmc_add_host()
mmc: vub300: fix return value check of mmc_add_host()
mmc: wmt-sdmmc: fix return value check of mmc_add_host()
mmc: atmel-mci: fix return value check of mmc_add_host()
mmc: omap_hsmmc: fix return value check of mmc_add_host()
mmc: meson-gx: fix return value check of mmc_add_host()
mmc: via-sdmmc: fix return value check of mmc_add_host()
mmc: wbsd: fix return value check of mmc_add_host()
mmc: mmci: fix return value check of mmc_add_host()
media: c8sectpfe: Add of_node_put() when breaking out of loop
media: coda: Add check for dcoda_iram_alloc
media: coda: Add check for kmalloc
clk: samsung: Fix memory leak in _samsung_clk_register_pll()
spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
wifi: rtl8xxxu: Fix the channel width reporting
wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
blktrace: Fix output non-blktrace event when blk_classic option enabled
clk: socfpga: clk-pll: Remove unused variable 'rc'
clk: socfpga: use clk_hw_register for a5/c5
clk: socfpga: Fix memory leak in socfpga_gate_init()
net: vmw_vsock: vmci: Check memcpy_from_msg()
net: defxx: Fix missing err handling in dfx_init()
net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
net: farsync: Fix kmemleak when rmmods farsync
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
net: amd-xgbe: Fix logic around active and passive cables
net: amd-xgbe: Check only the minimum speed for active/passive cables
can: tcan4x5x: Remove invalid write in clear_interrupts
net: lan9303: Fix read error execution path
ntb_netdev: Use dev_kfree_skb_any() in interrupt context
sctp: sysctl: make extra pointers netns aware
Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
stmmac: fix potential division by 0
apparmor: fix a memleak in multi_transaction_new()
apparmor: fix lockdep warning when removing a namespace
apparmor: Fix abi check to include v8 abi
crypto: sun8i-ss - use dma_addr instead u32
crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
scsi: core: Fix a race between scsi_done() and scsi_timeout()
apparmor: Use pointer to struct aa_label for lbs_cred
PCI: dwc: Fix n_fts[] array overrun
RDMA/core: Fix order of nldev_exit call
PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
f2fs: Fix the race condition of resize flag between resizefs
crypto: rockchip - do not do custom power management
crypto: rockchip - do not store mode globally
crypto: rockchip - add fallback for cipher
crypto: rockchip - add fallback for ahash
crypto: rockchip - better handle cipher key
crypto: rockchip - remove non-aligned handling
crypto: rockchip - delete unneeded variable initialization
crypto: rockchip - rework by using crypto_engine
apparmor: Fix memleak in alloc_ns()
f2fs: fix normal discard process
RDMA/siw: Fix immediate work request flush to completion queue
RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
RDMA/siw: Set defined status for work completion with undefined status
scsi: scsi_debug: Fix a warning in resp_write_scat()
crypto: ccree - Remove debugfs when platform_driver_register failed
crypto: cryptd - Use request context instead of stack for sub-request
crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
RDMA/hns: Fix ext_sge num error when post send
PCI: Check for alloc failure in pci_request_irq()
RDMA/hfi: Decrease PCI device reference count in error path
crypto: ccree - Make cc_debugfs_global_fini() available for module init function
RDMA/hns: fix memory leak in hns_roce_alloc_mr()
RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
scsi: hpsa: Fix possible memory leak in hpsa_init_one()
crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
padata: Always leave BHs disabled when running ->parallel()
padata: Fix list iterator in padata_do_serial()
scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
scsi: hpsa: Fix error handling in hpsa_add_sas_host()
scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
scsi: scsi_debug: Fix a warning in resp_verify()
scsi: scsi_debug: Fix a warning in resp_report_zones()
scsi: fcoe: Fix possible name leak when device_register() fails
scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
scsi: ipr: Fix WARNING in ipr_init()
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
scsi: snic: Fix possible UAF in snic_tgt_create()
RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
f2fs: avoid victim selection from previous victim section
RDMA/nldev: Fix failure to send large messages
crypto: amlogic - Remove kcalloc without check
crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
riscv/mm: add arch hook arch_clear_hugepage_flags
RDMA/hfi1: Fix error return code in parse_platform_config()
RDMA/srp: Fix error return code in srp_parse_options()
orangefs: Fix sysfs not cleanup when dev init failed
RDMA/hns: Fix PBL page MTR find
RDMA/hns: Fix page size cap from firmware
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
hwrng: amd - Fix PCI device refcount leak
hwrng: geode - Fix PCI device refcount leak
IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
drivers: dio: fix possible memory leak in dio_init()
serial: tegra: Read DMA status before terminating
class: fix possible memory leak in __class_register()
vfio: platform: Do not pass return buffer to ACPI _RST method
uio: uio_dmem_genirq: Fix missing unlock in irq configuration
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
usb: fotg210-udc: Fix ages old endianness issues
staging: vme_user: Fix possible UAF in tsi148_dma_list_add
usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
usb: typec: tipd: Fix spurious fwnode_handle_put in error path
serial: amba-pl011: avoid SBSA UART accessing DMACR register
serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
serial: pch: Fix PCI device refcount leak in pch_request_dma()
tty: serial: clean up stop-tx part in altera_uart_tx_chars()
tty: serial: altera_uart_{r,t}x_chars() need only uart_port
serial: altera_uart: fix locking in polling mode
serial: sunsab: Fix error handling in sunsab_init()
test_firmware: fix memory leak in test_firmware_init()
misc: ocxl: fix possible name leak in ocxl_file_register_afu()
ocxl: fix pci device refcount leak when calling get_function_0()
misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
iio: temperature: ltc2983: make bulk write buffer DMA-safe
genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable
iio: adis: handle devices that cannot unmask the drdy pin
iio: adis: stylistic changes
iio:imu:adis: Move exports into IIO_ADISLIB namespace
iio: adis: add '__adis_enable_irq()' implementation
counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
usb: gadget: f_hid: optional SETUP/SET_REPORT mode
usb: gadget: f_hid: fix f_hidg lifetime vs cdev
usb: gadget: f_hid: fix refcount leak on error path
drivers: mcb: fix resource leak in mcb_probe()
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
chardev: fix error handling in cdev_device_add()
i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
staging: rtl8192u: Fix use after free in ieee80211_rx()
staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
vme: Fix error not catched in fake_init()
gpiolib: Get rid of redundant 'else'
gpiolib: cdev: fix NULL-pointer dereferences
i2c: mux: reg: check return value after calling platform_get_resource()
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
usb: storage: Add check for kcalloc
tracing/hist: Fix issue of losting command info in error_log
samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
thermal/drivers/imx8mm_thermal: Validate temperature range
fbdev: ssd1307fb: Drop optional dependency
fbdev: pm2fb: fix missing pci_disable_device()
fbdev: via: Fix error in via_core_init()
fbdev: vermilion: decrease reference count in error path
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
power: supply: fix residue sysfs file in error handle route of __power_supply_register()
perf trace: Return error if a system call doesn't exist
perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
perf trace: Handle failure when trace point folder is missed
perf symbol: correction while adjusting symbol
HSI: omap_ssi_core: Fix error handling in ssi_init()
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
RDMA/siw: Fix pointer cast warning
iommu/sun50i: Fix reset release
iommu/sun50i: Consider all fault sources for reset
iommu/sun50i: Fix R/W permission check
iommu/sun50i: Fix flush size
phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
include/uapi/linux/swab: Fix potentially missing __always_inline
pwm: tegra: Improve required rate calculation
dmaengine: idxd: Fix crc_val field for completion record
rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
rtc: cmos: Fix event handler registration ordering issue
rtc: cmos: Fix wake alarm breakage
rtc: cmos: fix build on non-ACPI platforms
rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
rtc: cmos: Eliminate forward declarations of some functions
rtc: cmos: Rename ACPI-related functions
rtc: cmos: Disable ACPI RTC event on removal
rtc: snvs: Allow a time difference on clock register read
rtc: pcf85063: Fix reading alarm
iommu/amd: Fix pci device refcount leak in ppr_notifier()
iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
macintosh: fix possible memory leak in macio_add_one_device()
macintosh/macio-adb: check the return value of ioremap()
powerpc/52xx: Fix a resource leak in an error handling path
cxl: Fix refcount leak in cxl_calc_capp_routing
powerpc/xmon: Enable breakpoints on 8xx
powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
kbuild: remove unneeded mkdir for external modules_install
kbuild: unify modules(_install) for in-tree and external modules
kbuild: refactor single builds of *.ko
powerpc/perf: callchain validate kernel stack pointer bounds
powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
powerpc/hv-gpci: Fix hv_gpci event list
selftests/powerpc: Fix resource leaks
iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
remoteproc: qcom_q6v5_pas: detach power domains on remove
remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
powerpc/eeh: Drop redundant spinlock initialization
powerpc/pseries/eeh: use correct API for error log size
netfilter: flowtable: really fix NAT IPv6 offload
rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
rtc: pcf85063: fix pcf85063_clkout_control
NFSD: Remove spurious cb_setup_err tracepoint
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
net: macsec: fix net device access prior to holding a lock
mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
nfc: pn533: Clear nfc_target before being used
r6040: Fix kmemleak in probe and remove
net: switch to storing KCOV handle directly in sk_buff
net: add inline function skb_csum_is_sctp
net: igc: use skb_csum_is_sctp instead of protocol check
net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME
igc: Enhance Qbv scheduling by using first flag bit
igc: Use strict cycles for Qbv scheduling
igc: Add checking for basetime less than zero
igc: recalculate Qbv end_time by considering cycle time
igc: Lift TAPRIO schedule restriction
igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
rtc: mxc_v2: Add missing clk_disable_unprepare()
selftests: devlink: fix the fd redirect in dummy_reporter_test
openvswitch: Fix flow lookup to use unmasked key
skbuff: Account for tail adjustment during pull operations
mailbox: zynq-ipi: fix error handling while device_register() fails
net_sched: reject TCF_EM_SIMPLE case for complex ematch module
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
myri10ge: Fix an error handling path in myri10ge_probe()
net: stream: purge sk_error_queue in sk_stream_kill_queues()
rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
arm64: make is_ttbrX_addr() noinstr-safe
video: hyperv_fb: Avoid taking busy spinlock on panic path
x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
binfmt_misc: fix shift-out-of-bounds in check_special_flags
fs: jfs: fix shift-out-of-bounds in dbAllocAG
udf: Avoid double brelse() in udf_rename()
fs: jfs: fix shift-out-of-bounds in dbDiscardAG
ACPICA: Fix error code path in acpi_ds_call_control_method()
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
acct: fix potential integer overflow in encode_comp_t()
hfs: fix OOB Read in __hfs_brec_find
drm/etnaviv: add missing quirks for GC300
brcmfmac: return error when getting invalid max_flowrings from dongle
wifi: ath9k: verify the expected usb_endpoints are present
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
ipmi: fix memleak when unload ipmi driver
drm/amd/display: prevent memory leak
qed (gcc13): use u16 for fid to be big enough
bpf: make sure skb->len != 0 when redirecting to a tunneling device
net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
hamradio: baycom_epp: Fix return type of baycom_send_packet()
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
igb: Do not free q_vector unless new one was allocated
drm/amdgpu: Fix type of second parameter in trans_msg() callback
drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
s390/ctcm: Fix return type of ctc{mp,}m_tx()
s390/netiucv: Fix return type of netiucv_tx()
s390/lcs: Fix return type of lcs_start_xmit()
drm/msm: Use drm_mode_copy()
drm/rockchip: Use drm_mode_copy()
drm/sti: Use drm_mode_copy()
drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
md/raid1: stop mdx_raid1 thread when raid1 array run failed
drm/amd/display: fix array index out of bound error in bios parser
net: add atomic_long_t to net_device_stats fields
mrp: introduce active flags to prevent UAF when applicant uninit
ppp: associate skb with a device at tx
bpf: Prevent decl_tag from being referenced in func_proto arg
ethtool: avoiding integer overflow in ethtool_phys_id()
media: dvb-frontends: fix leak of memory fw
media: dvbdev: adopts refcnt to avoid UAF
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
blk-mq: fix possible memleak when register 'hctx' failed
libbpf: Avoid enum forward-declarations in public API in C++ mode
regulator: core: fix use_count leakage when handling boot-on
mmc: f-sdh30: Add quirks for broken timeout clock capability
mmc: renesas_sdhi: better reset from HS400 mode
media: si470x: Fix use-after-free in si470x_int_in_callback()
clk: st: Fix memory leak in st_of_quadfs_setup()
hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
hwmon: (jc42) Fix missing unlock on error in jc42_write()
ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
ALSA: hda: add snd_hdac_stop_streams() helper
ASoC: Intel: Skylake: Fix driver hang during shutdown
ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
ASoC: wm8994: Fix potential deadlock
ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
ASoC: rt5670: Remove unbalanced pm_runtime_put()
LoadPin: Ignore the "contents" argument of the LSM hooks
pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
afs: Fix lost servers_outstanding count
pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
ima: Simplify ima_lsm_copy_rule
ALSA: usb-audio: add the quirk for KT0206 device
ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
usb: dwc3: core: defer probe on ulpi_read_id timeout
HID: wacom: Ensure bootloader PID is usable in hidraw mode
HID: mcp2221: don't connect hidraw
reiserfs: Add missing calls to reiserfs_security_free()
iio: adc: ad_sigma_delta: do not use internal iio_dev lock
iio: adc128s052: add proper .data members in adc128_of_match table
regulator: core: fix deadlock on regulator enable
gcov: add support for checksum field
ovl: fix use inode directly in rcu-walk mode
media: dvbdev: fix build warning due to comments
media: dvbdev: fix refcnt bug
pwm: tegra: Fix 32 bit build
usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
cifs: fix oops during encryption
nvme-pci: fix doorbell buffer value endianness
nvme-pci: fix mempool alloc size
nvme-pci: fix page size checks
ata: ahci: Fix PCS quirk application for suspend
nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
nvmet: don't defer passthrough commands with trivial effects to the workqueue
objtool: Fix SEGFAULT
powerpc/rtas: avoid device tree lookups in rtas_os_term()
powerpc/rtas: avoid scheduling in rtas_os_term()
HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
HID: plantronics: Additional PIDs for double volume key presses quirk
pstore/zone: Use GFP_ATOMIC to allocate zone buffer
hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
binfmt: Fix error return code in load_elf_fdpic_binary()
ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
ALSA: line6: correct midi status byte when receiving data from podxt
ALSA: line6: fix stack overflow in line6_midi_transmit
pnode: terminate at peers of source
md: fix a crash in mempool_free
mm, compaction: fix fast_isolate_around() to stay within boundaries
f2fs: should put a page when checking the summary info
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
tpm: acpi: Call acpi_put_table() to fix memory leak
tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
kcsan: Instrument memcpy/memset/memmove with newer Clang
ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow()
wifi: rtlwifi: remove always-true condition pointed out by GCC 12
wifi: rtlwifi: 8192de: correct checking of IQK reload
torture: Exclude "NOHZ tick-stop error" from fatal errors
rcu: Prevent lockdep-RCU splats on lock acquisition/release
net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
net/af_packet: make sure to pull mac header
media: stv0288: use explicitly signed char
soc: qcom: Select REMAP_MMIO for LLCC driver
kest.pl: Fix grub2 menu handling for rebooting
ktest.pl minconfig: Unset configs instead of just removing them
jbd2: use the correct print format
arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
btrfs: fix resolving backrefs for inline extent followed by prealloc
ARM: ux500: do not directly dereference __iomem
arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
selftests: Use optional USERCFLAGS and USERLDFLAGS
PM/devfreq: governor: Add a private governor_data for governor
cpufreq: Init completion before kobject_init_and_add()
ALSA: patch_realtek: Fix Dell Inspiron Plus 16
ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
dm thin: Use last transaction's pmd->root when commit failed
dm thin: resume even if in FAIL mode
dm thin: Fix UAF in run_timer_softirq()
dm integrity: Fix UAF in dm_integrity_dtr()
dm clone: Fix UAF in clone_dtr()
dm cache: Fix UAF in destroy()
dm cache: set needs_check flag after aborting metadata
tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
perf/core: Call LSM hook after copying perf_event_attr
KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
x86/microcode/intel: Do not retry microcode reloading on the APs
ftrace/x86: Add back ftrace_expected for ftrace bug reports
x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
tracing/hist: Fix wrong return value in parse_action_params()
tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
staging: media: tegra-video: fix chan->mipi value on error
ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
media: dvb-core: Fix double free in dvb_register_device()
media: dvb-core: Fix UAF due to refcount races at releasing
cifs: fix confusing debug message
cifs: fix missing display of three mount options
rtc: ds1347: fix value written to century register
md/bitmap: Fix bitmap chunk size overflow issues
efi: Add iMac Pro 2017 to uefi skip cert quirk
wifi: wilc1000: sdio: fix module autoloading
ASoC: jz4740-i2s: Handle independent FIFO flush bits
ipmi: fix long wait in unload when IPMI disconnect
mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
ima: Fix a potential NULL pointer access in ima_restore_measurement_list
ipmi: fix use after free in _ipmi_destroy_user()
PCI: Fix pci_device_is_present() for VFs by checking PF
PCI/sysfs: Fix double free in error path
crypto: n2 - add missing hash statesize
driver core: Fix bus_type.match() error handling in __driver_attach()
iommu/amd: Fix ivrs_acpihid cmdline parsing code
remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
parisc: led: Fix potential null-ptr-deref in start_task()
device_cgroup: Roll back to original exceptions after copy failure
drm/connector: send hotplug uevent on connector cleanup
drm/vmwgfx: Validate the box size for the snooped cursor
drm/i915/dsi: fix VBT send packet port selection for dual link DSI
drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
ext4: silence the warning when evicting inode with dioread_nolock
ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
ext4: fix use-after-free in ext4_orphan_cleanup
ext4: fix undefined behavior in bit shift for ext4_check_flag_values
ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
ext4: add helper to check quota inums
ext4: fix bug_on in __es_tree_search caused by bad quota inode
ext4: fix reserved cluster accounting in __es_remove_extent()
ext4: check and assert if marking an no_delete evicting inode dirty
ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
ext4: init quota for 'old.inode' in 'ext4_rename'
ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
ext4: fix corruption when online resizing a 1K bigalloc fs
ext4: fix error code return to user-space in ext4_get_branch()
ext4: avoid BUG_ON when creating xattrs
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
ext4: initialize quota before expanding inode in setproject ioctl
ext4: avoid unaccounted block allocation when expanding inode
ext4: allocate extended attribute value in vmalloc area
drm/amdgpu: handle polaris10/11 overlap asics (v2)
drm/amdgpu: make display pinning more flexible (v2)
ARM: renumber bits related to _TIF_WORK_MASK
perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure
perf/x86/intel/uncore: Clear attr_update properly
btrfs: replace strncpy() with strscpy()
x86/mce: Get rid of msr_ops
x86/MCE/AMD: Clear DFR errors found in THR handler
media: s5p-mfc: Fix to handle reference queue during finishing
media: s5p-mfc: Clear workbit to handle error condition
media: s5p-mfc: Fix in register read and write for H264
perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
x86/kprobes: Convert to insn_decode()
x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
staging: media: tegra-video: fix device_node use after free
ravb: Fix "failed to switch device to config mode" message during unbind
riscv/stacktrace: Fix stack output without ra on the stack top
riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument
ext4: goto right label 'failed_mount3a'
ext4: correct inconsistent error msg in nojournal mode
mm/highmem: Lift memcpy_[to|from]_page to core
ext4: use memcpy_to_page() in pagecache_write()
fs: ext4: initialize fsdata in pagecache_write()
ext4: move functions in super.c
ext4: simplify ext4 error translation
ext4: fix various seppling typos
ext4: fix leaking uninitialized memory in fast-commit journal
ext4: use kmemdup() to replace kmalloc + memcpy
mbcache: don't reclaim used entries
mbcache: add functions to delete entry if unused
ext4: remove EA inode entry from mbcache on inode eviction
ext4: unindent codeblock in ext4_xattr_block_set()
ext4: fix race when reusing xattr blocks
mbcache: automatically delete entries from cache on freeing
ext4: fix deadlock due to mbcache entry corruption
SUNRPC: ensure the matching upcall is in-flight upon downcall
bpf: pull before calling skb_postpull_rcsum()
drm/panfrost: Fix GEM handle creation ref-counting
vmxnet3: correctly report csum_level for encapsulated packet
veth: Fix race with AF_XDP exposing old or uninitialized descriptors
nfsd: shut down the NFSv4 state objects before the filecache
net: hns3: add interrupts re-initialization while doing VF FLR
net: sched: fix memory leak in tcindex_set_parms
qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
nfc: Fix potential resource leaks
vhost/vsock: Fix error handling in vhost_vsock_init()
vringh: fix range used in iotlb_translate()
vhost: fix range used in translate_desc()
net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
net/mlx5: Avoid recovery in probe flows
net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
net: amd-xgbe: add missed tasklet_kill
net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
drm/meson: Reduce the FIFO lines held when AFBC is not used
filelock: new helper: vfs_inode_has_locks
ceph: switch to vfs_inode_has_locks() to fix file lock bug
gpio: sifive: Fix refcount leak in sifive_gpio_probe
net: sched: atm: dont intepret cls results when asked to drop
net: sched: cbq: dont intepret cls results when asked to drop
netfilter: ipset: fix hash:net,port,net hang with /0 subnet
netfilter: ipset: Rework long task execution when adding/deleting entries
perf tools: Fix resources leak in perf_data__open_dir()
drivers/net/bonding/bond_3ad: return when there's no aggregator
usb: rndis_host: Secure rndis_query check against int overflow
drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
caif: fix memory leak in cfctrl_linkup_request()
udf: Fix extension of the last extent in the file
ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
nvme: fix multipath crash caused by flush request when blktrace is enabled
x86/bugs: Flush IBP in ib_prctl_set()
nfsd: fix handling of readdir in v4root vs. mount upcall timeout
fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
riscv: uaccess: fix type of 0 variable on error in get_user()
drm/i915/gvt: fix gvt debugfs destroy
drm/i915/gvt: fix vgpu debugfs clean in remove
ext4: don't allow journal inode to have encrypt flag
selftests: set the BUILD variable to absolute path
hfs/hfsplus: use WARN_ON for sanity check
hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
mbcache: Avoid nesting of cache->c_list_lock under bit locks
efi: random: combine bootloader provided RNG seed with RNG protocol output
io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
parisc: Align parisc MADV_XXX constants with all other architectures
ext4: disable fast-commit of encrypted dir operations
ext4: don't set up encryption key during jbd2 transaction
fsl_lpuart: Don't enable interrupts too early
serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way"
mptcp: mark ops structures as ro_after_init
mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
mptcp: dedicated request sock for subflow in v6
mptcp: use proper req destructor for IPv6
net: sched: disallow noqueue for qdisc classes
net/ulp: prevent ULP without clone op from entering the LISTEN status
ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
Linux 5.10.163
Change-Id: I9026971760be8484f1e1fa607f9f91243cc87785
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
deyaoren@google.com
|
6c665a5f36 |
Merge remote-tracking branch into HEAD
* keystone/mirror-android12-5.10-2023-01: (51 commits) ANDROID: cpu: correct dl_cpu_busy() calls BACKPORT: ext4: fix use-after-free in ext4_rename_dir_prepare ANDROID: GKI: rockchip: Update symbols BACKPORT: f2fs: let's avoid panic if extent_tree is not created BACKPORT: f2fs: should use a temp extent_info for lookup BACKPORT: f2fs: don't mix to use union values in extent_info BACKPORT: f2fs: initialize extent_cache parameter BACKPORT: f2fs: add block_age-based extent cache BACKPORT: f2fs: allocate the extent_cache by default BACKPORT: f2fs: refactor extent_cache to support for read and more BACKPORT: f2fs: remove unnecessary __init_extent_tree BACKPORT: f2fs: move internal functions into extent_cache.c BACKPORT: f2fs: specify extent cache for read explicitly BACKPORT: f2fs: add "c_len" into trace_f2fs_update_extent_tree_range for compressed file BACKPORT: f2fs: fix race condition on setting FI_NO_EXTENT flag BACKPORT: f2fs: extent cache: support unaligned extent UPSTREAM: io_uring: kill goto error handling in io_sqpoll_wait_sq() ANDROID: allmodconfig: disable WERROR UPSTREAM: Enable '-Werror' by default for all kernel builds ANDROID: GKI: VIVO: Add a symbol to symbol list ... Change-Id: I23f6bc7da718938f9d6630ad56421df28ee268a6 |
||
Kees Cook
|
55eba18262 |
panic: Consolidate open-coded panic_on_warn checks
commit 79cc1ba7badf9e7a12af99695a557e9ce27ee967 upstream. Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location. Cc: Marco Elver <elver@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Juri Lelli <juri.lelli@redhat.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Ben Segall <bsegall@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Daniel Bristot de Oliveira <bristot@redhat.com> Cc: Valentin Schneider <vschneid@redhat.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: David Gow <davidgow@google.com> Cc: tangmeng <tangmeng@uniontech.com> Cc: Jann Horn <jannh@google.com> Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: Petr Mladek <pmladek@suse.com> Cc: "Paul E. McKenney" <paulmck@kernel.org> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Cc: kasan-dev@googlegroups.com Cc: linux-mm@kvack.org Reviewed-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Marco Elver <elver@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Link: https://lore.kernel.org/r/20221117234328.594699-4-keescook@chromium.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Tiezhu Yang
|
715a63588f |
kasan: no need to unset panic_on_warn in end_report()
commit e7ce7500375a63348e1d3a703c8d5003cbe3fea6 upstream. panic_on_warn is unset inside panic(), so no need to unset it before calling panic() in end_report(). Link: https://lkml.kernel.org/r/1644324666-15947-6-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Reviewed-by: Marco Elver <elver@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Baoquan He <bhe@redhat.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Xuefeng Li <lixuefeng@loongson.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Srinivasarao Pathipati
|
57d7f6b039 |
Merge keystone/android12-5.10-keystone-qcom-release.149+ (a3f0c2f) into msm-5.10
* refs/heads/tmp-a3f0c2f:
Revert "Input: atmel_mxt_ts - fix up inverted RESET handler"
ANDROID: cpu: correct dl_cpu_busy() calls
ANDROID: usb: gadget: uvc: remove duplicate code in unbind
ANDROID: mm: disable speculative page faults for CONFIG_NUMA
ANDROID: disable page table moves when speculative page faults are enabled
ANDROID: mm: skip pte_alloc during speculative page fault
UPSTREAM: binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
UPSTREAM: binder: Address corner cases in deferred copy and fixup
UPSTREAM: binder: fix pointer cast warning
UPSTREAM: binder: defer copies of pre-patched txn data
UPSTREAM: binder: read pre-translated fds from sender buffer
UPSTREAM: binder: avoid potential data leakage when copying txn
UPSTREAM: bpf: Ensure correct locking around vulnerable function find_vpid()
BACKPORT: UPSTREAM: usb: typec: ucsi: Wait for the USB role switches
UPSTREAM: HID: roccat: Fix use-after-free in roccat_read()
ANDROID: arm64: mm: perform clean & invalidation in __dma_map_area
BACKPORT: ANDROID: dma-buf: heaps: replace mutex lock with spinlock
UPSTREAM: binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
UPSTREAM: binder: Address corner cases in deferred copy and fixup
UPSTREAM: binder: fix pointer cast warning
UPSTREAM: binder: defer copies of pre-patched txn data
UPSTREAM: binder: read pre-translated fds from sender buffer
UPSTREAM: binder: avoid potential data leakage when copying txn
ANDROID: khugepaged: fix mixing declarations warning in retract_page_tables
ANDROID: mm: fix build issue in spf when CONFIG_USERFAULTFD=n
ANDROID: mm: disable speculative page faults for CONFIG_NUMA
ANDROID: mm: fix invalid backport in speculative page fault path
ANDROID: disable page table moves when speculative page faults are enabled
ANDROID: mm: assert that mmap_lock is taken exclusively in vm_write_begin
ANDROID: mm: remove sequence counting when mmap_lock is not exclusively owned
ANDROID: mm/khugepaged: add missing vm_write_{begin|end}
BACKPORT: FROMLIST: mm: implement speculative handling in filemap_fault()
ANDROID: mm: prevent reads of unstable pmd during speculation
ANDROID: mm: prevent speculative page fault handling for in do_swap_page()
ANDROID: mm: prevent speculative page fault handling for userfaults
ANDROID: mm: skip pte_alloc during speculative page fault
FROMGIT: mm/madvise: fix madvise_pageout for private file mappings
ANDROID: GKI: Update symbols to symbol list
Revert "FROMGIT: mm/vmalloc: Add override for lazy vunmap"
Revert "FROMGIT: arm64: Work around Cortex-A510 erratum 2454944"
UPSTREAM: efi: capsule-loader: Fix use-after-free in efi_capsule_write
FROMGIT: arm64: Work around Cortex-A510 erratum 2454944
FROMGIT: mm/vmalloc: Add override for lazy vunmap
BACKPORT: mm/page_alloc: always initialize memory map for the holes
UPSTREAM: usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
UPSTREAM: usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
UPSTREAM: mm/damon/core: initialize damon_target->list in damon_new_target()
UPSTREAM: usb: typec: ucsi: Remove incorrect warning
UPSTREAM: xhci: Don't show warning for reinit on known broken suspend
UPSTREAM: mm/damon: validate if the pmd entry is present before accessing
UPSTREAM: mm/damon/dbgfs: fix memory leak when using debugfs_lookup()
UPSTREAM: mm/damon/dbgfs: avoid duplicate context directory creation
UPSTREAM: crypto: lib - remove unneeded selection of XOR_BLOCKS
UPSTREAM: pinctrl: sunxi: Fix name for A100 R_PIO
UPSTREAM: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
BACKPORT: usb: gadget: f_uac2: fix superspeed transfer
BACKPORT: usb: dwc3: qcom: fix runtime PM wakeup
UPSTREAM: KVM: arm64: Reject 32bit user PSTATE on asymmetric systems
UPSTREAM: KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems
UPSTREAM: Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
UPSTREAM: mm: fix page leak with multiple threads mapping the same page
UPSTREAM: PM: domains: Ensure genpd_debugfs_dir exists before remove
UPSTREAM: usb: gadget: uvc: fix changing interface name via configfs
BACKPORT: dma-mapping: Fix build error unused-value
UPSTREAM: tools/vm/slabinfo: Handle files in debugfs
UPSTREAM: mm/damon: use set_huge_pte_at() to make huge pte old
UPSTREAM: usb: gadget: f_mass_storage: Make CD-ROM emulation works with Windows OS
UPSTREAM: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
UPSTREAM: PM: domains: Fix initialization of genpd's next_wakeup
BACKPORT: f2fs: don't use casefolded comparison for "." and ".."
UPSTREAM: regulator: scmi: Fix refcount leak in scmi_regulator_probe
UPSTREAM: block/mq-deadline: Set the fifo_time member also if inserting at head
BACKPORT: Revert "mm/cma.c: remove redundant cma_mutex lock"
UPSTREAM: module.h: simplify MODULE_IMPORT_NS
UPSTREAM: iommu/mediatek: Add mutex for m4u_group and m4u_dom in data
UPSTREAM: iommu/mediatek: Remove clk_disable in mtk_iommu_remove
UPSTREAM: iommu/mediatek: Fix 2 HW sharing pgtable issue
UPSTREAM: mm: hugetlb: add missing cache flushing in hugetlb_unshare_all_pmds()
UPSTREAM: selftests/damon: add damon to selftests root Makefile
FROMGIT: f2fs: allow to read node block after shutdown
BACKPORT: f2fs: do not submit NEW_ADDR to read node block
BACKPORT: ext4,f2fs: fix readahead of verity data
ANDROID: GKI: db845c: Update symbols list and ABI
Linux 5.10.149
wifi: mac80211: fix MBSSID parsing use-after-free
wifi: mac80211: don't parse mbssid in assoc response
mac80211: mlme: find auth challenge directly
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
Linux 5.10.148
misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
misc: pci_endpoint_test: Aggregate params checking for xfer
Input: xpad - fix wireless 360 controller breaking after suspend
Input: xpad - add supported devices as contributed on github
wifi: cfg80211: update hidden BSSes to avoid WARN_ON
wifi: mac80211: fix crash in beacon protection for P2P-device
wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
wifi: cfg80211: avoid nontransmitted BSS list corruption
wifi: cfg80211: fix BSS refcounting bugs
wifi: cfg80211: ensure length byte is present before access
wifi: cfg80211/mac80211: reject bad MBSSID elements
wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
random: use expired timer rather than wq for mixing fast pool
random: avoid reading two cache lines on irq randomness
USB: serial: qcserial: add new usb-id for Dell branded EM7455
scsi: stex: Properly zero out the passthrough command structure
efi: Correct Macmini DMI match in uefi cert quirk
ALSA: hda: Fix position reporting on Poulsbo
random: clamp credited irq bits to maximum mixed
random: restore O_NONBLOCK support
Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
USB: serial: ftdi_sio: fix 300 bps rate for SIO
usb: mon: make mmapped memory read only
mmc: core: Terminate infinite loop in SD-UHS voltage switch
mmc: core: Replace with already defined values for readability
drm/amd/display: skip audio setup when audio stream is enabled
drm/amd/display: update gamut remap if plane has changed
net: atlantic: fix potential memory leak in aq_ndev_close()
arch: um: Mark the stack non-executable to fix a binutils warning
um: Cleanup compiler warning in arch/x86/um/tls_32.c
um: Cleanup syscall_handler_t cast in syscalls_32.h
ALSA: hda/hdmi: Fix the converter reuse for the silent stream
net/ieee802154: fix uninit value bug in dgram_sendmsg
scsi: qedf: Fix a UAF bug in __qedf_probe()
ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
firmware: arm_scmi: Add SCMI PM driver remove routine
compiler_attributes.h: move __compiletime_{error|warning}
fs: fix UAF/GPF bug in nilfs_mdt_destroy
powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush
mm: gup: fix the fast GUP race against THP collapse
ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
xsk: Inherit need_wakeup flag for shared sockets
perf tools: Fixup get_current_dir_name() compilation
docs: update mediator information in CoC docs
Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
ceph: don't truncate file in atomic_open
nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
nilfs2: fix leak of nilfs_root in case of writer thread creation failure
nilfs2: fix use-after-free bug of struct nilfs_root
nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
Linux 5.10.147
ALSA: hda/hdmi: fix warning about PCM count when used with SOF
x86/alternative: Fix race in try_get_desc()
KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest
clk: iproc: Do not rely on node name for correct PLL setup
clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks
selftests: Fix the if conditions of in test_extra_filter()
net: stmmac: power up/down serdes in stmmac_open/release
nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
nvme: add new line after variable declatation
cxgb4: fix missing unlock on ETHOFLD desc collect fail path
net: sched: act_ct: fix possible refcount leak in tcf_ct_init()
usbnet: Fix memory leak in usbnet_disconnect()
Input: melfas_mip4 - fix return value check in mip4_probe()
Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
ASoC: tas2770: Reinit regcache on reset
soc: sunxi: sram: Fix debugfs info for A64 SRAM C
soc: sunxi: sram: Fix probe function ordering issues
soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource()
soc: sunxi: sram: Prevent the driver from being unbound
soc: sunxi: sram: Actually claim SRAM regions
reset: imx7: Fix the iMX8MP PCIe PHY PERST support
ARM: dts: am33xx: Fix MMCHS0 dma properties
scsi: hisi_sas: Revert "scsi: hisi_sas: Limit max hw sectors for v3 HW"
swiotlb: max mapping size takes min align mask into account
media: rkvdec: Disable H.264 error detection
media: dvb_vb2: fix possible out of bound access
mm: fix madivse_pageout mishandling on non-LRU page
mm/migrate_device.c: flush TLB while holding PTL
mm: prevent page_frag_alloc() from corrupting the memory
mm/page_alloc: fix race condition between build_all_zonelists and page allocation
mmc: hsq: Fix data stomping during mmc recovery
mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205
net: mt7531: only do PLL once after the reset
ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
ARM: dts: integrator: Tag PCI host with device_type
clk: ingenic-tcu: Properly enable registers before accessing timers
Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address
net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
thunderbolt: Explicitly reset plug events delay back to USB4 spec value
usb: typec: ucsi: Remove incorrect warning
uas: ignore UAS for Thinkplus chips
usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS
uas: add no-uas quirk for Hiksemi usb_disk
btrfs: fix hang during unmount when stopping a space reclaim worker
ALSA: hda: Fix Nvidia dp infoframe
ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically
ALSA: hda/tegra: Reset hardware
ALSA: hda/tegra: Use clk_bulk helpers
thunderbolt: Add support for Intel Maple Ridge single port controller
thunderbolt: Add support for Intel Maple Ridge
Revert "usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind"
Linux 5.10.146
ext4: make directory inode spreading reflect flexbg size
ext4: limit the number of retries after discarding preallocations blocks
ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
devdax: Fix soft-reservation memory description
i2c: mlxbf: Fix frequency calculation
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
i2c: mlxbf: incorrect base address passed during io write
i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible
workqueue: don't skip lockdep work dependency in cancel_work_sync()
drm/rockchip: Fix return type of cdn_dp_connector_mode_valid
drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage
drm/amd/display: Limit user regamma to a valid value
drm/amdgpu: use dirty framebuffer helper
drm/gma500: Fix BUG: sleeping function called from invalid context errors
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
cifs: always initialize struct msghdr smb_msg completely
cifs: use discard iterator to discard unneeded network data more efficiently
drm/amdgpu: Fix check for RAS support
vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
usb: xhci-mtk: fix issue of out-of-bounds array access
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting
serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting
serial: Create uart_xmit_advance()
drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV
selftests: forwarding: add shebang for sch_red.sh
net: sched: fix possible refcount leak in tc_new_tfilter()
net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
net/smc: Stop the CLC flow if no link to map buffers on
drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff()
perf kcore_copy: Do not check /proc/modules is unchanged
perf jit: Include program header in ELF files
can: gs_usb: gs_can_open(): fix race dev->can.state condition
netfilter: ebtables: fix memory leak when blob is malformed
netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()
netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()
net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs
net/sched: taprio: avoid disabling offload when it was never enabled
net: socket: remove register_gifconf
net: enetc: move enetc_set_psfp() out of the common enetc_set_features()
wireguard: netlink: avoid variable-sized memcpy on sockaddr
wireguard: ratelimiter: disable timings test by default
net: ipa: properly limit modem routing table use
net: ipa: kill IPA_TABLE_ENTRY_SIZE
net: ipa: DMA addresses are nicely aligned
net: ipa: avoid 64-bit modulus
net: ipa: fix table alignment requirement
net: ipa: fix assumptions about DMA address size
of: mdio: Add of_node_put() when breaking out of for_each_xx
drm/hisilicon: Add depends on MMU
drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled
sfc: fix null pointer dereference in efx_hard_start_xmit
sfc: fix TX channel offset when using legacy interrupts
i40e: Fix set max_tx_rate when it is lower than 1 Mbps
i40e: Fix VF set max MTU size
iavf: Fix set max MTU size with port VLAN and jumbo frames
iavf: Fix bad page state
MIPS: Loongson32: Fix PHY-mode being left unspecified
MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko
drm/panel: simple: Fix innolux_g121i1_l01 bus_format
net: team: Unsync device addresses on ndo_stop
net: bonding: Unsync device addresses on ndo_stop
net: bonding: Share lacpdu_mcast_addr definition
scsi: mpt3sas: Fix return value check of dma_get_required_mask()
scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region
net: phy: aquantia: wait for the suspend/resume operations to finish
net: core: fix flow symmetric hash
net: let flow have same hash in two directions
ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
iavf: Fix cached head and tail value for iavf_get_tx_pending
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
netfilter: nf_conntrack_irc: Tighten matching on DCC message
netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma
dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()
arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz
drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks
arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob
xfs: validate inode fork size against fork format
xfs: reorder iunlink remove operation in xfs_ifree
xfs: fix up non-directory creation in SGID directories
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
KVM: SEV: add cache flush to solve SEV cache incoherency issues
mm/slub: fix to return errno if kmalloc() fails
can: flexcan: flexcan_mailbox_read() fix return value for drop = true
riscv: fix a nasty sigreturn bug...
gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
gpio: mockup: fix NULL pointer dereference when removing debugfs
wifi: mt76: fix reading current per-tid starting sequence number for aggregation
efi: libstub: check Shim mode using MokSBStateRT
efi: x86: Wipe setup_data on pure EFI boot
media: flexcop-usb: fix endpoint type check
iommu/vt-d: Check correct capability for sagaw determination
ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop
ALSA: hda/realtek: Add quirk for ASUS GA503R laptop
ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack
ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack
ALSA: hda/realtek: Re-arrange quirk table entries
ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop
ALSA: hda/realtek: Add quirk for Huawei WRT-WX9
ALSA: hda: add Intel 5 Series / 3400 PCI DID
ALSA: hda/tegra: set depop delay for tegra
USB: serial: option: add Quectel RM520N
USB: serial: option: add Quectel BG95 0x0203 composition
USB: core: Fix RST error in hub.c
arm64/bti: Disable in kernel BTI when cross section thunks are broken
arm64: Restrict ARM64_BTI_KERNEL to clang 12.0.0 and newer
Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio"
vfio/type1: Unpin zero pages
vfio/type1: Prepare for batched pinning with struct vfio_batch
vfio/type1: Change success value of vaddr_get_pfn()
Revert "usb: add quirks for Lenovo OneLink+ Dock"
usb: cdns3: fix issue with rearming ISO OUT endpoint
usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer
usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
usb: add quirks for Lenovo OneLink+ Dock
tty: serial: atmel: Preserve previous USART mode if RS485 disabled
serial: atmel: remove redundant assignment in rs485_config
mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure
usb: xhci-mtk: relax TT periodic bandwidth allocation
usb: xhci-mtk: allow multiple Start-Split in a microframe
usb: xhci-mtk: add some schedule error number
usb: xhci-mtk: add a function to (un)load bandwidth info
usb: xhci-mtk: use @sch_tt to check whether need do TT schedule
usb: xhci-mtk: add only one extra CS for FS/LS INTR
usb: xhci-mtk: get the microframe boundary for ESIT
usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup()
usb: dwc3: gadget: Refactor pullup()
usb: dwc3: gadget: Prevent repeat pullup()
usb: dwc3: Issue core soft reset before enabling run/stop
usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind
usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device
usb: typec: intel_pmc_mux: Update IOM port status offset for AlderLake
drm/amdgpu: make sure to init common IP before gmc
drm/amdgpu: Separate vf2pf work item init from virt data exchange
drm/amdgpu: indirect register access for nv12 sriov
drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
Linux 5.10.145
ALSA: hda/sigmatel: Fix unused variable warning for beep power change
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
mksysmap: Fix the mismatch of 'L0' symbols in System.map
MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked
net: usb: qmi_wwan: add Quectel RM520N
ALSA: hda/tegra: Align BDL entry to 4KB boundary
ALSA: hda/sigmatel: Keep power up while beep is enabled
wifi: mac80211_hwsim: check length for virtio packets
rxrpc: Fix calc of resend age
rxrpc: Fix local destruction being repeated
regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
ASoC: nau8824: Fix semaphore unbalance at error paths
Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
video: fbdev: i740fb: Error out if 'pixclock' equals zero
tools/include/uapi: Fix <asm/errno.h> for parisc and xtensa
cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
cifs: revalidate mapping when doing direct writes
of/device: Fix up of_dma_configure_id() stub
tracing: hold caller_addr to hardirq_{enable,disable}_ip
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
drm/meson: Fix OSD1 RGB to YCbCr coefficient
drm/meson: Correct OSD1 global alpha value
gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx
NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
pinctrl: sunxi: Fix name for A100 R_PIO
of: fdt: fix off-by-one error in unflatten_dt_nodes()
net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
platform/x86/intel: hid: add quirk to support Surface Go 3
usb: cdns3: gadget: fix new urb never complete if ep cancel previous requests
powerpc/pseries/mobility: ignore ibm, platform-facilities updates
powerpc/pseries/mobility: refactor node lookup during DT update
dmaengine: bestcomm: fix system boot lockups
parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page
parisc: Optimize per-pagetable spinlocks
serial: 8250: Fix reporting real baudrate value in c_ospeed field
KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling
KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs
Revert "USB: core: Prevent nested device-reset calls"
Revert "xhci: Add grace period after xHC start to prevent premature runtime suspend."
Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse"
Revert "io_uring: disable polling pollfree files"
Linux 5.10.144
Input: goodix - add compatible string for GT1158
soc: fsl: select FSL_GUTS driver for DPIO
x86/ftrace: Use alternative RET encoding
x86/ibt,ftrace: Make function-graph play nice
Revert "x86/ftrace: Use alternative RET encoding"
mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
drm/amd/amdgpu: skip ucode loading if ucode_size == 0
nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
Input: iforce - add support for Boeder Force Feedback Wheel
ieee802154: cc2520: add rc code in cc2520_tx()
gpio: mockup: remove gpio debugfs when remove device
tg3: Disable tg3 device on system reboot to avoid triggering AER
hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
drm/msm/rd: Fix FIFO-full deadlock
Input: goodix - add support for GT1158
tracefs: Only clobber mode/uid/gid on remount if asked
iommu/vt-d: Correctly calculate sagaw value of IOMMU
ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible
ARM: dts: imx: align SPI NOR node name with dtschema
Linux 5.10.143
arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly
hwmon: (mr75203) enable polling for all VM channels
hwmon: (mr75203) fix multi-channel voltage reading
hwmon: (mr75203) fix voltage equation for negative source input
hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
iommu/amd: use full 64-bit value in build_completion_wait()
swiotlb: avoid potential left shift overflow
MIPS: loongson32: ls1c: Fix hang during startup
ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion
ASoC: mchp-spdiftx: remove references to mchp_i2s_caps
sch_sfb: Also store skb len before calling child enqueue
tcp: fix early ETIMEDOUT after spurious non-SACK RTO
nvme-tcp: fix regression that causes sporadic requests to time out
nvme-tcp: fix UAF when detecting digest errors
RDMA/mlx5: Set local port to one when accessing counters
IB/core: Fix a nested dead lock as part of ODP flow
ipv6: sr: fix out-of-bounds read when setting HMAC data.
RDMA/siw: Pass a pointer to virt_to_page()
xen-netback: only remove 'hotplug-status' when the vif is actually destroyed
i40e: Fix kernel crash during module removal
ice: use bitmap_free instead of devm_kfree
tipc: fix shift wrapping bug in map_get()
sch_sfb: Don't assume the skb is still around after enqueueing to child
afs: Use the operation issue time instead of the reply time for callbacks
rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
ALSA: usb-audio: Register card again for iface over delayed_register option
ALSA: usb-audio: Inform the delayed registration more properly
netfilter: nf_conntrack_irc: Fix forged IP logic
netfilter: nf_tables: clean up hook list when offload flags check fails
netfilter: br_netfilter: Drop dst references before setting.
ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time
ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time
ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges
ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges
RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
RDMA/hns: Fix supported page size
soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
RDMA/cma: Fix arguments order in net device validation
tee: fix compiler warning in tee_shm_register()
regulator: core: Clean up on enable failure
ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node
smb3: missing inode locks in punch hole
cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
scsi: lpfc: Add missing destroy_workqueue() in error path
scsi: mpt3sas: Fix use-after-free warning
drm/i915: Implement WaEdpLinkRateDataReload
nvmet: fix a use-after-free
debugfs: add debugfs_lookup_and_remove()
kprobes: Prohibit probes in gate area
ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
ALSA: aloop: Fix random zeros in capture data when using jiffies timer
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
net/core/skbuff: Check the return value of skb_copy_bits()
arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
drm/radeon: add a force flush to delay work when radeon
drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini
drm/gem: Fix GEM handle release errors
scsi: megaraid_sas: Fix double kfree()
scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
fs: only do a memory barrier for the first set_buffer_uptodate()
wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd()
efi: capsule-loader: Fix use-after-free in efi_capsule_write
efi: libstub: Disable struct randomization
tty: n_gsm: avoid call of sleeping functions from atomic context
tty: n_gsm: initialize more members at gsm_alloc_mux()
xen-blkfront: Cache feature_persistent value before advertisement
NFSD: Fix verifier returned in stable WRITEs
Linux 5.10.142
USB: serial: ch341: fix disabled rx timer on older devices
USB: serial: ch341: fix lost character on LCR updates
usb: dwc3: disable USB core PHY management
usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
usb: dwc3: fix PHY disable sequence
mmc: core: Fix UHS-I SD 1.8V workaround branch
btrfs: harden identification of a stale device
drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
ALSA: seq: Fix data-race at module auto-loading
ALSA: seq: oss: Fix data-race for max_midi_devs access
ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
net: mac802154: Fix a condition in the receive path
net: Use u64_stats_fetch_begin_irq() for stats fetch.
ip: fix triggering of 'icmp redirect'
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
driver core: Don't probe devices after bus_type.match() probe deferral
usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
USB: core: Prevent nested device-reset calls
s390: fix nospec table alignments
s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
usb-storage: Add ignore-residue quirk for NXP PN7462AU
USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
usb: dwc2: fix wrong order of phy_power_on and phy_init
usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles
USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
USB: serial: option: add Quectel EM060K modem
USB: serial: option: add support for OPPO R11 diag port
USB: serial: cp210x: add Decagon UCA device id
xhci: Add grace period after xHC start to prevent premature runtime suspend.
media: mceusb: Use new usb_control_msg_*() routines
thunderbolt: Use the actual buffer in tb_async_error()
xen-blkfront: Advertise feature-persistent as user requested
xen-blkback: Advertise feature-persistent as user requested
mm: pagewalk: Fix race between unmap and page walker
xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES
gpio: pca953x: Add mutex_lock for regcache sync in PM
hwmon: (gpio-fan) Fix array out of bounds access
clk: bcm: rpi: Add missing newline
clk: bcm: rpi: Prevent out-of-bounds access
clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc()
clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
Input: rk805-pwrkey - fix module autoloading
clk: core: Fix runtime PM sequence in clk_core_unprepare()
Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
binder: fix UAF of ref->proc caused by race condition
USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
misc: fastrpc: fix memory corruption on open
misc: fastrpc: fix memory corruption on probe
iio: adc: mcp3911: use correct formula for AD conversion
iio: ad7292: Prevent regulator double disable
Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete
vt: Clear selection before changing the font
powerpc: align syscall table for ppc32
staging: rtl8712: fix use after free bugs
serial: fsl_lpuart: RS485 RTS polariy is inverse
net/smc: Remove redundant refcount increase
Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
tcp: annotate data-race around challenge_timestamp
sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
kcm: fix strp_init() order and cleanup
ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
net/sched: fix netdevice reference leaks in attach_default_qdiscs()
net: sched: tbf: don't call qdisc_put() while holding tree lock
Revert "xhci: turn off port power in shutdown"
wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array
ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg
ieee802154/adf7242: defer destroy_workqueue call
bpf, cgroup: Fix kernel BUG in purge_effective_progs
iio: adc: mcp3911: make use of the sign bit
platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
drm/msm/dsi: Fix number of regulators for SDM660
drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4
drm/msm/dsi: fix the inconsistent indenting
Linux 5.10.141
net: neigh: don't call kfree_skb() under spin_lock_irqsave()
net/af_packet: check len when min_header_len equals to 0
xfs: revert "xfs: actually bump warning counts when we send warnings"
xfs: fix soft lockup via spinning in filestream ag selection loop
xfs: fix overfilling of reserve pool
xfs: always succeed at setting the reserve pool size
xfs: remove infinite loop when reserving free block pool
io_uring: disable polling pollfree files
kprobes: don't call disarm_kprobe() for disabled kprobes
lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()
netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
drm/amdgpu: Increase tlb flush timeout for sriov
drm/amd/display: Fix pixel clock programming
drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
s390/hypfs: avoid error message under KVM
neigh: fix possible DoS due to net iface start/stop loop
drm/amd/display: clear optc underflow before turn off odm clock
drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
drm/amd/display: Avoid MPC infinite loop
mmc: mtk-sd: Clear interrupts when cqe off/disable
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
bpf: Don't redirect packets with invalid pkt_len
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
fbdev: fb_pm2fb: Avoid potential divide by zero error
net: fix refcount bug in sk_psock_get (2)
HID: hidraw: fix memory leak in hidraw_release()
media: pvrusb2: fix memory leak in pvr_probe
udmabuf: Set the DMA mask for the udmabuf device (v2)
HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()"
Bluetooth: L2CAP: Fix build errors in some archs
kbuild: Fix include path in scripts/Makefile.modpost
s390/mm: do not trigger write fault when vma does not allow VM_WRITE
crypto: lib - remove unneeded selection of XOR_BLOCKS
x86/nospec: Fix i386 RSB stuffing
x86/nospec: Unwreck the RSB stuffing
mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
Linux 5.10.140
bpf: Don't use tnum_range on array range checking for poke descriptors
scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
scsi: ufs: core: Enable link lost interrupt
perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU
perf python: Fix build when PYTHON_CONFIG is user supplied
blk-mq: fix io hung due to missing commit_rqs
Documentation/ABI: Mention retbleed vulnerability info file for sysfs
arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76
md: call __md_stop_writes in md_stop
Revert "md-raid: destroy the bitmap after destroying the thread"
mm/hugetlb: fix hugetlb not supporting softdirty tracking
xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
ACPI: processor: Remove freq Qos request for all CPUs
s390: fix double free of GS and RI CBs on fork() failure
asm-generic: sections: refactor memory_intersects
loop: Check for overflow while configuring loop
x86/bugs: Add "unknown" reporting for MMIO Stale Data
x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
perf/x86/lbr: Enable the branch type for the Arch LBR by default
btrfs: check if root is readonly while setting security xattr
btrfs: add info when mount fails due to stale replace target
btrfs: replace: drop assert for suspended replace
btrfs: fix silent failure when deleting root reference
ionic: fix up issues with handling EAGAIN on FW cmds
rxrpc: Fix locking in rxrpc's sendmsg
ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
net: Fix a data-race around sysctl_somaxconn.
net: Fix data-races around sysctl_devconf_inherit_init_net.
net: Fix data-races around sysctl_fb_tunnels_only_for_init_net.
net: Fix a data-race around netdev_budget_usecs.
net: Fix a data-race around netdev_budget.
net: Fix a data-race around sysctl_net_busy_read.
net: Fix a data-race around sysctl_net_busy_poll.
net: Fix a data-race around sysctl_tstamp_allow_data.
net: Fix data-races around sysctl_optmem_max.
bpf: Folding omem_charge() into sk_storage_charge()
ratelimit: Fix data-races in ___ratelimit().
net: Fix data-races around netdev_tstamp_prequeue.
net: Fix data-races around netdev_max_backlog.
net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
net: Fix data-races around sysctl_[rw]mem_(max|default).
net: Fix data-races around sysctl_[rw]mem(_offset)?.
tcp: tweak len/truesize ratio for coalesce candidates
netfilter: nf_tables: disallow binding to already bound chain
netfilter: nf_tables: disallow jump to implicit chain from set element
netfilter: nf_tables: upfront validation of data via nft_data_init()
netfilter: bitwise: improve error goto labels
netfilter: nft_cmp: optimize comparison for 16-bytes
netfilter: nf_tables: consolidate rule verdict trace call
netfilter: nftables: remove redundant assignment of variable err
netfilter: nft_tunnel: restrict it to netdev family
netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
netfilter: nf_tables: do not leave chain stats enabled on error
netfilter: nft_payload: do not truncate csum_offset and csum_type
netfilter: nft_payload: report ERANGE for too long offset and length
bnxt_en: fix NQ resource accounting during vf creation on 57500 chips
netfilter: ebtables: reject blobs that don't provide all entry points
net: ipvtap - add __init/__exit annotations to module init/exit funcs
bonding: 802.3ad: fix no transmission of LACPDUs
net: moxa: get rid of asymmetry in DMA mapping/unmapping
net: ipa: don't assume SMEM is page-aligned
net/mlx5e: Properly disable vlan strip on non-UL reps
ice: xsk: prohibit usage of non-balanced queue id
ice: xsk: Force rings to be sized to power of 2
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
rose: check NULL rose_loopback_neigh->loopback
mm/smaps: don't access young/dirty bit if pte unpresent
mm/huge_memory.c: use helper function migration_entry_to_page()
SUNRPC: RPC level errors should set task->tk_rpc_status
NFSv4.2 fix problems with __nfs42_ssc_open
NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open()
xfrm: policy: fix metadata dst->dev xmit null pointer dereference
af_key: Do not call xfrm_probe_algs in parallel
xfrm: clone missing x->lastused in xfrm_do_migrate
xfrm: fix refcount leak in __xfrm_policy_check()
kernel/sched: Remove dl_boosted flag comment
xfs: only bother with sync_filesystem during readonly remount
xfs: return errors in xfs_fs_sync_fs
vfs: make sync_filesystem return errors from ->sync_fs
fs: remove __sync_filesystem
xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list()
pinctrl: amd: Don't save/restore interrupt status and wake status bits
kernel/sys_ni: add compat entry for fadvise64_64
parisc: Fix exception handler for fldw and fstw instructions
audit: fix potential double free on error path from fsnotify_add_inode_mark
Revert "ALSA: control: Use deferred fasync helper"
Revert "block: remove the request_queue to argument request based tracepoints"
Revert "blktrace: Trace remapped requests correctly"
Revert "USB: HCD: Fix URB giveback issue in tasklet function"
Linux 5.10.139
kbuild: dummy-tools: avoid tmpdir leak in dummy gcc
Linux 5.10.138
tee: fix memory leak in tee_shm_register()
bpf: Fix KASAN use-after-free Read in compute_effective_progs
qrtr: Convert qrtr_ports from IDR to XArray
PCI/ERR: Retain status from error notification
can: j1939: j1939_session_destroy(): fix memory leak of skbs
can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once()
tracing/probes: Have kprobes and uprobes use $COMM too
netfilter: nf_tables: fix audit memory leak in nf_tables_commit
netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect()
MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
video: fbdev: i740fb: Check the argument of i740_calc_vclk()
powerpc/64: Init jump labels before parse_early_param()
smb3: check xattr value length earlier
f2fs: fix to do sanity check on segment type in build_sit_entries()
f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
ALSA: control: Use deferred fasync helper
ALSA: timer: Use deferred fasync helper
ALSA: core: Add async signal helpers
powerpc/32: Don't always pass -mcpu=powerpc to the compiler
watchdog: export lockup_detector_reconfigure
RISC-V: Add fast call path of crash_kexec()
riscv: mmap with PROT_WRITE but no PROT_READ is invalid
modules: Ensure natural alignment for .altinstructions and __bug_table sections
mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
vfio: Clear the caps->buf to NULL after free
tty: serial: Fix refcount leak bug in ucc_uart.c
lib/list_debug.c: Detect uninitialized lists
ext4: avoid resizing to a partial cluster size
ext4: avoid remove directory when directory is corrupted
drivers:md:fix a potential use-after-free bug
nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown
md: Notify sysfs sync_completed in md_reap_sync_thread()
dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed
selftests/kprobe: Do not test for GRP/ without event failures
csky/kprobe: reclaim insn_slot on kprobe unregistration
RDMA/rxe: Limit the number of calls to each tasklet
um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
PCI/ACPI: Guard ARM64-specific mcfg_quirks
cxl: Fix a memory leak in an error handling path
pinctrl: intel: Check against matching data instead of ACPI companion
gadgetfs: ep_io - wait until IRQ finishes
scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
zram: do not lookup algorithm in backends table
uacce: Handle parent device removal or parent driver module rmmod
clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
vboxguest: Do not use devm for irq
usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch
usb: renesas: Fix refcount leak bug
usb: host: ohci-ppc-of: Fix refcount leak bug
clk: ti: Stop using legacy clkctrl names for omap4 and 5
drm/meson: Fix overflow implicit truncation warnings
irqchip/tegra: Fix overflow implicit truncation warnings
usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info
usb: cdns3 fix use-after-free at workaround 2
platform/chrome: cros_ec_proto: don't show MKBP version if unsupported
PCI: Add ACS quirk for Broadcom BCM5750x NICs
drm/sun4i: dsi: Prevent underflow when computing packet sizes
netfilter: add helper function to set up the nfnetlink header and use it
netfilter: nftables: add helper function to set the base sequence number
audit: log nftables configuration change events once per table
drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
ASoC: SOF: intel: move sof_intel_dsp_desc() forward
locking/atomic: Make test_and_*_bit() ordered on failure
gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
kbuild: fix the modules order between drivers and libs
igb: Add lock to avoid data race
stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
fec: Fix timer capture timing in `fec_ptp_enable_pps()`
i40e: Fix to stop tx_timeout recovery if GLOBR fails
regulator: pca9450: Remove restrictions for regulator-name
i2c: imx: Make sure to unregister adapter on remove()
ice: Ignore EEXIST when setting promisc mode
net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
net: genl: fix error path memory leak in policy dumping
net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters
net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry
net: moxa: pass pdev instead of ndev to DMA functions
net: dsa: mv88e6060: prevent crash on an unused port
spi: meson-spicc: add local pow2 clock ops to preserve rate between messages
powerpc/pci: Fix get_phb_number() locking
netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified
netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag
netfilter: nf_tables: really skip inactive sets when allocating name
ASoC: tas2770: Fix handling of mute/unmute
ASoC: tas2770: Drop conflicting set_bias_level power setting
ASoC: tas2770: Allow mono streams
ASoC: tas2770: Set correct FSYNC polarity
iavf: Fix adminq error handling
nios2: add force_successful_syscall_return()
nios2: restarts apply only to the first sigframe we build...
nios2: fix syscall restart checks
nios2: traced syscall does need to check the syscall number
nios2: don't leave NULLs in sys_call_table[]
nios2: page fault et.al. are *not* restartable syscalls...
dpaa2-eth: trace the allocated address instead of page struct
perf probe: Fix an error handling path in 'parse_perf_probe_command()'
geneve: fix TOS inheriting for ipv4
atm: idt77252: fix use-after-free bugs caused by tst_timer
xen/xenbus: fix return type in xenbus_file_read()
nfp: ethtool: fix the display error of `ethtool -m DEVNAME`
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
tools build: Switch to new openssl API for test-libcrypto
kbuild: dummy-tools: avoid tmpdir leak in dummy gcc
ceph: don't leak snap_rwsem in handle_cap_grant
tools/vm/slabinfo: use alphabetic order when two values are equal
ceph: use correct index when encoding client supported features
dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources
dt-bindings: arm: qcom: fix MSM8916 MTP compatibles
vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
vsock: Fix memory leak in vsock_connect()
plip: avoid rcu debug splat
ipv6: do not use RT_TOS for IPv6 flowlabel
geneve: do not use RT_TOS for IPv6 flowlabel
ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
pinctrl: qcom: sm8250: Fix PDC map
pinctrl: sunxi: Add I/O bias setting for H6 R-PIO
pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
net: bgmac: Fix a BUG triggered by wrong bytes_compl
devlink: Fix use-after-free after a failed reload
virtio_net: fix memory leak inside XPD_TX with mergeable
SUNRPC: Reinitialise the backchannel request buffers before reuse
sunrpc: fix expiry of auth creds
net: atlantic: fix aq_vec index out of range error
can: mcp251x: Fix race condition on receive interrupt
bpf: Check the validity of max_rdwr_access for sock local storage map iterator
bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator
bpf: Acquire map uref in .init_seq_private for sock local storage map iterator
bpf: Acquire map uref in .init_seq_private for hash map iterator
bpf: Acquire map uref in .init_seq_private for array map iterator
NFSv4/pnfs: Fix a use-after-free bug in open
NFSv4.1: RECLAIM_COMPLETE must handle EACCES
NFSv4: Fix races in the legacy idmapper upcall
NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly
NFSv4.1: Don't decrease the value of seq_nr_highest_sent
Documentation: ACPI: EINJ: Fix obsolete example
apparmor: Fix memleak in aa_simple_write_to_buffer()
apparmor: fix reference count leak in aa_pivotroot()
apparmor: fix overlapping attachment computation
apparmor: fix setting unconfined mode on a loaded profile
apparmor: fix aa_label_asxprint return check
apparmor: Fix failed mount permission check error message
apparmor: fix absroot causing audited secids to begin with =
apparmor: fix quiet_denied for file rules
can: ems_usb: fix clang's -Wunaligned-access warning
ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II
tracing: Have filter accept "common_cpu" to be consistent
btrfs: fix lost error handling when looking up extended ref on log replay
mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
mmc: pxamci: Fix an error handling path in pxamci_probe()
mmc: pxamci: Fix another error handling path in pxamci_probe()
ata: libata-eh: Add missing command name
rds: add missing barrier to release_refill
x86/mm: Use proper mask when setting PUD mapping
ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
ALSA: info: Fix llseek return value when using callback
Linux 5.10.137
btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
btrfs: only write the sectors in the vertical stripe which has data stripes
sched/fair: Fix fault in reweight_entity
net_sched: cls_route: disallow handle of 0
net/9p: Initialize the iounit field during fid creation
tee: add overflow check in register_shm_helper()
kvm: x86/pmu: Fix the compare function used by the pmu event filter
mtd: rawnand: arasan: Prevent an unsupported configuration
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
drm/vc4: change vc4_dma_range_matches from a global to static
drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function
Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
tcp: fix over estimation in sk_forced_mem_schedule()
mac80211: fix a memory leak where sta_info is not freed
KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
KVM: Add infrastructure and macro to mark VM as bugged
net_sched: cls_route: remove from list when handle is 0
dm raid: fix address sanitizer warning in raid_status
dm raid: fix address sanitizer warning in raid_resume
ext4: correct the misjudgment in ext4_iget_extra_inode
ext4: correct max_inline_xattr_value_size computing
ext4: fix extent status tree race in writeback error recovery path
ext4: update s_overhead_clusters in the superblock during an on-line resize
ext4: fix use-after-free in ext4_xattr_set_entry
ext4: make sure ext4_append() always allocates new block
ext4: fix warning in ext4_iomap_begin as race between bmap and write
ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
ext4: check if directory block is within i_size
tracing: Use a struct alignof to determine trace event field alignment
tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH
KEYS: asymmetric: enforce SM2 signature use pkey algo
xen-blkfront: Apply 'feature_persistent' parameter when connect
xen-blkback: Apply 'feature_persistent' parameter when connect
xen-blkback: fix persistent grants negotiation
KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl
KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU
KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter
KVM: x86/pmu: Use different raw event masks for AMD and Intel
KVM: x86/pmu: Use binary search to check filtered events
KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh
KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4
KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops hook
KVM: SVM: Drop VMXE check from svm_set_cr4()
KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4()
KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4()
ACPI: CPPC: Do not prevent CPPC from working in the future
btrfs: reset block group chunk force if we have to wait
btrfs: reject log replay if there is unsupported RO compat flag
um: Allow PM with suspend-to-idle
timekeeping: contribute wall clock to rng on time change
dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
dm writecache: set a default MAX_WRITEBACK_JOBS
serial: 8250: Fold EndRun device support into OxSemi Tornado code
serial: 8250_pci: Replace dev_*() by pci_*() macros
serial: 8250_pci: Refactor the loop in pci_ite887x_init()
serial: 8250: Correct the clock for OxSemi PCIe devices
serial: 8250: Dissociate 4MHz Titan ports from Oxford ports
PCI/AER: Iterate over error counters instead of error strings
PCI/ERR: Recover from RCEC AER errors
PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery()
PCI/ERR: Avoid negated conditional for clarity
PCI/ERR: Use "bridge" for clarity in pcie_do_recovery()
PCI/ERR: Simplify by computing pci_pcie_type() once
PCI/ERR: Simplify by using pci_upstream_bridge()
PCI/ERR: Rename reset_link() to reset_subordinates()
PCI/ERR: Bind RCEC devices to the Root Port driver
PCI/AER: Write AER Capability only when we control it
iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS)
KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors
intel_th: pci: Add Raptor Lake-S CPU support
intel_th: pci: Add Raptor Lake-S PCH support
intel_th: pci: Add Meteor Lake-P support
firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
usbnet: smsc95xx: Avoid link settings race on interrupt reception
usbnet: smsc95xx: Don't clear read-only PHY interrupt
mtd: rawnand: arasan: Fix clock rate in NV-DDR
mtd: rawnand: arasan: Support NV-DDR interface
mtd: rawnand: arasan: Fix a macro parameter
mtd: rawnand: Add NV-DDR timings
mtd: rawnand: arasan: Check the proposed data interface is supported
mtd: rawnand: Add a helper to clarify the interface configuration
drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component
HID: hid-input: add Surface Go battery quirk
HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx
drm/mediatek: Keep dsi as LP00 before dcs cmds transfer
drm/mediatek: Allow commands to be sent during video mode
drm/i915/dg1: Update DMC_DEBUG3 register
spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
__follow_mount_rcu(): verify that mount_lock remains unchanged
Input: gscps2 - check return value of ioremap() in gscps2_probe()
posix-cpu-timers: Cleanup CPU timers before freeing them during exec
x86/olpc: fix 'logical not is only applied to the left hand side'
ftrace/x86: Add back ftrace_expected assignment
x86/bugs: Enable STIBP for IBPB mitigated RETBleed
scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests
scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os
scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection
scsi: qla2xxx: Turn off multi-queue for 8G adapters
scsi: qla2xxx: Fix discovery issues in FC-AL topology
scsi: zfcp: Fix missing auto port scan and thus missing target ports
video: fbdev: s3fb: Check the size of screen before memset_io()
video: fbdev: arkfb: Check the size of screen before memset_io()
video: fbdev: vt8623fb: Check the size of screen before memset_io()
x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y
sched: Fix the check of nr_running at queue wakelist
tools/thermal: Fix possible path truncations
video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
x86/numa: Use cpumask_available instead of hardcoded NULL check
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy()
scripts/faddr2line: Fix vmlinux detection on arm64
genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
powerpc/pci: Fix PHB numbering when using opal-phbid
kprobes: Forbid probing on trampoline and BPF code areas
perf symbol: Fail to read phdr workaround
powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
powerpc/xive: Fix refcount leak in xive_get_max_prio
powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
f2fs: write checkpoint during FG_GC
f2fs: don't set GC_FAILURE_PIN for background GC
powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32
ASoC: mchp-spdifrx: disable end of block interrupt on failures
video: fbdev: sis: fix typos in SiS_GetModeID()
video: fbdev: amba-clcd: Fix refcount leak bugs
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
ASoC: audio-graph-card: Add of_node_put() in fail path
fuse: Remove the control interface for virtio-fs
ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format
s390/zcore: fix race when reading from hardware system area
s390/dump: fix old lowcore virtual vs physical address confusion
perf tools: Fix dso_id inode generation comparison
iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
mfd: max77620: Fix refcount leak in max77620_initialise_fps
mfd: t7l66xb: Drop platform disable callback
remoteproc: sysmon: Wait for SSCTL service to come up
lib/smp_processor_id: fix imbalanced instrumentation_end() call
kfifo: fix kfifo_to_user() return type
rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
iommu/exynos: Handle failed IOMMU device registration properly
tty: n_gsm: fix missing corner cases in gsmld_poll()
tty: n_gsm: fix DM command
tty: n_gsm: fix wrong T1 retry count handling
vfio/ccw: Do not change FSM state in subchannel event
vfio/mdev: Make to_mdev_device() into a static inline
vfio: Split creation of a vfio_device into init and register ops
vfio: Simplify the lifetime logic for vfio_device
vfio: Remove extra put/gets around vfio_device->group
remoteproc: qcom: wcnss: Fix handling of IRQs
ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe()
tty: n_gsm: fix race condition in gsmld_write()
tty: n_gsm: fix packet re-transmission without open control channel
tty: n_gsm: fix non flow control frames during mux flow off
tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()
tty: n_gsm: fix user open not possible at responder until initiator open
tty: n_gsm: Delete gsmtty open SABM frame when config requester
ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables
powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable
ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header
profiling: fix shift too large makes kernel panic
selftests/livepatch: better synchronize test_klp_callbacks_busy
remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
rpmsg: mtk_rpmsg: Fix circular locking dependency
ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV
serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
serial: 8250: Export ICR access helpers for internal use
ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
ASoC: codecs: da7210: add check for i2c_add_driver
ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe
ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
ASoC: samsung: Fix error handling in aries_audio_probe
ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe
opp: Fix error check in dev_pm_opp_attach_genpd()
usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable()
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
ext4: recover csum seed of tmp_inode after migrating to extents
jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction()
nvme: use command_id instead of req->tag in trace_nvme_complete_rq()
null_blk: fix ida error handling in null_add_dev()
RDMA/rxe: Fix error unwind in rxe_create_qp()
RDMA/mlx5: Add missing check for return value in get namespace flow
selftests: kvm: set rax before vmcall
mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
RDMA/srpt: Fix a use-after-free
RDMA/srpt: Introduce a reference count in struct srpt_device
RDMA/srpt: Duplicate port name members
platform/olpc: Fix uninitialized data in debugfs write
usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
USB: serial: fix tty-port initialized comments
PCI: tegra194: Fix link up retry sequence
PCI: tegra194: Fix Root Port interrupt handling
HID: alps: Declare U1_UNICORN_LEGACY support
mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
mmc: cavium-octeon: Add of_node_put() when breaking out of loop
HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
RDMA/hns: Fix incorrect clearing of interrupt status register
RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
RDMA/qedr: Improve error logs for rdma_alloc_tid error return
RDMA/rtrs-srv: Fix modinfo output for stringify
RDMA/rtrs: Avoid Wtautological-constant-out-of-range-compare
RDMA/rtrs: Define MIN_CHUNK_SIZE
um: random: Don't initialise hwrng struct with zero
interconnect: imx: fix max_node_id
eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
usb: dwc3: qcom: fix missing optional irq warnings
usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
usb: gadget: udc: amd5536 depends on HAS_DMA
xtensa: iss: fix handling error cases in iss_net_configure()
xtensa: iss/network: provide release() callback
scsi: smartpqi: Fix DMA direction for RAID requests
PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
PCI/portdrv: Don't disable AER reporting in get_port_device_capability()
KVM: s390: pv: leak the topmost page table when destroy fails
mmc: block: Add single read for 4k sector cards
mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
memstick/ms_block: Fix a memory leak
memstick/ms_block: Fix some incorrect memory allocation
mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback
intel_th: msu: Fix vmalloced buffers
intel_th: msu-sink: Potential dereference of null pointer
intel_th: Fix a resource leak in an error handling path
PCI: endpoint: Don't stop controller when unbinding endpoint function
dmaengine: sf-pdma: Add multithread support for a DMA channel
dmaengine: sf-pdma: apply proper spinlock flags in sf_pdma_prep_dma_memcpy()
KVM: arm64: Don't return from void function
soundwire: bus_type: fix remove and shutdown support
PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists
PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
clk: qcom: camcc-sdm845: Fix topology around titan_top power domain
clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
clk: qcom: ipq8074: fix NSS port frequency tables
clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
clk: qcom: ipq8074: fix NSS core PLL-s
usb: host: xhci: use snprintf() in xhci_decode_trb()
clk: qcom: clk-krait: unlock spin after mux completion
driver core: fix potential deadlock in __driver_attach
misc: rtsx: Fix an error handling path in rtsx_pci_probe()
dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics
mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
mwifiex: Ignore BTCOEX events from the 88W8897 firmware
KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
clk: mediatek: reset: Fix written reset bit offset
iio: accel: bma400: Reordering of header files
platform/chrome: cros_ec: Always expose last resume result
iio: accel: bma400: Fix the scale min and max macro values
netfilter: xtables: Bring SPDX identifier back
usb: xhci: tegra: Fix error check
usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()
usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
fpga: altera-pr-ip: fix unsigned comparison with less than zero
mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
mtd: partitions: Fix refcount leak in parse_redboot_of
mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
HID: cp2112: prevent a buffer overflow in cp2112_xfer()
PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
mtd: rawnand: meson: Fix a potential double free issue
mtd: maps: Fix refcount leak in ap_flash_init
mtd: maps: Fix refcount leak in of_flash_probe_versatile
clk: renesas: r9a06g032: Fix UART clkgrp bitsel
wireguard: allowedips: don't corrupt stack when detecting overflow
wireguard: ratelimiter: use hrtimer in selftest
dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
net: ionic: fix error check for vlan flags in ionic_set_nic_features()
net: rose: fix netdev reference changes
netdevsim: Avoid allocation warnings triggered from user space
iavf: Fix max_rate limiting
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
tcp: Fix data-races around sysctl_tcp_l3mdev_accept.
ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH()
tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if()
inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH()
crypto: hisilicon/sec - fix auth key size error
crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq
net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS
net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version
media: cedrus: hevc: Add check for invalid timestamp
wifi: libertas: Fix possible refcount leak in if_usb_probe()
wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
i2c: mux-gpmux: Add of_node_put() when breaking out of loop
i2c: cadence: Support PEC for SMBus block read
Bluetooth: hci_intel: Add check for platform_driver_register
can: pch_can: pch_can_error(): initialize errc before using it
can: error: specify the values of data[5..7] of CAN error frames
can: usb_8dev: do not report txerr and rxerr during bus-off
can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off
can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off
can: sun4i_can: do not report txerr and rxerr during bus-off
can: hi311x: do not report txerr and rxerr during bus-off
can: sja1000: do not report txerr and rxerr during bus-off
can: rcar_can: do not report txerr and rxerr during bus-off
can: pch_can: do not report txerr and rxerr during bus-off
selftests/bpf: fix a test for snprintf() overflow
wifi: p54: add missing parentheses in p54_flush()
wifi: p54: Fix an error handling path in p54spi_probe()
wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
fs: check FMODE_LSEEK to control internal pipe splicing
bpf: Fix subprog names in stack traces.
selftests: timers: clocksource-switch: fix passing errors from child
selftests: timers: valid-adjtimex: build fix for newer toolchains
libbpf: Fix the name of a reused map
tcp: make retransmitted SKB fit into the send window
drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed.
mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq
crypto: hisilicon/sec - don't sleep when in softirq
crypto: hisilicon/sec - fixes some coding style
drm/msm/mdp5: Fix global state lock backoff
net: hinic: avoid kernel hung in hinic_get_stats64()
net: hinic: fix bug that ethtool get wrong stats
hinic: Use the bitmap API when applicable
lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc()
lib: bitmap: order includes alphabetically
drm: bridge: sii8620: fix possible off-by-one
drm/mediatek: dpi: Only enable dpi after the bridge is enabled
drm/mediatek: dpi: Remove output format of YUV
drm/rockchip: Fix an error handling path rockchip_dp_probe()
drm/rockchip: vop: Don't crash for invalid duplicate_state()
selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0
crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE
drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes
drm/vc4: hdmi: Fix timings for interlaced modes
drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling
drm/vc4: hdmi: Don't access the connector state in reset if kmalloc fails
drm/vc4: hdmi: Avoid full hdmi audio fifo writes
drm/vc4: hdmi: Remove firmware logic for MAI threshold setting
drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration
drm/vc4: dsi: Fix dsi0 interrupt support
drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type
drm/vc4: dsi: Introduce a variant structure
drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array
drm/vc4: drv: Remove the DSI pointer in vc4_drv
drm/vc4: dsi: Correct pixel order for DSI0
drm/vc4: dsi: Correct DSI divider calculations
drm/vc4: plane: Fix margin calculations for the right/bottom edges
drm/vc4: plane: Remove subpixel positioning check
media: tw686x: Fix memory leak in tw686x_video_init
media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set
media: hdpvr: fix error value returns in hdpvr_read
drm/mcde: Fix refcount leak in mcde_dsi_bind
drm: bridge: adv7511: Add check for mipi_dsi_driver_register
crypto: ccp - During shutdown, check SEV data pointer before using
test_bpf: fix incorrect netdev features
drm/radeon: fix incorrrect SPDX-License-Identifiers
wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
media: tw686x: Register the irq at the end of probe
crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs()
i2c: Fix a potential use after free
net: fix sk_wmem_schedule() and sk_rmem_schedule() errors
crypto: sun8i-ss - fix error codes in allocate_flows()
crypto: sun8i-ss - do not allocate memory when handling hash requests
drm: adv7511: override i2c address of cec before accessing it
virtio-gpu: fix a missing check to avoid NULL dereference
i2c: npcm: Correct slave role behavior
i2c: npcm: Remove own slave addresses 2:10
drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs
drm/mediatek: Modify dsi funcs to atomic operations
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
ath11k: Fix incorrect debug_mask mappings
drm/mipi-dbi: align max_chunk to 2 in spi_transfer
ath11k: fix netdev open race
wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
drm/st7735r: Fix module autoloading for Okaya RH128128T
ath10k: do not enforce interrupt trigger type
drm/bridge: tc358767: Make sure Refclk clock are enabled
drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function
pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource()
pwm: sifive: Shut down hardware only after pwmchip_remove() completed
pwm: sifive: Ensure the clk is enabled exactly once per running PWM
pwm: sifive: Simplify offset calculation for PWMCMP registers
pwm: sifive: Don't check the return code of pwmchip_remove()
dm: return early from dm_pr_call() if DM device is suspended
thermal/tools/tmon: Include pthread and time headers in tmon.h
selftests/seccomp: Fix compile warning when CC=clang
nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX
arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment
soc: qcom: Make QCOM_RPMPD depend on PM
regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
blktrace: Trace remapped requests correctly
block: remove the request_queue to argument request based tracepoints
hwmon: (drivetemp) Add module alias
blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
erofs: avoid consecutive detection for Highmem memory
arm64: tegra: Fix SDMMC1 CD on P2888
arm64: dts: mt7622: fix BPI-R64 WPS button
bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
ARM: dts: qcom: pm8841: add required thermal-sensor-cells
soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register
soc: qcom: ocmem: Fix refcount leak in of_get_ocmem
ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
regulator: qcom_smd: Fix pm8916_pldo range
cpufreq: zynq: Fix refcount leak in zynq_get_revision
ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
ARM: OMAP2+: Fix refcount leak in omapdss_init_of
ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg
block: fix infinite loop for invalid zone append
soc: fsl: guts: machine variable might be unset
locking/lockdep: Fix lockdep_init_map_*() confusion
arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1
hexagon: select ARCH_WANT_LD_ORPHAN_WARN
ARM: dts: ast2600-evb: fix board compatible
ARM: dts: ast2500-evb: fix board compatible
x86/pmem: Fix platform-device leak in error path
arm64: dts: renesas: Fix thermal-sensors on single-zone sensors
soc: amlogic: Fix refcount leak in meson-secure-pwrc.c
soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values
Input: atmel_mxt_ts - fix up inverted RESET handler
ARM: dts: imx7d-colibri-emmc: add cpu1 supply
ACPI: processor/idle: Annotate more functions to live in cpuidle section
ARM: bcm: Fix refcount leak in bcm_kona_smc_init
arm64: dts: renesas: beacon: Fix regulator node names
meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
ARM: findbit: fix overflowing offset
spi: spi-rspi: Fix PIO fallback on RZ platforms
powerpc/64s: Disable stack variable initialisation for prom_init
selinux: Add boundary check in put_entry()
PM: hibernate: defer device probing when resuming from hibernation
firmware: tegra: Fix error check return value of debugfs_create_file()
ARM: shmobile: rcar-gen2: Increase refcount for new reference
arm64: dts: allwinner: a64: orangepi-win: Fix LED node name
arm64: dts: qcom: ipq8074: fix NAND node name
ACPI: LPSS: Fix missing check in register_device_clock()
ACPI: PM: save NVS memory for Lenovo G40-45
ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk
ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks
ARM: OMAP2+: display: Fix refcount leak bug
spi: synquacer: Add missing clk_disable_unprepare()
ARM: dts: BCM5301X: Add DT for Meraki MR26
ARM: dts: imx6ul: fix qspi node compatible
ARM: dts: imx6ul: fix lcdif node compatible
ARM: dts: imx6ul: fix csi node compatible
ARM: dts: imx6ul: fix keypad compatible
ARM: dts: imx6ul: change operating-points to uint32-matrix
ARM: dts: imx6ul: add missing properties for sram
wait: Fix __wait_event_hrtimeout for RT/DL tasks
irqchip/mips-gic: Check the return value of ioremap() in gic_of_init()
genirq: GENERIC_IRQ_IPI depends on SMP
irqchip/mips-gic: Only register IPI domain when SMP is enabled
genirq: Don't return error on missing optional irq_request_resources()
ext2: Add more validity checks for inode counts
arm64: fix oops in concurrently setting insn_emulation sysctls
arm64: Do not forget syscall when starting a new thread.
x86: Handle idle=nomwait cmdline properly for x86_idle
epoll: autoremove wakers even more aggressively
netfilter: nf_tables: fix null deref due to zeroed list head
netfilter: nf_tables: do not allow RULE_ID to refer to another chain
netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
netfilter: nf_tables: do not allow SET_ID to refer to another table
lockdep: Allow tuning tracing capacity constants.
usb: dwc3: gadget: fix high speed multiplier setting
usb: dwc3: gadget: refactor dwc3_repare_one_trb
arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
USB: HCD: Fix URB giveback issue in tasklet function
usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
coresight: Clear the connection field properly
MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
powerpc/powernv: Avoid crashing if rng is NULL
powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
powerpc/fsl-pci: Fix Class Code of PCIe Root Port
PCI: Add defines for normal and subtractive PCI bridges
ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator
md-raid10: fix KASAN warning
md-raid: destroy the bitmap after destroying the thread
serial: mvebu-uart: uart2 error bits clearing
fuse: limit nsec
scsi: qla2xxx: Zero undefined mailbox IN registers
scsi: qla2xxx: Fix incorrect display of max frame size
scsi: sg: Allow waiting for commands to complete on removed device
iio: light: isl29028: Fix the warning in isl29028_remove()
mtd: rawnand: arasan: Update NAND bus clock instead of system clock
drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime
drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend()
drm/nouveau: fix another off-by-one in nvbios_addr
drm/vc4: hdmi: Disable audio if dmas property is present but empty
drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error
parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode
parisc: Check the return value of ioremap() in lba_driver_probe()
parisc: Fix device names in /proc/iomem
ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
usbnet: Fix linkwatch use-after-free on disconnect
fbcon: Fix accelerated fbdev scrolling while logo is still shown
fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
thermal: sysfs: Fix cooling_device_stats_setup() error code path
fs: Add missing umask strip in vfs_tmpfile
vfs: Check the truncate maximum size in inode_newsize_ok()
tty: vt: initialize unicode screen buffer
ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED
ALSA: hda/realtek: Add quirk for another Asus K42JZ model
ALSA: hda/cirrus - support for iMac 12,1 model
ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
mm/mremap: hold the rmap lock in write mode when moving page table entries.
xfs: fix I_DONTCACHE
xfs: only set IOMAP_F_SHARED when providing a srcmap to a write
mm: Add kvrealloc()
riscv: set default pm_power_off to NULL
KVM: x86: Tag kvm_mmu_x86_module_init() with __init
KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value
KVM: s390: pv: don't present the ecall interrupt twice
KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case
KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
HID: wacom: Don't register pad_input for touch switch
HID: wacom: Only report rotation for art pen
add barriers to buffer_uptodate and set_buffer_uptodate
wifi: mac80211_hwsim: use 32-bit skb cookie
wifi: mac80211_hwsim: add back erroneously removed cast
wifi: mac80211_hwsim: fix race condition in pending packet
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
ALSA: hda/realtek: Add quirk for Clevo NV45PZ
ALSA: bcd2000: Fix a UAF bug on the error path of probing
scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"
x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
Makefile: link with -z noexecstack --no-warn-rwx-segments
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/arm/qcom.yaml
Documentation/devicetree/bindings/clock/qcom,gcc-msm8996.yaml
Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml
drivers/interconnect/qcom/icc-rpmh.c
drivers/remoteproc/qcom_sysmon.c
drivers/rpmsg/qcom_glink_native.c
net/qrtr/qrtr.c
Change-Id: If4f77aa8e63e7847571d37c1ba947f235236afff
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
|
||
|
Lee Jones
|
e096145ac3 |
ANDROID: mm: page_pinner: ensure do_div() arguments matches with respect to type
Fixes the following compiler warnings:
mm/page_pinner.c:240:28: error: comparison of distinct pointer types
('typeof ((ts_usec)) *' (aka 'long long *') and 'uint64_t *'
(aka 'unsigned long long *')) [-Werror,-Wcompare-distinct-pointer-types]
unsigned long rem_usec = do_div(ts_usec, 1000000);
^~~~~~~~~~~~~~~~~~~~~~~~
include/asm-generic/div64.h:226:28: note: expanded from macro 'do_div'
(void)(((typeof((n)) *)0) == ((uint64_t *)0)); \
~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~
mm/page_pinner.c:312:13: error: comparison of distinct pointer types
('typeof ((ts_usec)) *' (aka 'long long *') and 'uint64_t *'
(aka 'unsigned long long *')) [-Werror,-Wcompare-distinct-pointer-types]
rem_usec = do_div(ts_usec, 1000000);
^~~~~~~~~~~~~~~~~~~~~~~~
include/asm-generic/div64.h:226:28: note: expanded from macro 'do_div'
(void)(((typeof((n)) *)0) == ((uint64_t *)0)); \
~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~
Bug: 261962742
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I63bc6e2d82bfd757c4bf9df53a1a17a1a6235ba7
|
||
Hugh Dickins
|
8bc72b4952 |
mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
commit ab0c3f1251b4670978fde0bd54161795a139b060 upstream. uprobe_write_opcode() uses collapse_pte_mapped_thp() to restore huge pmd, when removing a breakpoint from hugepage text: vma->anon_vma is always set in that case, so undo the prohibition. And MADV_COLLAPSE ought to be able to collapse some page tables in a vma which happens to have anon_vma set from CoWing elsewhere. Is anon_vma lock required? Almost not: if any page other than expected subpage of the non-anon huge page is found in the page table, collapse is aborted without making any change. However, it is possible that an anon page was CoWed from this extent in another mm or vma, in which case a concurrent lookup might look here: so keep it away while clearing pmd (but perhaps we shall go back to using pmd_lock() there in future). Note that collapse_pte_mapped_thp() is exceptional in freeing a page table without having cleared its ptes: I'm uneasy about that, and had thought pte_clear()ing appropriate; but exclusive i_mmap lock does fix the problem, and we would have to move the mmu_notification if clearing those ptes. What this fixes is not a dangerous instability. But I suggest Cc stable because uprobes "healing" has regressed in that way, so this should follow 8d3c106e19e8 into those stable releases where it was backported (and may want adjustment there - I'll supply backports as needed). Link: https://lkml.kernel.org/r/b740c9fb-edba-92ba-59fb-7a5592e5dfc@google.com Fixes: 8d3c106e19e8 ("mm/khugepaged: take the right locks for page table retraction") Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: David Hildenbrand <david@redhat.com> Cc: Jann Horn <jannh@google.com> Cc: Yang Shi <shy828301@gmail.com> Cc: Zach O'Keefe <zokeefe@google.com> Cc: Song Liu <songliubraving@fb.com> Cc: <stable@vger.kernel.org> [5.4+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
d0782c9411 |
Merge tag 'android12-5.10.160_r00' into android12-5.10
This is the merge of the upstream LTS release of 5.10.160 into the android12-5.10 branch. It contains the following commits: |
||
Peter Collingbourne
|
ca53b8f1b4 |
BACKPORT: mm: make minimum slab alignment a runtime property
When CONFIG_KASAN_HW_TAGS is enabled we currently increase the minimum slab alignment to 16. This happens even if MTE is not supported in hardware or disabled via kasan=off, which creates an unnecessary memory overhead in those cases. Eliminate this overhead by making the minimum slab alignment a runtime property and only aligning to 16 if KASAN is enabled at runtime. On a DragonBoard 845c (non-MTE hardware) with a kernel built with CONFIG_KASAN_HW_TAGS, waiting for quiescence after a full Android boot I see the following Slab measurements in /proc/meminfo (median of 3 reboots): Before: 169020 kB After: 167304 kB [akpm@linux-foundation.org: make slab alignment type `unsigned int' to avoid casting] Link: https://linux-review.googlesource.com/id/I752e725179b43b144153f4b6f584ceb646473ead Link: https://lkml.kernel.org/r/20220427195820.1716975-2-pcc@google.com Signed-off-by: Peter Collingbourne <pcc@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Tested-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Acked-by: David Rientjes <rientjes@google.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Cc: Pekka Enberg <penberg@kernel.org> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 265364138 (cherry picked from commit d949a8155d139aa890795b802004a196b7f00598) [Zhenhua: fold 587cfd8e66df3515 ("ANDROID: fix alignment of struct shash_desc member") into this change, to keep ABI compatibility] Change-Id: I3749f8de65ef3619724e68a9affb4eefd1ebe737 Signed-off-by: Jaewon Kim <jaewon31.kim@samsung.com> Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com> |
||
|
Aaron Thompson
|
60806adc9b |
mm: Always release pages to the buddy allocator in memblock_free_late().
[ Upstream commit 115d9d77bb0f9152c60b6e8646369fa7f6167593 ]
If CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, memblock_free_pages()
only releases pages to the buddy allocator if they are not in the
deferred range. This is correct for free pages (as defined by
for_each_free_mem_pfn_range_in_zone()) because free pages in the
deferred range will be initialized and released as part of the deferred
init process. memblock_free_pages() is called by memblock_free_late(),
which is used to free reserved ranges after memblock_free_all() has
run. All pages in reserved ranges have been initialized at that point,
and accordingly, those pages are not touched by the deferred init
process. This means that currently, if the pages that
memblock_free_late() intends to release are in the deferred range, they
will never be released to the buddy allocator. They will forever be
reserved.
In addition, memblock_free_pages() calls kmsan_memblock_free_pages(),
which is also correct for free pages but is not correct for reserved
pages. KMSAN metadata for reserved pages is initialized by
kmsan_init_shadow(), which runs shortly before memblock_free_all().
For both of these reasons, memblock_free_pages() should only be called
for free pages, and memblock_free_late() should call __free_pages_core()
directly instead.
One case where this issue can occur in the wild is EFI boot on
x86_64. The x86 EFI code reserves all EFI boot services memory ranges
via memblock_reserve() and frees them later via memblock_free_late()
(efi_reserve_boot_services() and efi_free_boot_services(),
respectively). If any of those ranges happens to fall within the
deferred init range, the pages will not be released and that memory will
be unavailable.
For example, on an Amazon EC2 t3.micro VM (1 GB) booting via EFI:
v6.2-rc2:
# grep -E 'Node|spanned|present|managed' /proc/zoneinfo
Node 0, zone DMA
spanned 4095
present 3999
managed 3840
Node 0, zone DMA32
spanned 246652
present 245868
managed 178867
v6.2-rc2 + patch:
# grep -E 'Node|spanned|present|managed' /proc/zoneinfo
Node 0, zone DMA
spanned 4095
present 3999
managed 3840
Node 0, zone DMA32
spanned 246652
present 245868
managed 222816 # +43,949 pages
Fixes:
|
||
NARIBAYASHI Akira
|
882734bbc5 |
mm, compaction: fix fast_isolate_around() to stay within boundaries
commit be21b32afe470c5ae98e27e49201158a47032942 upstream.
Depending on the memory configuration, isolate_freepages_block() may scan
pages out of the target range and causes panic.
Panic can occur on systems with multiple zones in a single pageblock.
The reason it is rare is that it only happens in special
configurations. Depending on how many similar systems there are, it
may be a good idea to fix this problem for older kernels as well.
The problem is that pfn as argument of fast_isolate_around() could be out
of the target range. Therefore we should consider the case where pfn <
start_pfn, and also the case where end_pfn < pfn.
This problem should have been addressd by the commit 6e2b7044c199 ("mm,
compaction: make fast_isolate_freepages() stay within zone") but there was
an oversight.
Case1: pfn < start_pfn
<at memory compaction for node Y>
| node X's zone | node Y's zone
+-----------------+------------------------------...
pageblock ^ ^ ^
+-----------+-----------+-----------+-----------+...
^ ^ ^
^ ^ end_pfn
^ start_pfn = cc->zone->zone_start_pfn
pfn
<---------> scanned range by "Scan After"
Case2: end_pfn < pfn
<at memory compaction for node X>
| node X's zone | node Y's zone
+-----------------+------------------------------...
pageblock ^ ^ ^
+-----------+-----------+-----------+-----------+...
^ ^ ^
^ ^ pfn
^ end_pfn
start_pfn
<---------> scanned range by "Scan Before"
It seems that there is no good reason to skip nr_isolated pages just after
given pfn. So let perform simple scan from start to end instead of
dividing the scan into "Before" and "After".
Link: https://lkml.kernel.org/r/20221026112438.236336-1-a.naribayashi@fujitsu.com
Fixes: 6e2b7044c199 ("mm, compaction: make fast_isolate_freepages() stay within zone").
Signed-off-by: NARIBAYASHI Akira <a.naribayashi@fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Kalesh Singh
|
529351c4c8 |
ANDROID: Re-enable fast mremap and fix UAF with SPF
SPF attempts page faults without taking the mmap lock, but takes the
PTL. If there is a concurrent fast mremap (at PMD/PUD level), this
can lead to a UAF as fast mremap will only take the PTL locks at the
PMD/PUD level. SPF cannot take the PTL locks at the larger subtree
granularity since this introduces much contention in the page fault
paths.
To address the race:
1) Only try fast mremaps if there are no users of the VMA. Android
is concerned with this optimization in the context of
GC stop-the-world pause. So there are no other threads active
and this should almost always succeed.
2) Speculative faults detect ongoing fast mremaps and fallback
to conventional fault handling (taking mmap read lock).
Bug: 263177905
Change-Id: I23917e493ddc8576de19883cac053dfde9982b7f
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
|
||
|
Kalesh Singh
|
c67f268c84 |
Revert "ANDROID: Make SPF aware of fast mremaps"
This reverts commit
|
||
|
deyaoren@google.com
|
951b126e89 |
Merge remote-tracking branch into HEAD
* keystone/mirror-android12-5.10-2022-12: (1379 commits)
UPSTREAM: bpf: Ensure correct locking around vulnerable function find_vpid()
BACKPORT: UPSTREAM: usb: typec: ucsi: Wait for the USB role switches
UPSTREAM: HID: roccat: Fix use-after-free in roccat_read()
ANDROID: arm64: mm: perform clean & invalidation in __dma_map_area
BACKPORT: ANDROID: dma-buf: heaps: replace mutex lock with spinlock
UPSTREAM: binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
UPSTREAM: binder: Address corner cases in deferred copy and fixup
UPSTREAM: binder: fix pointer cast warning
UPSTREAM: binder: defer copies of pre-patched txn data
UPSTREAM: binder: read pre-translated fds from sender buffer
UPSTREAM: binder: avoid potential data leakage when copying txn
ANDROID: khugepaged: fix mixing declarations warning in retract_page_tables
ANDROID: mm: fix build issue in spf when CONFIG_USERFAULTFD=n
ANDROID: mm: disable speculative page faults for CONFIG_NUMA
ANDROID: mm: fix invalid backport in speculative page fault path
ANDROID: disable page table moves when speculative page faults are enabled
ANDROID: mm: assert that mmap_lock is taken exclusively in vm_write_begin
ANDROID: mm: remove sequence counting when mmap_lock is not exclusively owned
ANDROID: mm/khugepaged: add missing vm_write_{begin|end}
BACKPORT: FROMLIST: mm: implement speculative handling in filemap_fault()
...
Change-Id: I467114757562b4a34a34aeae94d93694fe225667
|
||
|
Suren Baghdasaryan
|
a43cd1f2bb |
Revert "Revert "ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath.""
This reverts commit
|
||
|
Suren Baghdasaryan
|
975fb682de |
ANDROID: mm: disable speculative page faults for CONFIG_NUMA
NUMA support with speculative page faults might be broken if
vma_replace_policy() replaces the mempolicy object used in
do_anonymous_page()
alloc_zeroed_user_highpage_movable()
alloc_page_vma()
alloc_pages_vma()
get_vma_policy()
__get_vma_policy() in speculative path does not always refcounts the
mempolicy object, therefore can't be relied on stabilizing it.
Rather than fixing this, just disable speculation for CONFIG_NUMA
for now and fix it if it's ever needed in Android.
Bug: 257443051
Change-Id: Ib5750b9809979a69a42ebfa6c130e123f416f1aa
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Lee Jones <joneslee@google.com>
|
||
|
Suren Baghdasaryan
|
e4ec065a37 |
ANDROID: disable page table moves when speculative page faults are enabled
move_page_tables() can move entire pmd or pud without locking individual ptes. This is problematic for speculative page faults which do not take mmap_lock because they rely on ptl lock when writing new pte value. To avoid possible race, disable move_page_tables() optimization when CONFIG_SPECULATIVE_PAGE_FAULT is enabled. Bug: 257443051 Change-Id: Ib48dda08ecad1abc60d08fc089a6566a63393c13 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Lee Jones <joneslee@google.com> |
||
|
Suren Baghdasaryan
|
0399bd7041 |
ANDROID: mm: skip pte_alloc during speculative page fault
Speculative page fault checks pmd to be valid before starting to handle the page fault and pte_alloc() should do nothing if pmd stays valid. If pmd gets changed during speculative page fault, we will detect the change later and retry with mmap_lock. Therefore pte_alloc() can be safely skipped and this prevents the racy pmd_lock() call which can access pmd->ptl after pmd was cleared. Bug: 257443051 Change-Id: Iec57df5530dba6e0e0bdf9f7500f910851c3d3fd Signed-off-by: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Lee Jones <joneslee@google.com> |
||
|
Srinivasarao Pathipati
|
f0e9702eed |
Merge keystone/android12-5.10-keystone-qcom-release.136+ (897411a) into msm-5.10
* refs/heads/tmp-897411a: ANDROID: dma-buf: don't re-purpose kobject as work_struct ANDROID: dma-buf: Fix build breakage with !CONFIG_DMABUF_SYSFS_STATS ANDROID: usb: gadget: uvc: remove duplicate code in unbind FROMGIT: mm/madvise: fix madvise_pageout for private file mappings ANDROID: arm64: mm: perform clean & invalidation in __dma_map_area BACKPORT: mm/page_alloc: always initialize memory map for the holes ANDROID: dma-buf: Add vendor hook for deferred dmabuf sysfs stats release ANDROID: dm-user: Remove bio recount in I/O path ANDROID: abi_gki_aarch64_qcom: Add wait_on_page_bit UPSTREAM: drm/meson: Fix overflow implicit truncation warnings UPSTREAM: irqchip/tegra: Fix overflow implicit truncation warnings UPSTREAM: video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write UPSTREAM: irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling UPSTREAM: mm: kfence: fix missing objcg housekeeping for SLAB UPSTREAM: clk: Fix clk_hw_get_clk() when dev is NULL UPSTREAM: arm64: kasan: fix include error in MTE functions UPSTREAM: arm64: prevent instrumentation of bp hardening callbacks UPSTREAM: PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() UPSTREAM: mm: fix use-after-free bug when mm->mmap is reused after being freed BACKPORT: vsprintf: Fix %pK with kptr_restrict == 0 UPSTREAM: net: preserve skb_end_offset() in skb_unclone_keeptruesize() BACKPORT: net: add skb_set_end_offset() helper UPSTREAM: arm64: Correct wrong label in macro __init_el2_gicv3 UPSTREAM: KVM: arm64: Stop handle_exit() from handling HVC twice when an SError occurs UPSTREAM: KVM: arm64: Avoid consuming a stale esr value when SError occur BACKPORT: arm64: Enable Cortex-A510 erratum 2051678 by default UPSTREAM: usb: typec: tcpm: Do not disconnect when receiving VSAFE0V UPSTREAM: usb: typec: tcpci: don't touch CC line if it's Vconn source UPSTREAM: dt-bindings: memory: mtk-smi: Correct minItems to 2 for the gals clocks BACKPORT: dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167 BACKPORT: dt-bindings: memory: mtk-smi: Rename clock to clocks UPSTREAM: KVM: arm64: Use shadow SPSR_EL1 when injecting exceptions on !VHE UPSTREAM: block: fix async_depth sysfs interface for mq-deadline UPSTREAM: dma-buf: cma_heap: Fix mutex locking section UPSTREAM: scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl() UPSTREAM: f2fs: include non-compressed blocks in compr_written_block UPSTREAM: kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS UPSTREAM: dma-buf: DMABUF_SYSFS_STATS should depend on DMA_SHARED_BUFFER UPSTREAM: mmflags.h: add missing __GFP_ZEROTAGS and __GFP_SKIP_KASAN_POISON names BACKPORT: scsi: ufs: Optimize serialization of setup_xfer_req() calls UPSTREAM: Kbuild: lto: fix module versionings mismatch in GNU make 3.X UPSTREAM: clk: versatile: Depend on HAS_IOMEM BACKPORT: arm64: meson: select COMMON_CLK UPSTREAM: kbuild: do not include include/config/auto.conf from adjust_autoksyms.sh UPSTREAM: inet: fully convert sk->sk_rx_dst to RCU rules ANDROID: Update symbol list for mtk FROMLIST: binder: fix UAF of alloc->vma in race with munmap() ANDROID: GKI: Update symbol list for mtk tablet projects UPSTREAM: af_key: Do not call xfrm_probe_algs in parallel UPSTREAM: mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() UPSTREAM: mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() FROMGIT: f2fs: let's avoid to get cp_rwsem twice by f2fs_evict_inode by d_invalidate ANDROID: abi_gki_aarch64_qcom: whitelist some vm symbols ANDROID: vendor_hook: skip trace_android_vh_page_trylock_set when ignore_references is true BACKPORT: ANDROID: dma-buf: Move sysfs work out of DMA-BUF export path UPSTREAM: wifi: mac80211: fix MBSSID parsing use-after-free UPSTREAM: wifi: mac80211: don't parse mbssid in assoc response UPSTREAM: mac80211: mlme: find auth challenge directly UPSTREAM: wifi: cfg80211: update hidden BSSes to avoid WARN_ON UPSTREAM: wifi: mac80211: fix crash in beacon protection for P2P-device UPSTREAM: wifi: mac80211_hwsim: avoid mac80211 warning on bad rate UPSTREAM: wifi: cfg80211: avoid nontransmitted BSS list corruption UPSTREAM: wifi: cfg80211: fix BSS refcounting bugs UPSTREAM: wifi: cfg80211: ensure length byte is present before access UPSTREAM: wifi: cfg80211/mac80211: reject bad MBSSID elements UPSTREAM: wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() ANDROID: GKI: Update symbols to symbol list ANDROID: sched: add restricted hooks to replace the former hooks ANDROID: GKI: Add symbol snd_pcm_stop_xrun ANDROID: ABI: update allowed list for galaxy ANDROID: GKI: Update symbols to symbol list UPSTREAM: dma-buf: ensure unique directory name for dmabuf stats UPSTREAM: dma-buf: call dma_buf_stats_setup after dmabuf is in valid list Conflicts: Documentation/devicetree/bindings Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml Change-Id: If8181c06536ceb430cde0826f557298b4ab648e7 Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com> |
||
|
Kalesh Singh
|
134c1aae43 |
ANDROID: Make SPF aware of fast mremaps
SPF attempts page faults without taking the mmap lock, but takes the
PTL. If there is a concurrent fast mremap (at PMD/PUD level), this
can lead to a UAF as fast mremap will only take the PTL locks at the
PMD/PUD level. SPF cannot take the PTL locks at the larger subtree
granularity since this introduces much contention in the page fault
paths.
To address the race:
1) Fast mremaps wait until there are no users of the VMA.
2) Speculative faults detect ongoing fast mremaps and fallback
to conventional fault handling (taking mmap read lock).
Since this race condition is very rare the performance impact is
negligible.
Bug: 263177905
Change-Id: If9755aa4261337fe180e3093a3cefaae8ac9ff1a
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
|
||
|
Greg Kroah-Hartman
|
01ef2d0b53 |
This is the 5.10.159 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOZpiwACgkQONu9yGCS aT6whRAArWRCd5yEvuYtdCIPQh70Yz3vhHKkeqKU3AzAOYxYB+UbmRf8i6Cgv5S7 b0Mmla4vV1w+tRZcwdPHXoNrwxQ+r6b89mywResfp+FLAti/Ak1wMNR1l0FGQTeM z2dIeuhNtVIatvpBw7E1KKGXpSRYfJuzbkT3npKRmWqv1hmcwcqkQ9uZSkFCf3dO YETpGjOk6Z8/Ml4z6gEWy54+W3nLf3X8G0i1CfDwxkxcCf4fqIgNCaGaT26Q+Yv1 GDKtAzmF/FfxwwIdwxx+Y/Iq3+ccEf2WTRQEDWb8K62TBbNjR+q1+Y3IJCfrBj+H 6sVfnyQm9fTQd7gKLy3gipJxphS4sAZ+OcwY+gMfRQBBHSmccHOC9MhQFgd+wN39 vBnCG0g6x+9J/DESPOXwrTDnWuGW1Grv7avYlJo2L4WTUFsAuDrtGdCRJ+Bwd9PH VVD6eSmXQdrFe9ttf8CQUERlWmNkAmFvT135Hf+qclNsvp7PbtCX2rjgo27NxVbo mdOkLLNXBwMNcHjhWhN7MDzoEw7gUqvWWC6vdRgQicrLJphrcV82+C0QIW3A/Uft tp/HEsHhGCX6mTXN0x9faz9WMXrfI+j6rUs0UoSVBfP+rwtCqweX5qgz5eUj2jjJ v+edcnh/2t4dVwK2dbsniw8y19tI/VHfyfMJiGSY18LsLlMrHiw= =QY26 -----END PGP SIGNATURE----- Merge 5.10.159 into android12-5.10-lts Changes in 5.10.159 arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series arm: dts: rockchip: fix node name for hym8563 rtc ARM: dts: rockchip: fix ir-receiver node names arm64: dts: rockchip: fix ir-receiver node names ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 9p/fd: Use P9_HDRSZ for header size regulator: slg51000: Wait after asserting CS pin ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event btrfs: send: avoid unaligned encoded writes when attempting to clone range ASoC: soc-pcm: Add NULL check in BE reparenting regulator: twl6030: fix get status of twl6032 regulators fbcon: Use kzalloc() in fbcon_prepare_logo() usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer 9p/xen: check logical size for buffer size net: usb: qmi_wwan: add u-blox 0x1342 composition mm/khugepaged: take the right locks for page table retraction mm/khugepaged: fix GUP-fast interaction by sending IPI mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths rtc: mc146818: Prevent reading garbage rtc: mc146818: Detect and handle broken RTCs rtc: mc146818: Dont test for bit 0-5 in Register D rtc: cmos: remove stale REVISIT comments rtc: mc146818-lib: change return values of mc146818_get_time() rtc: Check return value from mc146818_get_time() rtc: mc146818-lib: fix RTC presence check rtc: mc146818-lib: extract mc146818_avoid_UIP rtc: cmos: avoid UIP when writing alarm time rtc: cmos: avoid UIP when reading alarm time rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ rtc: mc146818: Reduce spinlock section in mc146818_set_time() xen/netback: Ensure protocol headers don't fall in the non-linear area xen/netback: do some code cleanup xen/netback: don't call kfree_skb() with interrupts disabled media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() Revert "ARM: dts: imx7: Fix NAND controller size-cells" media: v4l2-dv-timings.c: fix too strict blanking sanity checks memcg: fix possible use-after-free in memcg_write_event_control() mm/gup: fix gup_pud_range() for dax Bluetooth: btusb: Add debug message for CSR controllers Bluetooth: Fix crash when replugging CSR fake controllers KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field drm/vmwgfx: Don't use screen objects when SEV is active drm/shmem-helper: Remove errant put in error path drm/shmem-helper: Avoid vm_open error paths HID: usbhid: Add ALWAYS_POLL quirk for some mice HID: hid-lg4ff: Add check for empty lbuf HID: core: fix shift-out-of-bounds in hid_report_raw_event can: af_can: fix NULL pointer dereference in can_rcv_filter mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page rtc: cmos: Disable irq around direct invocation of cmos_interrupt() rtc: mc146818-lib: fix locking in mc146818_set_time rtc: mc146818-lib: fix signedness bug in mc146818_get_time() netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one ieee802154: cc2520: Fix error return code in cc2520_hw_init() ca8210: Fix crash by zero initializing data netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark drm/bridge: ti-sn65dsi86: Fix output polarity setting bug gpio: amd8111: Fix PCI device reference count leak e1000e: Fix TX dispatch condition igb: Allocate MSI-X vector when testing drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 af_unix: Get user_ns from in_skb in unix_diag_get_exact(). vmxnet3: correctly report encapsulated LRO packet Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() Bluetooth: Fix not cleanup led when bt_init fails net: dsa: ksz: Check return value selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() net: encx24j600: Add parentheses to fix precedence net: encx24j600: Fix invalid logic in reading of MISTAT register xen-netfront: Fix NULL sring after live migration net: mvneta: Prevent out of bounds read in mvneta_config_rss() i40e: Fix not setting default xps_cpus after reset i40e: Fix for VF MAC address 0 i40e: Disallow ip4 and ip6 l4_4_bytes NFC: nci: Bounds check struct nfc_target arrays nvme initialize core quirks before calling nvme_init_subsystem net: stmmac: fix "snps,axi-config" node property parsing ip_gre: do not report erspan version on GRE interface net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq net: hisilicon: Fix potential use-after-free in hisi_femac_rx() net: hisilicon: Fix potential use-after-free in hix5hd2_rx() tipc: Fix potential OOB in tipc_link_proto_rcv() ipv4: Fix incorrect route flushing when source address is deleted ipv4: Fix incorrect route flushing when table ID 0 is used net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() tipc: call tipc_lxc_xmit without holding node_read_lock ethernet: aeroflex: fix potential skb leak in greth_init_rings() xen/netback: fix build warning net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() ipv6: avoid use-after-free in ip6_fragment() net: mvneta: Fix an out of bounds check macsec: add missing attribute validation for offload can: esd_usb: Allow REC and TEC to return to zero Linux 5.10.159 Change-Id: I3ec26473c358ffda0ea8a8dd91ee265f58739029 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Baolin Wang
|
fccee93eb2 |
mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
commit fac35ba763ed07ba93154c95ffc0c4a55023707f upstream. On some architectures (like ARM64), it can support CONT-PTE/PMD size hugetlb, which means it can support not only PMD/PUD size hugetlb (2M and 1G), but also CONT-PTE/PMD size(64K and 32M) if a 4K page size specified. So when looking up a CONT-PTE size hugetlb page by follow_page(), it will use pte_offset_map_lock() to get the pte entry lock for the CONT-PTE size hugetlb in follow_page_pte(). However this pte entry lock is incorrect for the CONT-PTE size hugetlb, since we should use huge_pte_lock() to get the correct lock, which is mm->page_table_lock. That means the pte entry of the CONT-PTE size hugetlb under current pte lock is unstable in follow_page_pte(), we can continue to migrate or poison the pte entry of the CONT-PTE size hugetlb, which can cause some potential race issues, even though they are under the 'pte lock'. For example, suppose thread A is trying to look up a CONT-PTE size hugetlb page by move_pages() syscall under the lock, however antoher thread B can migrate the CONT-PTE hugetlb page at the same time, which will cause thread A to get an incorrect page, if thread A also wants to do page migration, then data inconsistency error occurs. Moreover we have the same issue for CONT-PMD size hugetlb in follow_huge_pmd(). To fix above issues, rename the follow_huge_pmd() as follow_huge_pmd_pte() to handle PMD and PTE level size hugetlb, which uses huge_pte_lock() to get the correct pte entry lock to make the pte entry stable. Mike said: Support for CONT_PMD/_PTE was added with |
||
John Starks
|
f1cf856123 |
mm/gup: fix gup_pud_range() for dax
commit fcd0ccd836ffad73d98a66f6fea7b16f735ea920 upstream. For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit |
||
Tejun Heo
|
f1f7f36cf6 |
memcg: fix possible use-after-free in memcg_write_event_control()
commit 4a7ba45b1a435e7097ca0f79a847d0949d0eb088 upstream. memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to |
||
Jann Horn
|
7f445ca2e0 |
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
commit f268f6cf875f3220afc77bdd0bf1bb136eb54db9 upstream. Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit |
||
|
Jann Horn
|
4a1cdb49d0 |
mm/khugepaged: fix GUP-fast interaction by sending IPI
commit 2ba99c5e08812494bc57f319fb562f527d9bacd8 upstream.
Since commit 70cbc3cc78a99 ("mm: gup: fix the fast GUP race against THP
collapse"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to
ensure that the page table was not removed by khugepaged in between.
However, lockless_pages_from_mm() still requires that the page table is
not concurrently freed. Fix it by sending IPIs (if the architecture uses
semi-RCU-style page table freeing) before freeing/reusing page tables.
Link: https://lkml.kernel.org/r/20221129154730.2274278-2-jannh@google.com
Link: https://lkml.kernel.org/r/20221128180252.1684965-2-jannh@google.com
Link: https://lkml.kernel.org/r/20221125213714.4115729-2-jannh@google.com
Fixes:
|
||
|
Jann Horn
|
cdfd3739b2 |
mm/khugepaged: take the right locks for page table retraction
commit 8d3c106e19e8d251da31ff4cc7462e4565d65084 upstream.
pagetable walks on address ranges mapped by VMAs can be done under the
mmap lock, the lock of an anon_vma attached to the VMA, or the lock of the
VMA's address_space. Only one of these needs to be held, and it does not
need to be held in exclusive mode.
Under those circumstances, the rules for concurrent access to page table
entries are:
- Terminal page table entries (entries that don't point to another page
table) can be arbitrarily changed under the page table lock, with the
exception that they always need to be consistent for
hardware page table walks and lockless_pages_from_mm().
This includes that they can be changed into non-terminal entries.
- Non-terminal page table entries (which point to another page table)
can not be modified; readers are allowed to READ_ONCE() an entry, verify
that it is non-terminal, and then assume that its value will stay as-is.
Retracting a page table involves modifying a non-terminal entry, so
page-table-level locks are insufficient to protect against concurrent page
table traversal; it requires taking all the higher-level locks under which
it is possible to start a page walk in the relevant range in exclusive
mode.
The collapse_huge_page() path for anonymous THP already follows this rule,
but the shmem/file THP path was getting it wrong, making it possible for
concurrent rmap-based operations to cause corruption.
Link: https://lkml.kernel.org/r/20221129154730.2274278-1-jannh@google.com
Link: https://lkml.kernel.org/r/20221128180252.1684965-1-jannh@google.com
Link: https://lkml.kernel.org/r/20221125213714.4115729-1-jannh@google.com
Fixes:
|
||
|
Greg Kroah-Hartman
|
5ab4c6b843 |
This is the 5.10.158 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmORvAIACgkQONu9yGCS
aT6OMhAAkxn/BD0mYER+XMJK+z5KIgusOh2TbHJGIkHUmj1u6Fse8VfR1xAjTk5q
y3J0uX5Bung1FIsA8iVF7no1D4ungqsyXUt6cclO8X3dVQAV8ikNDRTu2FFLiywY
4QxJ/h1Nhl+6lb1lqHT+iSEuMAjlUr6DtAq4hb9Xxgbn9hOghTMzg4dZYjXI3cr4
Bxk/tunrp8Rc5ad/I9Gwba0ar23cFDLYNxT6VKn+FBJ2jcj/74ULjwPvT3SyAm2U
hONKAQQZNtGPmGsUXkjdjhz7VaceNlLp0bA92AqCvNEmbnJzjb21qAklfdNAvEGH
yP4GOdxDvmwzPxkxpZfa0I3OYpfxAwT2bG6mVSl7+Ok8LNIiKvvD+TlL0p+nqoe1
LogxV309xqpN+D3EgUnX03lLkJDfWfrZyhEIPgEuRdW7OjixqYOs0hWLmkF0QCi6
vLYRSPnsoxragShq8HrdC/QlLmLCckMy8i7bcCiwpSwcsL/1vVUnb05O6iaFoIc4
56nTifRT5p3nJlnjQhCyPVbxmF8CRlhsRwbOsA+0pklkTQx5qHaYMFLuXsd7nSFG
+le0Kuc+xTMdP/ABgs2s3UdZFh3Zevovt4gaOnYjC6EDbmoeG6DNTTzIbNEwa1vw
D6+Zrw3HePytwJcUNRHthXuTUN2V68YvsXu7zVhKU8mlyj+UXpE=
=Zr7b
-----END PGP SIGNATURE-----
Merge 5.10.158 into android12-5.10-lts
Changes in 5.10.158
btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino
btrfs: free btrfs_path before copying inodes to userspace
spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
drm/amdgpu: update drm_display_info correctly when the edid is read
drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
iio: health: afe4403: Fix oob read in afe4403_read_raw
iio: health:
|
||
Pavankumar Kondeti
|
81a0f22464 |
FROMGIT: mm/madvise: fix madvise_pageout for private file mappings
When MADV_PAGEOUT is called on a private file mapping VMA region,
we bail out early if the process is neither owner nor write capable
of the file. However, this VMA may have both private/shared clean
pages and private dirty pages. The opportunity of paging out the
private dirty pages (Anon pages) is missed. Fix this by caching
the file access check and use it later along with PageAnon() during
page walk.
We observe ~10% improvement in zram usage, thus leaving more available
memory on a 4GB RAM system running Android.
Link: https://lkml.kernel.org/r/1667971116-12900-1-git-send-email-quic_pkondeti@quicinc.com
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Cc: Charan Teja Kalla <quic_charante@quicinc.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 8fc5be8efc3cf356f25098fbd4bda7c0e949c2ea
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable)
Bug: 259329159
Bug: 261815590
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Change-Id: I5f2d425aec94e5a75ebeaf90f9f5d7adf1975c59
(cherry picked from commit
|
||
Linus Torvalds
|
d072a10c81 |
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
commit 6647e76ab623b2b3fb2efe03a86e9c9046c52c33 upstream.
The V4L2_MEMORY_USERPTR interface is long deprecated and shouldn't be
used (and is discouraged for any modern v4l drivers). And Seth Jenkins
points out that the fallback to VM_PFNMAP/VM_IO is fundamentally racy
and dangerous.
Note that it's not even a case that should trigger, since any normal
user pointer logic ends up just using the pin_user_pages_fast() call
that does the proper page reference counting. That's not the problem
case, only if you try to use special device mappings do you have any
issues.
Normally I'd just remove this during the merge window, but since Seth
pointed out the problem cases, we really want to know as soon as
possible if there are actually any users of this odd special case of a
legacy interface. Neither Hans nor Mauro seem to think that such
mis-uses of the old legacy interface should exist. As Mauro says:
"See, V4L2 has actually 4 streaming APIs:
- Kernel-allocated mmap (usually referred simply as just mmap);
- USERPTR mmap;
- read();
- dmabuf;
The USERPTR is one of the oldest way to use it, coming from V4L
version 1 times, and by far the least used one"
And Hans chimed in on the USERPTR interface:
"To be honest, I wouldn't mind if it goes away completely, but that's a
bit of a pipe dream right now"
but while removing this legacy interface entirely may be a pipe dream we
can at least try to remove the unlikely (and actively broken) case of
using special device mappings for USERPTR accesses.
This replaces it with a WARN_ONCE() that we can remove once we've
hopefully confirmed that no actual users exist.
NOTE! Longer term, this means that a 'struct frame_vector' only ever
contains proper page pointers, and all the games we have with converting
them to pages can go away (grep for 'frame_vector_to_pages()' and the
uses of 'vec->is_pfns'). But this is just the first step, to verify
that this code really is all dead, and do so as quickly as possible.
Reported-by: Seth Jenkins <sethjenkins@google.com>
Acked-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
982d7f3eb8 |
This is the 5.10.157 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOKKmsACgkQONu9yGCS aT73ixAAwyEk1kuY9T0i4JfjPViD9Kg+v64lGLnM88CuGjkxcT4kv2Lg/hURDD+K pObBEaOWduKVxqH/4GqpeEpqrw3bxxQJUchw1F5C2ZsLjB5mA4u9U0dqExTPIeY2 GSLdkBY/3yWBgDlpWsEHRjhzqx16ZuvHyvMGegHLG5+hNbfmfiFBhVpn8knTFaqv fXRyC9MAt072thjjuPG6QcWpWAFFTG0PWsEkNWGLw0U07FF+V7O9sWLontHi93sn seIEUPbjgGEFND2NqLfiLOLZ9m2fBB3P32L66b9rrZNZ2DPmyrNCD0WSLhlzb1OV 8yXiVEkDUozkI6W8fzVtUUjH3gYvB9e37zCYPO6WnAl5cwGhCJz1cpQfN7g7hk9H iKpetcKf7XFBRmUq2Ftnaq7KPc81dVrQ5mYfrtsT9IYDnWMdF7AcOctN+dKkCS15 QoiJklSeE28b4PZtdt7Uv7OF2qW6w+tMKSD3PJyiBHB46rcQjuuOy7ifa8VqaXHI ZO+mWUjMMUdo3q0lXoy2i5PMNrul41QMsdnrGaZxXU+LfaCVIubpHghSBHFhnFTY 3r2Fko3ZOsuAOQXX5iCTCstCEev5LH0v74bou355Y0uteueCqpnc/GSEZ8KhP+M0 kqpcyf3e6KAL7TA7eqQdptpFyDW732IgcbU4bQKUMd038Hb5I4o= =1JWA -----END PGP SIGNATURE----- Merge 5.10.157 into android12-5.10-lts Changes in 5.10.157 scsi: scsi_transport_sas: Fix error handling in sas_phy_add() ata: libata-scsi: simplify __ata_scsi_queuecmd() ata: libata-core: do not issue non-internal commands once EH is pending bridge: switchdev: Notify about VLAN protocol changes bridge: switchdev: Fix memory leaks when changing VLAN protocol drm/display: Don't assume dual mode adaptors support i2c sub-addressing nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro iio: ms5611: Simplify IO callback parameters iio: pressure: ms5611: fixed value compensation bug ceph: do not update snapshot context when there is no new snapshot ceph: avoid putting the realm twice when decoding snaps fails wifi: mac80211: fix memory free error when registering wiphy fail wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support riscv: dts: sifive unleashed: Add PWM controlled LEDs audit: fix undefined behavior in bit shift for AUDIT_BIT wifi: airo: do not assign -1 to unsigned char wifi: mac80211: Fix ack frame idr leak when mesh has no route spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run selftests/bpf: Add verifier test for release_reference() Revert "net: macsec: report real_dev features when HW offloading is enabled" platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 scsi: ibmvfc: Avoid path failures during live migration scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) block, bfq: fix null pointer dereference in bfq_bio_bfqg() arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. RISC-V: vdso: Do not add missing symbols to version section in linker script MIPS: pic32: treat port as signed integer xfrm: fix "disable_policy" on ipv4 early demux xfrm: replay: Fix ESN wrap around for GSO af_key: Fix send_acquire race with pfkey_register ARM: dts: am335x-pcm-953: Define fixed regulators in root node ASoC: hdac_hda: fix hda pcm buffer overflow issue ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() scsi: storvsc: Fix handling of srb_status and capacity change events regulator: core: fix kobject release warning and memory leak in regulator_register() spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() regulator: core: fix UAF in destroy_regulator() bus: sunxi-rsb: Support atomic transfers tee: optee: fix possible memory leak in optee_register_device() ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl net: liquidio: simplify if expression rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc rxrpc: Use refcount_t rather than atomic_t rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] nfc/nci: fix race with opening and closing net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() 9p/fd: fix issue of list_del corruption in p9_fd_cancel() netfilter: conntrack: Fix data-races around ct mark ARM: mxs: fix memory leak in mxs_machine_init() ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties net: ethernet: mtk_eth_soc: fix error handling in mtk_open() net/mlx4: Check retval of mlx4_bitmap_init net/qla3xxx: fix potential memleak in ql3xxx_send() net: pch_gbe: fix pci device refcount leak while module exiting nfp: fill splittable of devlink_port_attrs correctly nfp: add port from netdev validation for EEPROM access macsec: Fix invalid error code set Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() netfilter: ipset: Limit the maximal range of consecutive elements to add/delete netfilter: ipset: regression in ip_set_hash_ip.c net/mlx5: Fix FW tracer timestamp calculation net/mlx5: Fix handling of entry refcount when command is not issued to FW tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc tipc: check skb_linearize() return value in tipc_disc_rcv() xfrm: Fix ignored return value in xfrm6_init() sfc: fix potential memleak in __ef100_hard_start_xmit() net: sched: allow act_ct to be built without NF_NAT NFC: nci: fix memory leak in nci_rx_data_packet() regulator: twl6030: re-add TWL6032_SUBCLASS bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() dma-buf: fix racing conflict of dma_heap_add() netfilter: flowtable_offload: add missing locking dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). ipv4: Fix error return code in fib_table_insert() s390/dasd: fix no record found for raw_track_access net: arcnet: Fix RESET flag handling arcnet: fix potential memory leak in com20020_probe() nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION nfc: st-nci: fix memory leaks in EVT_TRANSACTION net: thunderx: Fix the ACPI memory leak s390/crashdump: fix TOD programmable field size net: enetc: manage ENETC_F_QBV in priv->active_offloads only when enabled net: enetc: cache accesses to &priv->si->hw net: enetc: preserve TX ring priority across reconfiguration lib/vdso: use "grep -E" instead of "egrep" usb: dwc3: exynos: Fix remove() function ext4: fix use-after-free in ext4_ext_shift_extents arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency iio: light: apds9960: fix wrong register for gesture gain iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash nios2: add FORCE for vmlinuz.gz mmc: sdhci-brcmstb: Re-organize flags mmc: sdhci-brcmstb: Enable Clock Gating to save power mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI usb: cdns3: Add support for DRD CDNSP ceph: make ceph_create_session_msg a global symbol ceph: make iterate_sessions a global symbol ceph: flush mdlog before umounting ceph: flush the mdlog before waiting on unsafe reqs ceph: fix off by one bugs in unsafe_request_wait() ceph: put the requests/sessions when it fails to alloc memory ceph: fix possible NULL pointer dereference for req->r_session ceph: Use kcalloc for allocating multiple elements ceph: fix NULL pointer dereference for req->r_session usb: dwc3: gadget: conditionally remove requests usb: dwc3: gadget: Return -ESHUTDOWN on ep disable usb: dwc3: gadget: Clear ep descriptor last nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty gcov: clang: fix the buffer overflow issue mm: vmscan: fix extreme overreclaim and swap floods KVM: x86: nSVM: leave nested mode on vCPU free KVM: x86: remove exit_int_info warning in svm_handle_exit x86/ioremap: Fix page aligned size calculation in __ioremap_caller() binder: avoid potential data leakage when copying txn binder: read pre-translated fds from sender buffer binder: defer copies of pre-patched txn data binder: fix pointer cast warning binder: Address corner cases in deferred copy and fixup binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() Input: goodix - try resetting the controller when no config is set Input: soc_button_array - add use_low_level_irq module parameter Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too xen/platform-pci: add missing free_irq() in error path platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) zonefs: fix zone report size in __zonefs_io_error() platform/x86: hp-wmi: Ignore Smart Experience App event tcp: configurable source port perturb table size net: usb: qmi_wwan: add Telit 0x103a composition gpu: host1x: Avoid trying to use GART on Tegra20 dm integrity: flush the journal on suspend dm integrity: clear the journal on suspend wifi: wilc1000: validate pairwise and authentication suite offsets wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute wifi: wilc1000: validate number of channels genirq/msi: Shutdown managed interrupts with unsatifiable affinities genirq: Always limit the affinity to online CPUs irqchip/gic-v3: Always trust the managed affinity provided by the core code genirq: Take the proposed affinity at face value if force==true btrfs: free btrfs_path before copying root refs to userspace btrfs: free btrfs_path before copying fspath to userspace btrfs: free btrfs_path before copying subvol info to userspace btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN drm/amdgpu: always register an MMU notifier for userptr drm/i915: fix TLB invalidation for Gen12 video and compute engines fuse: lock inode unconditionally in fuse_fallocate() Linux 5.10.157 Change-Id: Ie53a7379c392879de240237eb8258857b59564a6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Johannes Weiner
|
d925dd3e44 |
mm: vmscan: fix extreme overreclaim and swap floods
commit f53af4285d775cd9a9a146fc438bd0a1bee1838a upstream.
During proactive reclaim, we sometimes observe severe overreclaim, with
several thousand times more pages reclaimed than requested.
This trace was obtained from shrink_lruvec() during such an instance:
prio:0 anon_cost:1141521 file_cost:7767
nr_reclaimed:4387406 nr_to_reclaim:1047 (or_factor:4190)
nr=[7161123 345 578 1111]
While he reclaimer requested 4M, vmscan reclaimed close to 16G, most of it
by swapping. These requests take over a minute, during which the write()
to memory.reclaim is unkillably stuck inside the kernel.
Digging into the source, this is caused by the proportional reclaim
bailout logic. This code tries to resolve a fundamental conflict: to
reclaim roughly what was requested, while also aging all LRUs fairly and
in accordance to their size, swappiness, refault rates etc. The way it
attempts fairness is that once the reclaim goal has been reached, it stops
scanning the LRUs with the smaller remaining scan targets, and adjusts the
remainder of the bigger LRUs according to how much of the smaller LRUs was
scanned. It then finishes scanning that remainder regardless of the
reclaim goal.
This works fine if priority levels are low and the LRU lists are
comparable in size. However, in this instance, the cgroup that is
targeted by proactive reclaim has almost no files left - they've already
been squeezed out by proactive reclaim earlier - and the remaining anon
pages are hot. Anon rotations cause the priority level to drop to 0,
which results in reclaim targeting all of anon (a lot) and all of file
(almost nothing). By the time reclaim decides to bail, it has scanned
most or all of the file target, and therefor must also scan most or all of
the enormous anon target. This target is thousands of times larger than
the reclaim goal, thus causing the overreclaim.
The bailout code hasn't changed in years, why is this failing now? The
most likely explanations are two other recent changes in anon reclaim:
1. Before the series starting with commit
|
||
|
Greg Kroah-Hartman
|
d9b90a99f3 |
This is the 5.10.156 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOA8VIACgkQONu9yGCS aT7Z2g/+O/03N67HvGVJavgGXI0B1DcGQYSdyyLwoHLLu6RnwUjIZVUEL8EJnC1+ HKG3l/8r2mjkD/5g1SVIDSo/6sGOQUkrWcEqmpBjUt6g6xOB1w/RWagHKYL9d+9I IEAGArdElzPFwUagYJsUoXt77ixS9R22DYWq4bqcru19+TQRZ8SP4HOEMQ+kjeFo fn0cqFsXxefhUrE4Io3gTQh9mcRI2kVJh9eCQqCrmjmuY25t4an8leEATqCEGpNT TNLdCIqpmKXPl5MuoiFQf4/0W0ymmhTU+Xa8XxVD7wW9eD1kX75uIY5MHAz9OoWw waLK5qPwQlguWhNF618nSzBaMFB1CBQ3uiSlW0BaLNLa6OIx7E3rV9PXyLJ7z3kh K+XgVXgukAtwuQvpbnE57tm78oyyq7Nw6toAAyomYyJKgZfZ6XovK35ilz32Y7Eb mxT3yA3D05SLwm92sbkDvrpyzu5ONkyf02ubDw0e2sdBOXyajwuuoxny/nlQZMxO bhN1aDIpi4cudPWEjZh2XbDDRtxTD4SOAlqfi39j11QUCwk5S+7994alBrMHPbOn RTrVnblyaKcjM5gYNRFmLygqfaHVcAd9xNpLBpuywgF8sSESYeYscdNrd1O/zeux VTIZkN/lAPqVE00QlBlYIqOIOHLzDpGN/Ba1y6EehDGWt82G8dE= =c7T7 -----END PGP SIGNATURE----- Merge 5.10.156 into android12-5.10-lts Changes in 5.10.156 ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe" ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe" ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe" ASoC: mt6660: Keep the pm_runtime enables before component stuff in mt6660_i2c_probe ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK spi: intel: Fix the offset to get the 64K erase opcode ASoC: codecs: jz4725b: add missed Line In power control bit ASoC: codecs: jz4725b: fix reported volume for Master ctl ASoC: codecs: jz4725b: use right control for Capture Volume ASoC: codecs: jz4725b: fix capture selector naming selftests/futex: fix build for clang selftests/intel_pstate: fix build for ARCH=x86_64 ASoC: rt1308-sdw: add the default value of some registers drm/amd/display: Remove wrong pipe control lock NFSv4: Retry LOCK on OLD_STATEID during delegation return i2c: tegra: Allocate DMA memory for DMA engine i2c: i801: add lis3lv02d's I2C address for Vostro 5568 drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid btrfs: remove pointless and double ulist frees in error paths of qgroup tests Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route" ALSA: hda/realtek: fix speakers and micmute on HP 855 G8 mtd: spi-nor: intel-spi: Disable write protection only if asked spi: intel: Use correct mask for flash and protected regions mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA drm/amd/pm: support power source switch on Sienna Cichlid drm/amd/pm: Read BIF STRAP also for BACO check drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid cards drm/amdgpu: disable BACO on special BEIGE_GOBY card spi: stm32: Print summary 'callbacks suppressed' message ASoC: core: Fix use-after-free in snd_soc_exit() ASoC: tas2770: Fix set_tdm_slot in case of single slot ASoC: tas2764: Fix set_tdm_slot in case of single slot serial: 8250: Remove serial_rs485 sanitization from em485 serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() serial: 8250_omap: remove wait loop from Errata i202 workaround serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() serial: 8250: omap: Flush PM QOS work on remove serial: imx: Add missing .thaw_noirq hook tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() ASoC: soc-utils: Remove __exit for snd_soc_util_exit() sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent sctp: clear out_curr if all frag chunks of current msg are pruned block: sed-opal: kmalloc the cmd/resp buffers arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro siox: fix possible memory leak in siox_device_add() parport_pc: Avoid FIFO port location truncation pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map drm/panel: simple: set bpc field for logic technologies displays drm/drv: Fix potential memory leak in drm_dev_init() drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() ARM: dts: imx7: Fix NAND controller size-cells arm64: dts: imx8mm: Fix NAND controller size-cells arm64: dts: imx8mn: Fix NAND controller size-cells ata: libata-transport: fix double ata_host_put() in ata_tport_add() ata: libata-transport: fix error handling in ata_tport_add() ata: libata-transport: fix error handling in ata_tlink_add() ata: libata-transport: fix error handling in ata_tdev_add() bpf: Initialize same number of free nodes for each pcpu_freelist net: bgmac: Drop free_netdev() from bgmac_enet_remove() mISDN: fix possible memory leak in mISDN_dsp_element_register() net: hinic: Fix error handling in hinic_module_init() net: liquidio: release resources when liquidio driver open failed mISDN: fix misuse of put_device() in mISDN_register_device() net: macvlan: Use built-in RCU list checking net: caif: fix double disconnect client in chnl_net_open() bnxt_en: Remove debugfs when pci_register_driver failed xen/pcpu: fix possible memory leak in register_pcpu() net: ionic: Fix error handling in ionic_init_module() net: ena: Fix error handling in ena_init() drbd: use after free in drbd_create_device() platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized cifs: add check for returning value of SMB2_close_init net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in ag71xx_open() net/x25: Fix skb leak in x25_lapb_receive_frame() cifs: Fix wrong return value checking when GETFLAGS net: thunderbolt: Fix error handling in tbnet_init() cifs: add check for returning value of SMB2_set_info_init ftrace: Fix the possible incorrect kernel message ftrace: Optimize the allocation for mcount entries ftrace: Fix null pointer dereference in ftrace_add_mod() ring_buffer: Do not deactivate non-existant pages tracing/ring-buffer: Have polling block on watermark tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() tracing: Fix wild-memory-access in register_synth_event() tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 Revert "usb: dwc3: disable USB core PHY management" slimbus: stream: correct presence rate frequencies speakup: fix a segfault caused by switching consoles USB: bcma: Make GPIO explicitly optional USB: serial: option: add Sierra Wireless EM9191 USB: serial: option: remove old LARA-R6 PID USB: serial: option: add u-blox LARA-R6 00B modem USB: serial: option: add u-blox LARA-L6 modem USB: serial: option: add Fibocom FM160 0x0111 composition usb: add NO_LPM quirk for Realforce 87U Keyboard usb: chipidea: fix deadlock in ci_otg_del_timer usb: typec: mux: Enter safe mode only when pins need to be reconfigured iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() iio: adc: mp2629: fix wrong comparison of channel iio: adc: mp2629: fix potential array out of bound access iio: pressure: ms5611: changed hardcoded SPI speed to value limited dm ioctl: fix misbehavior if list_versions races with module loading serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs serial: 8250: Flush DMA Rx on RLSI serial: 8250_lpss: Configure DMA also w/o DMA filter Input: iforce - invert valid length check when fetching device IDs maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault() scsi: zfcp: Fix double free of FSF request when qdio send fails iommu/vt-d: Set SRE bit only when hardware has SRS cap firmware: coreboot: Register bus in module init mmc: core: properly select voltage range without power cycle mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() docs: update mediator contact information in CoC doc misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() perf/x86/intel/pt: Fix sampling using single range output nvme: restrict management ioctls to admin nvme: ensure subsystem reset is single threaded net: fix a concurrency bug in l2tp_tunnel_register() ring-buffer: Include dropped pages in counting dirty patches usbnet: smsc95xx: Fix deadlock on runtime resume stddef: Introduce struct_group() helper macro net: use struct_group to copy ip/ipv6 header addresses scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case Input: i8042 - fix leaking of platform device on module removal uapi/linux/stddef.h: Add include guards macvlan: enforce a consistent minimal mtu tcp: cdg: allow tcp_cdg_release() to be called multiple times kcm: avoid potential race in kcm_tx_work kcm: close race conditions on sk_receive_queue 9p: trans_fd/p9_conn_cancel: drop client lock earlier gfs2: Check sb_bsize_shift after reading superblock gfs2: Switch from strlcpy to strscpy 9p/trans_fd: always use O_NONBLOCK read/write mm: fs: initialize fsdata passed to write_begin/write_end interface ntfs: fix use-after-free in ntfs_attr_find() ntfs: fix out-of-bounds read in ntfs_attr_find() ntfs: check overflow when iterating ATTR_RECORDs Revert "net: broadcom: Fix BCMGENET Kconfig" Linux 5.10.156 Change-Id: Ic9fe339913a510cc9fb9c4557b3bd6e196db834f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
25af5a11f1 |
Merge 5.10.155 into android12-5.10-lts
Changes in 5.10.155
fuse: fix readdir cache race
hwspinlock: qcom: correct MMIO max register for newer SoCs
phy: stm32: fix an error code in probe
wifi: cfg80211: silence a sparse RCU warning
wifi: cfg80211: fix memory leak in query_regdb_file()
bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE
HID: hyperv: fix possible memory leak in mousevsc_probe()
bpf: Support for pointers beyond pkt_end.
bpf: Add helper macro bpf_for_each_reg_in_vstate
bpf: Fix wrong reg type conversion in release_reference()
net: gso: fix panic on frag_list with mixed head alloc types
macsec: delete new rxsc when offload fails
macsec: fix secy->n_rx_sc accounting
macsec: fix detection of RXSCs when toggling offloading
macsec: clear encryption keys from the stack after setting up offload
net: tun: Fix memory leaks of napi_get_frags
bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
net: fman: Unregister ethernet device on removal
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
KVM: s390x: fix SCK locking
KVM: s390: pv: don't allow userspace to set the clock under PV
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
hamradio: fix issue of dev reference count leakage in bpq_device_event()
drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
can: af_can: fix NULL pointer dereference in can_rx_register()
net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable()
net: broadcom: Fix BCMGENET Kconfig
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
dmaengine: pxa_dma: use platform_get_irq_optional
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
perf stat: Fix printing os->prefix in CSV metrics output
net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init()
net: nixge: disable napi when enable interrupts failed in nixge_open()
net/mlx5: Allow async trigger completion execution on single CPU systems
net/mlx5e: E-Switch, Fix comparing termination table instance
net: cpsw: disable napi in cpsw_ndo_open()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
net: phy: mscc: macsec: clear encryption keys when freeing a flow
net: atlantic: macsec: clear encryption keys from the stack
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: tundra: free irq when alloc ring failed in tsi108_open()
net: macvlan: fix memory leaks of macvlan_common_newlink
riscv: process: fix kernel info leakage
riscv: vdso: fix build with llvm
riscv: Enable CMA support
riscv: Separate memory init from paging init
riscv: fix reserved memory setup
arm64: efi: Fix handling of misaligned runtime regions and drop warning
MIPS: jump_label: Fix compat branch range check
mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
ALSA: hda/hdmi - enable runtime pm for more AMD display audio
ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
ALSA: hda: fix potential memleak in 'add_widget_node'
ALSA: hda/realtek: Add Positivo C6300 model quirk
ALSA: usb-audio: Add quirk entry for M-Audio Micro
ALSA: usb-audio: Add DSD support for Accuphase DAC-60
vmlinux.lds.h: Fix placement of '.data..decrypted' section
ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure
nilfs2: fix deadlock in nilfs_count_free_blocks()
nilfs2: fix use-after-free bug of ns_writer on remount
drm/i915/dmabuf: fix sg_table handling in map_dma_buf
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
mm/memremap.c: map FS_DAX device memory as decrypted
can: j1939: j1939_send_one(): fix missing CAN header initialization
cert host tools: Stop complaining about deprecated OpenSSL functions
dmaengine: at_hdmac: Fix at_lli struct definition
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending
dmaengine: at_hdmac: Fix premature completion of desc in issue_pending
dmaengine: at_hdmac: Do not call the complete callback on device_terminate_all
dmaengine: at_hdmac: Protect atchan->status with the channel lock
dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all()
dmaengine: at_hdmac: Fix concurrency over descriptor
dmaengine: at_hdmac: Free the memset buf without holding the chan lock
dmaengine: at_hdmac: Fix concurrency over the active list
dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Check return code of dma_async_device_register
net: tun: call napi_schedule_prep() to ensure we own a napi
mmc: sdhci-esdhc-imx: Convert the driver to DT-only
x86/cpu: Restore AMD's DE_CFG MSR after resume
io_uring: kill goto error handling in io_sqpoll_wait_sq()
Linux 5.10.155
Change-Id: Id7d803ed2db044ef465aab7e80fca8b4b07df258
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Greg Kroah-Hartman
|
9ef4727680 |
Merge tag 'android12-5.10.149_r00' into android12-5.10
This is the merge of the upstream LTS release of 5.10.149 into the android12-5.10 branch. It contains the following commits: |
||
|
Suren Baghdasaryan
|
d95f5e3da7 |
ANDROID: khugepaged: fix mixing declarations warning in retract_page_tables
vm_write_begin() was added before variable definition, producing a
"mixing declarations and code is a C99 extension" warning. Fix by
rearranging the code.
Fixes: ("ANDROID: mm/khugepaged: add missing vm_write_{begin|end}")
Bug: 257443051
Change-Id: I6e85ccfabd5e37b1397c654d61d0b8177326c3d8
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
|
||
|
Suren Baghdasaryan
|
aaf03dd58c |
ANDROID: mm: fix build issue in spf when CONFIG_USERFAULTFD=n
When CONFIG_USERFAULTFD=n __VM_UFFD_FLAGS mask is undefined and produces
build error. Fix it by making the check conditional on CONFIG_USERFAULTFD.
Fixes: ("ANDROID: mm: prevent speculative page fault handling for userfaults")
Bug: 257443051
Change-Id: Ie9ff98b840032eb18183b49e3566cf178359948f
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
|
||
|
Suren Baghdasaryan
|
1c828eb3da |
ANDROID: mm: disable speculative page faults for CONFIG_NUMA
NUMA support with speculative page faults might be broken if
vma_replace_policy() replaces the mempolicy object used in
do_anonymous_page()
alloc_zeroed_user_highpage_movable()
alloc_page_vma()
alloc_pages_vma()
get_vma_policy()
__get_vma_policy() in speculative path does not always refcounts the
mempolicy object, therefore can't be relied on stabilizing it.
Rather than fixing this, just disable speculation for CONFIG_NUMA
for now and fix it if it's ever needed in Android.
Bug: 257443051
Change-Id: Ib5750b9809979a69a42ebfa6c130e123f416f1aa
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
|
||
|
Suren Baghdasaryan
|
1900436df5 |
ANDROID: mm: fix invalid backport in speculative page fault path
Invalid condition was introduced when porting the original SPF patch
which would affect NUMA mode.
Fixes:
|
||
|
Suren Baghdasaryan
|
0f43357d37 |
ANDROID: disable page table moves when speculative page faults are enabled
move_page_tables() can move entire pmd or pud without locking individual ptes. This is problematic for speculative page faults which do not take mmap_lock because they rely on ptl lock when writing new pte value. To avoid possible race, disable move_page_tables() optimization when CONFIG_SPECULATIVE_PAGE_FAULT is enabled. Bug: 257443051 Change-Id: Ib48dda08ecad1abc60d08fc089a6566a63393c13 Signed-off-by: Suren Baghdasaryan <surenb@google.com> |
||
|
Suren Baghdasaryan
|
bfdcf47ca3 |
ANDROID: mm: remove sequence counting when mmap_lock is not exclusively owned
In a number of cases vm_write_{begin|end} is called while mmap_lock is
not owned exclusively. This is unnecessary and can affect correctness of
the sequence counting protecting speculative page fault handlers. Remove
extra calls.
Bug: 257443051
Change-Id: I1278638a0794448e22fbdab5601212b3b2eaebdc
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
|
||
|
Suren Baghdasaryan
|
5ed391bd8a |
ANDROID: mm/khugepaged: add missing vm_write_{begin|end}
Speculative page fault handler needs to detect concurrent pmd changes
and relies on vma seqcount for that. pmdp_collapse_flush(), set_huge_pmd() and collapse_and_free_pmd() can modify a pmd.
vm_write_{begin|end} are needed in the paths which can call these
functions for page fault handler to detect pmd changes.
Bug: 257443051
Change-Id: Ieb784b5f44901b66a594f61b9e7c91190ff97f80
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
|
||
Michel Lespinasse
|
59d4d125b7 |
BACKPORT: FROMLIST: mm: implement speculative handling in filemap_fault()
Extend filemap_fault() to handle speculative faults. In the speculative case, we will only be fishing existing pages out of the page cache. The logic we use mirrors what is done in the non-speculative case, assuming that pages are found in the page cache, are up to date and not already locked, and that readahead is not necessary at this time. In all other cases, the fault is aborted to be handled non-speculatively. Signed-off-by: Michel Lespinasse <michel@lespinasse.org> Link: https://lore.kernel.org/all/20210407014502.24091-26-michel@lespinasse.org/ Conflicts: mm/filemap.c 1. Added back file_ra_state variable used by SPF path. 2. Updated comment for filemap_fault to reflect SPF locking rules. Bug: 161210518 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I82eba7fcfc81876245c2e65bc5ae3d33ddfcc368 |
||
|
Suren Baghdasaryan
|
2bb39b9121 |
ANDROID: mm: prevent reads of unstable pmd during speculation
Checks of pmd during speculative page fault handling are racy because pmd is unprotected and might be modified or cleared. This might cause use-after-free reads from speculative path, therefore prevent such checks. At the beginning of speculation pmd is checked to be valid and if it's changed before page fault is handled, the change will be detected and page fault will be retried under mmap_lock protection. Bug: 257443051 Change-Id: I0cbd3b0b44e8296cf0d6cb298fae48c696580068 Signed-off-by: Suren Baghdasaryan <surenb@google.com> |
||
|
Suren Baghdasaryan
|
4b388752ac |
ANDROID: mm: prevent speculative page fault handling for in do_swap_page()
do_swap_page() uses migration_entry_wait() which operates on page tables without protection. Disable speculative page fault handling. Bug: 257443051 Change-Id: I677eb1ee85707dce533d5d811dcde5f5dabcfdf3 Signed-off-by: Suren Baghdasaryan <surenb@google.com> |
||
|
Suren Baghdasaryan
|
0560f5f7b3 |
ANDROID: mm: prevent speculative page fault handling for userfaults
handle_userfault() should be protected against a concurrent userfaultfd_release(), therefore handling a userfaults speculatively without mmap_lock protection should be disallowed. Bug: 257443051 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: Ic6ae39329c73e8849048ea15b5351a49346404d3 |
||
|
Suren Baghdasaryan
|
1169f70f8f |
ANDROID: mm: skip pte_alloc during speculative page fault
Speculative page fault checks pmd to be valid before starting to handle the page fault and pte_alloc() should do nothing if pmd stays valid. If pmd gets changed during speculative page fault, we will detect the change later and retry with mmap_lock. Therefore pte_alloc() can be safely skipped and this prevents the racy pmd_lock() call which can access pmd->ptl after pmd was cleared. Bug: 257443051 Change-Id: Iec57df5530dba6e0e0bdf9f7500f910851c3d3fd Signed-off-by: Suren Baghdasaryan <surenb@google.com> |
||
Alexander Potapenko
|
294ef12dcc |
mm: fs: initialize fsdata passed to write_begin/write_end interface
commit 1468c6f4558b1bcd92aa0400f2920f9dc7588402 upstream. Functions implementing the a_ops->write_end() interface accept the `void *fsdata` parameter that is supposed to be initialized by the corresponding a_ops->write_begin() (which accepts `void **fsdata`). However not all a_ops->write_begin() implementations initialize `fsdata` unconditionally, so it may get passed uninitialized to a_ops->write_end(), resulting in undefined behavior. Fix this by initializing fsdata with NULL before the call to write_begin(), rather than doing so in all possible a_ops implementations. This patch covers only the following cases found by running x86 KMSAN under syzkaller: - generic_perform_write() - cont_expand_zero() and generic_cont_expand_simple() - page_symlink() Other cases of passing uninitialized fsdata may persist in the codebase. Link: https://lkml.kernel.org/r/20220915150417.722975-43-glider@google.com Signed-off-by: Alexander Potapenko <glider@google.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Andrey Konovalov <andreyknvl@google.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Borislav Petkov <bp@alien8.de> Cc: Christoph Hellwig <hch@lst.de> Cc: Christoph Lameter <cl@linux.com> Cc: David Rientjes <rientjes@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Eric Biggers <ebiggers@google.com> Cc: Eric Biggers <ebiggers@kernel.org> Cc: Eric Dumazet <edumazet@google.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Ilya Leoshkevich <iii@linux.ibm.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Kees Cook <keescook@chromium.org> Cc: Marco Elver <elver@google.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Petr Mladek <pmladek@suse.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vegard Nossum <vegard.nossum@oracle.com> Cc: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Alban Crequy
|
db744288af |
maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault()
commit 8678ea06852cd1f819b870c773d43df888d15d46 upstream.
If a page fault occurs while copying the first byte, this function resets one
byte before dst.
As a consequence, an address could be modified and leaded to kernel crashes if
case the modified address was accessed later.
Fixes:
|
||
|
Pavankumar Kondeti
|
d84fac9795 |
FROMGIT: mm/madvise: fix madvise_pageout for private file mappings
When MADV_PAGEOUT is called on a private file mapping VMA region, we bail out early if the process is neither owner nor write capable of the file. However, this VMA may have both private/shared clean pages and private dirty pages. The opportunity of paging out the private dirty pages (Anon pages) is missed. Fix this by caching the file access check and use it later along with PageAnon() during page walk. We observe ~10% improvement in zram usage, thus leaving more available memory on a 4GB RAM system running Android. Link: https://lkml.kernel.org/r/1667971116-12900-1-git-send-email-quic_pkondeti@quicinc.com Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com> Cc: Charan Teja Kalla <quic_charante@quicinc.com> Cc: Minchan Kim <minchan@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 8fc5be8efc3cf356f25098fbd4bda7c0e949c2ea git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 259329159 Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com> Change-Id: I5f2d425aec94e5a75ebeaf90f9f5d7adf1975c59 |
||
Mike Rapoport
|
f1bf7ee90f |
BACKPORT: mm/page_alloc: always initialize memory map for the holes
Patch series "mm: ensure consistency of memory map poisoning". Currently memory map allocation for FLATMEM case does not poison the struct pages regardless of CONFIG_PAGE_POISON setting. This happens because allocation of the memory map for FLATMEM and SPARSMEM use different memblock functions and those that are used for SPARSMEM case (namely memblock_alloc_try_nid_raw() and memblock_alloc_exact_nid_raw()) implicitly poison the allocated memory. Another side effect of this implicit poisoning is that early setup code that uses the same functions to allocate memory burns cycles for the memory poisoning even if it was not intended. These patches introduce memmap_alloc() wrapper that ensure that the memory map allocation is consistent for different memory models. This patch (of 4): Currently memory map for the holes is initialized only when SPARSEMEM memory model is used. Yet, even with FLATMEM there could be holes in the physical memory layout that have memory map entries. For instance, the memory reserved using e820 API on i386 or "reserved-memory" nodes in device tree would not appear in memblock.memory and hence the struct pages for such holes will be skipped during memory map initialization. These struct pages will be zeroed because the memory map for FLATMEM systems is allocated with memblock_alloc_node() that clears the allocated memory. While zeroed struct pages do not cause immediate problems, the correct behaviour is to initialize every page using __init_single_page(). Besides, enabling page poison for FLATMEM case will trigger PF_POISONED_CHECK() unless the memory map is properly initialized. Make sure init_unavailable_range() is called for both SPARSEMEM and FLATMEM so that struct pages representing memory holes would appear as PG_Reserved with any memory layout. [rppt@kernel.org: fix microblaze] Link: https://lkml.kernel.org/r/YQWW3RCE4eWBuMu/@kernel.org (cherry picked from commit c3ab6baf6a004eab7344a1d8880a971f2414e1b6) Bug: 258556132 Link: https://lkml.kernel.org/r/20210714123739.16493-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20210714123739.16493-2-rppt@kernel.org Change-Id: Ib60682288ba76e65384de91b70a08662ead12934 Signed-off-by: Mike Rapoport <rppt@linux.ibm.com> Acked-by: David Hildenbrand <david@redhat.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Cc: Michal Simek <monstr@monstr.eu> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|
Greg Kroah-Hartman
|
673a7341bd |
This is the 5.10.153 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNj1woACgkQONu9yGCS aT5mQw/+IG2zLoH79zTzQDZF+DYZ+J5WRGVLfx+5mM2j1fGgXWmxADdlzMZTSSAc XP1hDxHBYQSnQi/kRPuJOKJbV9TysdOV2SSvwzblq6UE4B7tw3q4YE9calfYPaiF AhvMMAEaXGVHAVSgliRqcgnlq5Yj6nrxjr73O3kuyCWvfv6XToCd6LKFJyHdVniw kJ7gbkgiOVH/caKyzJxW3uSZ11t4uZ10nu4q+rd3JOLDecPLcPLM28pDTL/znqS0 ECiPypmIrd10UL+V4aiHsBR9wHEJdZULb/SLLwy85EuUeEhmx4i1ylu5JosY77cQ 2CkxHIt8nCKxJ3BziMUbutY40VBs/MP74t1kB5Th/3JK8gsw2+JdUJ7b9RXzb60k vbFjc3lJugmNsAXqOnibAu/PdoWYi4IC7A2D/gJcWzsEKgVWQptZizJpn5Se3F3+ OCWdqgOiTZiegK55W3w2xbNqSLkuvAfbx18UEWltHhzS1UT7cqGVxx7qcsFhWGfV rG1yzzF1Skx2BcnBf+6yTczOUcOyLrMyyek3tRD00EWn8o1ik9lKARNKd+b7IUW4 57NUvaGsBp/BRrJobrdx5r7AkTg5AfEWQAM69+vbDUxjKRM02FQlfEycGxcTT2GD nUUzJMgobd0GW4HU/2rpmMk67QCnJ9guJxRCpcp7ocGkX0x2WYs= =n9Bi -----END PGP SIGNATURE----- Merge 5.10.153 into android12-5.10-lts Changes in 5.10.153 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() can: kvaser_usb: Fix possible completions during init_completion ALSA: Use del_timer_sync() before freeing timer ALSA: au88x0: use explicitly signed char ALSA: rme9652: use explicitly signed char USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM usb: dwc3: gadget: Stop processing more requests on IMI usb: dwc3: gadget: Don't set IMI for no_interrupt usb: bdc: change state when port disconnected usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller mtd: rawnand: marvell: Use correct logic for nand-keep-config xhci: Add quirk to reset host back to default state at shutdown xhci: Remove device endpoints from bandwidth list when freeing the device tools: iio: iio_utils: fix digit calculation iio: light: tsl2583: Fix module unloading iio: temperature: ltc2983: allocate iio channels once fbdev: smscufx: Fix several use-after-free bugs fs/binfmt_elf: Fix memory leak in load_elf_binary() exec: Copy oldsighand->action under spin-lock mac802154: Fix LQI recording scsi: qla2xxx: Use transport-defined speed mask for supported_speeds drm/msm/dsi: fix memory corruption with too many bridges drm/msm/hdmi: fix memory corruption with too many bridges drm/msm/dp: fix IRQ lifetime mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO mmc: core: Fix kernel panic when remove non-standard SDIO card counter: microchip-tcb-capture: Handle Signal1 read and Synapse kernfs: fix use-after-free in __kernfs_remove perf auxtrace: Fix address filter symbol name match for modules s390/futex: add missing EX_TABLE entry to __futex_atomic_op() s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() Xen/gntdev: don't ignore kernel unmapping error xen/gntdev: Prevent leaking grants mm/memory: add non-anonymous page check in the copy_present_page() mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages net: ieee802154: fix error return code in dgram_bind() media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation drm/msm: Fix return type of mdp4_lvds_connector_mode_valid ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile arc: iounmap() arg is volatile ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap() tipc: fix a null-ptr-deref in tipc_topsrv_accept net: netsec: fix error handling in netsec_register_mdio() net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg() net: hinic: fix memory leak when reading function table net: hinic: fix the issue of CMDQ memory leaks net: hinic: fix the issue of double release MBOX callback of VF x86/unwind/orc: Fix unreliable stack dump with gcov amd-xgbe: fix the SFP compliance codes check for DAC cables amd-xgbe: add the bit rate quirk for Molex cables atlantic: fix deadlock at aq_nic_stop kcm: annotate data-races around kcm->rx_psock kcm: annotate data-races around kcm->rx_wait net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY tcp: minor optimization in tcp_add_backlog() tcp: fix a signed-integer-overflow bug in tcp_add_backlog() tcp: fix indefinite deferral of RTO with SACK reneging can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path PM: hibernate: Allow hybrid sleep to work with s2idle media: vivid: s_fbuf: add more sanity checks media: vivid: dev->bitmap_cap wasn't freed in all cases media: v4l2-dv-timings: add sanity checks for blanking values media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' media: vivid: set num_in/outputs to 0 if not supported ipv6: ensure sane device mtu in tunnels i40e: Fix ethtool rx-flow-hash setting for X722 i40e: Fix VF hang when reset is triggered on another VF i40e: Fix flow-type by setting GL_HASH_INSET registers net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() PM: domains: Fix handling of unavailable/disabled idle states net: fec: limit register access on i.MX6UL ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() ALSA: aoa: Fix I2S device accounting openvswitch: switch from WARN to pr_warn net: ehea: fix possible memory leak in ehea_register_port() nh: fix scope used to find saddr when adding non gw nh net/mlx5e: Do not increment ESN when updating IPsec ESN state net/mlx5: Fix possible use-after-free in async command interface net/mlx5: Fix crash during sync firmware reset net: enetc: survive memory pressure without crashing arm64: Add AMPERE1 to the Spectre-BHB affected list scsi: sd: Revert "scsi: sd: Remove a local variable" arm64/mm: Fix __enable_mmu() for new TGRAN range values arm64/kexec: Test page size support with new TGRAN range values can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive serial: core: move RS485 configuration tasks from drivers into core serial: Deassert Transmit Enable on probe in driver-specific way Linux 5.10.153 Change-Id: I1cbca2c5cbaaab34ccd6e055f13c35d900d4ce25 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Will Deacon
|
dcdb7eadfd |
Revert "FROMGIT: mm/vmalloc: Add override for lazy vunmap"
Revert submission 2302443 Reason for revert: Series is not queued in a maintainer tree and has not been posted to a public mailing list. Reverted Changes: Iffd38bf97:FROMGIT: arm64: Work around Cortex-A510 erratum 24... I694523564:FROMGIT: mm/vmalloc: Add override for lazy vunmap Change-Id: I345e32bac76292413908b4a81295a228003fa4c0 Signed-off-by: Will Deacon <willdeacon@google.com> |
||
|
Sivasri Kumar, Vanka
|
25b8343bd4 |
Merge keystone/android12-5.10-keystone-qcom-release.136+ (3593700) into msm-5.10
* refs/heads/tmp-3593700c:
ANDROID: abi_gki_aarch64_qcom: Add wait_on_page_bit
FROMLIST: binder: fix UAF of alloc->vma in race with munmap()
UPSTREAM: wifi: mac80211: fix MBSSID parsing use-after-free
UPSTREAM: wifi: mac80211: don't parse mbssid in assoc response
UPSTREAM: mac80211: mlme: find auth challenge directly
UPSTREAM: wifi: cfg80211: update hidden BSSes to avoid WARN_ON
UPSTREAM: wifi: mac80211: fix crash in beacon protection for P2P-device
UPSTREAM: wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
UPSTREAM: wifi: cfg80211: avoid nontransmitted BSS list corruption
UPSTREAM: wifi: cfg80211: fix BSS refcounting bugs
UPSTREAM: wifi: cfg80211: ensure length byte is present before access
UPSTREAM: wifi: cfg80211/mac80211: reject bad MBSSID elements
UPSTREAM: wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
UPSTREAM: psi: Fix psi state corruption when schedule() races with cgroup move
ANDROID: GKI: Update symbol list for mtk AIoT projects
UPSTREAM: psi: Fix psi state corruption when schedule() races with cgroup move
BACKPORT: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
BACKPORT: mm: don't be stuck to rmap lock on reclaim path
Revert "firmware_loader: use kernel credentials when reading firmware"
Revert "firmware_loader: use kernel credentials when reading firmware"
UPSTREAM: crypto: jitter - add oversampling of noise source
ANDROID: Fix kenelci build-break for !CONFIG_PERF_EVENTS
FROMGIT: f2fs: support recording stop_checkpoint reason into super_block
UPSTREAM: wifi: mac80211_hwsim: use 32-bit skb cookie
UPSTREAM: wifi: mac80211_hwsim: add back erroneously removed cast
UPSTREAM: wifi: mac80211_hwsim: fix race condition in pending packet
ANDROID: abi_gki_aarch64_qcom: Add android_vh_madvise_cold_or_pageout
ANDROID: force struct page_vma_mapped_walk to be defined in KMI
ANDROID: vendor_hooks: Allow shared pages reclaim via MADV_PAGEOUT
UPSTREAM: usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
ANDROID: GKI: Update symbols to symbol list
ANDROID: make sure all types for hooks are defined in KMI
ANDROID: force struct selinux_state to be defined in KMI
BACKPORT: erofs: fix use-after-free of on-stack io[]
ANDROID: GKI: Update symbols to symbol list
ANDROID: vendor_hook: rename the the name of hooks
ANDROID: ABI: Add extcon_get_property_capability symbol
Revert "ANDROID: arm64: debug-monitors: export break hook APIs"
Revert "ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath."
Revert "ANDROID: Export functions to be used with dma_map_ops in modules"
FROMLIST: f2fs: let FI_OPU_WRITE override FADVISE_COLD_BIT
ANDROID: remove unused xhci_get_endpoint_address export
ANDROID: incfs: Add check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr
ANDROID: GKI: Update symbols to symbol list
ANDROID: vendor_hooks: Add hooks for lookaround
Revert "Revert "ANDROID: add for tuning readahead size""
ANDROID: transsion: Update the ABI xml and symbol list
ANDROID: vendor_hooks: Add hooks for lookaround
BACKPORT: dm verity: set DM_TARGET_IMMUTABLE feature flag
BACKPORT: pipe: Fix missing lock in pipe_resize_ring()
BACKPORT: KVM: x86: avoid calling x86 emulator without a decoded instruction
ANDROID: GKI: add symbols in android/abi_gki_aarch64_oplus
BACKPORT: watchqueue: make sure to serialize 'wqueue->defunct' properly
ANDROID: GKI: Update symbol list for Exynos SoC
Linux 5.10.136
x86/speculation: Add LFENCE to RSB fill sequence
x86/speculation: Add RSB VM Exit protections
macintosh/adb: fix oob read in do_adb_query() function
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007
Bluetooth: btusb: Add support of IMC Networks PID 0x3568
Bluetooth: hci_bcm: Add DT compatible for CYW55572
Bluetooth: hci_bcm: Add BCM4349B1 variant
selftests: KVM: Handle compiler optimizations in ucall
tools/kvm_stat: fix display of error when multiple processes are found
crypto: arm64/poly1305 - fix a read out-of-bound
ACPI: APEI: Better fix to avoid spamming the console with old error logs
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
ACPI: video: Force backlight native for some TongFang devices
tun: avoid double free in tun_free_netdev
selftests/bpf: Check dst_port only on the client socket
selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()
x86/speculation: Make all RETbleed mitigations 64-bit only
Linux 5.10.135
selftests: bpf: Don't run sk_lookup in verifier tests
bpf: Add PROG_TEST_RUN support for sk_lookup programs
bpf: Consolidate shared test timing code
x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available
xfs: Enforce attr3 buffer recovery order
xfs: logging the on disk inode LSN can make it go backwards
xfs: remove dead stale buf unpin handling code
xfs: hold buffer across unpin and potential shutdown processing
xfs: force the log offline when log intent item recovery fails
xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes
xfs: prevent UAF in xfs_log_item_in_current_chkpt
xfs: xfs_log_force_lsn isn't passed a LSN
xfs: refactor xfs_file_fsync
docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed
EDAC/ghes: Set the DIMM label unconditionally
ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow
mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
page_alloc: fix invalid watermark check on a negative value
ARM: crypto: comment out gcc warning that breaks clang builds
sctp: leave the err path free in sctp_stream_init to sctp_stream_free
sfc: disable softirqs for ptp TX
perf symbol: Correct address for bss symbols
virtio-net: fix the race between refill work and close
netfilter: nf_queue: do not allow packet truncation below transport header offset
sctp: fix sleep in atomic context bug in timer handlers
i40e: Fix interface init with MSI interrupts (no MSI-X)
tcp: Fix data-races around sysctl_tcp_reflect_tos.
tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns.
tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
net: macsec: fix potential resource leak in macsec_add_rxsa() and macsec_add_txsa()
macsec: always read MACSEC_SA_ATTR_PN as a u64
macsec: limit replay window size with XPN
macsec: fix error message in macsec_add_rxsa and _txsa
macsec: fix NULL deref in macsec_add_rxsa
Documentation: fix sctp_wmem in ip-sysctl.rst
tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
tcp: Fix a data-race around sysctl_tcp_autocorking.
tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
igmp: Fix data-races around sysctl_igmp_qrv.
net/tls: Remove the context from the list in tls_device_down
ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
net: ping6: Fix memleak in ipv6_renew_options().
tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
tcp: Fix a data-race around sysctl_tcp_limit_output_bytes.
tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf.
Revert "tcp: change pingpong threshold to 3"
scsi: ufs: host: Hold reference returned by of_parse_phandle()
ice: do not setup vlan for loopback VSI
ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS)
tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save.
tcp: Fix a data-race around sysctl_tcp_nometrics_save.
tcp: Fix a data-race around sysctl_tcp_frto.
tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
tcp: Fix a data-race around sysctl_tcp_app_win.
tcp: Fix data-races around sysctl_tcp_dsack.
watch_queue: Fix missing locking in add_watch_to_object()
watch_queue: Fix missing rcu annotation
nouveau/svm: Fix to migrate all requested pages
s390/archrandom: prevent CPACF trng invocations in interrupt context
ntfs: fix use-after-free in ntfs_ucsncmp()
Revert "ocfs2: mount shared volume without ha stack"
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
ANDROID: fix up 5.10.132 merge with the virtio_mmio.c driver
Linux 5.10.134
watch-queue: remove spurious double semicolon
net: usb: ax88179_178a needs FLAG_SEND_ZLP
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
tty: drop tty_schedule_flip()
tty: the rest, stop using tty_schedule_flip()
tty: drivers/tty/, stop using tty_schedule_flip()
watchqueue: make sure to serialize 'wqueue->defunct' properly
x86/alternative: Report missing return thunk details
x86/amd: Use IBPB for firmware calls
Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
Bluetooth: SCO: Fix sco_send_frame returning skb->len
Bluetooth: Fix passing NULL to PTR_ERR
Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
Bluetooth: Add bt_skb_sendmmsg helper
Bluetooth: Add bt_skb_sendmsg helper
ALSA: memalloc: Align buffer allocations in page size
bitfield.h: Fix "type of reg too small for mask" test
drm/imx/dcss: fix unused but set variable warnings
dlm: fix pending remove if msg allocation fails
x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
sched/deadline: Fix BUG_ON condition for deboosted tasks
bpf: Make sure mac_header was set before using it
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
KVM: Don't null dereference ops->destroy
spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
tcp: Fix data-races around sysctl_tcp_max_reordering.
tcp: Fix a data-race around sysctl_tcp_rfc1337.
tcp: Fix a data-race around sysctl_tcp_stdurg.
tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
tcp: Fix data-races around sysctl_tcp_recovery.
tcp: Fix a data-race around sysctl_tcp_early_retrans.
tcp: Fix data-races around sysctl knobs related to SYN option.
udp: Fix a data-race around sysctl_udp_l3mdev_accept.
ip: Fix data-races around sysctl_ip_prot_sock.
ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.
drm/imx/dcss: Add missing of_node_put() in fail path
be2net: Fix buffer overflow in be_get_module_eeprom
gpio: pca953x: use the correct register address when regcache sync during init
gpio: pca953x: use the correct range when do regmap sync
gpio: pca953x: only use single read/write for No AI mode
ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero
i40e: Fix erroneous adapter reinitialization during recovery process
iavf: Fix handling of dummy receive descriptors
tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.
tcp: Fix data-races around sysctl_tcp_fastopen.
tcp: Fix data-races around sysctl_max_syn_backlog.
tcp: Fix a data-race around sysctl_tcp_tw_reuse.
tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
tcp: Fix data-races around some timeout sysctl knobs.
tcp: Fix data-races around sysctl_tcp_reordering.
tcp: Fix data-races around sysctl_tcp_syncookies.
tcp: Fix data-races around keepalive sysctl knobs.
igmp: Fix data-races around sysctl_igmp_max_msf.
igmp: Fix a data-race around sysctl_igmp_max_memberships.
igmp: Fix data-races around sysctl_igmp_llm_reports.
net/tls: Fix race in TLS device down flow
net: stmmac: fix dma queue left shift overflow issue
i2c: cadence: Change large transfer count reset logic to be unconditional
net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow
tcp: Fix a data-race around sysctl_tcp_probe_interval.
tcp: Fix a data-race around sysctl_tcp_probe_threshold.
tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.
tcp: Fix data-races around sysctl_tcp_min_snd_mss.
tcp: Fix data-races around sysctl_tcp_base_mss.
tcp: Fix data-races around sysctl_tcp_mtu_probing.
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
ip: Fix a data-race around sysctl_fwmark_reflect.
ip: Fix a data-race around sysctl_ip_autobind_reuse.
ip: Fix data-races around sysctl_ip_nonlocal_bind.
ip: Fix data-races around sysctl_ip_fwd_update_priority.
ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
ip: Fix data-races around sysctl_ip_no_pmtu_disc.
igc: Reinstate IGC_REMOVED logic and implement it properly
drm/amdgpu/display: add quirk handling for stutter mode
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
pinctrl: ralink: Check for null return of devm_kcalloc
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
serial: mvebu-uart: correctly report configured baudrate value
PCI: hv: Fix interrupt mapping for multi-MSI
PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
PCI: hv: Fix multi-MSI to allow more than one MSI vector
Revert "m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch"
net: inline rollback_registered_many()
net: move rollback_registered_many()
net: inline rollback_registered()
net: move net_set_todo inside rollback_registered()
net: make sure devices go through netdev_wait_all_refs
net: make free_netdev() more lenient with unregistering devices
docs: net: explain struct net_device lifetime
xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
io_uring: Use original task for req identity in io_identity_cow()
lockdown: Fix kexec lockdown bypass with ima policy
mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication
riscv: add as-options for modules with assembly compontents
pinctrl: stm32: fix optional IRQ support to gpios
Revert "cgroup: Use separate src/dst nodes when preloading css_sets for migration"
Revert "drm: fix EDID struct for old ARM OABI format"
Revert "mailbox: forward the hrtimer if not queued and under a lock"
Revert "Fonts: Make font size unsigned in font_desc"
Revert "parisc/stifb: Keep track of hardware path of graphics card"
Revert "Bluetooth: Interleave with allowlist scan"
Revert "Bluetooth: use inclusive language when filtering devices"
Revert "Bluetooth: use hdev lock for accept_list and reject_list in conn req"
Revert "thermal/drivers/core: Use a char pointer for the cooling device name"
Revert "thermal/core: Fix memory leak in __thermal_cooling_device_register()"
Revert "thermal/core: fix a UAF bug in __thermal_cooling_device_register()"
Revert "thermal/core: Fix memory leak in the error path"
Revert "ALSA: jack: Access input_dev under mutex"
Revert "gpiolib: of: Introduce hook for missing gpio-ranges"
Revert "pinctrl: bcm2835: implement hook for missing gpio-ranges"
Revert "ext4: fix use-after-free in ext4_rename_dir_prepare"
Revert "ext4: verify dir block before splitting it"
Linux 5.10.133
tools headers: Remove broken definition of __LITTLE_ENDIAN
tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again
objtool: Fix elf_create_undef_symbol() endianness
kvm: fix objtool relocation warning
x86: Use -mindirect-branch-cs-prefix for RETPOLINE builds
um: Add missing apply_returns()
x86/bugs: Remove apostrophe typo
tools headers cpufeatures: Sync with the kernel sources
tools arch x86: Sync the msr-index.h copy with the kernel sources
KVM: emulate: do not adjust size of fastop and setcc subroutines
x86/kvm: fix FASTOP_SIZE when return thunks are enabled
efi/x86: use naked RET on mixed mode call wrapper
x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit
x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub
x86/xen: Fix initialisation in hypercall_page after rethunk
x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted
tools/insn: Restore the relative include paths for cross building
x86/static_call: Serialize __static_call_fixup() properly
x86/speculation: Disable RRSBA behavior
x86/kexec: Disable RET on kexec
x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
x86/bugs: Add Cannon lake to RETBleed affected CPU list
x86/retbleed: Add fine grained Kconfig knobs
x86/cpu/amd: Enumerate BTC_NO
x86/common: Stamp out the stepping madness
x86/speculation: Fill RSB on vmexit for IBRS
KVM: VMX: Fix IBRS handling after vmexit
KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
KVM: VMX: Convert launched argument to flags
KVM: VMX: Flatten __vmx_vcpu_run()
objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}
x86/speculation: Remove x86_spec_ctrl_mask
x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
x86/speculation: Fix SPEC_CTRL write on SMT state change
x86/speculation: Fix firmware entry SPEC_CTRL handling
x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
x86/cpu/amd: Add Spectral Chicken
objtool: Add entry UNRET validation
x86/bugs: Do IBPB fallback check only once
x86/bugs: Add retbleed=ibpb
x86/xen: Rename SYS* entry points
objtool: Update Retpoline validation
intel_idle: Disable IBRS during long idle
x86/bugs: Report Intel retbleed vulnerability
x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation()
x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
x86/bugs: Optimize SPEC_CTRL MSR writes
x86/entry: Add kernel IBRS implementation
x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
x86/bugs: Enable STIBP for JMP2RET
x86/bugs: Add AMD retbleed= boot parameter
x86/bugs: Report AMD retbleed vulnerability
x86: Add magic AMD return-thunk
objtool: Treat .text.__x86.* as noinstr
x86: Use return-thunk in asm code
x86/sev: Avoid using __x86_return_thunk
x86/vsyscall_emu/64: Don't use RET in vsyscall emulation
x86/kvm: Fix SETcc emulation for return thunks
x86/bpf: Use alternative RET encoding
x86/ftrace: Use alternative RET encoding
x86,static_call: Use alternative RET encoding
objtool: skip non-text sections when adding return-thunk sites
x86,objtool: Create .return_sites
x86: Undo return-thunk damage
x86/retpoline: Use -mfunction-return
Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC}
x86/retpoline: Swizzle retpoline thunk
x86/retpoline: Cleanup some #ifdefery
x86/cpufeatures: Move RETPOLINE flags to word 11
x86/kvm/vmx: Make noinstr clean
x86/realmode: build with -D__DISABLE_EXPORTS
objtool: Fix objtool regression on x32 systems
x86/entry: Remove skip_r11rcx
objtool: Fix symbol creation
objtool: Fix type of reloc::addend
objtool: Fix code relocs vs weak symbols
objtool: Fix SLS validation for kcov tail-call replacement
crypto: x86/poly1305 - Fixup SLS
objtool: Default ignore INT3 for unreachable
kvm/emulate: Fix SETcc emulation function offsets with SLS
tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy'
x86: Add straight-line-speculation mitigation
objtool: Add straight-line-speculation validation
x86/alternative: Relax text_poke_bp() constraint
x86: Prepare inline-asm for straight-line-speculation
x86: Prepare asm files for straight-line-speculation
x86/lib/atomic64_386_32: Rename things
bpf,x86: Respect X86_FEATURE_RETPOLINE*
bpf,x86: Simplify computing label offsets
x86/alternative: Add debug prints to apply_retpolines()
x86/alternative: Try inline spectre_v2=retpoline,amd
x86/alternative: Handle Jcc __x86_indirect_thunk_\reg
x86/alternative: Implement .retpoline_sites support
x86/retpoline: Create a retpoline thunk array
x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h
x86/asm: Fixup odd GEN-for-each-reg.h usage
x86/asm: Fix register order
x86/retpoline: Remove unused replacement symbols
objtool,x86: Replace alternatives with .retpoline_sites
objtool: Explicitly avoid self modifying code in .altinstr_replacement
objtool: Classify symbols
objtool: Handle __sanitize_cov*() tail calls
objtool: Introduce CFI hash
objtool: Make .altinstructions section entry size consistent
objtool: Remove reloc symbol type checks in get_alt_entry()
objtool: print out the symbol type when complaining about it
objtool: Teach get_alt_entry() about more relocation types
objtool: Don't make .altinstructions writable
objtool/x86: Ignore __x86_indirect_alt_* symbols
objtool: Only rewrite unconditional retpoline thunk calls
objtool: Fix .symtab_shndx handling for elf_create_undef_symbol()
x86/alternative: Optimize single-byte NOPs at an arbitrary position
objtool: Support asm jump tables
objtool/x86: Rewrite retpoline thunk calls
objtool: Skip magical retpoline .altinstr_replacement
objtool: Cache instruction relocs
objtool: Keep track of retpoline call sites
objtool: Add elf_create_undef_symbol()
objtool: Extract elf_symbol_add()
objtool: Extract elf_strtab_concat()
objtool: Create reloc sections implicitly
objtool: Add elf_create_reloc() helper
objtool: Rework the elf_rebuild_reloc_section() logic
objtool: Handle per arch retpoline naming
objtool: Correctly handle retpoline thunk calls
x86/retpoline: Simplify retpolines
x86/alternatives: Optimize optimize_nops()
x86: Add insn_decode_kernel()
x86/alternative: Use insn_decode()
x86/insn-eval: Handle return values from the decoder
x86/insn: Add an insn_decode() API
x86/insn: Add a __ignore_sync_check__ marker
x86/insn: Rename insn_decode() to insn_decode_from_regs()
x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has()
x86/alternative: Support ALTERNATIVE_TERNARY
x86/alternative: Support not-feature
x86/alternative: Merge include files
x86/xen: Support objtool vmlinux.o validation in xen-head.S
x86/xen: Support objtool validation in xen-asm.S
objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC
objtool: Assume only ELF functions do sibling calls
objtool: Support retpoline jump detection for vmlinux.o
objtool: Support stack layout changes in alternatives
objtool: Add 'alt_group' struct
objtool: Refactor ORC section generation
KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S
Linux 5.10.132
x86/pat: Fix x86_has_pat_wp()
serial: 8250: Fix PM usage_count for console handover
serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
serial: stm32: Clear prev values before setting RTS delays
serial: 8250: fix return error code in serial8250_request_std_resource()
vt: fix memory overlapping when deleting chars in the buffer
tty: serial: samsung_tty: set dma burst_size to 1
usb: dwc3: gadget: Fix event pending check
usb: typec: add missing uevent when partner support PD
USB: serial: ftdi_sio: add Belimo device ids
signal handling: don't use BUG_ON() for debugging
nvme-pci: phison e16 has bogus namespace ids
Revert "can: xilinx_can: Limit CANFD brp to 2"
ARM: dts: stm32: use the correct clock source for CEC on stm32mp151
soc: ixp4xx/npe: Fix unused match warning
x86: Clear .brk area at early boot
irqchip: or1k-pic: Undefine mask_ack for level triggered hardware
ASoC: madera: Fix event generation for rate controls
ASoC: madera: Fix event generation for OUT1 demux
ASoC: cs47l15: Fix event generation for low power mux control
ASoC: dapm: Initialise kcontrol data for mux/demux controls
ASoC: wm5110: Fix DRE control
ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow
pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux()
ASoC: ops: Fix off by one in range control validation
net: sfp: fix memory leak in sfp_probe()
nvme: fix regression when disconnect a recovering ctrl
nvme-tcp: always fail a request when sending it failed
NFC: nxp-nci: don't print header length mismatch on i2c error
net: tipc: fix possible refcount leak in tipc_sk_create()
platform/x86: hp-wmi: Ignore Sanitization Mode event
cpufreq: pmac32-cpufreq: Fix refcount leak bug
scsi: hisi_sas: Limit max hw sectors for v3 HW
netfilter: br_netfilter: do not skip all hooks with 0 priority
virtio_mmio: Restore guest page size on resume
virtio_mmio: Add missing PM calls to freeze/restore
mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE
net/tls: Check for errors in tls_device_init
KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op()
net: atlantic: remove aq_nic_deinit() when resume
net: atlantic: remove deep parameter on suspend/resume functions
sfc: fix kernel panic when creating VF
seg6: bpf: fix skb checksum in bpf_push_seg6_encap()
seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
seg6: fix skb checksum evaluation in SRH encapsulation/insertion
sfc: fix use after free when disabling sriov
ima: Fix potential memory leak in ima_init_crypto()
ima: force signature verification when CONFIG_KEXEC_SIG is configured
net: ftgmac100: Hold reference returned by of_get_child_by_name()
nexthop: Fix data-races around nexthop_compat_mode.
ipv4: Fix data-races around sysctl_ip_dynaddr.
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
icmp: Fix a data-race around sysctl_icmp_ratemask.
icmp: Fix a data-race around sysctl_icmp_ratelimit.
sysctl: Fix data-races in proc_dointvec_ms_jiffies().
drm/i915/gt: Serialize TLB invalidates with GT resets
drm/i915/selftests: fix a couple IS_ERR() vs NULL tests
ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
ARM: dts: at91: sama5d2: Fix typo in i2s1 node
ipv4: Fix a data-race around sysctl_fib_sync_mem.
icmp: Fix data-races around sysctl.
cipso: Fix data-races around sysctl.
net: Fix data-races around sysctl_mem.
inetpeer: Fix data-races around sysctl.
tcp: Fix a data-race around sysctl_tcp_max_orphans.
sysctl: Fix data races in proc_dointvec_jiffies().
sysctl: Fix data races in proc_doulongvec_minmax().
sysctl: Fix data races in proc_douintvec_minmax().
sysctl: Fix data races in proc_dointvec_minmax().
sysctl: Fix data races in proc_douintvec().
sysctl: Fix data races in proc_dointvec().
net: stmmac: dwc-qos: Disable split header for Tegra194
ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array
ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks()
ASoC: tas2764: Fix amp gain register offset & default
ASoC: tas2764: Correct playback volume range
ASoC: tas2764: Fix and extend FSYNC polarity handling
ASoC: tas2764: Add post reset delays
ASoC: sgtl5000: Fix noise on shutdown/remove
ima: Fix a potential integer overflow in ima_appraise_measurement
drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()
net/mlx5e: Fix capability check for updating vnic env counters
net/mlx5e: kTLS, Fix build time constant test in RX
net/mlx5e: kTLS, Fix build time constant test in TX
ARM: 9210/1: Mark the FDT_FIXED sections as shareable
ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
spi: amd: Limit max transfer and message size
ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count
ext4: fix race condition between ext4_write and ext4_convert_inline_data
Revert "evm: Fix memleak in init_desc"
sh: convert nommu io{re,un}map() to static inline functions
nilfs2: fix incorrect masking of permission flags for symlinks
fs/remap: constrain dedupe of EOF blocks
drm/panfrost: Fix shrinker list corruption by madvise IOCTL
drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error
btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents
cgroup: Use separate src/dst nodes when preloading css_sets for migration
wifi: mac80211: fix queue selection for mesh/OCB interfaces
ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction
ARM: 9213/1: Print message about disabled Spectre workarounds only once
ip: fix dflt addr selection for connected nexthop
net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer
tracing/histograms: Fix memory leak problem
mm: split huge PUD on wp_huge_pud fallback
fix race between exit_itimers() and /proc/pid/timers
xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221
ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
ALSA: hda/realtek: Fix headset mic for Acer SF313-51
ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
ALSA: hda - Add fixup for Dell Latitidue E5430
Linux 5.10.131
Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"
ANDROID: random: fix CRC issues with the merge
ANDROID: change function signatures for some random functions.
ANDROID: cpu/hotplug: avoid breaking Android ABI by fusing cpuhp steps
ANDROID: random: add back removed callback functions
UPSTREAM: Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
UPSTREAM: lib/crypto: add prompts back to crypto libraries
Linux 5.10.130
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
dmaengine: pl330: Fix lockdep warning about non-static key
ida: don't use BUG_ON() for debugging
dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo
misc: rtsx_usb: set return value in rsp_buf alloc err path
misc: rtsx_usb: use separate command and response buffers
misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
dmaengine: imx-sdma: Allow imx8m for imx7 FW revs
i2c: cadence: Unregister the clk notifier in error path
r8169: fix accessing unset transport header
selftests: forwarding: fix error message in learning_test
selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT
selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT
ibmvnic: Properly dispose of all skbs during a failover.
i40e: Fix dropped jumbo frames statistics
xsk: Clear page contiguity bit when unmapping pool
ARM: dts: at91: sama5d2_icp: fix eeprom compatibles
ARM: dts: at91: sam9x60ek: fix eeprom compatible and size
ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt
ARM: at91: pm: use proper compatible for sama5d2's rtc
arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo
pinctrl: sunxi: sunxi_pconf_set: use correct offset
arm64: dts: imx8mp-evk: correct I2C3 pad settings
arm64: dts: imx8mp-evk: correct gpio-led pad settings
arm64: dts: imx8mp-evk: correct the uart2 pinctl value
arm64: dts: imx8mp-evk: correct mmc pad settings
arm64: dts: qcom: msm8994: Fix CPU6/7 reg values
pinctrl: sunxi: a83t: Fix NAND function name for some pins
ARM: meson: Fix refcount leak in meson_smp_prepare_cpus
xfs: remove incorrect ASSERT in xfs_rename
can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits
can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression
can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info
powerpc/powernv: delay rng platform device creation until later in boot
video: of_display_timing.h: include errno.h
memregion: Fix memregion_free() fallback definition
PM: runtime: Redefine pm_runtime_release_supplier()
fbcon: Prevent that screen size is smaller than font size
fbcon: Disallow setting font bigger than screen size
fbmem: Check virtual screen sizes in fb_set_var()
fbdev: fbmem: Fix logo center image dx issue
iommu/vt-d: Fix PCI bus rescan device hot add
netfilter: nf_tables: stricter validation of element data
netfilter: nft_set_pipapo: release elements in clone from abort path
net: rose: fix UAF bug caused by rose_t0timer_expiry
usbnet: fix memory leak in error case
bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals
bpf: Fix incorrect verifier simulation around jmp32's jeq/jne
can: gs_usb: gs_usb_open/close(): fix memory leak
can: grcan: grcan_probe(): remove extra of_node_get()
can: bcm: use call_rcu() instead of costly synchronize_rcu()
ALSA: hda/realtek: Add quirk for Clevo L140PU
mm/slub: add missing TID updates on slab deactivation
Linux 5.10.129
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
net: usb: qmi_wwan: add Telit 0x1070 composition
net: usb: qmi_wwan: add Telit 0x1060 composition
xen/arm: Fix race in RB-tree based P2M accounting
xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses()
xen/blkfront: force data bouncing when backend is untrusted
xen/netfront: force data bouncing when backend is untrusted
xen/netfront: fix leaking data in shared pages
xen/blkfront: fix leaking data in shared pages
selftests/rseq: Change type of rseq_offset to ptrdiff_t
selftests/rseq: x86-32: use %gs segment selector for accessing rseq thread area
selftests/rseq: x86-64: use %fs segment selector for accessing rseq thread area
selftests/rseq: Fix: work-around asm goto compiler bugs
selftests/rseq: Remove arm/mips asm goto compiler work-around
selftests/rseq: Fix warnings about #if checks of undefined tokens
selftests/rseq: Fix ppc32 offsets by using long rather than off_t
selftests/rseq: Fix ppc32 missing instruction selection "u" and "x" for load/store
selftests/rseq: Fix ppc32: wrong rseq_cs 32-bit field pointer on big endian
selftests/rseq: Uplift rseq selftests for compatibility with glibc-2.35
selftests/rseq: Introduce thread pointer getters
selftests/rseq: Introduce rseq_get_abi() helper
selftests/rseq: Remove volatile from __rseq_abi
selftests/rseq: Remove useless assignment to cpu variable
selftests/rseq: introduce own copy of rseq uapi header
selftests/rseq: remove ARRAY_SIZE define from individual tests
hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails
ipv6/sit: fix ipip6_tunnel_get_prl return value
sit: use min
drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c
xen/gntdev: Avoid blocking in unmap_grant_pages()
tcp: add a missing nf_reset_ct() in 3WHS handling
xfs: fix xfs_reflink_unshare usage of filemap_write_and_wait_range
xfs: update superblock counters correctly for !lazysbcount
xfs: fix xfs_trans slab cache name
xfs: ensure xfs_errortag_random_default matches XFS_ERRTAG_MAX
xfs: Skip repetitive warnings about mount options
xfs: rename variable mp to parsing_mp
xfs: use current->journal_info for detecting transaction recursion
net: tun: avoid disabling NAPI twice
tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio
epic100: fix use after free on rmmod
tipc: move bc link creation back to tipc_node_create
NFC: nxp-nci: Don't issue a zero length i2c_master_read()
nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
net: bonding: fix use-after-free after 802.3ad slave unbind
net: bonding: fix possible NULL deref in rlb code
net/sched: act_api: Notify user space if any actions were flushed before error
netfilter: nft_dynset: restore set element counter when failing to update
s390: remove unneeded 'select BUILD_BIN2C'
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
caif_virtio: fix race between virtio_device_ready() and ndo_open()
NFSD: restore EINVAL error translation in nfsd_commit()
net: ipv6: unexport __init-annotated seg6_hmac_net_init()
usbnet: fix memory allocation in helpers
linux/dim: Fix divide by 0 in RDMA DIM
RDMA/cm: Fix memory leak in ib_cm_insert_listen
RDMA/qedr: Fix reporting QP timeout attribute
net: dp83822: disable rx error interrupt
net: dp83822: disable false carrier interrupt
net: tun: stop NAPI when detaching queues
net: tun: unlink NAPI from device on destruction
net: dsa: bcm_sf2: force pause link settings
selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test
virtio-net: fix race between ndo_open() and virtio_device_ready()
net: usb: ax88179_178a: Fix packet receiving
net: rose: fix UAF bugs caused by timer handler
SUNRPC: Fix READ_PLUS crasher
s390/archrandom: simplify back to earlier design and initialize earlier
dm raid: fix KASAN warning in raid5_add_disks
dm raid: fix accesses beyond end of raid member array
powerpc/bpf: Fix use of user_pt_regs in uapi
powerpc/book3e: Fix PUD allocation size in map_kernel_page()
powerpc/prom_init: Fix kernel config grep
nvdimm: Fix badblocks clear off-by-one error
nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G)
ipv6: take care of disable_policy when restoring routes
drm/amdgpu: To flush tlb for MMHUB of RAVEN series
Linux 5.10.128
net: mscc: ocelot: allow unregistered IP multicast flooding
powerpc/ftrace: Remove ftrace init tramp once kernel init is complete
xfs: check sb_meta_uuid for dabuf buffer recovery
xfs: remove all COW fork extents when remounting readonly
xfs: Fix the free logic of state in xfs_attr_node_hasname
xfs: punch out data fork delalloc blocks on COW writeback failure
xfs: use kmem_cache_free() for kmem_cache objects
bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init()
tick/nohz: unexport __init-annotated tick_nohz_full_setup()
drm: remove drm_fb_helper_modinit
MAINTAINERS: add Amir as xfs maintainer for 5.10.y
Linux 5.10.127
powerpc/pseries: wire up rng during setup_arch()
kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
random: update comment from copy_to_user() -> copy_to_iter()
modpost: fix section mismatch check for exported init/exit sections
ARM: cns3xxx: Fix refcount leak in cns3xxx_init
memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
ARM: Fix refcount leak in axxia_boot_secondary
soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
ARM: exynos: Fix refcount leak in exynos_map_pmu
ARM: dts: imx6qdl: correct PU regulator ramp delay
ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node
powerpc/powernv: wire up rng during setup_arch
powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
powerpc: Enable execve syscall exit tracepoint
parisc: Enable ARCH_HAS_STRICT_MODULE_RWX
parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI
xtensa: Fix refcount leak bug in time.c
xtensa: xtfpga: Fix refcount leak bug in setup
iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
iio: adc: axp288: Override TS pin bias current for some models
iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message
iio: adc: stm32: Fix ADCs iteration in irq handler
iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
iio: adc: stm32: fix maximum clock rate for stm32mp15x
iio: trigger: sysfs: fix use-after-free on remove
iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
iio: accel: mma8452: ignore the return value of reset operation
iio:accel:mxc4005: rearrange iio trigger get and register
iio:accel:bma180: rearrange iio trigger get and register
iio:chemical:ccs811: rearrange iio trigger get and register
f2fs: attach inline_data after setting compression
usb: chipidea: udc: check request status before setting device address
USB: gadget: Fix double-free bug in raw_gadget driver
usb: gadget: Fix non-unique driver names in raw-gadget driver
xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
xhci: turn off port power in shutdown
usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC
iio: adc: vf610: fix conversion mode sysfs node name
iio: mma8452: fix probe fail when device tree compatible is used.
s390/cpumf: Handle events cycles and instructions identical
gpio: winbond: Fix error code in winbond_gpio_get()
nvme: move the Samsung X5 quirk entry to the core quirks
nvme-pci: add NO APST quirk for Kioxia device
nvme-pci: allocate nvme_command within driver pdu
nvme: don't check nvme_req flags for new req
nvme: mark nvme_setup_passsthru() inline
nvme: split nvme_alloc_request()
nvme: centralize setting the timeout in nvme_alloc_request
Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
virtio_net: fix xdp_rxq_info bug after suspend/resume
igb: Make DMA faster when CPU is active on the PCIe link
regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
ice: ethtool: advertise 1000M speeds properly
afs: Fix dynamic root getattr
MIPS: Remove repetitive increase irq_err_count
x86/xen: Remove undefined behavior in setup_features()
selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
udmabuf: add back sanity check
net/tls: fix tls_sk_proto_close executed repeatedly
erspan: do not assume transport header is always set
drm/msm/dp: fix connect/disconnect handled at irq_hpd
drm/msm/dp: promote irq_hpd handle to handle link training correctly
drm/msm/dp: deinitialize mainlink if link training failed
drm/msm/dp: fixes wrong connection state caused by failure of link train
drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind()
drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
igb: fix a use-after-free issue in igb_clean_tx_ring
tipc: fix use-after-free Read in tipc_named_reinit
tipc: simplify the finalize work queue
phy: aquantia: Fix AN when higher speeds than 1G are not advertised
bpf, x86: Fix tail call count offset calculation on bpf2bpf call
drm/sun4i: Fix crash during suspend after component bind failure
bpf: Fix request_sock leak in sk lookup helpers
drm/msm: use for_each_sgtable_sg to iterate over scatterlist
scsi: scsi_debug: Fix zone transition to full condition
netfilter: use get_random_u32 instead of prandom
netfilter: nftables: add nft_parse_register_store() and use it
netfilter: nftables: add nft_parse_register_load() and use it
drm/msm: Fix double pm_runtime_disable() call
USB: serial: option: add Quectel RM500K module support
USB: serial: option: add Quectel EM05-G modem
USB: serial: option: add Telit LE910Cx 0x1250 composition
dm mirror log: clear log bits up to BITS_PER_LONG boundary
dm era: commit metadata in postsuspend after worker stops
ata: libata: add qc->flags in ata_qc_complete_template tracepoint
mtd: rawnand: gpmi: Fix setting busy timeout setting
mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
btrfs: add error messages to all unrecognized mount options
net: openvswitch: fix parsing of nw_proto for IPv6 fragments
ALSA: hda/realtek: Add quirk for Clevo NS50PU
ALSA: hda/realtek: Add quirk for Clevo PD70PNT
ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
ALSA: hda/realtek - ALC897 headset MIC no sound
ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
ALSA: hda/conexant: Fix missing beep setup
ALSA: hda/via: Fix missing beep setup
random: quiet urandom warning ratelimit suppression message
random: schedule mix_interrupt_randomness() less often
vt: drop old FONT ioctls
Linux 5.10.126
io_uring: use separate list entry for iopoll requests
Linux 5.10.125
io_uring: add missing item types for various requests
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
serial: core: Initialize rs485 RTS polarity already on probe
tcp: drop the hash_32() part from the index calculation
tcp: increase source port perturb table to 2^16
tcp: dynamically allocate the perturb table used by source ports
tcp: add small random increments to the source port
tcp: use different parts of the port_offset for index and offset
tcp: add some entropy in __inet_hash_connect()
usb: gadget: u_ether: fix regression in setting fixed MAC address
zonefs: fix zonefs_iomap_begin() for reads
s390/mm: use non-quiescing sske for KVM switch to keyed guest
Revert "xfrm: Add possibility to set the default to block if we have no policy"
Revert "net: xfrm: fix shift-out-of-bounce"
Revert "xfrm: make user policy API complete"
Revert "xfrm: notify default policy on update"
Revert "xfrm: fix dflt policy check when there is no policy configured"
Revert "xfrm: rework default policy structure"
Revert "xfrm: fix "disable_policy" flag use when arriving from different devices"
Revert "include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage"
Linux 5.10.124
clk: imx8mp: fix usb_root_clk parent
powerpc/book3e: get rid of #include <generated/compile.h>
igc: Enable PCIe PTM
Revert "PCI: Make pci_enable_ptm() private"
net: openvswitch: fix misuse of the cached connection on tuple changes
net/sched: act_police: more accurate MTU policing
dma-direct: don't over-decrypt memory
virtio-pci: Remove wrong address verification in vp_del_vqs()
ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine
KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak
KVM: x86: Account a variety of miscellaneous allocations
KVM: arm64: Don't read a HW interrupt pending state in user context
ext4: add reserved GDT blocks check
ext4: make variable "count" signed
ext4: fix bug_on ext4_mb_use_inode_pa
drm/amd/display: Cap OLED brightness per max frame-average luminance
dm mirror log: round up region bitmap size to BITS_PER_LONG
serial: 8250: Store to lsr_save_flags after lsr read
usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
usb: dwc2: Fix memory leak in dwc2_hcd_init
USB: serial: io_ti: add Agilent E5805A support
USB: serial: option: add support for Cinterion MV31 with new baseline
crypto: memneq - move into lib/
comedi: vmk80xx: fix expression for tx buffer size
mei: me: add raptor lake point S DID
i2c: designware: Use standard optional ref clock implementation
irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions
irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions
irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
i2c: npcm7xx: Add check for platform_driver_register
faddr2line: Fix overlapping text section failures, the sequel
block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
certs/blacklist_hashes.c: fix const confusion in certs blacklist
arm64: ftrace: consistently handle PLTs.
arm64: ftrace: fix branch range checks
net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
net: bgmac: Fix an erroneous kfree() in bgmac_remove()
mlxsw: spectrum_cnt: Reorder counter pools
nvme: add device name to warning in uuid_show()
nvme: use sysfs_emit instead of sprintf
drm/i915/reset: Fix error_state_read ptr + offset use
misc: atmel-ssc: Fix IRQ check in ssc_probe
tty: goldfish: Fix free_irq() on remove
Drivers: hv: vmbus: Release cpu lock in error case
i40e: Fix call trace in setup_tx_descriptors
i40e: Fix calculating the number of queue pairs
i40e: Fix adding ADQ filter to TC0
clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()
pNFS: Avoid a live lock condition in pnfs_update_layout()
pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
random: credit cpu and bootloader seeds by default
gpio: dwapb: Don't print error on -EPROBE_DEFER
MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error.
mellanox: mlx5: avoid uninitialized variable warning with gcc-12
net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag
ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed
ALSA: hda/realtek - Add HW8326 support
scsi: pmcraid: Fix missing resource cleanup in error case
scsi: ipr: Fix missing/incorrect resource cleanup in error case
scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion
scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq
ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
ASoC: es8328: Fix event generation for deemphasis control
ASoC: wm8962: Fix suspend while playing music
quota: Prevent memory allocation recursion while holding dq_lock
ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
ASoC: cs42l51: Correct minimum value for SX volume control
ASoC: cs42l56: Correct typo in minimum level for SX volume controls
ASoC: cs42l52: Correct TLV for Bypass Volume
ASoC: cs53l30: Correct number of volume levels on SX controls
ASoC: cs35l36: Update digital volume TLV
ASoC: cs42l52: Fix TLV scales for mixer controls
dma-debug: make things less spammy under memory pressure
ASoC: nau8822: Add operation for internal PLL off and on
powerpc/kasan: Silence KASAN warnings in __get_wchan()
arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3
bpf: Fix incorrect memory charge cost calculation in stack_map_alloc()
nfsd: Replace use of rwsem with errseq_t
9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
Linux 5.10.123
x86/speculation/mmio: Print SMT warning
KVM: x86/speculation: Disable Fill buffer clear within guests
x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
x86/speculation/srbds: Update SRBDS mitigation selection
x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
x86/speculation: Add a common function for MD_CLEAR mitigation update
x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
Documentation: Add documentation for Processor MMIO Stale Data
Linux 5.10.122
tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
dmaengine: idxd: add missing callback function to support DMA_INTERRUPT
zonefs: fix handling of explicit_open option on mount
PCI: qcom: Fix pipe clock imbalance
md/raid0: Ignore RAID0 layout if the second zone has only one device
interconnect: Restore sync state by ignoring ipa-virt in provider count
interconnect: qcom: sc7180: Drop IP0 interconnects
powerpc/mm: Switch obsolete dssall to .long
powerpc/32: Fix overread/overwrite of thread_struct via ptrace
drm/atomic: Force bridge self-refresh-exit on CRTC switch
drm/bridge: analogix_dp: Support PSR-exit to disable transition
Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
ixgbe: fix unexpected VLAN Rx in promisc mode on VF
ixgbe: fix bcast packets Rx on VF after promisc removal
nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
net: phy: dp83867: retrigger SGMII AN when link change
mmc: block: Fix CQE recovery reset success
ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
cifs: fix reconnect on smb3 mount types
cifs: return errors during session setup during reconnects
ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021
ALSA: hda/conexant - Fix loopback issue with CX20632
scripts/gdb: change kernel config dumping method
vringh: Fix loop descriptors check in the indirect cases
nodemask: Fix return values to be unsigned
cifs: version operations for smb20 unneeded when legacy support disabled
s390/gmap: voluntarily schedule during key setting
nbd: fix io hung while disconnecting device
nbd: fix race between nbd_alloc_config() and module removal
nbd: call genl_unregister_family() first in nbd_cleanup()
jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
x86/cpu: Elide KCSAN for cpu_has() and friends
modpost: fix undefined behavior of is_arm_mapping_symbol()
drm/radeon: fix a possible null pointer dereference
ceph: allow ceph.dir.rctime xattr to be updatable
Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
scsi: myrb: Fix up null pointer access on myrb_cleanup()
md: protect md_unregister_thread from reentrancy
watchdog: wdat_wdt: Stop watchdog when rebooting the system
kernfs: Separate kernfs_pr_cont_buf and rename_lock.
serial: msm_serial: disable interrupts in __msm_console_write()
staging: rtl8712: fix uninit-value in r871xu_drv_init()
staging: rtl8712: fix uninit-value in usb_read8() and friends
clocksource/drivers/sp804: Avoid error on multiple instances
extcon: Modify extcon device to be created after driver data is set
misc: rtsx: set NULL intfdata when probe fails
usb: dwc2: gadget: don't reset gadget's driver->bus
sysrq: do not omit current cpu when showing backtrace of all active CPUs
USB: hcd-pci: Fully suspend across freeze/thaw cycle
drivers: usb: host: Fix deadlock in oxu_bus_suspend()
drivers: tty: serial: Fix deadlock in sa1100_set_termios()
USB: host: isp116x: check return value after calling platform_get_resource()
drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
tty: Fix a possible resource leak in icom_probe
tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
lkdtm/usercopy: Expand size of "out of frame" object
iio: st_sensors: Add a local lock for protecting odr
staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
iio: dummy: iio_simple_dummy: check the return value of kstrdup()
drm: imx: fix compiler warning with gcc-12
net: altera: Fix refcount leak in altera_tse_mdio_create
ip_gre: test csum_start instead of transport header
net/mlx5: fs, fail conflicting actions
net/mlx5: Rearm the FW tracer after each tracer event
net: ipv6: unexport __init-annotated seg6_hmac_init()
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
net: mdio: unexport __init-annotated mdio_bus_init()
SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
bpf, arm64: Clear prog->jited_len along prog->jited
af_unix: Fix a data-race in unix_dgram_peer_wake_me().
xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
netfilter: nf_tables: bail out early if hardware offload is not supported
netfilter: nf_tables: memleak flow rule from commit path
netfilter: nf_tables: release new hooks on unsupported flowtable flags
ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
netfilter: nf_tables: always initialize flowtable hook list in transaction
powerpc/kasan: Force thread size increase with KASAN
netfilter: nf_tables: delete flowtable hooks via transaction list
netfilter: nat: really support inet nat without l3 address
xprtrdma: treat all calls not a bcall when bc_serv is NULL
video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()
video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
NFSv4: Don't hold the layoutget locks across multiple RPC calls
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
m68knommu: fix undefined reference to `_init_sp'
m68knommu: set ZERO_PAGE() to the allocated zeroed page
i2c: cadence: Increase timeout per message if necessary
f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
iommu/arm-smmu-v3: check return value after calling platform_get_resource()
iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
tracing: Avoid adding tracer option before update_tracer_options
tracing: Fix sleeping function called from invalid context on RT kernel
bootconfig: Make the bootconfig.o as a normal object file
mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
dmaengine: idxd: set DMA_INTERRUPT cap bit
perf c2c: Fix sorting in percent_rmt_hitm_cmp()
driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction
tipc: check attribute length for bearer name
scsi: sd: Fix potential NULL pointer dereference
afs: Fix infinite loop found by xfstest generic/676
gpio: pca953x: use the correct register address to do regcache sync
tcp: tcp_rtx_synack() can be called from process context
net: sched: add barrier to fix packet stuck problem for lockless qdisc
net/mlx5e: Update netdev features after changing XDP state
net/mlx5: correct ECE offset in query qp output
net/mlx5: Don't use already freed action pointer
sfc: fix wrong tx channel offset with efx_separate_tx_channels
sfc: fix considering that all channels have TX queues
nfp: only report pause frame configuration for physical device
net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *"
riscv: read-only pages should not be writable
bpf: Fix probe read error in ___bpf_prog_run()
ubi: ubi_create_volume: Fix use-after-free when volume creation failed
ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty
jffs2: fix memory leak in jffs2_do_fill_super
modpost: fix removing numeric suffixes
net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
driver core: fix deadlock in __device_attach
driver: base: fix UAF when driver_attach failed
bus: ti-sysc: Fix warnings for unbind for serial
firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
serial: stm32-usart: Correct CSIZE, bits, and parity
serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
serial: sifive: Sanitize CSIZE and c_iflag
serial: sh-sci: Don't allow CS5-6
serial: txx9: Don't allow CS5-6
serial: rda-uart: Don't allow CS5-6
serial: digicolor-usart: Don't allow CS5-6
serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
serial: meson: acquire port->lock in startup()
rtc: mt6397: check return value after calling platform_get_resource()
clocksource/drivers/riscv: Events are stopped during CPU suspend
soc: rockchip: Fix refcount leak in rockchip_grf_init
extcon: ptn5150: Add queue work sync before driver release
coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
serial: sifive: Report actual baud base rather than fixed 115200
phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
iio: adc: sc27xx: Fine tune the scale calibration values
iio: adc: sc27xx: fix read big scale voltage not right
iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout
iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
usb: typec: mux: Check dev_set_name() return value
firmware: stratix10-svc: fix a missing check on list iterator
misc: fastrpc: fix an incorrect NULL check on list iterator
usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
pwm: lp3943: Fix duty calculation in case period was clamped
staging: fieldbus: Fix the error handling path in anybuss_host_common_probe()
usb: musb: Fix missing of_node_put() in omap2430_probe
USB: storage: karma: fix rio_karma_init return
usb: usbip: add missing device lock on tweak configuration cmd
usb: usbip: fix a refcount leak in stub_probe()
tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get
tty: n_tty: Restore EOF push handling behavior
tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
tty: goldfish: Use tty_port_destroy() to destroy port
lkdtm/bugs: Check for the NULL pointer after calling kmalloc
iio: adc: ad7124: Remove shift from scan_type
staging: greybus: codecs: fix type confusion of list iterator variable
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
Linux 5.10.121
md: bcache: check the return value of kzalloc() in detached_dev_do_request()
ext4: only allow test_dummy_encryption when supported
MIPS: IP30: Remove incorrect `cpu_has_fpu' override
MIPS: IP27: Remove incorrect `cpu_has_fpu' override
RDMA/rxe: Generate a completion for unsupported/invalid opcode
Revert "random: use static branch for crng_ready()"
block: fix bio_clone_blkg_association() to associate with proper blkcg_gq
bfq: Make sure bfqg for which we are queueing requests is online
bfq: Get rid of __bio_blkcg() usage
bfq: Remove pointless bfq_init_rq() calls
bfq: Drop pointless unlock-lock pair
bfq: Avoid merging queues with different parents
thermal/core: Fix memory leak in the error path
thermal/core: fix a UAF bug in __thermal_cooling_device_register()
kseltest/cgroup: Make test_stress.sh work if run interactively
xfs: assert in xfs_btree_del_cursor should take into account error
xfs: consider shutdown in bmapbt cursor delete assert
xfs: force log and push AIL to clear pinned inodes when aborting mount
xfs: restore shutdown check in mapped write fault path
xfs: fix incorrect root dquot corruption error when switching group/project quota types
xfs: fix chown leaking delalloc quota blocks when fssetxattr fails
xfs: sync lazy sb accounting on quiesce of read-only mounts
xfs: set inode size after creating symlink
net: ipa: fix page free in ipa_endpoint_replenish_one()
net: ipa: fix page free in ipa_endpoint_trans_release()
phy: qcom-qmp: fix reset-controller leak on probe errors
coresight: core: Fix coresight device probe failure issue
blk-iolatency: Fix inflight count imbalances and IO hangs on offline
vdpasim: allow to enable a vq repeatedly
dt-bindings: gpio: altera: correct interrupt-cells
docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op
ARM: pxa: maybe fix gpio lookup tables
ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries
phy: qcom-qmp: fix struct clk leak on probe errors
arm64: dts: qcom: ipq8074: fix the sleep clock frequency
gma500: fix an incorrect NULL check on list iterator
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
serial: pch: don't overwrite xmit->buf[0] by x_char
bcache: avoid journal no-space deadlock by reserving 1 journal bucket
bcache: remove incremental dirty sector counting for bch_sectors_dirty_init()
bcache: improve multithreaded bch_sectors_dirty_init()
bcache: improve multithreaded bch_btree_check()
stm: ltdc: fix two incorrect NULL checks on list iterator
carl9170: tx: fix an incorrect use of list iterator
ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
rtl818x: Prevent using not initialized queues
xtensa/simdisk: fix proc_read_simdisk()
hugetlb: fix huge_pmd_unshare address update
nodemask.h: fix compilation error with GCC12
iommu/msm: Fix an incorrect NULL check on list iterator
ftrace: Clean up hash direct_functions on register failures
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
um: Fix out-of-bounds read in LDT setup
um: chan_user: Fix winch_tramp() return value
mac80211: upgrade passive scan to active scan on DFS channels after beacon rx
cfg80211: declare MODULE_FIRMWARE for regulatory.db
irqchip: irq-xtensa-mx: fix initial IRQ affinity
irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x
csky: patch_text: Fixup last cpu should be master
RDMA/hfi1: Fix potential integer multiplication overflow errors
Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug
ima: remove the IMA_TEMPLATE Kconfig option
media: coda: Add more H264 levels for CODA960
media: coda: Fix reported H264 profile
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write
md: fix an incorrect NULL check in md_reload_sb
md: fix an incorrect NULL check in does_sb_need_changing
drm/i915/dsi: fix VBT send packet port selection for ICL+
drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator
drm/nouveau/clk: Fix an incorrect NULL check on list iterator
drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem
drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
scsi: dc395x: Fix a missing check on list iterator
ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
dlm: fix missing lkb refcount handling
dlm: fix plock invalid read
s390/perf: obtain sie_block from the right address
mm, compaction: fast_find_migrateblock() should return pfn in the target zone
PCI: qcom: Fix unbalanced PHY init on probe errors
PCI: qcom: Fix runtime PM imbalance on probe errors
PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299
tracing: Fix potential double free in create_var_ref()
ACPI: property: Release subnode properties with data nodes
ext4: avoid cycles in directory h-tree
ext4: verify dir block before splitting it
ext4: fix bug_on in __es_tree_search
ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
ext4: fix bug_on in ext4_writepages
ext4: fix warning in ext4_handle_inode_extension
ext4: fix use-after-free in ext4_rename_dir_prepare
bfq: Track whether bfq_group is still online
bfq: Update cgroup information before merging bio
bfq: Split shared queues on move between cgroups
efi: Do not import certificates from UEFI Secure Boot for T2 Macs
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
iwlwifi: mvm: fix assert 1F04 upon reconfig
wifi: mac80211: fix use-after-free in chanctx code
f2fs: fix to do sanity check for inline inode
f2fs: fix fallocate to use file_modified to update permissions consistently
f2fs: fix to do sanity check on total_data_blocks
f2fs: don't need inode lock for system hidden quota
f2fs: fix deadloop in foreground GC
f2fs: fix to clear dirty inode in f2fs_evict_inode()
f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
perf jevents: Fix event syntax error caused by ExtSel
perf c2c: Use stdio interface if slang is not supported
i2c: rcar: fix PM ref counts in probe error paths
i2c: npcm: Handle spurious interrupts
i2c: npcm: Correct register access width
i2c: npcm: Fix timeout calculation
iommu/amd: Increase timeout waiting for GA log enablement
dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()
dmaengine: stm32-mdma: rework interrupt handler
dmaengine: stm32-mdma: remove GISR1 register
video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout
NFS: Don't report errors from nfs_pageio_complete() more than once
NFS: Do not report flush errors in nfs_write_end()
NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS
NFS: Do not report EINTR/ERESTARTSYS as mapping errors
dmaengine: idxd: Fix the error handling path in idxd_cdev_register()
i2c: at91: Initialize dma_buf in at91_twi_xfer()
MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon
cpufreq: mediatek: Unregister platform device on exit
cpufreq: mediatek: Use module_init and add module_exit
cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init
i2c: at91: use dma safe buffers
iommu/mediatek: Add list_del in mtk_iommu_remove
f2fs: fix dereference of stale list iterator after loop body
OPP: call of_node_put() on error path in _bandwidth_supported()
Input: stmfts - do not leave device disabled in stmfts_input_open
RDMA/hfi1: Prevent use of lock before it is initialized
mailbox: forward the hrtimer if not queued and under a lock
mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()
powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
macintosh: via-pmu and via-cuda need RTC_LIB
powerpc/perf: Fix the threshold compare group constraint for power9
powerpc/64: Only WARN if __pa()/__va() called with bad addresses
hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume()
PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits
Input: sparcspkr - fix refcount leak in bbc_beep_probe
crypto: cryptd - Protect per-CPU resource by disabling BH.
crypto: sun8i-ss - handle zero sized sg
crypto: sun8i-ss - rework handling of IV
tty: fix deadlock caused by calling printk() under tty_port->lock
PCI: imx6: Fix PERST# start-up sequence
ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()
proc: fix dentry/inode overinstantiating under /proc/${pid}/net
ASoC: atmel-classd: Remove endianness flag on class d component
ASoC: atmel-pdmic: Remove endianness flag on pdmic component
powerpc/4xx/cpm: Fix return value of __setup() handler
powerpc/idle: Fix return value of __setup() handler
pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()
powerpc/8xx: export 'cpm_setbrg' for modules
drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()
dax: fix cache flush on PMD-mapped pages
drivers/base/node.c: fix compaction sysfs file leak
pinctrl: mvebu: Fix irq_of_parse_and_map() return value
nvdimm: Allow overwrite in the presence of disabled dimms
nvdimm: Fix firmware activation deadlock scenarios
firmware: arm_scmi: Fix list protocols enumeration in the base protocol
scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
mfd: ipaq-micro: Fix error check return value of platform_get_irq()
powerpc/fadump: fix PT_LOAD segment for boot memory area
arm: mediatek: select arch timer for mt7629
pinctrl: bcm2835: implement hook for missing gpio-ranges
gpiolib: of: Introduce hook for missing gpio-ranges
crypto: marvell/cesa - ECB does not IV
misc: ocxl: fix possible double free in ocxl_file_register_afu
ARM: dts: bcm2835-rpi-b: Fix GPIO line names
ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
can: xilinx_can: mark bit timing constants as const
platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
platform/chrome: cros_ec: fix error handling in cros_ec_register()
KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault
KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry
soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
PCI: dwc: Fix setting error return on MSI DMA mapping failure
PCI: rockchip: Fix find_first_zero_bit() limit
PCI: cadence: Fix find_first_zero_bit() limit
soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
ARM: dts: suniv: F1C100: fix watchdog compatible
memory: samsung: exynos5422-dmc: Avoid some over memory allocation
arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
net/smc: postpone sk_refcnt increment in connect()
hinic: Avoid some over memory allocation
net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()
rxrpc: Fix decision on when to generate an IDLE ACK
rxrpc: Don't let ack.previousPacket regress
rxrpc: Fix overlapping ACK accounting
rxrpc: Don't try to resend the request if we're receiving the reply
rxrpc: Fix listen() setting the bar too high for the prealloc rings
hv_netvsc: Fix potential dereference of NULL pointer
net: stmmac: fix out-of-bounds access in a selftest
net: stmmac: selftests: Use kcalloc() instead of kzalloc()
ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()
NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
thermal/core: Fix memory leak in __thermal_cooling_device_register()
thermal/drivers/core: Use a char pointer for the cooling device name
thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
thermal/drivers/bcm2711: Don't clamp temperature at zero
drm/i915: Fix CFI violation with show_dynamic_id()
drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
x86/sev: Annotate stack change in the #VC handler
drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
ext4: reject the 'commit' option on ext2 filesystems
media: rkvdec: h264: Fix bit depth wrap in pps packet
media: rkvdec: h264: Fix dpb_valid implementation
media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()
media: ov7670: remove ov7670_power_off from ov7670_remove
ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
sctp: read sk->sk_bound_dev_if once in sctp_rcv()
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
m68k: math-emu: Fix dependencies of math emulation support
nvme: set dma alignment to dword
Bluetooth: use hdev lock for accept_list and reject_list in conn req
Bluetooth: use inclusive language when filtering devices
Bluetooth: use inclusive language in HCI role comments
Bluetooth: LL privacy allow RPA
Bluetooth: L2CAP: Rudimentary typo fixes
Bluetooth: Interleave with allowlist scan
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
media: vsp1: Fix offset calculation for plane cropping
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
media: exynos4-is: Change clk_disable to clk_disable_unprepare
media: st-delta: Fix PM disable depth imbalance in delta_probe
media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
media: aspeed: Fix an error handling path in aspeed_video_probe()
scripts/faddr2line: Fix overlapping text section failures
kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
ASoC: samsung: Fix refcount leak in aries_audio_probe
ASoC: samsung: Use dev_err_probe() helper
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
ath11k: Don't check arvif->is_started before sending management frames
perf/amd/ibs: Use interrupt regs ip for stack unwinding
regulator: qcom_smd: Fix up PM8950 regulator configuration
Revert "cpufreq: Fix possible race in cpufreq online error path"
spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
iomap: iomap_write_failed fix
media: uvcvideo: Fix missing check to determine if element is found in list
drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
arm64: fix types in copy_highpage()
x86/mm: Cleanup the control_va_addr_alignment() __setup handler
irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
irqchip/exiu: Fix acknowledgment of edge triggered interrupts
x86: Fix return value of __setup handlers
virtio_blk: fix the discard_granularity and discard_alignment queue limits
perf tools: Use Python devtools for version autodetection rather than runtime
drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
drm/msm: add missing include to msm_drv.c
drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
drm/msm/hdmi: check return value after calling platform_get_resource_byname()
drm/msm/dsi: fix error checks and return values for DSI xmit functions
drm/msm/dp: fix error check return value of irq_of_parse_and_map()
drm/msm/dp: stop event kernel thread when DP unbind
drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
perf tools: Add missing headers needed by util/data.h
ASoC: rk3328: fix disabling mclk on pclk probe failure
x86/speculation: Add missing prototype for unpriv_ebpf_notify()
mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()
x86/pm: Fix false positive kmemleak report in msr_build_context()
mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check()
libbpf: Fix logic for finding matching program for CO-RE relocation
selftests/resctrl: Fix null pointer dereference on open failed
scsi: ufs: core: Exclude UECxx from SFR dump list
scsi: ufs: qcom: Fix ufs_qcom_resume()
drm/msm/dpu: adjust display_v_end for eDP and DP
of: overlay: do not break notify on NOTIFY_{OK|STOP}
fsnotify: fix wrong lockdep annotations
inotify: show inotify mask flags in proc fdinfo
ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
media: hantro: Empty encoder capture buffers by default
ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
cpufreq: Fix possible race in cpufreq online error path
spi: img-spfi: Fix pm_runtime_get_sync() error checking
sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
drm/bridge: Fix error handling in analogix_dp_probe
HID: elan: Fix potential double free in elan_input_configured
HID: hid-led: fix maximum brightness for Dream Cheeky
mtd: rawnand: denali: Use managed device resources
EDAC/dmc520: Don't print an error for each unconfigured interrupt line
drbd: fix duplicate array initializer
target: remove an incorrect unmap zeroes data deduction
efi: Add missing prototype for efi_capsule_setup_info
NFC: NULL out the dev->rfkill to prevent UAF
net: dsa: mt7530: 1G can also support 1000BASE-X link mode
scftorture: Fix distribution of short handler delays
spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
drm: mali-dp: potential dereference of null pointer
drm/komeda: Fix an undefined behavior bug in komeda_plane_add()
nl80211: show SSID for P2P_GO interfaces
bpf: Fix excessive memory allocation in stack_map_alloc()
libbpf: Don't error out on CO-RE relos for overriden weak subprogs
drm/vc4: txp: Force alpha to be 0xff if it's disabled
drm/vc4: txp: Don't set TXP_VSTART_AT_EOF
drm/vc4: hvs: Reset muxes at probe time
drm/mediatek: Fix mtk_cec_mask()
drm/ingenic: Reset pixclock rate when parent clock rate changes
x86/delay: Fix the wrong asm constraint in delay_loop()
ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
spi: qcom-qspi: Add minItems to interconnect-names
drm/bridge: adv7511: clean up CEC adapter when probe fails
drm/edid: fix invalid EDID extension block filtering
ath9k: fix ar9003_get_eepmisc
ath11k: acquire ab->base_lock in unassign when finding the peer by addr
dt-bindings: display: sitronix, st7735r: Fix backlight in example
drm: fix EDID struct for old ARM OABI format
RDMA/hfi1: Prevent panic when SDMA is disabled
powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
powerpc/powernv: fix missing of_node_put in uv_init()
powerpc/xics: fix refcount leak in icp_opal_init()
powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr
tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
ARM: hisi: Add missing of_node_put after of_find_compatible_node
ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
ARM: versatile: Add missing of_node_put in dcscb_init
pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()
fat: add ratelimit to fat*_ent_bread()
powerpc/fadump: Fix fadump to work with a different endian capture kernel
ARM: OMAP1: clock: Fix UART rate reporting algorithm
fs: jfs: fix possible NULL pointer dereference in dbFree()
soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc
crypto: ccree - use fine grained DMA mapping dir
PM / devfreq: rk3399_dmc: Disable edev on remove()
arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count
ARM: dts: s5pv210: align DMA channels with dtschema
ARM: dts: ox820: align interrupt controller node name with dtschema
IB/rdmavt: add missing locks in rvt_ruc_loopback
gfs2: use i_lock spin_lock for inode qadata
selftests/bpf: fix btf_dump/btf_dump due to recent clang change
eth: tg3: silence the GCC 12 array-bounds warning
rxrpc, afs: Fix selection of abort codes
rxrpc: Return an error to sendmsg if call failed
m68k: atari: Make Atari ROM port I/O write macros return void
x86/microcode: Add explicit CPU vendor dependency
can: mcp251xfd: silence clang's -Wunaligned-access warning
ASoC: rt1015p: remove dependency on GPIOLIB
ASoC: max98357a: remove dependency on GPIOLIB
media: exynos4-is: Fix compile warning
net: phy: micrel: Allow probing without .driver_data
nbd: Fix hung on disconnect request if socket is closed before
ASoC: rt5645: Fix errorenous cleanup order
nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
openrisc: start CPU timer early in boot
media: cec-adap.c: fix is_configuring state
media: imon: reorganize serialization
media: coda: limit frame interval enumeration to supported encoder frame sizes
media: rga: fix possible memory leak in rga_probe
rtlwifi: Use pr_warn instead of WARN_ONCE
ipmi: Fix pr_fmt to avoid compilation issues
ipmi:ssif: Check for NULL msg when handling events and messages
ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
spi: stm32-qspi: Fix wait_cmd timeout in APM mode
perf/amd/ibs: Cascade pmu init functions' return value
s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES
net: remove two BUG() from skb_checksum_help()
ASoC: tscs454: Add endianness flag in snd_soc_component_driver
HID: bigben: fix slab-out-of-bounds Write in bigben_probe
drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
mlxsw: Treat LLDP packets as control
mlxsw: spectrum_dcb: Do not warn about priority changes
ASoC: dapm: Don't fold register value changes into notifications
net/mlx5: fs, delete the FTE when there are no rules attached to it
ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
drm: msm: fix error check return value of irq_of_parse_and_map()
arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall
ath10k: skip ath10k_halt during suspend for driver state RESTARTING
drm/amd/pm: fix the compile warning
drm/plane: Move range check for format_count earlier
ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408
ath11k: disable spectral scan during spectral deinit
scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
scsi: megaraid: Fix error check return value of register_chrdev()
drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit
mmc: jz4740: Apply DMA engine limits to maximum segment size
md/bitmap: don't set sb values if can't pass sanity check
media: cx25821: Fix the warning when removing the module
media: pci: cx23885: Fix the error handling in cx23885_initdev()
media: venus: hfi: avoid null dereference in deinit
ath9k: fix QCA9561 PA bias level
drm/amd/pm: fix double free in si_parse_power_table()
tools/power turbostat: fix ICX DRAM power numbers
spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction
ALSA: jack: Access input_dev under mutex
sfc: ef10: Fix assigning negative value to unsigned variable
rcu: Make TASKS_RUDE_RCU select IRQ_WORK
rcu-tasks: Fix race in schedule and flush work
drm/komeda: return early if drm_universal_plane_init() fails.
ACPICA: Avoid cache flush inside virtual machines
x86/platform/uv: Update TSC sync state for UV5
fbcon: Consistently protect deferred_takeover with console_lock()
ipv6: fix locking issues with loops over idev->addr_list
ipw2x00: Fix potential NULL dereference in libipw_xmit()
b43: Fix assigning negative value to unsigned variable
b43legacy: Fix assigning negative value to unsigned variable
mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
iommu/vt-d: Add RPLS to quirk list to skip TE disabling
btrfs: repair super block num_devices automatically
btrfs: add "0x" prefix for unsupported optional features
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP
perf/x86/intel: Fix event constraints for ICL
x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails
parisc/stifb: Keep track of hardware path of graphics card
Fonts: Make font size unsigned in font_desc
xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
cifs: when extending a file with falloc we should make files not-sparse
usb: core: hcd: Add support for deferring roothub registration
usb: dwc3: gadget: Move null pinter check to proper place
USB: new quirk for Dell Gen 2 devices
USB: serial: option: add Quectel BG95 modem
ALSA: usb-audio: Cancel pending work at closing a MIDI substream
ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS
ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop
riscv: Fix irq_work when SMP is disabled
riscv: Initialize thread pointer before calling C functions
parisc/stifb: Implement fb_is_primary_device()
binfmt_flat: do not stop relocating GOT entries prematurely on riscv
Linux 5.10.120
bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
NFSD: Fix possible sleep during nfsd4_release_lockowner()
NFS: Memory allocation failures are not server fatal errors
docs: submitting-patches: Fix crossref to 'The canonical patch format'
tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
tpm: Fix buffer access in tpm2_get_tpm_pt()
HID: multitouch: add quirks to enable Lenovo X12 trackpoint
HID: multitouch: Add support for Google Whiskers Touchpad
raid5: introduce MD_BROKEN
dm verity: set DM_TARGET_IMMUTABLE feature flag
dm stats: add cond_resched when looping over entries
dm crypt: make printing of the key constant-time
dm integrity: fix error code in dm_integrity_ctr()
ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries
Bluetooth: hci_qca: Use del_timer_sync() before freeing
zsmalloc: fix races between asynchronous zspage free and page migration
crypto: ecrdsa - Fix incorrect use of vli_cmp
crypto: caam - fix i.MX6SX entropy delay value
KVM: x86: avoid calling x86 emulator without a decoded instruction
x86, kvm: use correct GFP flags for preemption disabled
x86/kvm: Alloc dummy async #PF token outside of raw spinlock
KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator
netfilter: conntrack: re-fetch conntrack after insertion
netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
crypto: drbg - make reseeding from get_random_bytes() synchronous
crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
crypto: drbg - prepare for more fine-grained tracking of seeding state
lib/crypto: add prompts back to crypto libraries
exfat: check if cluster num is valid
drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
xfs: Fix CIL throttle hang when CIL space used going backwards
xfs: fix an ABBA deadlock in xfs_rename
xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks
xfs: show the proper user quota options
xfs: detect overflows in bmbt records
net: ipa: compute proper aggregation limit
io_uring: fix using under-expanded iters
io_uring: don't re-import iovecs from callbacks
assoc_array: Fix BUG_ON during garbage collect
cfg80211: set custom regdomain after wiphy registration
pipe: Fix missing lock in pipe_resize_ring()
pipe: make poll_usage boolean and annotate its access
netfilter: nf_tables: disallow non-stateful expression in sets earlier
drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
net: ftgmac100: Disable hardware checksum on AST2600
nfc: pn533: Fix buggy cleanup order
net: af_key: check encryption module availability consistency
percpu_ref_init(): clean ->percpu_count_ref on failure
pinctrl: sunxi: fix f1c100s uart2 function
Linux 5.10.119
ALSA: ctxfi: Add SB046x PCI ID
random: check for signals after page of pool writes
random: wire up fops->splice_{read,write}_iter()
random: convert to using fops->write_iter()
random: convert to using fops->read_iter()
random: unify batched entropy implementations
random: move randomize_page() into mm where it belongs
random: move initialization functions out of hot pages
random: make consistent use of buf and len
random: use proper return types on get_random_{int,long}_wait()
random: remove extern from functions in header
random: use static branch for crng_ready()
random: credit architectural init the exact amount
random: handle latent entropy and command line from random_init()
random: use proper jiffies comparison macro
random: remove ratelimiting for in-kernel unseeded randomness
random: move initialization out of reseeding hot path
random: avoid initializing twice in credit race
random: use symbolic constants for crng_init states
siphash: use one source of truth for siphash permutations
random: help compiler out with fast_mix() by using simpler arguments
random: do not use input pool from hard IRQs
random: order timer entropy functions below interrupt functions
random: do not pretend to handle premature next security model
random: use first 128 bits of input as fast init
random: do not use batches when !crng_ready()
random: insist on random_get_entropy() existing in order to simplify
xtensa: use fallback for random_get_entropy() instead of zero
sparc: use fallback for random_get_entropy() instead of zero
um: use fallback for random_get_entropy() instead of zero
x86/tsc: Use fallback for random_get_entropy() instead of zero
nios2: use fallback for random_get_entropy() instead of zero
arm: use fallback for random_get_entropy() instead of zero
mips: use fallback for random_get_entropy() instead of just c0 random
riscv: use fallback for random_get_entropy() instead of zero
m68k: use fallback for random_get_entropy() instead of zero
timekeeping: Add raw clock fallback for random_get_entropy()
powerpc: define get_cycles macro for arch-override
alpha: define get_cycles macro for arch-override
parisc: define get_cycles macro for arch-override
s390: define get_cycles macro for arch-override
ia64: define get_cycles macro for arch-override
init: call time_init() before rand_initialize()
random: fix sysctl documentation nits
random: document crng_fast_key_erasure() destination possibility
random: make random_get_entropy() return an unsigned long
random: allow partial reads if later user copies fail
random: check for signals every PAGE_SIZE chunk of /dev/[u]random
random: check for signal_pending() outside of need_resched() check
random: do not allow user to keep crng key around on stack
random: do not split fast init input in add_hwgenerator_randomness()
random: mix build-time latent entropy into pool at init
random: re-add removed comment about get_random_{u32,u64} reseeding
random: treat bootloader trust toggle the same way as cpu trust toggle
random: skip fast_init if hwrng provides large chunk of entropy
random: check for signal and try earlier when generating entropy
random: reseed more often immediately after booting
random: make consistent usage of crng_ready()
random: use SipHash as interrupt entropy accumulator
random: replace custom notifier chain with standard one
random: don't let 644 read-only sysctls be written to
random: give sysctl_random_min_urandom_seed a more sensible value
random: do crng pre-init loading in worker rather than irq
random: unify cycles_t and jiffies usage and types
random: cleanup UUID handling
random: only wake up writers after zap if threshold was passed
random: round-robin registers as ulong, not u32
random: clear fast pool, crng, and batches in cpuhp bring up
random: pull add_hwgenerator_randomness() declaration into random.h
random: check for crng_init == 0 in add_device_randomness()
random: unify early init crng load accounting
random: do not take pool spinlock at boot
random: defer fast pool mixing to worker
random: rewrite header introductory comment
random: group sysctl functions
random: group userspace read/write functions
random: group entropy collection functions
random: group entropy extraction functions
random: group crng functions
random: group initialization wait functions
random: remove whitespace and reorder includes
random: remove useless header comment
random: introduce drain_entropy() helper to declutter crng_reseed()
random: deobfuscate irq u32/u64 contributions
random: add proper SPDX header
random: remove unused tracepoints
random: remove ifdef'd out interrupt bench
random: tie batched entropy generation to base_crng generation
random: fix locking for crng_init in crng_reseed()
random: zero buffer after reading entropy from userspace
random: remove outdated INT_MAX >> 6 check in urandom_read()
random: make more consistent use of integer types
random: use hash function for crng_slow_load()
random: use simpler fast key erasure flow on per-cpu keys
random: absorb fast pool into input pool after fast load
random: do not xor RDRAND when writing into /dev/random
random: ensure early RDSEED goes through mixer on init
random: inline leaves of rand_initialize()
random: get rid of secondary crngs
random: use RDSEED instead of RDRAND in entropy extraction
random: fix locking in crng_fast_load()
random: remove batched entropy locking
random: remove use_input_pool parameter from crng_reseed()
random: make credit_entropy_bits() always safe
random: always wake up entropy writers after extraction
random: use linear min-entropy accumulation crediting
random: simplify entropy debiting
random: use computational hash for entropy extraction
random: only call crng_finalize_init() for primary_crng
random: access primary_pool directly rather than through pointer
random: continually use hwgenerator randomness
random: simplify arithmetic function flow in account()
random: selectively clang-format where it makes sense
random: access input_pool_data directly rather than through pointer
random: cleanup fractional entropy shift constants
random: prepend remaining pool constants with POOL_
random: de-duplicate INPUT_POOL constants
random: remove unused OUTPUT_POOL constants
random: rather than entropy_store abstraction, use global
random: remove unused extract_entropy() reserved argument
random: remove incomplete last_data logic
random: cleanup integer types
random: cleanup poolinfo abstraction
random: fix typo in comments
random: don't reset crng_init_cnt on urandom_read()
random: avoid superfluous call to RDRAND in CRNG extraction
random: early initialization of ChaCha constants
random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
random: harmonize "crng init done" messages
random: mix bootloader randomness into pool
random: do not re-init if crng_reseed completes before primary init
random: do not sign extend bytes for rotation when mixing
random: use BLAKE2s instead of SHA1 in extraction
random: remove unused irq_flags argument from add_interrupt_randomness()
random: document add_hwgenerator_randomness() with other input functions
lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI
lib/crypto: sha1: re-roll loops to reduce code size
lib/crypto: blake2s: move hmac construction into wireguard
lib/crypto: blake2s: include as built-in
crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
crypto: blake2s - adjust include guard naming
crypto: blake2s - add comment for blake2s_state fields
crypto: blake2s - optimize blake2s initialization
crypto: blake2s - share the "shash" API boilerplate code
crypto: blake2s - move update and final logic to internal/blake2s.h
crypto: blake2s - remove unneeded includes
crypto: x86/blake2s - define shash_alg structs using macros
crypto: blake2s - define shash_alg structs using macros
crypto: lib/blake2s - Move selftest prototype into header file
MAINTAINERS: add git tree for random.c
MAINTAINERS: co-maintain random.c
random: remove dead code left over from blocking pool
random: avoid arch_get_random_seed_long() when collecting IRQ randomness
ACPI: sysfs: Fix BERT error region memory mapping
ACPI: sysfs: Make sparse happy about address space in use
media: vim2m: initialize the media device earlier
media: vim2m: Register video device after setting up internals
secure_seq: use the 64 bits of the siphash for port offset calculation
tcp: change source port randomizarion at connect() time
KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
KVM: x86: Properly handle APF vs disabled LAPIC situation
staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
lockdown: also lock down previous kgdb use
Linux 5.10.118
module: check for exit sections in layout_sections() instead of module_init_section()
include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage
afs: Fix afs_getattr() to refetch file status if callback break occurred
i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe()
module: treat exit sections the same as init sections when !CONFIG_MODULE_UNLOAD
dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group
Input: ili210x - fix reset timing
arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs
net: atlantic: verify hw_head_ lies within TX buffer ring
net: atlantic: add check for MAX_SKB_FRAGS
net: atlantic: reduce scope of is_rsc_complete
net: atlantic: fix "frag[0] not initialized"
net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one()
nl80211: fix locking in nl80211_set_tx_bitrate_mask()
selftests: add ping test with ping_group_range tuned
nl80211: validate S1G channel width
mac80211: fix rx reordering with non explicit / psmp ack policy
scsi: qla2xxx: Fix missed DMA unmap for aborted commands
perf bench numa: Address compiler error on s390
gpio: mvebu/pwm: Refuse requests with inverted polarity
gpio: gpio-vf610: do not touch other bits when set the target bit
riscv: dts: sifive: fu540-c000: align dma node name with dtschema
net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
igb: skip phy status check where unavailable
ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
ARM: 9196/1: spectre-bhb: enable for Cortex-A15
net: af_key: add check for pfkey_broadcast in function pfkey_process
net/mlx5e: Properly block LRO when XDP is enabled
NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
net/qla3xxx: Fix a test in ql_reset_work()
clk: at91: generated: consider range when calculating best rate
ice: fix possible under reporting of ethtool Tx and Rx statistics
net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
net: systemport: Fix an error handling path in bcm_sysport_probe()
net/sched: act_pedit: sanitize shift argument before usage
xfrm: fix "disable_policy" flag use when arriving from different devices
xfrm: rework default policy structure
xfrm: fix dflt policy check when there is no policy configured
xfrm: notify default policy on update
xfrm: make user policy API complete
net: xfrm: fix shift-out-of-bounce
xfrm: Add possibility to set the default to block if we have no policy
net: evaluate net.ipvX.conf.all.disable_policy and disable_xfrm
net: macb: Increment rx bd head after allocating skb and buffer
net: ipa: record proper RX transaction count
ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group
pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl
ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi
dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace
drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
libceph: fix potential use-after-free on linger ping and resends
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
arm64: mte: Ensure the cleared tags are visible before setting the PTE
arm64: paravirt: Use RCU read locks to guard stolen_time
KVM: x86/mmu: Update number of zapped pages even if page list is stable
PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold
Fix double fget() in vhost_net_set_backend()
selinux: fix bad cleanup on error in hashtab_duplicate()
perf: Fix sys_perf_event_open() race against self
ALSA: hda/realtek: Add quirk for TongFang devices with pop noise
ALSA: wavefront: Proper check of get_user() error
ALSA: usb-audio: Restore Rane SL-1 quirk
Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
Revert "swiotlb: fix info leak with DMA_FROM_DEVICE"
nilfs2: fix lockdep warnings during disk space reclamation
nilfs2: fix lockdep warnings in page operations for btree nodes
ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
platform/chrome: cros_ec_debugfs: detach log reader wq from devm
drbd: remove usage of list iterator variable after loop
MIPS: lantiq: check the return value of kzalloc()
fs: fix an infinite loop in iomap_fiemap
rtc: mc146818-lib: Fix the AltCentury for AMD platforms
nvme-multipath: fix hang when disk goes live over reconnect
tools/virtio: compile with -pthread
vhost_vdpa: don't setup irq offloading when irq_num < 0
s390/pci: improve zpci_dev reference counting
ALSA: hda/realtek: Enable headset mic on Lenovo P360
crypto: x86/chacha20 - Avoid spurious jumps to other functions
crypto: stm32 - fix reference leak in stm32_crc_remove
rtc: sun6i: Fix time overflow handling
gfs2: Disable page faults during lockless buffered reads
nvme-pci: add quirks for Samsung X5 SSDs
Input: stmfts - fix reference leak in stmfts_input_open
Input: add bounds checking to input_set_capability()
um: Cleanup syscall_handler_t definition/cast, fix warning
rtc: pcf2127: fix bug when reading alarm registers
rtc: fix use-after-free on device removal
igc: Update I226_K device ID
igc: Remove phy->type checking
igc: Remove _I_PHY_ID checking
Revert "drm/i915/opregion: check port number bounds for SWSCI display power state"
floppy: use a statically allocated error counter
io_uring: always grab file table for deferred statx
usb: gadget: fix race when gadget driver register via ioctl
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/display/sitronix,st7735r.yaml
Documentation/devicetree/bindings/dma/allwinner,sun50i-a64-dma.yaml
Documentation/devicetree/bindings/gpio/gpio-altera.txt
Documentation/devicetree/bindings/pinctrl/aspeed,ast2600-pinctrl.yaml
Documentation/devicetree/bindings/spi/qcom,spi-qcom-qspi.yaml
drivers/scsi/ufs/ufs-qcom.c
drivers/soc/qcom/llcc-qcom.c
drivers/virtio/virtio_mmio.c
Change-Id: I7130d4c99319ff2a9474e07159e3943d94059e3a
Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com>
|
||
|
Robin Murphy
|
abb277d9f1 |
FROMGIT: mm/vmalloc: Add override for lazy vunmap
Add an interface for arch code to disable lazy vunmap by forcing the threshold to zero. This might be interesting for debugging/testing in general, but primarily helps a horrible situation which needs to guarantee that vmalloc aliases are up-to-date from atomic context, wherein the only practical solution is to never let them get stale in the first place. Bug: 223346425 (cherry picked from commit 2a34c1503b85f49dd472dfd932dfcd16cab8ee8a https://git.gitlab.arm.com/linux-arm/linux-rm.git arm64/2454944) Change-Id: I694523564357b4c43d30c129af1e89fd803824d3 Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Beata Michalska <beata.michalska@arm.com> |
||
|
Mike Rapoport
|
68d4b5fef2 |
BACKPORT: mm/page_alloc: always initialize memory map for the holes
Patch series "mm: ensure consistency of memory map poisoning". Currently memory map allocation for FLATMEM case does not poison the struct pages regardless of CONFIG_PAGE_POISON setting. This happens because allocation of the memory map for FLATMEM and SPARSMEM use different memblock functions and those that are used for SPARSMEM case (namely memblock_alloc_try_nid_raw() and memblock_alloc_exact_nid_raw()) implicitly poison the allocated memory. Another side effect of this implicit poisoning is that early setup code that uses the same functions to allocate memory burns cycles for the memory poisoning even if it was not intended. These patches introduce memmap_alloc() wrapper that ensure that the memory map allocation is consistent for different memory models. This patch (of 4): Currently memory map for the holes is initialized only when SPARSEMEM memory model is used. Yet, even with FLATMEM there could be holes in the physical memory layout that have memory map entries. For instance, the memory reserved using e820 API on i386 or "reserved-memory" nodes in device tree would not appear in memblock.memory and hence the struct pages for such holes will be skipped during memory map initialization. These struct pages will be zeroed because the memory map for FLATMEM systems is allocated with memblock_alloc_node() that clears the allocated memory. While zeroed struct pages do not cause immediate problems, the correct behaviour is to initialize every page using __init_single_page(). Besides, enabling page poison for FLATMEM case will trigger PF_POISONED_CHECK() unless the memory map is properly initialized. Make sure init_unavailable_range() is called for both SPARSEMEM and FLATMEM so that struct pages representing memory holes would appear as PG_Reserved with any memory layout. [rppt@kernel.org: fix microblaze] Link: https://lkml.kernel.org/r/YQWW3RCE4eWBuMu/@kernel.org (cherry picked from commit c3ab6baf6a004eab7344a1d8880a971f2414e1b6) Bug: 258556132 Link: https://lkml.kernel.org/r/20210714123739.16493-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20210714123739.16493-2-rppt@kernel.org Change-Id: Ib60682288ba76e65384de91b70a08662ead12934 Signed-off-by: Mike Rapoport <rppt@linux.ibm.com> Acked-by: David Hildenbrand <david@redhat.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Cc: Michal Simek <monstr@monstr.eu> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|
SeongJae Park
|
e0243d1991 |
UPSTREAM: mm/damon/core: initialize damon_target->list in damon_new_target()
'struct damon_target' creation function, 'damon_new_target()' is not initializing its '->list' field, unlike other DAMON structs creator functions such as 'damon_new_region()'. Normal users of 'damon_new_target()' initializes the field by adding the target to DAMON context's targets list, but some code could access the uninitialized field. This commit avoids the case by initializing the field in 'damon_new_target()'. Bug: 254441685 Link: https://lkml.kernel.org/r/20221002193130.8227-1-sj@kernel.org Fixes: f23b8eee1871 ("mm/damon/core: implement region-based sampling") Signed-off-by: SeongJae Park <sj@kernel.org> Reported-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Tested-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit b1f44cdabad8c50cd72d6b6731e9fdf3730a8f4f) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ie500358e0cc7d5bf82225e6e2b5229f6629736f4 |
||
|
Baolin Wang
|
2df2e2c084 |
UPSTREAM: mm/damon: validate if the pmd entry is present before accessing
pmd_huge() is used to validate if the pmd entry is mapped by a huge page, also including the case of non-present (migration or hwpoisoned) pmd entry on arm64 or x86 architectures. This means that pmd_pfn() can not get the correct pfn number for a non-present pmd entry, which will cause damon_get_page() to get an incorrect page struct (also may be NULL by pfn_to_online_page()), making the access statistics incorrect. This means that the DAMON may make incorrect decision according to the incorrect statistics, for example, DAMON may can not reclaim cold page in time due to this cold page was regarded as accessed mistakenly if DAMOS_PAGEOUT operation is specified. Moreover it does not make sense that we still waste time to get the page of the non-present entry. Just treat it as not-accessed and skip it, which maintains consistency with non-present pte level entries. So add pmd entry present validation to fix the above issues. Bug: 254441685 Link: https://lkml.kernel.org/r/58b1d1f5fbda7db49ca886d9ef6783e3dcbbbc98.1660805030.git.baolin.wang@linux.alibaba.com Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces") Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com> Reviewed-by: SeongJae Park <sj@kernel.org> Reviewed-by: Muchun Song <songmuchun@bytedance.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit c8b9aff419303e4d4219b5ff64b1c7e062dee48e) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Idda1765dcbc93a28ad38ccc53688d69b64202330 |
||
Greg Kroah-Hartman
|
ed91943b48 |
UPSTREAM: mm/damon/dbgfs: fix memory leak when using debugfs_lookup()
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput(). Bug: 254441685 Link: https://lkml.kernel.org/r/20220902191149.112434-1-sj@kernel.org Fixes: 75c1c2b53c78b ("mm/damon/dbgfs: support multiple contexts") Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: SeongJae Park <sj@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 1552fd3ef7dbe07208b8ae84a0a6566adf7dfc9d) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I7f2e8fa0167b3e44c4c251a51df341a6a7d98fd2 |
||
Badari Pulavarty
|
3093f8b52c |
UPSTREAM: mm/damon/dbgfs: avoid duplicate context directory creation
When user tries to create a DAMON context via the DAMON debugfs interface
with a name of an already existing context, the context directory creation
fails but a new context is created and added in the internal data
structure, due to absence of the directory creation success check. As a
result, memory could leak and DAMON cannot be turned on. An example test
case is as below:
# cd /sys/kernel/debug/damon/
# echo "off" > monitor_on
# echo paddr > target_ids
# echo "abc" > mk_context
# echo "abc" > mk_context
# echo $$ > abc/target_ids
# echo "on" > monitor_on <<< fails
Return value of 'debugfs_create_dir()' is expected to be ignored in
general, but this is an exceptional case as DAMON feature is depending
on the debugfs functionality and it has the potential duplicate name
issue. This commit therefore fixes the issue by checking the directory
creation failure and immediately return the error in the case.
Bug: 254441685
Link: https://lkml.kernel.org/r/20220821180853.2400-1-sj@kernel.org
Fixes: 75c1c2b53c78 ("mm/damon/dbgfs: support multiple contexts")
Signed-off-by: Badari Pulavarty <badari.pulavarty@intel.com>
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> [ 5.15.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit d26f60703606ab425eee9882b32a1781a8bed74d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8951b95f41306818ef1b4a5789369a84d8ca2cf2
|
||
Josef Bacik
|
fdc033d445 |
UPSTREAM: mm: fix page leak with multiple threads mapping the same page
We have an application with a lot of threads that use a shared mmap backed by tmpfs mounted with -o huge=within_size. This application started leaking loads of huge pages when we upgraded to a recent kernel. Using the page ref tracepoints and a BPF program written by Tejun Heo we were able to determine that these pages would have multiple refcounts from the page fault path, but when it came to unmap time we wouldn't drop the number of refs we had added from the faults. I wrote a reproducer that mmap'ed a file backed by tmpfs with -o huge=always, and then spawned 20 threads all looping faulting random offsets in this map, while using madvise(MADV_DONTNEED) randomly for huge page aligned ranges. This very quickly reproduced the problem. The problem here is that we check for the case that we have multiple threads faulting in a range that was previously unmapped. One thread maps the PMD, the other thread loses the race and then returns 0. However at this point we already have the page, and we are no longer putting this page into the processes address space, and so we leak the page. We actually did the correct thing prior to f9ce0be71d1f, however it looks like Kirill copied what we do in the anonymous page case. In the anonymous page case we don't yet have a page, so we don't have to drop a reference on anything. Previously we did the correct thing for file based faults by returning VM_FAULT_NOPAGE so we correctly drop the reference on the page we faulted in. Fix this by returning VM_FAULT_NOPAGE in the pmd_devmap_trans_unstable() case, this makes us drop the ref on the page properly, and now my reproducer no longer leaks the huge pages. Bug: 254441685 [josef@toxicpanda.com: v2] Link: https://lkml.kernel.org/r/e90c8f0dbae836632b669c2afc434006a00d4a67.1657721478.git.josef@toxicpanda.com Link: https://lkml.kernel.org/r/2b798acfd95c9ab9395fe85e8d5a835e2e10a920.1657051137.git.josef@toxicpanda.com Fixes: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") Signed-off-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Rik van Riel <riel@surriel.com> Signed-off-by: Chris Mason <clm@fb.com> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 3fe2895cfecd03ac74977f32102b966b6589f481) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I982509aab4bcbf22d66aff5e1d3dfce927426f51 |
||
|
Baolin Wang
|
0b21c99c83 |
UPSTREAM: mm/damon: use set_huge_pte_at() to make huge pte old
The huge_ptep_set_access_flags() can not make the huge pte old according to the discussion [1], that means we will always mornitor the young state of the hugetlb though we stopped accessing the hugetlb, as a result DAMON will get inaccurate accessing statistics. So changing to use set_huge_pte_at() to make the huge pte old to fix this issue. [1] https://lore.kernel.org/all/Yqy97gXI4Nqb7dYo@arm.com/ Bug: 254441685 Link: https://lkml.kernel.org/r/1655692482-28797-1-git-send-email-baolin.wang@linux.alibaba.com Fixes: 49f4203aae06 ("mm/damon: add access checking for hugetlb pages") Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com> Reviewed-by: SeongJae Park <sj@kernel.org> Acked-by: Mike Kravetz <mike.kravetz@oracle.com> Reviewed-by: Muchun Song <songmuchun@bytedance.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit ed1523a895ffdabcab6e067af18685ed00f5ce15) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I4bdab0c5baace75e01c64e0d10fd8fc4d4ea93b8 |
||
Dong Aisheng
|
e3b4c69c57 |
BACKPORT: Revert "mm/cma.c: remove redundant cma_mutex lock"
This reverts commit a4efc174b382fcdb which introduced a regression issue
that when there're multiple processes allocating dma memory in parallel by
calling dma_alloc_coherent(), it may fail sometimes as follows:
Error log:
cma: cma_alloc: linux,cma: alloc failed, req-size: 148 pages, ret: -16
cma: number of available pages:
3@125+20@172+12@236+4@380+32@736+17@2287+23@2473+20@36076+99@40477+108@40852+44@41108+20@41196+108@41364+108@41620+
108@42900+108@43156+483@44061+1763@45341+1440@47712+20@49324+20@49388+5076@49452+2304@55040+35@58141+20@58220+20@58284+
7188@58348+84@66220+7276@66452+227@74525+6371@75549=> 33161 free of 81920 total pages
When issue happened, we saw there were still 33161 pages (129M) free CMA
memory and a lot available free slots for 148 pages in CMA bitmap that we
want to allocate.
When dumping memory info, we found that there was also ~342M normal
memory, but only 1352K CMA memory left in buddy system while a lot of
pageblocks were isolated.
Memory info log:
Normal free:351096kB min:30000kB low:37500kB high:45000kB reserved_highatomic:0KB
active_anon:98060kB inactive_anon:98948kB active_file:60864kB inactive_file:31776kB
unevictable:0kB writepending:0kB present:1048576kB managed:1018328kB mlocked:0kB
bounce:0kB free_pcp:220kB local_pcp:192kB free_cma:1352kB lowmem_reserve[]: 0 0 0
Normal: 78*4kB (UECI) 1772*8kB (UMECI) 1335*16kB (UMECI) 360*32kB (UMECI) 65*64kB (UMCI)
36*128kB (UMECI) 16*256kB (UMCI) 6*512kB (EI) 8*1024kB (UEI) 4*2048kB (MI) 8*4096kB (EI)
8*8192kB (UI) 3*16384kB (EI) 8*32768kB (M) = 489288kB
The root cause of this issue is that since commit a4efc174b382 ("mm/cma.c:
remove redundant cma_mutex lock"), CMA supports concurrent memory
allocation. It's possible that the memory range process A trying to alloc
has already been isolated by the allocation of process B during memory
migration.
The problem here is that the memory range isolated during one allocation
by start_isolate_page_range() could be much bigger than the real size we
want to alloc due to the range is aligned to MAX_ORDER_NR_PAGES.
Taking an ARMv7 platform with 1G memory as an example, when
MAX_ORDER_NR_PAGES is big (e.g. 32M with max_order 14) and CMA memory is
relatively small (e.g. 128M), there're only 4 MAX_ORDER slot, then it's
very easy that all CMA memory may have already been isolated by other
processes when one trying to allocate memory using dma_alloc_coherent().
Since current CMA code will only scan one time of whole available CMA
memory, then dma_alloc_coherent() may easy fail due to contention with
other processes.
This patch simply falls back to the original method that using cma_mutex
to make alloc_contig_range() run sequentially to avoid the issue.
Bug: 254441685
Link: https://lkml.kernel.org/r/20220509094551.3596244-1-aisheng.dong@nxp.com
Link: https://lore.kernel.org/all/20220315144521.3810298-2-aisheng.dong@nxp.com/
Fixes: a4efc174b382 ("mm/cma.c: remove redundant cma_mutex lock")
Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org> [5.11+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 60a60e32cf91169840abcb4a80f0b0df31708ba7)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4f94b43316d2fae1481eefa038bb4d6fbf5946cd
|
||
|
Baolin Wang
|
ec3e1bddde |
UPSTREAM: mm: hugetlb: add missing cache flushing in hugetlb_unshare_all_pmds()
Missed calling flush_cache_range() before removing the sharing PMD entrires, otherwise data consistence issue may be occurred on some architectures whose caches are strict and require a virtual>physical translation to exist for a virtual address. Thus add it. Now no architectures enabling PMD sharing will be affected, since they do not have a VIVT cache. That means this issue can not be happened in practice so far. Bug: 254441685 Link: https://lkml.kernel.org/r/47441086affcabb6ecbe403173e9283b0d904b38.1650956489.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/419b0e777c9e6d1454dcd906e0f5b752a736d335.1650781755.git.baolin.wang@linux.alibaba.com Fixes: 6dfeaff93be1 ("hugetlb/userfaultfd: unshare all pmds for hugetlbfs when register wp") Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com> Reviewed-by: Muchun Song <songmuchun@bytedance.com> Reviewed-by: Peter Xu <peterx@redhat.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 9c8bbfaca1bce84664403fd7dddbef6b3ff0a05a) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ifb14e96429c339520083ff8ddb2bf58f4e6fa899 |
||
Pankaj Gupta
|
0b692d41ee |
mm/memremap.c: map FS_DAX device memory as decrypted
commit 867400af90f1f953ff9e10b1b87ecaf9369a7eb8 upstream.
virtio_pmem use devm_memremap_pages() to map the device memory. By
default this memory is mapped as encrypted with SEV. Guest reboot changes
the current encryption key and guest no longer properly decrypts the FSDAX
device meta data.
Mark the corresponding device memory region for FSDAX devices (mapped with
memremap_pages) as decrypted to retain the persistent memory property.
Link: https://lkml.kernel.org/r/20221102160728.3184016-1-pankaj.gupta@amd.com
Fixes:
|
||
|
Greg Kroah-Hartman
|
0b500f5b16 |
This is the 5.10.150 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNZGa8ACgkQONu9yGCS
aT48lBAA04ORlv/P+tkaLh7gkJjuvnbsemni3KXdpq0hcOfUIpdquUvU06tD7T/P
cnM20NPgBR+IZ1sIcGWdPhTpIOEId9yxu84HQT5ctOjAZPuGg98s2JOQaXWD3Jh2
g88kbWgMeThfrJebPYZMofy5vRSZ5eMatAixhtjaM/2b/MXDSu2rIL4AoHZ99CKr
wovy1r1bN2niJADu8DwC+jANrPTfStMsjJ9dcOpAqVt83EKz0j3ktCDfzcUftFIw
z4y5leEx1qftUOWtY1DKPZEAhMZSpjZYLC1nldopwEl2JvZ7z9aGx3fFJyr/7zOt
4/mNWT2Ra4S9Tqn2RuFnCdWfqGBOmrE0AJf37IdEdpnlcXol6NaGu4LsQsQq4ffk
DxPc6tN6BGY1XXh+pNSlSW7jsXx6jbJ+OnL8JpSXV49ZOofz3XPTHQ/8tJEttfO4
rURa3iMk4GFeORw+mrHKOVJuWcfpnjVoxStGv6XiKqPpHjwbtB8ZGBlr9pMDYDQP
i2RBwkr/cz5JJzlaA4Q/n96nbZFAKpsiy0Vh1MWboxxlojIqLe3yIlZT6b2M3CFf
jsoqlLfaBjBa7RGQP1rW/im2SqxG2ftTiRdGZXPvjEZKnfIpUZEFszD9TmSuIk8f
uuJY2Tj6rSJ2nJPS0iui/KVQ78IWLz9PG3Xwm5E2A9QcPz1JAfk=
=pfwB
-----END PGP SIGNATURE-----
Merge 5.10.150 into android12-5.10-lts
Changes in 5.10.150
ALSA: oss: Fix potential deadlock at unregistration
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: usb-audio: Fix potential memory leaks
ALSA: usb-audio: Fix NULL dererence at error path
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
mtd: rawnand: atmel: Unmap streaming DMA mappings
cifs: destage dirty pages before re-reading them for cache=none
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
iio: dac: ad5593r: Fix i2c read protocol requirements
iio: ltc2497: Fix reading conversion results
iio: adc: ad7923: fix channel readings for some variants
iio: pressure: dps310: Refactor startup procedure
iio: pressure: dps310: Reset chip after timeout
usb: add quirks for Lenovo OneLink+ Dock
can: kvaser_usb: Fix use of uninitialized completion
can: kvaser_usb_leaf: Fix overread with an invalid command
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
can: kvaser_usb_leaf: Fix CAN state after restart
mmc: sdhci-sprd: Fix minimum clock limit
fs: dlm: fix race between test_bit() and queue_work()
fs: dlm: handle -EBUSY first in lock arg validation
HID: multitouch: Add memory barriers
quota: Check next/prev free block number after reading from quota file
platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
ASoC: wcd9335: fix order of Slimbus unprepare/disable
ASoC: wcd934x: fix order of Slimbus unprepare/disable
hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
regulator: qcom_rpm: Fix circular deferral regression
RISC-V: Make port I/O string accessors actually work
parisc: fbdev/stifb: Align graphics memory size to 4MB
riscv: Allow PROT_WRITE-only mmap()
riscv: Make VM_WRITE imply VM_READ
riscv: Pass -mno-relax only on lld < 15.0.0
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
nvme-pci: set min_align_mask before calculating max_hw_sectors
drm/virtio: Check whether transferred 2D BO is shmem
drm/udl: Restore display mode on resume
block: fix inflight statistics of part0
mm/mmap: undo ->mmap() when arch_validate_flags() fails
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
powerpc/boot: Explicitly disable usage of SPE instructions
scsi: qedf: Populate sysfs attributes for vport
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
btrfs: fix race between quota enable and quota rescan ioctl
f2fs: increase the limit for reserve_root
f2fs: fix to do sanity check on destination blkaddr during recovery
f2fs: fix to do sanity check on summary info
hardening: Clarify Kconfig text for auto-var-init
hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
jbd2: wake up journal waiters in FIFO order, not LIFO
jbd2: fix potential buffer head reference count leak
jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
jbd2: add miss release buffer head in fc_do_one_pass()
ext4: avoid crash when inline data creation follows DIO write
ext4: fix null-ptr-deref in ext4_write_info
ext4: make ext4_lazyinit_thread freezable
ext4: fix check for block being out of directory size
ext4: don't increase iversion counter for ea_inodes
ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
ext4: place buffer head allocation before handle start
ext4: fix miss release buffer head in ext4_fc_write_inode
ext4: fix potential memory leak in ext4_fc_record_modified_inode()
ext4: fix potential memory leak in ext4_fc_record_regions()
ext4: update 'state->fc_regions_size' after successful memory allocation
livepatch: fix race between fork and KLP transition
ftrace: Properly unset FTRACE_HASH_FL_MOD
ring-buffer: Allow splice to read previous partially read pages
ring-buffer: Have the shortest_full queue be the shortest not longest
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Add ring_buffer_wake_waiters()
ring-buffer: Fix race between reset page and reading page
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
thunderbolt: Explicitly enable lane adapter hotplug events at startup
efi: libstub: drop pointless get_memory_map() call
media: cedrus: Set the platform driver data earlier
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
staging: greybus: audio_helper: remove unused and wrong debugfs usage
drm/nouveau/kms/nv140-: Disable interlacing
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
smb3: must initialize two ACL struct fields to zero
selinux: use "grep -E" instead of "egrep"
userfaultfd: open userfaultfds with O_RDONLY
sh: machvec: Use char[] for section boundaries
MIPS: SGI-IP27: Free some unused memory
MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
objtool: Preserve special st_shndx indexes in elf_update_symbol
nfsd: Fix a memory leak in an error handling path
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
leds: lm3601x: Don't use mutex after it was destroyed
wifi: mac80211: allow bw change during channel switch in mesh
bpftool: Fix a wrong type cast in btf_dumper_int
spi: mt7621: Fix an error message in mt7621_spi_probe()
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
Bluetooth: btusb: Fine-tune mt7663 mechanism.
Bluetooth: btusb: fix excessive stack usage
Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
selftests/xsk: Avoid use-after-free on ctx
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
spi: meson-spicc: do not rely on busy flag in pow2 clk ops
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
net: fs_enet: Fix wrong check in do_pd_setup
bpf: Ensure correct locking around vulnerable function find_vpid()
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
wifi: ath11k: fix number of VHT beamformee spatial streams
x86/microcode/AMD: Track patch allocation size explicitly
x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
i2c: mlxbf: support lock mechanism
Bluetooth: hci_core: Fix not handling link timeouts propertly
netfilter: nft_fib: Fix for rpath check with VRF devices
spi: s3c64xx: Fix large transfers with DMA
wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
vhost/vsock: Use kvmalloc/kvfree for larger packets.
mISDN: fix use-after-free bugs in l1oip timer handlers
sctp: handle the error returned from sctp_auth_asoc_init_active_key
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
spi: Ensure that sg_table won't be used after being freed
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
net/ieee802154: reject zero-sized raw_sendmsg()
once: add DO_ONCE_SLOW() for sleepable contexts
net: mvpp2: fix mvpp2 debugfs leak
drm: bridge: adv7511: fix CEC power down control register offset
drm/bridge: Avoid uninitialized variable warning
drm/mipi-dsi: Detach devices when removing the host
drm/bridge: parade-ps8640: Fix regulator supply order
drm/dp_mst: fix drm_dp_dpcd_read return value checks
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
platform/chrome: fix double-free in chromeos_laptop_prepare()
platform/chrome: fix memory corruption in ioctl
ASoC: tas2764: Allow mono streams
ASoC: tas2764: Drop conflicting set_bias_level power setting
ASoC: tas2764: Fix mute/unmute
platform/x86: msi-laptop: Fix old-ec check for backlight registering
platform/x86: msi-laptop: Fix resource cleanup
drm: fix drm_mipi_dbi build errors
drm/bridge: megachips: Fix a null pointer dereference bug
ASoC: rsnd: Add check for rsnd_mod_power_on
ALSA: hda: beep: Simplify keep-power-at-enable behavior
drm/omap: dss: Fix refcount leak bugs
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
ALSA: dmaengine: increment buffer pointer atomically
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
ALSA: hda/hdmi: Don't skip notification handling during PM operation
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
memory: of: Fix refcount leak bug in of_get_ddr_timings()
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
ARM: dts: kirkwood: lsxl: fix serial line
ARM: dts: kirkwood: lsxl: remove first ethernet port
ia64: export memory_add_physaddr_to_nid to fix cxl build error
soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
ARM: Drop CMDLINE_* dependency on ATAGS
arm64: ftrace: fix module PLTs with mcount
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
iio: inkern: only release the device node when done with it
iio: ABI: Fix wrong format of differential capacitance channel ABI.
usb: ch9: Add USB 3.2 SSP attributes
usb: common: Parse for USB SSP genXxY
usb: common: add function to get interval expressed in us unit
usb: common: move function's kerneldoc next to its definition
usb: common: debug: Check non-standard control requests
clk: meson: Hold reference returned by of_get_parent()
clk: oxnas: Hold reference returned by of_get_parent()
clk: qoriq: Hold reference returned by of_get_parent()
clk: berlin: Add of_node_put() for of_get_parent()
clk: sprd: Hold reference returned by of_get_parent()
clk: tegra: Fix refcount leak in tegra210_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra20: Fix refcount leak in tegra20_clock_init
HSI: omap_ssi: Fix refcount leak in ssi_probe
HSI: omap_ssi_port: Fix dma_map_sg error check
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
tty: xilinx_uartps: Fix the ignore_status
media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
RDMA/rxe: Fix "kernel NULL pointer dereference" error
RDMA/rxe: Fix the error caused by qp->sk
misc: ocxl: fix possible refcount leak in afu_ioctl()
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
dmaengine: hisilicon: Disable channels when unregister hisi_dma
dmaengine: hisilicon: Fix CQ head update
dmaengine: hisilicon: Add multi-thread support for a DMA channel
dyndbg: fix static_branch manipulation
dyndbg: fix module.dyndbg handling
dyndbg: let query-modname override actual module name
dyndbg: drop EXPORTed dynamic_debug_exec_queries
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
mtd: rawnand: fsl_elbc: Fix none ECC mode
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
ata: fix ata_id_has_devslp()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_dipm()
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
md: Replace snprintf with scnprintf
md/raid5: Ensure stripe_fill happens on non-read IO with journal
RDMA/cm: Use SLID in the work completion as the DLID in responder side
IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
xhci: Don't show warning for reinit on known broken suspend
usb: gadget: function: fix dangling pnp_string in f_printer.c
drivers: serial: jsm: fix some leaks in probe
serial: 8250: Add an empty line and remove some useless {}
serial: 8250: Toggle IER bits on only after irq has been set up
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
phy: qualcomm: call clk_disable_unprepare in the error handling
staging: vt6655: fix some erroneous memory clean-up loops
firmware: google: Test spinlock on panic path to avoid lockups
serial: 8250: Fix restoring termios speed after suspend
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
fsi: core: Check error number after calling ida_simple_get
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: fsl-imx25: Fix check for platform_get_irq() errors
mfd: sm501: Add check for platform_driver_register()
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
clk: baikal-t1: Fix invalid xGMAC PTP clock divider
clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
clk: baikal-t1: Add SATA internal ref clock buffer
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
clk: ast2600: BCLK comes from EPLL
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
powerpc/math_emu/efp: Include module.h
powerpc/sysdev/fsl_msi: Add missing of_node_put()
powerpc/pci_dn: Add missing of_node_put()
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
powerpc: Fix SPE Power ISA properties for e500v1 platforms
crypto: sahara - don't sleep when in softirq
crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
iommu/omap: Fix buffer overflow in debugfs
crypto: akcipher - default implementation for setting a private key
crypto: ccp - Release dma channels before dmaengine unrgister
crypto: inside-secure - Change swab to swab32
crypto: qat - fix use of 'dma_map_single'
crypto: qat - use pre-allocated buffers in datapath
crypto: qat - fix DMA transfer direction
iommu/iova: Fix module config properly
tracing: kprobe: Fix kprobe event gen test module on exit
tracing: kprobe: Make gen test module work in arm and riscv
kbuild: remove the target in signal traps when interrupted
kbuild: rpm-pkg: fix breakage when V=1 is used
crypto: marvell/octeontx - prevent integer overflows
crypto: cavium - prevent integer overflow loading firmware
thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
f2fs: fix race condition on setting FI_NO_EXTENT flag
f2fs: fix to avoid REQ_TIME and CP_TIME collision
f2fs: fix to account FS_CP_DATA_IO correctly
selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
rcu: Back off upon fill_page_cache_func() allocation failure
rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
MIPS: BCM47XX: Cast memcmp() of function to (void *)
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
x86/entry: Work around Clang __bdos() bug
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
NFSD: fix use-after-free on source server when doing inter-server copy
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
bpftool: Clear errno after libcap's checks
openvswitch: Fix double reporting of drops in dropwatch
openvswitch: Fix overreporting of drops in dropwatch
tcp: annotate data-race around tcp_md5sig_pool_populated
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
xfrm: Update ipcomp_scratches with NULL when freed
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
regulator: core: Prevent integer underflow
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
can: bcm: check the result of can_send() in bcm_can_tx()
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
wifi: rt2x00: set VGC gain for both chains of MT7620
wifi: rt2x00: set SoC wmac clock register
wifi: rt2x00: correctly set BBP register 86 for MT7620
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Bluetooth: L2CAP: Fix user-after-free
r8152: Rate limit overflow messages
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
drm: Use size_t type for len variable in drm_copy_field()
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
drm/amd/display: fix overflow on MIN_I64 definition
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
drm: bridge: dw_hdmi: only trigger hotplug event on link change
drm/vc4: vec: Fix timings for VEC modes
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
platform/chrome: cros_ec: Notify the PM of wake events during resume
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
drm/amdgpu: fix initial connector audio value
drm/meson: explicitly remove aggregate driver at module unload time
mmc: sdhci-msm: add compatible string check for sdm670
drm/dp: Don't rewrite link config when setting phy test pattern
drm/amd/display: Remove interface for periodic interrupt 1
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6sl: add missing properties for sram
ARM: dts: imx6sll: add missing properties for sram
ARM: dts: imx6sx: add missing properties for sram
kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
btrfs: scrub: try to fix super block errors
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
usb: host: xhci-plat: suspend and resume clocks
usb: host: xhci-plat: suspend/resume clks for brcm
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
staging: vt6655: fix potential memory leak
blk-throttle: prevent overflow while calculating wait time
ata: libahci_platform: Sanity check the DT child nodes number
bcache: fix set_at_max_writeback_rate() for multiple attached devices
soundwire: cadence: Don't overwrite msg->buf during write commands
soundwire: intel: fix error handling on dai registration issues
HID: roccat: Fix use-after-free in roccat_read()
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
usb: musb: Fix musb_gadget.c rxstate overflow bug
Revert "usb: storage: Add quirk for Samsung Fit flash"
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
nvme: copy firmware_rev on each init
nvmet-tcp: add bounds check on Transfer Tag
usb: idmouse: fix an uninit-value in idmouse_open
clk: bcm2835: Make peripheral PLLC critical
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
arm64: topology: fix possible overflow in amu_fie_setup()
io_uring: correct pinned_vm accounting
io_uring/af_unix: defer registered files gc to io_uring release
mm: hugetlb: fix UAF in hugetlb_handle_userfault
net: ieee802154: return -EINVAL for unknown addr type
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
net/ieee802154: don't warn zero-sized raw_sendmsg()
Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega"
Revert "drm/amdgpu: use dirty framebuffer helper"
ext4: continue to expand file system when the target size doesn't reach
inet: fully convert sk->sk_rx_dst to RCU rules
thermal: intel_powerclamp: Use first online CPU as control_cpu
f2fs: fix wrong condition to trigger background checkpoint correctly
gcov: support GCC 12.1 and newer compilers
Revert "drm/amdgpu: make sure to init common IP before gmc"
Linux 5.10.150
Change-Id: I54f32f1f0149ec614c8bc7944e15adb5d80cd51a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Muchun Song
|
2357d700f8 |
UPSTREAM: mm: kfence: fix missing objcg housekeeping for SLAB
The objcg is not cleared and put for kfence object when it is freed, which could lead to memory leak for struct obj_cgroup and wrong statistics of NR_SLAB_RECLAIMABLE_B or NR_SLAB_UNRECLAIMABLE_B. Since the last freed object's objcg is not cleared, mem_cgroup_from_obj() could return the wrong memcg when this kfence object, which is not charged to any objcgs, is reallocated to other users. A real word issue [1] is caused by this bug. Bug: 254441685 Link: https://lore.kernel.org/all/000000000000cabcb505dae9e577@google.com/ [1] Reported-by: syzbot+f8c45ccc7d5d45fc5965@syzkaller.appspotmail.com Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB") Signed-off-by: Muchun Song <songmuchun@bytedance.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Marco Elver <elver@google.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit ae085d7f9365de7da27ab5c0d16b12d51ea7fca9) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: If17f6048e312e0cf78d01f7c122b84b3fb4a58d8 |
||
|
Suren Baghdasaryan
|
f55885db0c |
UPSTREAM: mm: fix use-after-free bug when mm->mmap is reused after being freed
oom reaping (__oom_reap_task_mm) relies on a 2 way synchronization with exit_mmap. First it relies on the mmap_lock to exclude from unlock path[1], page tables tear down (free_pgtables) and vma destruction. This alone is not sufficient because mm->mmap is never reset. For historical reasons[2] the lock is taken there is also MMF_OOM_SKIP set for oom victims before. The oom reaper only ever looks at oom victims so the whole scheme works properly but process_mrelease can opearate on any task (with fatal signals pending) which doesn't really imply oom victims. That means that the MMF_OOM_SKIP part of the synchronization doesn't work and it can see a task after the whole address space has been demolished and traverse an already released mm->mmap list. This leads to use after free as properly caught up by KASAN report. Fix the issue by reseting mm->mmap so that MMF_OOM_SKIP synchronization is not needed anymore. The MMF_OOM_SKIP is not removed from exit_mmap yet but it acts mostly as an optimization now. [1] |
||
Rik van Riel
|
568e3812b1 |
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
commit 12df140f0bdfae5dcfc81800970dd7f6f632e00c upstream.
The h->*_huge_pages counters are protected by the hugetlb_lock, but
alloc_huge_page has a corner case where it can decrement the counter
outside of the lock.
This could lead to a corrupted value of h->resv_huge_pages, which we have
observed on our systems.
Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a
potential race.
Link: https://lkml.kernel.org/r/20221017202505.0e6a4fcd@imladris.surriel.com
Fixes:
|
||
Yuanzheng Song
|
935a8b6202 |
mm/memory: add non-anonymous page check in the copy_present_page()
The vma->anon_vma of the child process may be NULL because
the entire vma does not contain anonymous pages. In this
case, a BUG will occur when the copy_present_page() passes
a copy of a non-anonymous page of that vma to the
page_add_new_anon_rmap() to set up new anonymous rmap.
------------[ cut here ]------------
kernel BUG at mm/rmap.c:1044!
Internal error: Oops - BUG: 0 [#1] SMP
Modules linked in:
CPU: 2 PID: 3617 Comm: test Not tainted 5.10.149 #1
Hardware name: linux,dummy-virt (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
pc : __page_set_anon_rmap+0xbc/0xf8
lr : __page_set_anon_rmap+0xbc/0xf8
sp : ffff800014c1b870
x29: ffff800014c1b870 x28: 0000000000000001
x27: 0000000010100073 x26: ffff1d65c517baa8
x25: ffff1d65cab0f000 x24: ffff1d65c416d800
x23: ffff1d65cab5f248 x22: 0000000020000000
x21: 0000000000000001 x20: 0000000000000000
x19: fffffe75970023c0 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000
x9 : ffffc3096d5fb858 x8 : 0000000000000000
x7 : 0000000000000011 x6 : ffff5a5c9089c000
x5 : 0000000000020000 x4 : ffff5a5c9089c000
x3 : ffffc3096d200000 x2 : ffffc3096e8d0000
x1 : ffff1d65ca3da740 x0 : 0000000000000000
Call trace:
__page_set_anon_rmap+0xbc/0xf8
page_add_new_anon_rmap+0x1e0/0x390
copy_pte_range+0xd00/0x1248
copy_page_range+0x39c/0x620
dup_mmap+0x2e0/0x5a8
dup_mm+0x78/0x140
copy_process+0x918/0x1a20
kernel_clone+0xac/0x638
__do_sys_clone+0x78/0xb0
__arm64_sys_clone+0x30/0x40
el0_svc_common.constprop.0+0xb0/0x308
do_el0_svc+0x48/0xb8
el0_svc+0x24/0x38
el0_sync_handler+0x160/0x168
el0_sync+0x180/0x1c0
Code: 97f8ff85 f9400294 17ffffeb 97f8ff82 (d4210000)
---[ end trace a972347688dc9bd4 ]---
Kernel panic - not syncing: Oops - BUG: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: 0x43095d200000 from 0xffff800010000000
PHYS_OFFSET: 0xffffe29a80000000
CPU features: 0x08200022,61806082
Memory Limit: none
---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception ]---
This problem has been fixed by the commit <fb3d824d1a46>
("mm/rmap: split page_dup_rmap() into page_dup_file_rmap()
and page_try_dup_anon_rmap()"), but still exists in the
linux-5.10.y branch.
This patch is not applicable to this version because
of the large version differences. Therefore, fix it by
adding non-anonymous page check in the copy_present_page().
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jann Horn
|
4e5c3aad56 |
UPSTREAM: mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
This is a stable-specific patch.
I botched the stable-specific rewrite of
commit b67fbebd4cf98 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"):
As Hugh pointed out, unmap_region() actually operates on a list of VMAs,
and the variable "vma" merely points to the first VMA in that list.
So if we want to check whether any of the VMAs we're operating on is
PFNMAP or MIXEDMAP, we have to iterate through the list and check each VMA.
Bug: 245812080
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3998dc50ebdc127ae79b10992856fb76debc2005)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ib8ddb51815e53f42daec5d98a196866a078a7550
|
||
|
Jann Horn
|
89fc774058 |
UPSTREAM: mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream.
Some drivers rely on having all VMAs through which a PFN might be
accessible listed in the rmap for correctness.
However, on X86, it was possible for a VMA with stale TLB entries
to not be listed in the rmap.
This was fixed in mainline with
commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"),
but that commit relies on preceding refactoring in
commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma()
implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch
tlb_{start,end}_vma()").
This patch provides equivalent protection without needing that
refactoring, by forcing a TLB flush between removing PTEs in
unmap_vmas() and the call to unlink_file_vma() in free_pgtables().
Bug: 245812080
[This is a stable-specific rewrite of the upstream commit!]
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic29df5cfb76676aa87a14619dd19aba301580507
|
||
|
Greg Kroah-Hartman
|
0118fb827b |
Merge branch 'android12-5.10' into branch 'android12-5.10-lts'
Sync up with android12-5.10 for the following commits: |
||
Liu Shixin
|
45c3396675 |
mm: hugetlb: fix UAF in hugetlb_handle_userfault
commit 958f32ce832ba781ac20e11bb2d12a9352ea28fc upstream.
The vma_lock and hugetlb_fault_mutex are dropped before handling userfault
and reacquire them again after handle_userfault(), but reacquire the
vma_lock could lead to UAF[1,2] due to the following race,
hugetlb_fault
hugetlb_no_page
/*unlock vma_lock */
hugetlb_handle_userfault
handle_userfault
/* unlock mm->mmap_lock*/
vm_mmap_pgoff
do_mmap
mmap_region
munmap_vma_range
/* clean old vma */
/* lock vma_lock again <--- UAF */
/* unlock vma_lock */
Since the vma_lock will unlock immediately after
hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in
hugetlb_handle_userfault() to fix the issue.
[1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/
[2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/
Link: https://lkml.kernel.org/r/20220923042113.137273-1-liushixin2@huawei.com
Fixes:
|
||
Carlos Llamas
|
a3c08c0217 |
mm/mmap: undo ->mmap() when arch_validate_flags() fails
commit deb0f6562884b5b4beb883d73e66a7d3a1b96d99 upstream. Commit |
||
|
Peifeng Li
|
af699fd6a2 |
ANDROID: vendor_hook: skip trace_android_vh_page_trylock_set when ignore_references is true
Avoid async-reclaim to cause to reclaim-delay when ignore_references is true. Bug: 240003372 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: Iaf50bd4ac53f748da0dac93324c6d94de11e01e9 |
||
Bing Han
|
09f4246296 |
ANDROID: sched: add restricted hooks to replace the former hooks
Fix Bug: scheduling while atomic In these vendor hooks, we will perform schedule due to competion. This will lead to kernel exception. To solve this problem, we need to add these restrcted hooks to replace the former regular vendor hooks. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: I151125a7119a91d1339d4790a68a6a4796d673e3 |
||
|
Greg Kroah-Hartman
|
c1e111543d |
This is the 5.10.148 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNKS3sACgkQONu9yGCS
aT6DphAAtZL2kn9sdtQM15lm60MXWNEemk7C3TbZdqyAp8N8XqYWPOuKhcVwc+pT
xhfl7ygVpyAVVQtQL88sYcBSOkO2KYOJp3NCT0iMRgdpe5zNWqAW3W2i6GIas+qy
fU9o8YMdXupzRUh+9nGIvtmlXitVJqtl6Ec2hIC+HSEnWHUh8tB6yIT2EIbRvyzl
aaaE4nTTeM8skU1Se8iLuWnwcoGmGU9NuLEOO8ZtX0c7aReLPB1VeWFo/lRrolP1
27k84tpbb32E4ZzTtRk7Zin06u3LVAKVUp1OIa0OWKEQ42W6AAa/Hvo8TIjT9mAN
hBSdg+xHGq3x1QOEGB5t1j8cny/tyJyrtTj62WEotd/jEt42dRG3cSTvWhgqiPGC
WR8Mmxo8wk1iVDIrZG9wQJcJut2Q6x2YEaoJWOSmBC0ZmgFKQ7BHF5rQ3zhT88BA
rK+rx81oFTsA7fEKmMO2OTpOawTuCa1fHgTzIn4gq4iXC1ZLNO7RBvx2VfcmZdBl
E45RnnmY3bStDnIqi/x0+lCqLMPyfocoOPG7FOSjSgMZx9v52sK7Acv87pgGLVvR
GpIPLhHfLwKEkcsaiDJ4X7Tp18QqVYlUaGhUOIRCGGWRf59SX2Mx7dGkP1xjXnWy
WrWnBXgnXvS+c/g+KOPEaGjgzepZVneP7hOJ7pTjHoYTBE5mImE=
=f9Y7
-----END PGP SIGNATURE-----
Merge 5.10.148 into android12-5.10-lts
Changes in 5.10.148
nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
nilfs2: fix use-after-free bug of struct nilfs_root
nilfs2: fix leak of nilfs_root in case of writer thread creation failure
nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
ceph: don't truncate file in atomic_open
Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
docs: update mediator information in CoC docs
perf tools: Fixup get_current_dir_name() compilation
xsk: Inherit need_wakeup flag for shared sockets
ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
mm: gup: fix the fast GUP race against THP collapse
powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush
fs: fix UAF/GPF bug in nilfs_mdt_destroy
compiler_attributes.h: move __compiletime_{error|warning}
firmware: arm_scmi: Add SCMI PM driver remove routine
dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
scsi: qedf: Fix a UAF bug in __qedf_probe()
net/ieee802154: fix uninit value bug in dgram_sendmsg
ALSA: hda/hdmi: Fix the converter reuse for the silent stream
um: Cleanup syscall_handler_t cast in syscalls_32.h
um: Cleanup compiler warning in arch/x86/um/tls_32.c
arch: um: Mark the stack non-executable to fix a binutils warning
net: atlantic: fix potential memory leak in aq_ndev_close()
drm/amd/display: update gamut remap if plane has changed
drm/amd/display: skip audio setup when audio stream is enabled
mmc: core: Replace with already defined values for readability
mmc: core: Terminate infinite loop in SD-UHS voltage switch
usb: mon: make mmapped memory read only
USB: serial: ftdi_sio: fix 300 bps rate for SIO
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
random: restore O_NONBLOCK support
random: clamp credited irq bits to maximum mixed
ALSA: hda: Fix position reporting on Poulsbo
efi: Correct Macmini DMI match in uefi cert quirk
scsi: stex: Properly zero out the passthrough command structure
USB: serial: qcserial: add new usb-id for Dell branded EM7455
random: avoid reading two cache lines on irq randomness
random: use expired timer rather than wq for mixing fast pool
wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
wifi: cfg80211/mac80211: reject bad MBSSID elements
wifi: cfg80211: ensure length byte is present before access
wifi: cfg80211: fix BSS refcounting bugs
wifi: cfg80211: avoid nontransmitted BSS list corruption
wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
wifi: mac80211: fix crash in beacon protection for P2P-device
wifi: cfg80211: update hidden BSSes to avoid WARN_ON
Input: xpad - add supported devices as contributed on github
Input: xpad - fix wireless 360 controller breaking after suspend
misc: pci_endpoint_test: Aggregate params checking for xfer
misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
Linux 5.10.148
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ieced30eaa00066cb2fc36836250f8f0a553f490f
|
||
Yang Shi
|
377c60dd32 |
mm: gup: fix the fast GUP race against THP collapse
commit 70cbc3cc78a997d8247b50389d37c4e1736019da upstream. Since general RCU GUP fast was introduced in commit |
||
Minchan Kim
|
c35cda5280 |
BACKPORT: mm: don't be stuck to rmap lock on reclaim path
The rmap locks(i_mmap_rwsem and anon_vma->root->rwsem) could be contended
under memory pressure if processes keep working on their vmas(e.g., fork,
mmap, munmap). It makes reclaim path stuck. In our real workload traces,
we see kswapd is waiting the lock for 300ms+(worst case, a sec) and it
makes other processes entering direct reclaim, which were also stuck on
the lock.
This patch makes lru aging path try_lock mode like shink_page_list so the
reclaim context will keep working with next lru pages without being stuck.
if it found the rmap lock contended, it rotates the page back to head of
lru in both active/inactive lrus to make them consistent behavior, which
is basic starting point rather than adding more heristic.
Since this patch introduces a new "contended" field as out-param along
with try_lock in-param in rmap_walk_control, it's not immutable any longer
if the try_lock is set so remove const keywords on rmap related functions.
Since rmap walking is already expensive operation, I doubt the const
would help sizable benefit( And we didn't have it until 5.17).
In a heavy app workload in Android, trace shows following statistics. It
almost removes rmap lock contention from reclaim path.
Martin Liu reported:
Before:
max_dur(ms) min_dur(ms) max-min(dur)ms avg_dur(ms) sum_dur(ms) count blocked_function
1632 0 1631 151.542173 31672 209 page_lock_anon_vma_read
601 0 601 145.544681 28817 198 rmap_walk_file
After:
max_dur(ms) min_dur(ms) max-min(dur)ms avg_dur(ms) sum_dur(ms) count blocked_function
NaN NaN NaN NaN NaN 0.0 NaN
0 0 0 0.127645 1 12 rmap_walk_file
[minchan@kernel.org: add comment, per Matthew]
Link: https://lkml.kernel.org/r/YnNqeB5tUf6LZ57b@google.com
Link: https://lkml.kernel.org/r/20220510215423.164547-1-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: John Dias <joaodias@google.com>
Cc: Tim Murray <timmurray@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Martin Liu <liumartin@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Conflicts:
folio->page
(cherry picked from commit 6d4675e601357834dadd2ba1d803f6484596015c)
Bug: 239681156
Bug: 252333201
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I0c63e0291120c8a1b5f2d83b8a7b210cb56c27a2
Signed-off-by: chenxin <chenxinxin@xiaomi.corp-partner.google.com>
|
||
|
Greg Kroah-Hartman
|
bc7618b493 |
This is the 5.10.147 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmM9QpgACgkQONu9yGCS aT7hyBAAoFVZrmAekRm6bQp1JBk5zMbZ8tYl4LgtYOncxLBgpf4d3fFXBtL75i45 Guc+CDVqcmE3lkBlq4Z6IxmbvHSRsn0r9HyDN5zP5HuYYQmECDU7wpO4OTpv3gBC +A38tbjVGSsUzJvfXZF07np4NNjxbFtfu19aRBJ9ztX/DMoXxi0+KUtwPPdwN9Tt L2Y2T54fI1GsrhqtaS+yD5XVTZUvOy6TPvBd+wvL5UfbhQRX4M5hjOSdbj6qzv4R qrI55rtAFqe6q+d3afta4qE6MdZM19pB03/CPPQBST/YITWSzwpIbHkE2Oj+h2QE h9anubbw67Ob/HFU1NIaU0GONIlogONFs6SeK2cLoNTU3WedxWQK0G2ny4qdkev+ jqo8/oEq8eNbt1Orido5ruwp+draMbpVUZfP9tJ2rx7p7nddWh1GPi1vf5VAm/Hh 3wEbSprolG8ptR2nyvLxCDj6vY3WGSn7GRrje9Wemencutp9277hocrXuL8YQC5u kOlVqo5Ju3kNHC5flOQO+gdtp9oUz9jPZNiwYfM8M3i1/WYSpSdIg4Mz1TK10beh U84izz7ZFFeI8WxhGQlEC9eWqsDTzmgOVbDiNsl19MdaPXM+yswwtpkNUV+/xVBe qoj6mfnI8gSxKfmBG/quw/OcHzrOuxPmPPKvenr+iK3mL2ebBV4= =L2ke -----END PGP SIGNATURE----- Merge 5.10.147 into android12-5.10-lts Changes in 5.10.147 thunderbolt: Add support for Intel Maple Ridge thunderbolt: Add support for Intel Maple Ridge single port controller ALSA: hda/tegra: Use clk_bulk helpers ALSA: hda/tegra: Reset hardware ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically ALSA: hda: Fix Nvidia dp infoframe btrfs: fix hang during unmount when stopping a space reclaim worker uas: add no-uas quirk for Hiksemi usb_disk usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS uas: ignore UAS for Thinkplus chips usb: typec: ucsi: Remove incorrect warning thunderbolt: Explicitly reset plug events delay back to USB4 spec value net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address clk: ingenic-tcu: Properly enable registers before accessing timers ARM: dts: integrator: Tag PCI host with device_type ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() net: mt7531: only do PLL once after the reset libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 mmc: moxart: fix 4-bit bus width and remove 8-bit bus width mmc: hsq: Fix data stomping during mmc recovery mm/page_alloc: fix race condition between build_all_zonelists and page allocation mm: prevent page_frag_alloc() from corrupting the memory mm/migrate_device.c: flush TLB while holding PTL mm: fix madivse_pageout mishandling on non-LRU page media: dvb_vb2: fix possible out of bound access media: rkvdec: Disable H.264 error detection swiotlb: max mapping size takes min align mask into account scsi: hisi_sas: Revert "scsi: hisi_sas: Limit max hw sectors for v3 HW" ARM: dts: am33xx: Fix MMCHS0 dma properties reset: imx7: Fix the iMX8MP PCIe PHY PERST support soc: sunxi: sram: Actually claim SRAM regions soc: sunxi: sram: Prevent the driver from being unbound soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource() soc: sunxi: sram: Fix probe function ordering issues soc: sunxi: sram: Fix debugfs info for A64 SRAM C ASoC: tas2770: Reinit regcache on reset Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" Input: melfas_mip4 - fix return value check in mip4_probe() usbnet: Fix memory leak in usbnet_disconnect() net: sched: act_ct: fix possible refcount leak in tcf_ct_init() cxgb4: fix missing unlock on ETHOFLD desc collect fail path nvme: add new line after variable declatation nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices net: stmmac: power up/down serdes in stmmac_open/release selftests: Fix the if conditions of in test_extra_filter() clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks clk: iproc: Do not rely on node name for correct PLL setup KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest x86/alternative: Fix race in try_get_desc() ALSA: hda/hdmi: fix warning about PCM count when used with SOF Linux 5.10.147 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie6bbda212478a9c78498458b61e39200e6637f31 |
||
|
Minchan Kim
|
be2cd261ca |
mm: fix madivse_pageout mishandling on non-LRU page
commit 58d426a7ba92870d489686dfdb9d06b66815a2ab upstream.
MADV_PAGEOUT tries to isolate non-LRU pages and gets a warning from
isolate_lru_page below.
Fix it by checking PageLRU in advance.
------------[ cut here ]------------
trying to isolate tail page
WARNING: CPU: 0 PID: 6175 at mm/folio-compat.c:158 isolate_lru_page+0x130/0x140
Modules linked in:
CPU: 0 PID: 6175 Comm: syz-executor.0 Not tainted 5.18.12 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:isolate_lru_page+0x130/0x140
Link: https://lore.kernel.org/linux-mm/485f8c33.2471b.182d5726afb.Coremail.hantianshuo@iie.ac.cn/
Link: https://lkml.kernel.org/r/20220908151204.762596-1-minchan@kernel.org
Fixes:
|
||
Alistair Popple
|
1002d5fef4 |
mm/migrate_device.c: flush TLB while holding PTL
commit 60bae73708963de4a17231077285bd9ff2f41c44 upstream.
When clearing a PTE the TLB should be flushed whilst still holding the PTL
to avoid a potential race with madvise/munmap/etc. For example consider
the following sequence:
CPU0 CPU1
---- ----
migrate_vma_collect_pmd()
pte_unmap_unlock()
madvise(MADV_DONTNEED)
-> zap_pte_range()
pte_offset_map_lock()
[ PTE not present, TLB not flushed ]
pte_unmap_unlock()
[ page is still accessible via stale TLB ]
flush_tlb_range()
In this case the page may still be accessed via the stale TLB entry after
madvise returns. Fix this by flushing the TLB while holding the PTL.
Fixes:
|
||
Maurizio Lombardi
|
a54fc53691 |
mm: prevent page_frag_alloc() from corrupting the memory
commit dac22531bbd4af2426c4e29e05594415ccfa365d upstream.
A number of drivers call page_frag_alloc() with a fragment's size >
PAGE_SIZE.
In low memory conditions, __page_frag_cache_refill() may fail the order
3 cache allocation and fall back to order 0; In this case, the cache
will be smaller than the fragment, causing memory corruptions.
Prevent this from happening by checking if the newly allocated cache is
large enough for the fragment; if not, the allocation will fail and
page_frag_alloc() will return NULL.
Link: https://lkml.kernel.org/r/20220715125013.247085-1-mlombard@redhat.com
Fixes:
|
||
Mel Gorman
|
466a26af2d |
mm/page_alloc: fix race condition between build_all_zonelists and page allocation
commit 3d36424b3b5850bd92f3e89b953a430d7cfc88ef upstream. Patrick Daly reported the following problem; NODE_DATA(nid)->node_zonelists[ZONELIST_FALLBACK] - before offline operation [0] - ZONE_MOVABLE [1] - ZONE_NORMAL [2] - NULL For a GFP_KERNEL allocation, alloc_pages_slowpath() will save the offset of ZONE_NORMAL in ac->preferred_zoneref. If a concurrent memory_offline operation removes the last page from ZONE_MOVABLE, build_all_zonelists() & build_zonerefs_node() will update node_zonelists as shown below. Only populated zones are added. NODE_DATA(nid)->node_zonelists[ZONELIST_FALLBACK] - after offline operation [0] - ZONE_NORMAL [1] - NULL [2] - NULL The race is simple -- page allocation could be in progress when a memory hot-remove operation triggers a zonelist rebuild that removes zones. The allocation request will still have a valid ac->preferred_zoneref that is now pointing to NULL and triggers an OOM kill. This problem probably always existed but may be slightly easier to trigger due to |
||
|
Greg Kroah-Hartman
|
0e8dfc1216 |
Merge branch 'android12-5.10' into branch 'android12-5.10-lts'
Sync up with android12-5.10 for the following commits: |
||
|
Greg Kroah-Hartman
|
1d17080edb |
This is the 5.10.146 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmM0D5YACgkQONu9yGCS
aT60zQ//azKm1LwkEJrXhq9W8RH0qFooR5ktMtD77mX7jznl6QrebRycyD0lj67H
QqkSWLKWocMiGNjCBHA4LS/OXVoMvjfWvdha1ExHO/1fqkM6MVqfy8+z8Tngzky/
iTfaOjA6BSiQNnAyC+LPtJb5dCnvFYHL78+vZ3Kr6xHhX/MBCoTL+pP5bBp82ES+
4N5mirDlLgLxI2d2KCfpwVkaRC+Ylsz5/PLkvzYpXz7RnXLL7PAu/tbHvJpM9qqj
lONQU3av0utXPLzV8FdeejspFdTacG+V9d1AAfXivYQTBI5dyaUEPoR6qkZ4WgsN
zZ6huMi/7Q0uL9QxGvvSqpEMPeq7hikanqFAZsfgNtXLZQM2Th8GyaqhVKtBN31n
75z4dMrV5Whb0K6fo4yOZAzPL/safwHtqtEIsZsgpjCnUKgl0YWyRlmrjQyOdTcI
2DY/wTwf+f+D/U0CNfYd0xrmlDMsRgUQ3pjtT98kLHk0K8VPRySlSvkk9YW0qsLf
4Hc8DCIiVa5lB5Rl8nGTUq0iIl9t17lpfy1Iboibhxay1IUMLBYdRNQ/bnOD2Y0W
ZYimIghn6x0KuvqiQkktzMqtRdlzIhvnu3ytOWBL7hNnVlGaa4kEY8zr0Ia5zwMP
XKA18+ip/qV9qENnrjck/sh69itVR2q2qWa/BlV3cYnQsyTu62Y=
=dY1i
-----END PGP SIGNATURE-----
Merge 5.10.146 into android12-5.10-lts
Changes in 5.10.146
drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
drm/amdgpu: indirect register access for nv12 sriov
drm/amdgpu: Separate vf2pf work item init from virt data exchange
drm/amdgpu: make sure to init common IP before gmc
usb: typec: intel_pmc_mux: Update IOM port status offset for AlderLake
usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device
usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind
usb: dwc3: Issue core soft reset before enabling run/stop
usb: dwc3: gadget: Prevent repeat pullup()
usb: dwc3: gadget: Refactor pullup()
usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup()
usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
usb: xhci-mtk: get the microframe boundary for ESIT
usb: xhci-mtk: add only one extra CS for FS/LS INTR
usb: xhci-mtk: use @sch_tt to check whether need do TT schedule
usb: xhci-mtk: add a function to (un)load bandwidth info
usb: xhci-mtk: add some schedule error number
usb: xhci-mtk: allow multiple Start-Split in a microframe
usb: xhci-mtk: relax TT periodic bandwidth allocation
mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure
serial: atmel: remove redundant assignment in rs485_config
tty: serial: atmel: Preserve previous USART mode if RS485 disabled
usb: add quirks for Lenovo OneLink+ Dock
usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer
usb: cdns3: fix issue with rearming ISO OUT endpoint
Revert "usb: add quirks for Lenovo OneLink+ Dock"
vfio/type1: Change success value of vaddr_get_pfn()
vfio/type1: Prepare for batched pinning with struct vfio_batch
vfio/type1: Unpin zero pages
Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio"
arm64: Restrict ARM64_BTI_KERNEL to clang 12.0.0 and newer
arm64/bti: Disable in kernel BTI when cross section thunks are broken
USB: core: Fix RST error in hub.c
USB: serial: option: add Quectel BG95 0x0203 composition
USB: serial: option: add Quectel RM520N
ALSA: hda/tegra: set depop delay for tegra
ALSA: hda: add Intel 5 Series / 3400 PCI DID
ALSA: hda/realtek: Add quirk for Huawei WRT-WX9
ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop
ALSA: hda/realtek: Re-arrange quirk table entries
ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack
ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack
ALSA: hda/realtek: Add quirk for ASUS GA503R laptop
ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop
iommu/vt-d: Check correct capability for sagaw determination
media: flexcop-usb: fix endpoint type check
efi: x86: Wipe setup_data on pure EFI boot
efi: libstub: check Shim mode using MokSBStateRT
wifi: mt76: fix reading current per-tid starting sequence number for aggregation
gpio: mockup: fix NULL pointer dereference when removing debugfs
gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
riscv: fix a nasty sigreturn bug...
can: flexcan: flexcan_mailbox_read() fix return value for drop = true
mm/slub: fix to return errno if kmalloc() fails
KVM: SEV: add cache flush to solve SEV cache incoherency issues
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
xfs: fix up non-directory creation in SGID directories
xfs: reorder iunlink remove operation in xfs_ifree
xfs: validate inode fork size against fork format
arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob
drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks
arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz
dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()
arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma
netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
netfilter: nf_conntrack_irc: Tighten matching on DCC message
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
iavf: Fix cached head and tail value for iavf_get_tx_pending
ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
net: let flow have same hash in two directions
net: core: fix flow symmetric hash
net: phy: aquantia: wait for the suspend/resume operations to finish
scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region
scsi: mpt3sas: Fix return value check of dma_get_required_mask()
net: bonding: Share lacpdu_mcast_addr definition
net: bonding: Unsync device addresses on ndo_stop
net: team: Unsync device addresses on ndo_stop
drm/panel: simple: Fix innolux_g121i1_l01 bus_format
MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko
MIPS: Loongson32: Fix PHY-mode being left unspecified
iavf: Fix bad page state
iavf: Fix set max MTU size with port VLAN and jumbo frames
i40e: Fix VF set max MTU size
i40e: Fix set max_tx_rate when it is lower than 1 Mbps
sfc: fix TX channel offset when using legacy interrupts
sfc: fix null pointer dereference in efx_hard_start_xmit
drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled
drm/hisilicon: Add depends on MMU
of: mdio: Add of_node_put() when breaking out of for_each_xx
net: ipa: fix assumptions about DMA address size
net: ipa: fix table alignment requirement
net: ipa: avoid 64-bit modulus
net: ipa: DMA addresses are nicely aligned
net: ipa: kill IPA_TABLE_ENTRY_SIZE
net: ipa: properly limit modem routing table use
wireguard: ratelimiter: disable timings test by default
wireguard: netlink: avoid variable-sized memcpy on sockaddr
net: enetc: move enetc_set_psfp() out of the common enetc_set_features()
net: socket: remove register_gifconf
net/sched: taprio: avoid disabling offload when it was never enabled
net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs
netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()
netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()
netfilter: ebtables: fix memory leak when blob is malformed
can: gs_usb: gs_can_open(): fix race dev->can.state condition
perf jit: Include program header in ELF files
perf kcore_copy: Do not check /proc/modules is unchanged
drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff()
net/smc: Stop the CLC flow if no link to map buffers on
net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
net: sched: fix possible refcount leak in tc_new_tfilter()
selftests: forwarding: add shebang for sch_red.sh
drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV
serial: Create uart_xmit_advance()
serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting
serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
usb: xhci-mtk: fix issue of out-of-bounds array access
vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
drm/amdgpu: Fix check for RAS support
cifs: use discard iterator to discard unneeded network data more efficiently
cifs: always initialize struct msghdr smb_msg completely
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
drm/gma500: Fix BUG: sleeping function called from invalid context errors
drm/amdgpu: use dirty framebuffer helper
drm/amd/display: Limit user regamma to a valid value
drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage
drm/rockchip: Fix return type of cdn_dp_connector_mode_valid
workqueue: don't skip lockdep work dependency in cancel_work_sync()
i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible
i2c: mlxbf: incorrect base address passed during io write
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
i2c: mlxbf: Fix frequency calculation
devdax: Fix soft-reservation memory description
ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
ext4: limit the number of retries after discarding preallocations blocks
ext4: make directory inode spreading reflect flexbg size
Linux 5.10.146
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I45edad7e4191aad7a85278b43fa9909a6253643f
|
||
Treehugger Robot
|
464a3706e6 | Merge "Merge tag 'android12-5.10.136_r00' into android12-5.10" into android12-5.10 | ||
|
Sivasri Kumar, Vanka
|
86f9bee9c0 |
Merge keystone/android12-5.10-keystone-qcom-release.117+ (26604a5) into msm-5.10
* refs/heads/tmp-26604a5: UPSTREAM: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop UPSTREAM: usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion BACKPORT: scsi: ufs: core: Increase fDeviceInit poll frequency FROMGIT: f2fs: increase the limit for reserve_root FROMGIT: f2fs: complete checkpoints during remount FROMGIT: f2fs: flush pending checkpoints when freezing super BACKPORT: f2fs: don't get FREEZE lock in f2fs_evict_inode in frozen fs BACKPORT: f2fs: introduce F2FS_IPU_HONOR_OPU_WRITE ipu policy Revert "ANDROID: GKI: signal: Export for __lock_task_sighand" BACKPORT: f2fs: invalidate meta pages only for post_read required inode BACKPORT: f2fs: fix to invalidate META_MAPPING before DIO write BACKPORT: f2fs: invalidate META_MAPPING before IPU/DIO write ANDROID: mm: page_pinner: use page_ext_get/put() to work with page_ext FROMLIST: mm: fix use-after free of page_ext after race with memory-offline ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath. ANDROID: GKI: rockchip: add symbol netif_set_xps_queue ANDROID: GKI: Update symbol list Revert "ANDROID: vendor_hooks: tune reclaim scan type for specified mem_cgroup" ANDROID: Fix a build warning inside early_memblock_nomap ANDROID: mm/memory_hotplug: Fix error path handling Revert "ANDROID: add for tuning readahead size" Revert "ANDROID: vendor_hooks: Add hooks for mutex" ANDROID: fix execute bit on android/abi_gki_aarch64_asus ANDROID: avoid huge-page not to clear trylock-bit after shrink_page_list. ANDROID: vendor_hooks: Add hooks for oem futex optimization ANDROID: mm: memblock: avoid to create memmap for memblock nomap regions ANDROID: abi_gki_aarch64_qcom: Add android_vh_disable_thermal_cooling_stats ANDROID: thermal: vendor hook to disable thermal cooling stats ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: rockchip: update fragment file ANDROID: GKI: rockchip: Enable symbols bcmdhd-sdio ANDROID: GKI: rockchip: Update symbols for rga driver BACKPORT: cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock UPSTREAM: cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree ANDROID: GKI: Update symbol list for transsion ANDROID: vendor_hook: Add hook in __free_pages() ANDROID: vendor_hooks: Add hooks to extend the struct swap_info_struct ANDROID: vendor_hook: Add hook in si_swapinfo() ANDROID: GKI: Update symbols to symbol list ANDROID: Use rq_clock_task without CONFIG_SMP ANDROID: abi_gki_aarch64_qcom: Add skb and scatterlist helpers Revert "ANDROID: vendor_hook: Add hook in si_swapinfo()" Revert "ANDROID: vendor_hooks:vendor hook for pidfd_open" Revert "ANDROID: vendor_hooks: Add hooks to extend the struct swap_info_struct" Revert "ANDROID: vendor_hooks:vendor hook for mmput" ANDROID: GKI: Update symbols to symbol list ANDROID: Guard rq_clock_task_mult with CONFIG_SMP Revert "ANDROID: vendor_hook: Add hook in __free_pages()" Revert "ANDROID: vendor_hooks: Add hooks for binder" ANDROID: vendor_hook: add hooks to protect locking-tsk in cpu scheduler ANDROID: export reclaim_pages ANDROID: vendor_hook: Add hook to not be stuck ro rmap lock in kswapd or direct_reclaim Change-Id: Id29a9448f424508e3b3e82c4f69959fa9da81699 Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com> |
||
Chao Yu
|
379ac7905f |
mm/slub: fix to return errno if kmalloc() fails
commit 7e9c323c52b379d261a72dc7bd38120a761a93cd upstream.
In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to
out-of-memory, if it fails, return errno correctly rather than
triggering panic via BUG_ON();
kernel BUG at mm/slub.c:5893!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Call trace:
sysfs_slab_add+0x258/0x260 mm/slub.c:5973
__kmem_cache_create+0x60/0x118 mm/slub.c:4899
create_cache mm/slab_common.c:229 [inline]
kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335
kmem_cache_create+0x1c/0x28 mm/slab_common.c:390
f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]
f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808
f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149
mount_bdev+0x1b8/0x210 fs/super.c:1400
f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512
legacy_get_tree+0x30/0x74 fs/fs_context.c:610
vfs_get_tree+0x40/0x140 fs/super.c:1530
do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
path_mount+0x358/0x914 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568
Cc: <stable@kernel.org>
Fixes:
|
||
|
Greg Kroah-Hartman
|
18cd39b706 |
Merge tag 'android12-5.10.136_r00' into android12-5.10
This is the merge of the upstream LTS release of 5.10.136 into the android12-5.10 branch. It contains the following commits: |
||
|
Pavankumar Kondeti
|
6d04d8ce90 |
ANDROID: vendor_hooks: Allow shared pages reclaim via MADV_PAGEOUT
Add a hook in madvise_cold_or_pageout_pte_range() to allow vendor modules to influence the shared pages reclaim. Bug: 242678506 Change-Id: I269a385b59f7291c2e96478674bb3d05f94584cb Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com> |
||
|
Greg Kroah-Hartman
|
7474313da8 |
This is the 5.10.144 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMpmC4ACgkQONu9yGCS aT6Dmw/+ODARHbnaUN1M/E+xmzbU47SUtiZ5JLf15bTA0xrOKndSSl6dHa84AWNi hpcW25f3NBNHQITtLSTkWDyms9z7Mvx3wojzUoA5oB6eYh7o18eGTV/Y8dofqxcK akC4E3i84sZNuo2Z+uNf02zC5QPZ95A+1UMk9umHapOvaxQPLtulzRj+Eij3nx8m x3IFjDdxD4ZvtLUwgTCcMLNn8oxkzz/SeU39kpdpXxwrIW1ER1/RwvDtduZFpb/d YXq6axOjpToaPz4J9RXQqpscT3QxSyO+Pmk1IrDaLRA5YGJH12YaJBdcMNjIGEB3 /jHDoVYaI+DoHBcX2YqfIKhlDoW/ePwKFixQBqFPFQeBJyo6STV8NbtVx/wHQ37L dv8Mcsbxrc2U4ucsUOaY1y6UgJBgZRaNFAVtAbHjaUepp6XFEf250PzqllYEDbBh WBYvrjRJclijE1QtX51xGulbS5MKwKHgUazi0r1R4gjlkO32czg0BfCeqXvuWSh4 qUgqctUTiDD7dM91w9agalJ0IreCvAixO9jdHFcZaXulM/wHDfz3cx7s1MSQ2URi i3Zc+T4FQ8K/ZIh2IxgGqN8pDGKK2tG35DA3gDLPTrlIK3GgIxYUxfRfdnWP89OM auN9xcbTBLWphtZWu51xqm/a3omDgNVJcqJ0fMm2Xj9zeG2kPHM= =3cbn -----END PGP SIGNATURE----- Merge 5.10.144 into android12-5.10-lts Changes in 5.10.144 ARM: dts: imx: align SPI NOR node name with dtschema ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible iommu/vt-d: Correctly calculate sagaw value of IOMMU tracefs: Only clobber mode/uid/gid on remount if asked Input: goodix - add support for GT1158 drm/msm/rd: Fix FIFO-full deadlock HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message tg3: Disable tg3 device on system reboot to avoid triggering AER gpio: mockup: remove gpio debugfs when remove device ieee802154: cc2520: add rc code in cc2520_tx() Input: iforce - add support for Boeder Force Feedback Wheel nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change() drm/amd/amdgpu: skip ucode loading if ucode_size == 0 perf/arm_pmu_platform: fix tests for platform_get_irq() failure platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() Revert "x86/ftrace: Use alternative RET encoding" x86/ibt,ftrace: Make function-graph play nice x86/ftrace: Use alternative RET encoding soc: fsl: select FSL_GUTS driver for DPIO Input: goodix - add compatible string for GT1158 Linux 5.10.144 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie5222afc95240a8f4b6b4b42d249a8d00eaf661f |
||
|
Greg Kroah-Hartman
|
3dbfa90b61 |
This is the 5.10.143 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMi8SIACgkQONu9yGCS aT5fNRAAzsIlb9OehdslBs5PcJjQztWRSapzpR+umubzCvVht3HKoPN4EBane+t+ w3y6BUKJEWrTuomO+KpizGzDG82B9kNYkS88TCrZHTu37knH4nl2mze09KGUjz0l A8OgmwfA7DFaZucNQWxmO5m80USMUJoARxT87bQ1edW9L4phquNHpCXnlDbbX15/ La4d6tQWrEHx7LgxhfxCN4UGJCKzp4xDVnedPsicMALYjEZ6kc9STz95DR+0lQZK e7FyR6uLit/TtnuVpJYJcHRs9k+MHe5grtQ/VA5PAxB6uMU2Y0G8dzzUrQKZ/L4N ty/qqKS7zaqqD2ywh8JEPuFJMbAFRerXHEuQ9HI7d3guCYsKICE9eNd5eRLrN/rn MckBm41/of7vksZvofpx/U4uZdIlNSzF0ybADv/UGMPDyCfEEKOKlok3KFM9UWLK MWzufJHaX9MF/J5vfrixO7QPol5MKTdUypZ7BhXeXb9b7F2Y/JrYsHgIIzpE+TH1 p1wkfmT3YfHA+6Wl5VnjxvZS6QhcZFTY97hOmVPJ4ge1orAGDK9Jj9FpL6EM4XDb oaKJU8WB0Ry+YYxjEa0QQY+VWHAEns/lauECM4kJoxDKLo2b5A8qvvpaDGyXz/M4 2/66ZmV2KKOlEiWAC5oVhxPiWxpVbryO0FhEdR2e9WuidmQ27Mc= =XF1H -----END PGP SIGNATURE----- Merge 5.10.143 into android12-5.10-lts Changes in 5.10.143 NFSD: Fix verifier returned in stable WRITEs xen-blkfront: Cache feature_persistent value before advertisement tty: n_gsm: initialize more members at gsm_alloc_mux() tty: n_gsm: avoid call of sleeping functions from atomic context efi: libstub: Disable struct randomization efi: capsule-loader: Fix use-after-free in efi_capsule_write wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() fs: only do a memory barrier for the first set_buffer_uptodate() Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX scsi: megaraid_sas: Fix double kfree() drm/gem: Fix GEM handle release errors drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. drm/radeon: add a force flush to delay work when radeon parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level net/core/skbuff: Check the return value of skb_copy_bits() fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() ALSA: aloop: Fix random zeros in capture data when using jiffies timer ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() kprobes: Prohibit probes in gate area debugfs: add debugfs_lookup_and_remove() nvmet: fix a use-after-free drm/i915: Implement WaEdpLinkRateDataReload scsi: mpt3sas: Fix use-after-free warning scsi: lpfc: Add missing destroy_workqueue() in error path cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() smb3: missing inode locks in punch hole ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node regulator: core: Clean up on enable failure tee: fix compiler warning in tee_shm_register() RDMA/cma: Fix arguments order in net device validation soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs RDMA/hns: Fix supported page size RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time netfilter: br_netfilter: Drop dst references before setting. netfilter: nf_tables: clean up hook list when offload flags check fails netfilter: nf_conntrack_irc: Fix forged IP logic ALSA: usb-audio: Inform the delayed registration more properly ALSA: usb-audio: Register card again for iface over delayed_register option rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2() afs: Use the operation issue time instead of the reply time for callbacks sch_sfb: Don't assume the skb is still around after enqueueing to child tipc: fix shift wrapping bug in map_get() ice: use bitmap_free instead of devm_kfree i40e: Fix kernel crash during module removal xen-netback: only remove 'hotplug-status' when the vif is actually destroyed RDMA/siw: Pass a pointer to virt_to_page() ipv6: sr: fix out-of-bounds read when setting HMAC data. IB/core: Fix a nested dead lock as part of ODP flow RDMA/mlx5: Set local port to one when accessing counters nvme-tcp: fix UAF when detecting digest errors nvme-tcp: fix regression that causes sporadic requests to time out tcp: fix early ETIMEDOUT after spurious non-SACK RTO sch_sfb: Also store skb len before calling child enqueue ASoC: mchp-spdiftx: remove references to mchp_i2s_caps ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion MIPS: loongson32: ls1c: Fix hang during startup swiotlb: avoid potential left shift overflow iommu/amd: use full 64-bit value in build_completion_wait() hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors hwmon: (mr75203) fix voltage equation for negative source input hwmon: (mr75203) fix multi-channel voltage reading hwmon: (mr75203) enable polling for all VM channels arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly Linux 5.10.143 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia1bc1b76bcad0e2cb3b27d1a37278b1d24c6b90d |
||
|
Greg Kroah-Hartman
|
e0f0b200a5 |
This is the 5.10.142 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMZsd0ACgkQONu9yGCS aT5gXw//QdDh8KQRcJdVrIKSm1CzApFkAbjaL461gcjKMqBwAavjdWNDx8zKFEw7 H0OX+m0fr9gaDHNoNqjvKGN0V57HfXve/0f786W9aTqENF9BOmomHtsT0k5I5T9y C2uTvSw/l3GXoMI1afepTtHFdip+PSZSlYL9afBDZI4WAz8Bkn+RlVHDNCtQdn1D GaDliP6iQ+1J1p/VB32TdZyPOZK/qspD15b+3xYVoA8ad1/oKrUtYcvyA/svl45V I3GrH2klYBBp/ffgCGawe6qOjwiQeabDkMyuvNUVaYwNOEeYLdNIbVRxFz3N+b0W 0Kixpwwqijb8AVY8xsL7W8Ure/2KRzu/4cILtHOiTbqB2lQCmGAIgfHjIOBc+CPf uW6UpBeXSgiXJJhbtEd3kYEVWeFBppKiuN2i2puP+fkWFvEHKEddtlLapqA65WDq 3GITqiKLC2GPftigs6ws8T1Ow1izZ3MXzhO8s9JS1WHZeUg1jxL7tIlLsuXIh4xt MA64n6ASJ4JsoNaP2jvix3J1T7PQ6/mz/jfzDR4emTiCFNuJhF1k70sAtssusX4W SSuh3bLrHO0CNXfChp++MphfWV4takBobMTbjjSsblfif9FEyx2advYNEJe2BG9C NqQTUDs1eKP6PR0yI871uKyBlvw7rCZoCMrZCLggkLjL8+jxbWw= =Ebrg -----END PGP SIGNATURE----- Merge 5.10.142 into android12-5.10-lts Changes in 5.10.142 drm/msm/dsi: fix the inconsistent indenting drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4 drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg drm/msm/dsi: Fix number of regulators for SDM660 platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask iio: adc: mcp3911: make use of the sign bit bpf, cgroup: Fix kernel BUG in purge_effective_progs ieee802154/adf7242: defer destroy_workqueue call ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() Revert "xhci: turn off port power in shutdown" net: sched: tbf: don't call qdisc_put() while holding tree lock net/sched: fix netdevice reference leaks in attach_default_qdiscs() ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler kcm: fix strp_init() order and cleanup sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb tcp: annotate data-race around challenge_timestamp Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb" net/smc: Remove redundant refcount increase serial: fsl_lpuart: RS485 RTS polariy is inverse staging: rtl8712: fix use after free bugs powerpc: align syscall table for ppc32 vt: Clear selection before changing the font tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag iio: ad7292: Prevent regulator double disable iio: adc: mcp3911: use correct formula for AD conversion misc: fastrpc: fix memory corruption on probe misc: fastrpc: fix memory corruption on open USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id binder: fix UAF of ref->proc caused by race condition drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops" clk: core: Fix runtime PM sequence in clk_core_unprepare() Input: rk805-pwrkey - fix module autoloading clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc() clk: bcm: rpi: Prevent out-of-bounds access clk: bcm: rpi: Add missing newline hwmon: (gpio-fan) Fix array out of bounds access gpio: pca953x: Add mutex_lock for regcache sync in PM KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() mm: pagewalk: Fix race between unmap and page walker xen-blkback: Advertise feature-persistent as user requested xen-blkfront: Advertise feature-persistent as user requested thunderbolt: Use the actual buffer in tb_async_error() media: mceusb: Use new usb_control_msg_*() routines xhci: Add grace period after xHC start to prevent premature runtime suspend. USB: serial: cp210x: add Decagon UCA device id USB: serial: option: add support for OPPO R11 diag port USB: serial: option: add Quectel EM060K modem USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles usb: dwc2: fix wrong order of phy_power_on and phy_init USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) usb-storage: Add ignore-residue quirk for NXP PN7462AU s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages s390: fix nospec table alignments USB: core: Prevent nested device-reset calls usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS driver core: Don't probe devices after bus_type.match() probe deferral wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected wifi: mac80211: Fix UAF in ieee80211_scan_rx() ip: fix triggering of 'icmp redirect' net: Use u64_stats_fetch_begin_irq() for stats fetch. net: mac802154: Fix a condition in the receive path ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298 ALSA: seq: oss: Fix data-race for max_midi_devs access ALSA: seq: Fix data-race at module auto-loading drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk btrfs: harden identification of a stale device mmc: core: Fix UHS-I SD 1.8V workaround branch usb: dwc3: fix PHY disable sequence usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup usb: dwc3: disable USB core PHY management USB: serial: ch341: fix lost character on LCR updates USB: serial: ch341: fix disabled rx timer on older devices Linux 5.10.142 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I32d9b4c4c0e6c802744abb8b1c87ad794f4de0c8 |
||
|
Greg Kroah-Hartman
|
e69a383052 |
Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
cc51dcbc60 |
Revert "ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath."
This reverts commit
|
||
|
Jann Horn
|
891f03f688 |
mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
This is a stable-specific patch.
I botched the stable-specific rewrite of
commit b67fbebd4cf98 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"):
As Hugh pointed out, unmap_region() actually operates on a list of VMAs,
and the variable "vma" merely points to the first VMA in that list.
So if we want to check whether any of the VMAs we're operating on is
PFNMAP or MIXEDMAP, we have to iterate through the list and check each VMA.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Yee Lee
|
a14f1799ce |
Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
This reverts commit 23c2d497de21f25898fbea70aeb292ab8acc8c94.
Commit 23c2d497de21 ("mm: kmemleak: take a full lowmem check in
kmemleak_*_phys()") brought false leak alarms on some archs like arm64
that does not init pfn boundary in early booting. The final solution
lands on linux-6.0: commit 0c24e061196c ("mm: kmemleak: add rbtree and
store physical address for objects allocated with PA").
Revert this commit before linux-6.0. The original issue of invalid PA
can be mitigated by additional check in devicetree.
The false alarm report is as following: Kmemleak output: (Qemu/arm64)
unreferenced object 0xffff0000c0170a00 (size 128):
comm "swapper/0", pid 1, jiffies 4294892404 (age 126.208s)
hex dump (first 32 bytes):
62 61 73 65 00 00 00 00 00 00 00 00 00 00 00 00 base............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<(____ptrval____)>] __kmalloc_track_caller+0x1b0/0x2e4
[<(____ptrval____)>] kstrdup_const+0x8c/0xc4
[<(____ptrval____)>] kvasprintf_const+0xbc/0xec
[<(____ptrval____)>] kobject_set_name_vargs+0x58/0xe4
[<(____ptrval____)>] kobject_add+0x84/0x100
[<(____ptrval____)>] __of_attach_node_sysfs+0x78/0xec
[<(____ptrval____)>] of_core_init+0x68/0x104
[<(____ptrval____)>] driver_init+0x28/0x48
[<(____ptrval____)>] do_basic_setup+0x14/0x28
[<(____ptrval____)>] kernel_init_freeable+0x110/0x178
[<(____ptrval____)>] kernel_init+0x20/0x1a0
[<(____ptrval____)>] ret_from_fork+0x10/0x20
This pacth is also applicable to linux-5.17.y/linux-5.18.y/linux-5.19.y
Cc: <stable@vger.kernel.org>
Signed-off-by: Yee Lee <yee.lee@mediatek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
liang zhang
|
feedd14d14 |
Revert "Revert "ANDROID: add for tuning readahead size""
This reverts commit
|
||
|
Peifeng Li
|
f50f24e781 |
ANDROID: vendor_hooks: Add hooks for lookaround
Add hooks for support lookaround in memory reclamation. - android_vh_test_clear_look_around_ref - android_vh_check_page_look_around_ref - android_vh_look_around_migrate_page - android_vh_look_around Bug: 241079328 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: I9a606ae71d2f1303df3b02403b30bc8fdc9d06dd |
||
|
Sivasri Kumar, Vanka
|
6ef4770b8e |
Merge keystone/android12-5.10-keystone-qcom-release.117+ (8f0aba1) into msm-5.10
* refs/heads/tmp-8f0aba1:
ANDROID: Update symbol list for mtk
ANDROID: GKI: rockchip: Add symbols for crypto
ANDROID: GKI: rockchip: Add symbol pci_disable_link_state
ANDROID: GKI: rockchip: Add symbols for sound
ANDROID: GKI: rockchip: Add symbols for video
BACKPORT: f2fs: do not set compression bit if kernel doesn't support
UPSTREAM: exfat: improve performance of exfat_free_cluster when using dirsync mount
ANDROID: GKI: rockchip: Add symbols for drm dp
UPSTREAM: arm64: perf: Support new DT compatibles
UPSTREAM: arm64: perf: Simplify registration boilerplate
UPSTREAM: arm64: perf: Support Denver and Carmel PMUs
UPSTREAM: arm64: perf: add support for Cortex-A78
ANDROID: GKI: rockchip: Update symbol for devfreq
ANDROID: GKI: rockchip: Update symbols for drm
ANDROID: GKI: Update symbols to symbol list
UPSTREAM: ASoC: hdmi-codec: make hdmi_codec_controls static
UPSTREAM: ASoC: hdmi-codec: Add a prepare hook
UPSTREAM: ASoC: hdmi-codec: Add iec958 controls
UPSTREAM: ASoC: hdmi-codec: Rework to support more controls
UPSTREAM: ALSA: iec958: Split status creation and fill
UPSTREAM: ALSA: doc: Clarify IEC958 controls iface
UPSTREAM: ASoC: hdmi-codec: remove unused spk_mask member
UPSTREAM: ASoC: hdmi-codec: remove useless initialization
UPSTREAM: ASoC: codec: hdmi-codec: Support IEC958 encoded PCM format
UPSTREAM: ASoC: hdmi-codec: Fix return value in hdmi_codec_set_jack()
UPSTREAM: ASoC: hdmi-codec: Add RX support
UPSTREAM: ASoC: hdmi-codec: Get ELD in before reporting plugged event
ANDROID: GKI: rockchip: Add symbols for display driver
BACKPORT: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
BACKPORT: io_uring: always grab file table for deferred statx
BACKPORT: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
ANDROID: add two func in mm/memcontrol.c
ANDROID: vendor_hooks: protect multi-mapcount pages in kernel
ANDROID: vendor_hooks: account page-mapcount
FROMGIT: io_uring: Use original task for req identity in io_identity_cow()
FROMLIST: binder: fix UAF of ref->proc caused by race condition
ANDROID: vendor_hooks: Guard cgroup struct with CONFIG_CGROUPS
ANDROID: vendor_hooks: add hooks for remove_vm_area.
ANDROID: GKI: allow mm vendor hooks header inclusion from header files
ANDROID: Update symbol list of mediatek
ANDROID: sched: add vendor hook to PELT multiplier
ANDROID: Guard hooks with their CONFIG_ options
ANDROID: fix kernelci issue for allnoconfig builds
ANDROID: sched: Introducing PELT multiplier
FROMGIT: binder: fix redefinition of seq_file attributes
ANDROID: GKI: pcie: Fix the broken dw_pcie structure
UPSTREAM: PCI: dwc: Support multiple ATU memory regions
ANDROID: oplus: Update the ABI xml and symbol list
ANDROID: vendor_hooks: add hooks in __alloc_pages_slowpath
ANDROID: GKI: Update symbols to symbol list
FROMGIT: arm64: fix oops in concurrently setting insn_emulation sysctls
FROMGIT: usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
ANDROID: vendor_hooks:vendor hook for mmput
ANDROID: vendor_hooks:vendor hook for pidfd_open
ANDROID: GKI: db845c: Update symbols list and ABI
Linux 5.10.117
SUNRPC: Fix fall-through warnings for Clang
io_uring: always use original task when preparing req identity
usb: gadget: uvc: allow for application to cleanly shutdown
usb: gadget: uvc: rename function to be more consistent
ping: fix address binding wrt vrf
arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
net: phy: Fix race condition on link status change
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
SUNRPC: Don't call connect() more than once on a TCP socket
SUNRPC: Prevent immediate close+reconnect
SUNRPC: Clean up scheduling of autoclose
drm/vmwgfx: Initialize drm_mode_fb_cmd2
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
net: atlantic: always deep reset on pm op, fixing up my null deref regression
i40e: i40e_main: fix a missing check on list iterator
drm/nouveau/tegra: Stop using iommu_present()
ceph: fix setting of xattrs on async created inodes
serial: 8250_mtk: Fix register address for XON/XOFF character
serial: 8250_mtk: Fix UART_EFR register address
slimbus: qcom: Fix IRQ check in qcom_slim_probe
USB: serial: option: add Fibocom MA510 modem
USB: serial: option: add Fibocom L610 modem
USB: serial: qcserial: add support for Sierra Wireless EM7590
USB: serial: pl2303: add device id for HP LM930 Display
usb: typec: tcpci_mt6360: Update for BMC PHY setting
usb: typec: tcpci: Don't skip cleanup in .remove() on error
usb: cdc-wdm: fix reading stuck on device close
tty: n_gsm: fix mux activation issues in gsm_config()
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
firmware_loader: use kernel credentials when reading firmware
tcp: resalt the secret every 10 seconds
net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
s390: disable -Warray-bounds
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
ASoC: max98090: Generate notifications on changes for custom control
ASoC: max98090: Reject invalid values in custom control put()
hwmon: (f71882fg) Fix negative temperature
gfs2: Fix filesystem block deallocation for short writes
tls: Fix context leak on tls_device_down
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
net/sched: act_pedit: really ensure the skb is writable
s390/lcs: fix variable dereferenced before check
s390/ctcm: fix potential memory leak
s390/ctcm: fix variable dereferenced before check
selftests: vm: Makefile: rename TARGETS to VMTARGETS
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
dim: initialize all struct fields
ionic: fix missing pci_release_regions() on error in ionic_probe()
nfs: fix broken handling of the softreval mount option
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
net: sfc: fix memory leak due to ptp channel
sfc: Use swap() instead of open coding it
netlink: do not reset transport header in netlink_recvmsg()
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
ipv4: drop dst in multicast routing path
net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters
net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted
net: Fix features skip in for_each_netdev_feature()
mac80211: Reset MBSSID parameters upon connection
hwmon: (tmp401) Add OF device ID table
iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
batman-adv: Don't skb_split skbuffs with frag_list
Linux 5.10.116
mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
mm: fix missing cache flush for all tail pages of compound page
Bluetooth: Fix the creation of hdev->name
arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
nfp: bpf: silence bitwise vs. logical OR warning
drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version, environment} types
block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
regulator: consumer: Add missing stubs to regulator/consumer.h
MIPS: Use address-of operator on section symbols
ANDROID: GKI: update the abi .xml file due to hex_to_bin() changes
Revert "tcp: ensure to use the most recently sent skb when filling the rate sample"
Linux 5.10.115
mmc: rtsx: add 74 Clocks in power on flow
PCI: aardvark: Fix reading MSI interrupt number
PCI: aardvark: Clear all MSIs at setup
dm: interlock pending dm_io and dm_wait_for_bios_completion
block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
rcu: Apply callbacks processing time limit only on softirq
rcu: Fix callbacks processing time limit retaining cond_resched()
KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs
KVM: x86: Do not change ICR on write to APIC_SELF_IPI
x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
net/mlx5: Fix slab-out-of-bounds while reading resource dump menu
kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
btrfs: always log symlinks in full mode
smsc911x: allow using IRQ0
selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer
bnxt_en: Fix unnecessary dropping of RX packets
bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
hinic: fix bug of wq out of bound access
net: emaclite: Add error handling for of_address_to_resource()
net: cpsw: add missing of_node_put() in cpsw_probe_dt()
net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
net: dsa: mt7530: add missing of_node_put() in mt7530_setup()
net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
NFSv4: Don't invalidate inode attributes on delegation return
RDMA/siw: Fix a condition race issue in MPA request processing
selftests/seccomp: Don't call read() on TTY from background pgrp
net/mlx5: Avoid double clear or set of sync reset requested
net/mlx5e: Fix the calling of update_buffer_lossy() API
net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release
net/mlx5e: Don't match double-vlan packets if cvlan is not set
net/mlx5e: Fix trust state reset in reload
ASoC: dmaengine: Restore NULL prepare_slave_config() callback
hwmon: (adt7470) Fix warning on module removal
gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set)
NFC: netlink: fix sleep in atomic bug when firmware download timeout
nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
nfc: replace improper check device_is_registered() in netlink related functions
can: grcan: only use the NAPI poll budget for RX
can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
can: grcan: use ofdev->dev when allocating DMA memory
can: isotp: remove re-binding of bound socket
can: grcan: grcan_close(): fix deadlock
s390/dasd: Fix read inconsistency for ESE DASD devices
s390/dasd: Fix read for ESE with blksize < 4k
s390/dasd: prevent double format of tracks for ESE devices
s390/dasd: fix data corruption for ESE devices
ASoC: meson: Fix event generation for AUI CODEC mux
ASoC: meson: Fix event generation for G12A tohdmi mux
ASoC: meson: Fix event generation for AUI ACODEC mux
ASoC: wm8958: Fix change notifications for DSP controls
ASoC: da7219: Fix change notifications for tone generator frequency
genirq: Synchronize interrupt thread startup
net: stmmac: disable Split Header (SPH) for Intel platforms
firewire: core: extend card->lock in fw_core_handle_bus_reset
firewire: remove check of list iterator against head past the loop body
firewire: fix potential uaf in outbound_phy_packet_callback()
Revert "SUNRPC: attempt AF_LOCAL connect on setup"
drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT
iommu/vt-d: Calculate mask for non-aligned flushes
KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
mmc: core: Set HS clock speed before sending HS CMD13
mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
parisc: Merge model and model name into one line in /proc/cpuinfo
MIPS: Fix CP0 counter erratum detection for R4k CPUs
Revert "ipv6: make ip6_rt_gc_expire an atomic_t"
Revert "oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup"
Linux 5.10.114
perf symbol: Remove arch__symbols__fixup_end()
tty: n_gsm: fix software flow control handling
tty: n_gsm: fix incorrect UA handling
tty: n_gsm: fix reset fifo race condition
tty: n_gsm: fix wrong command frame length field encoding
tty: n_gsm: fix wrong command retry handling
tty: n_gsm: fix missing explicit ldisc flush
tty: n_gsm: fix wrong DLCI release order
tty: n_gsm: fix insufficient txframe size
netfilter: nft_socket: only do sk lookups when indev is available
tty: n_gsm: fix malformed counter for out of frame data
tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
tty: n_gsm: fix mux cleanup after unregister tty device
tty: n_gsm: fix decoupled mux resource
tty: n_gsm: fix restart handling via CLD command
perf symbol: Update symbols__fixup_end()
perf symbol: Pass is_kallsyms to symbols__fixup_end()
x86/cpu: Load microcode during restore_processor_state()
thermal: int340x: Fix attr.show callback prototype
net: ethernet: stmmac: fix write to sgmii_adapter_base
drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses
kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time
zonefs: Clear inode information flags on inode creation
zonefs: Fix management of open zones
powerpc/perf: Fix 32bit compile
drivers: net: hippi: Fix deadlock in rr_close()
cifs: destage any unwritten data to the server before calling copychunk_write
x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
ext4: fix bug_on in start_this_handle during umount filesystem
ASoC: wm8731: Disable the regulator when probing fails
ASoC: Intel: soc-acpi: correct device endpoints for max98373
tcp: fix F-RTO may not work correctly when receiving DSACK
Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits"
ibmvnic: fix miscellaneous checks
ixgbe: ensure IPsec VF<->PF compatibility
net: fec: add missing of_node_put() in fec_enet_init_stop_mode()
bnx2x: fix napi API usage sequence
tls: Skip tls_append_frag on zero copy size
drm/amd/display: Fix memory leak in dcn21_clock_source_create
drm/amdkfd: Fix GWS queue count
net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
net: phy: marvell10g: fix return value on error
net: bcmgenet: hide status block before TX timestamping
clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
tcp: make sure treq->af_specific is initialized
tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
ip6_gre: Make o_seqno start from 0 in native mode
ip_gre: Make o_seqno start from 0 in native mode
net/smc: sync err code when tcp connection was refused
net: hns3: add return value for mailbox handling in PF
net: hns3: add validity check for message data length
net: hns3: modify the return code of hclge_get_ring_chain_from_mbx
cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
pinctrl: pistachio: fix use of irq_of_parse_and_map()
arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
ARM: dts: imx6ull-colibri: fix vqmmc regulator
sctp: check asoc strreset_chunk in sctp_generate_reconf_event
wireguard: device: check for metadata_dst with skb_valid_dst()
tcp: ensure to use the most recently sent skb when filling the rate sample
pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested
tcp: md5: incorrect tcp_header_len for incoming connections
pinctrl: rockchip: fix RK3308 pinmux bits
bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
net: dsa: Add missing of_node_put() in dsa_port_link_register_of
memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode
pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI
mtd: fix 'part' field data corruption in mtd_info
mtd: rawnand: Fix return value check of wait_for_completion_timeout
pinctrl: mediatek: moore: Fix build error
ipvs: correctly print the memory size of ip_vs_conn_tab
ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
ARM: dts: am3517-evm: Fix misc pinmuxing
ARM: dts: Fix mmc order for omap3-gta04
phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe
ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name
ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek
phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific
ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
phy: samsung: exynos5250-sata: fix missing device put in probe error paths
phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
USB: Fix xhci event ring dequeue pointer ERDP update issue
mtd: rawnand: fix ecc parameters for mt7622
iio:imu:bmi160: disable regulator in error path
arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards
arm64: dts: meson: remove CPU opps below 1GHz for G12B boards
video: fbdev: udlfb: properly check endpoint type
iocost: don't reset the inuse weight of under-weighted debtors
x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
riscv: patch_text: Fixup last cpu should be master
hex2bin: fix access beyond string end
hex2bin: make the function hex_to_bin constant-time
pinctrl: samsung: fix missing GPIOLIB on ARM64 Exynos config
arch_topology: Do not set llc_sibling if llc_id is invalid
serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
serial: 8250: Also set sticky MCR bits in console restoration
serial: imx: fix overrun interrupts in DMA mode
usb: phy: generic: Get the vbus supply
usb: cdns3: Fix issue for clear halt endpoint
usb: dwc3: gadget: Return proper request status
usb: dwc3: core: Only handle soft-reset in DCTL
usb: dwc3: core: Fix tx/rx threshold settings
usb: dwc3: Try usb-role-switch first in dwc3_drd_init
usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
usb: gadget: uvc: Fix crash when encoding data for usb request
usb: typec: ucsi: Fix role swapping
usb: typec: ucsi: Fix reuse of completion structure
usb: misc: fix improper handling of refcount in uss720_probe()
iio: imu: inv_icm42600: Fix I2C init possible nack
iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
iio: dac: ad5446: Fix read_raw not returning set value
iio: dac: ad5592r: Fix the missing return value.
xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
xhci: stop polling roothubs after shutdown
xhci: Enable runtime PM on second Alderlake controller
USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
USB: quirks: add STRING quirk for VCOM device
USB: quirks: add a Realtek card reader
usb: mtu3: fix USB 3.0 dual-role-switch from device to host
lightnvm: disable the subsystem
floppy: disable FDRAWCMD by default
Linux 5.10.113
Revert "net: micrel: fix KS8851_MLL Kconfig"
block/compat_ioctl: fix range check in BLKGETSIZE
staging: ion: Prevent incorrect reference counting behavour
spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller
jbd2: fix a potential race while discarding reserved buffers after an abort
can: isotp: stop timeout monitoring when no first frame was sent
ext4: force overhead calculation if the s_overhead_cluster makes no sense
ext4: fix overhead calculation to account for the reserved gdt blocks
ext4, doc: fix incorrect h_reserved size
ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
ext4: fix use-after-free in ext4_search_dir
ext4: fix symlink file size not match to file content
ext4: fix fallocate to use file_modified to update permissions consistently
perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event
powerpc/perf: Fix power9 event alternatives
drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage
KVM: PPC: Fix TCE handling for VFIO
drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare
drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled
sched/pelt: Fix attach_entity_load_avg() corner case
arm_pmu: Validate single/group leader events
ARC: entry: fix syscall_trace_exit argument
e1000e: Fix possible overflow in LTR decoding
ASoC: soc-dapm: fix two incorrect uses of list iterator
gpio: Request interrupts after IRQ is initialized
openvswitch: fix OOB access in reserve_sfa_size()
xtensa: fix a7 clobbering in coprocessor context load/store
xtensa: patch_text: Fixup last cpu should be master
net: atlantic: invert deep par in pm functions, preventing null derefs
dma: at_xdmac: fix a missing check on list iterator
ata: pata_marvell: Check the 'bmdma_addr' beforing reading
mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()
oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
mm, hugetlb: allow for "high" userspace addresses
EDAC/synopsys: Read the error count from the correct register
nvme-pci: disable namespace identifiers for Qemu controllers
nvme: add a quirk to disable namespace identifiers
stat: fix inconsistency between struct stat and struct compat_stat
scsi: qedi: Fix failed disconnect handling
net: macb: Restart tx only if queue pointer is lagging
drm/msm/mdp5: check the return of kzalloc()
dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info()
brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
mt76: Fix undefined behavior due to shift overflowing the constant
net: atlantic: Avoid out-of-bounds indexing
cifs: Check the IOCB_DIRECT flag, not O_DIRECT
vxlan: fix error return code in vxlan_fdb_append
arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes
ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
reset: tegra-bpmp: Restore Handle errors in BPMP response
ARM: vexpress/spc: Avoid negative array index when !SMP
arm64: mm: fix p?d_leaf()
arm64/mm: Remove [PUD|PMD]_TABLE_BIT from [pud|pmd]_bad()
selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets
dmaengine: idxd: add RO check for wq max_transfer_size write
dmaengine: idxd: add RO check for wq max_batch_size write
net: stmmac: Use readl_poll_timeout_atomic() in atomic state
netlink: reset network and mac headers in netlink_dump()
ipv6: make ip6_rt_gc_expire an atomic_t
l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu
net/sched: cls_u32: fix possible leak in u32_init_knode()
ip6_gre: Fix skb_under_panic in __gre6_xmit()
ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
net/packet: fix packet_sock xmit return value checking
net/smc: Fix sock leak when release after smc_shutdown()
rxrpc: Restore removed timer deletion
igc: Fix BUG: scheduling while atomic
igc: Fix infinite loop in release_swfw_sync
esp: limit skb_page_frag_refill use to a single page
spi: spi-mtk-nor: initialize spi controller after resume
dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources
dmaengine: imx-sdma: Fix error checking in sdma_event_remap
ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use
ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component
ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
dm: fix mempool NULL pointer race when completing IO
ALSA: hda/realtek: Add quirk for Clevo NP70PNP
ALSA: usb-audio: Clear MIDI port active flag after draining
net/sched: cls_u32: fix netns refcount changes in u32_change()
gfs2: assign rgrp glock before compute_bitstructs
perf tools: Fix segfault accessing sample_id xyarray
tracing: Dump stacktrace trigger to the corresponding instance
mm: page_alloc: fix building error on -Werror=array-compare
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
ANDROID: fix up gpio change in 5.10.111
Linux 5.10.112
ax25: Fix UAF bugs in ax25 timers
ax25: Fix NULL pointer dereferences in ax25 timers
ax25: fix NPD bug in ax25_disconnect
ax25: fix UAF bug in ax25_send_control()
ax25: Fix refcount leaks caused by ax25_cb_del()
ax25: fix UAF bugs of net_device caused by rebinding operation
ax25: fix reference count leaks of ax25_dev
ax25: add refcount in ax25_dev to avoid UAF bugs
scsi: iscsi: Fix unbound endpoint error handling
scsi: iscsi: Fix endpoint reuse regression
dma-direct: avoid redundant memory sync for swiotlb
timers: Fix warning condition in __run_timers()
i2c: pasemi: Wait for write xfers to finish
smp: Fix offline cpu check in flush_smp_call_function_queue()
dm integrity: fix memory corruption when tag_size is less than digest size
ARM: davinci: da850-evm: Avoid NULL pointer dereference
tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
genirq/affinity: Consider that CPUs on nodes can be unbalanced
drm/amdgpu: Enable gfxoff quirk on MacBook Pro
drm/amd/display: don't ignore alpha property on pre-multiplied mode
ipv6: fix panic when forwarding a pkt with no in6 dev
nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers
ALSA: hda/realtek: Add quirk for Clevo PD50PNT
btrfs: mark resumed async balance as writing
btrfs: fix root ref counts in error handling in btrfs_get_root_ref
ath9k: Fix usage of driver-private space in tx_info
ath9k: Properly clear TX status area before reporting to mac80211
gcc-plugins: latent_entropy: use /dev/urandom
memory: renesas-rpc-if: fix platform-device leak in error path
KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded
mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
mm: fix unexpected zeroed page mapping with zram swap
mm, page_alloc: fix build_zonerefs_node()
perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant
drivers: net: slip: fix NPD bug in sl_tx_timeout()
scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan
scsi: mvsas: Add PCI ID of RocketRaid 2640
drm/amd/display: Fix allocate_mst_payload assert on resume
drm/amd/display: Revert FEC check in validation
myri10ge: fix an incorrect free for skb in myri10ge_sw_tso
net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
net: axienet: setup mdio unconditionally
tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry
arm64: alternatives: mark patch_alternative() as `noinstr`
regulator: wm8994: Add an off-on delay for WM8994 variant
gpu: ipu-v3: Fix dev_dbg frequency output
ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
net: micrel: fix KS8851_MLL Kconfig
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
scsi: lpfc: Fix queue failures when recovering from PCI parity error
scsi: target: tcmu: Fix possible page UAF
Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
drm/amdkfd: Check for potential null return of kmalloc_array()
drm/amdgpu/vcn: improve vcn dpg stop procedure
drm/amdkfd: Fix Incorrect VMIDs passed to HWS
drm/amd/display: Update VTEM Infopacket definition
drm/amd/display: FEC check in timing validation
drm/amd/display: fix audio format not updated after edid updated
btrfs: do not warn for free space inode in cow_file_range
btrfs: fix fallocate to use file_modified to update permissions consistently
drm/amd: Add USBC connector ID
net: bcmgenet: Revert "Use stronger register read/writes to assure ordering"
dm mpath: only use ktime_get_ns() in historical selector
cifs: potential buffer overflow in handling symlinks
nfc: nci: add flush_workqueue to prevent uaf
perf tools: Fix misleading add event PMU debug message
testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set
sctp: Initialize daddr on peeled off socket
scsi: iscsi: Fix conn cleanup and stop race during iscsid restart
scsi: iscsi: Fix offload conn cleanup when iscsid restarts
scsi: iscsi: Move iscsi_ep_disconnect()
scsi: iscsi: Fix in-kernel conn failure handling
scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
scsi: iscsi: Use system_unbound_wq for destroy_work
scsi: iscsi: Force immediate failure during shutdown
scsi: iscsi: Stop queueing during ep_disconnect
scsi: pm80xx: Enable upper inbound, outbound queues
scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63
net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init()
drm/msm: Fix range size vs end confusion
cfg80211: hold bss_lock while updating nontrans_list
net/sched: taprio: Check if socket flags are valid
net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
net: dsa: felix: suppress -EPROBE_DEFER errors
net/sched: fix initialization order when updating chain 0 head
mlxsw: i2c: Fix initialization error flow
net: mdio: Alphabetically sort header inclusion
gpiolib: acpi: use correct format characters
veth: Ensure eth header is in skb's linear part
net/sched: flower: fix parsing of ethertype following VLAN header
SUNRPC: Fix the svc_deferred_event trace class
media: rockchip/rga: do proper error checking in probe
firmware: arm_scmi: Fix sorting of retrieved clock rates
memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
drm/msm: Add missing put_task_struct() in debugfs path
btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()
ACPI: processor idle: Check for architectural support for LPI
cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function
hamradio: remove needs_free_netdev to avoid UAF
hamradio: defer 6pack kfree after unregister_netdev
drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
Linux 5.10.111
powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit
mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
irqchip/gic, gic-v3: Prevent GSI to SGI translations
Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb()
arm64: module: remove (NOLOAD) from linker script
selftests: cgroup: Test open-time cgroup namespace usage for migration checks
selftests: cgroup: Test open-time credential usage for migration checks
selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644
selftests/cgroup: Fix build on older distros
cgroup: Use open-time credentials for process migraton perm checks
mm: don't skip swap entry even if zap_details specified
ubsan: remove CONFIG_UBSAN_OBJECT_SIZE
dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
tools build: Filter out options and warnings not supported by clang
perf python: Fix probing for some clang command line options
perf build: Don't use -ffat-lto-objects in the python feature test when building with clang-13
drm/amdkfd: Create file descriptor after client is added to smi_clients list
drm/nouveau/pmu: Add missing callbacks for Tegra devices
drm/amdgpu/smu10: fix SoC/fclk units in auto mode
irqchip/gic-v3: Fix GICR_CTLR.RWP polling
perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
ata: sata_dwc_460ex: Fix crash due to OOB write
gpio: Restrict usage of GPIO chip irq members before initialization
RDMA/hfi1: Fix use-after-free bug for mm struct
arm64: patch_text: Fixup last cpu should be master
btrfs: prevent subvol with swapfile from being deleted
btrfs: fix qgroup reserve overflow the qgroup limit
x86/speculation: Restore speculation related MSRs during S3 resume
x86/pm: Save the MSR validity status at context setup
io_uring: fix race between timeout flush and removal
mm/mempolicy: fix mpol_new leak in shared_policy_replace
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
lz4: fix LZ4_decompress_safe_partial read out of bound
mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete
mmc: mmci: stm32: correctly check all elements of sg list
Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
arm64: Add part number for Arm Cortex-A78AE
perf session: Remap buf if there is no space for event
perf tools: Fix perf's libperf_print callback
perf: arm-spe: Fix perf report --mem-mode
iommu/omap: Fix regression in probe for NULL pointer dereference
SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()
SUNRPC: Handle low memory situations in call_status()
SUNRPC: Handle ENOMEM in call_transmit_status()
io_uring: don't touch scm_fp_list after queueing skb
drbd: Fix five use after free bugs in get_initial_state
bpf: Support dual-stack sockets in bpf_tcp_check_syncookie
spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op()
qede: confirm skb is allocated before using
net: phy: mscc-miim: reject clause 45 register accesses
rxrpc: fix a race in rxrpc_exit_net()
net: openvswitch: fix leak of nested actions
net: openvswitch: don't send internal clone attribute to the userspace.
ice: synchronize_rcu() when terminating rings
ipv6: Fix stats accounting in ip6_pkt_drop
ice: Do not skip not enabled queues in ice_vc_dis_qs_msg
ice: Set txq_teid to ICE_INVAL_TEID on ring creation
dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe
IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition
RDMA/mlx5: Don't remove cache MRs when a delay is needed
sfc: Do not free an empty page_ring
bnxt_en: reserve space inside receive page for skb_shared_info
drm/imx: Fix memory leak in imx_pd_connector_get_modes
drm/imx: imx-ldb: Check for null pointer after calling kmemdup
net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
net: ipv4: fix route with nexthop object delete warning
ice: Clear default forwarding VSI during VSI release
net/tls: fix slab-out-of-bounds bug in decrypt_internal
scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
NFSv4: fix open failure with O_ACCMODE flag
Revert "NFSv4: Handle the special Linux file open access mode"
Drivers: hv: vmbus: Fix potential crash on module unload
drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
Revert "hv: utils: add PTP_1588_CLOCK to Kconfig to fix build"
mm: fix race between MADV_FREE reclaim and blkdev direct IO read
parisc: Fix patch code locking and flushing
parisc: Fix CPU affinity for Lasi, WAX and Dino chips
NFS: Avoid writeback threads getting stuck in mempool_alloc()
NFS: nfsiod should not block forever in mempool_alloc()
SUNRPC: Fix socket waits for write buffer space
jfs: prevent NULL deref in diFree
virtio_console: eliminate anonymous module_init & module_exit
serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy
NFS: swap-out must always use STABLE writes.
NFS: swap IO handling is slightly different for O_DIRECT IO
SUNRPC: remove scheduling boost for "SWAPPER" tasks.
SUNRPC/xprt: async tasks mustn't block waiting for memory
SUNRPC/call_alloc: async tasks mustn't block waiting for memory
clk: Enforce that disjoints limits are invalid
clk: ti: Preserve node in ti_dt_clocks_register()
xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
NFSv4: Protect the state recovery thread against direct reclaim
NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
staging: wfx: fix an error handling in wfx_init_common()
phy: amlogic: meson8b-usb2: Use dev_err_probe()
staging: vchiq_core: handle NULL result of find_service_by_handle
clk: si5341: fix reported clk_rate when output divider is 2
minix: fix bug when opening a file with O_DIRECT
init/main.c: return 1 from handled __setup() functions
ceph: fix memory leak in ceph_readdir when note_last_dentry returns error
netlabel: fix out-of-bounds memory accesses
Bluetooth: Fix use after free in hci_send_acl
MIPS: ingenic: correct unit node address
xtensa: fix DTC warning unit_address_format
usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
net: sfp: add 2500base-X quirk for Lantech SFP module
net: limit altnames to 64k total
net: account alternate interface name memory
can: isotp: set default value for N_As to 50 micro seconds
scsi: libfc: Fix use after free in fc_exch_abts_resp()
powerpc/secvar: fix refcount leak in format_show()
MIPS: fix fortify panic when copying asm exception handlers
PCI: endpoint: Fix misused goto label
bnxt_en: Eliminate unintended link toggle during FW reset
Bluetooth: use memset avoid memory leaks
Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}
tuntap: add sanity checks about msg_controllen in sendmsg
macvtap: advertise link netns via netlink
mips: ralink: fix a refcount leak in ill_acc_of_setup()
net/smc: correct settings of RMB window update limit
scsi: hisi_sas: Free irq vectors in order for v3 HW
scsi: aha152x: Fix aha152x_setup() __setup handler return value
mt76: mt7615: Fix assigning negative values to unsigned variable
scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()
scsi: pm8001: Fix tag leaks on error
scsi: pm8001: Fix task leak in pm8001_send_abort_all()
scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
scsi: pm8001: Fix pm80xx_pci_mem_copy() interface
drm/amdkfd: make CRAT table missing message informational only
dm: requeue IO if mapping table not yet available
dm ioctl: prevent potential spectre v1 gadget
ipv4: Invalidate neighbour for broadcast address upon address addition
iwlwifi: mvm: Correctly set fragmented EBS
power: supply: axp288-charger: Set Vhold to 4.4V
PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.
PCI: endpoint: Fix alignment fault error in copy tests
usb: ehci: add pci device support for Aspeed platforms
iommu/arm-smmu-v3: fix event handling soft lockup
PCI: aardvark: Fix support for MSI interrupts
drm/amdgpu: Fix recursive locking warning
powerpc: Set crashkernel offset to mid of RMA region
ipv6: make mc_forwarding atomic
libbpf: Fix build issue with llvm-readelf
cfg80211: don't add non transmitted BSS to 6GHz scanned channels
mt76: dma: initialize skip_unmap in mt76_dma_rx_fill
power: supply: axp20x_battery: properly report current when discharging
scsi: bfa: Replace snprintf() with sysfs_emit()
scsi: mvsas: Replace snprintf() with sysfs_emit()
bpf: Make dst_port field in struct bpf_sock 16-bit wide
ath11k: mhi: use mhi_sync_power_up()
ath11k: fix kernel panic during unload/load ath11k modules
powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
ptp: replace snprintf with sysfs_emit
usb: gadget: tegra-xudc: Fix control endpoint's definitions
usb: gadget: tegra-xudc: Do not program SPARAM
drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
drm/amd/display: Add signal type check when verify stream backends same
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
drm: Add orientation quirk for GPD Win Max
KVM: x86/emulator: Emulate RDPID only if it is enabled in guest
KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
rtc: wm8350: Handle error for wm8350_register_irq
gfs2: gfs2_setattr_size error path fix
gfs2: Fix gfs2_release for non-writers regression
gfs2: Check for active reservation in gfs2_release
ubifs: Rectify space amount budget for mkdir/tmpfile operations
Conflicts:
drivers/mmc/host/sdhci-msm.c
Change-Id: I7a49ede6a9c42c6f5425b8ba632730a5a289d6ab
Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com>
|
||
Steven Price
|
47a73e5e6b |
mm: pagewalk: Fix race between unmap and page walker
[ Upstream commit 8782fb61cc848364e1e1599d76d3c9dd58a1cc06 ]
The mmap lock protects the page walker from changes to the page tables
during the walk. However a read lock is insufficient to protect those
areas which don't have a VMA as munmap() detaches the VMAs before
downgrading to a read lock and actually tearing down PTEs/page tables.
For users of walk_page_range() the solution is to simply call pte_hole()
immediately without checking the actual page tables when a VMA is not
present. We now never call __walk_page_range() without a valid vma.
For walk_page_range_novma() the locking requirements are tightened to
require the mmap write lock to be taken, and then walking the pgd
directly with 'no_vma' set.
This in turn means that all page walkers either have a valid vma, or
it's that special 'novma' case for page table debugging. As a result,
all the odd '(!walk->vma && !walk->no_vma)' tests can be removed.
Fixes:
|
||
|
Greg Kroah-Hartman
|
5d60de7a5f |
This is the 5.10.141 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMVs1MACgkQONu9yGCS
aT4dIA/+JYX/VG4PxtN3ndJGacUGTTxXf0fKn5TAPkJVKJ5Jt5zDuWbAA4+oLWym
z8L7W2DQ8sdhWiKTSbQMUXWhzyMDyxmFED/J9sm9HXd4c1VbAaRroeViI26fcbxU
ND5soyoTprxD2iwePmmxI7EKO2IIpqkw3hkcUS0XI6bLT2j8/zusEBHUP4RF8D9I
+FCpE9miQZielOjeTLlCRiU5VlZDEg5FusTuy+EJlN4k1HJxiO/L31NVX3iG0xPs
2x4E0q5QT85xEQRwzJFUPU64hPzPFeSGENfAsiq0tzRdsqgOFuQulnp31Vt/nba3
D+D96/dRxo/OZ/s1o2zt08J9zI5tV64sdxrxXSni/+Pnc/qc2/ZrGM3pPIw4taUg
/35orlmDqseNvPyZ5BKuHc68G+1Ma3uxQTbhGfcESvOEZ+T/Ezd6wL+BGMoL/jjq
QKBrRDORAt2t4JmaNoq3t+LGyE4Kdi7RxUmnawYImwzmMKS+qAk0f9mTVcYST0BM
DWFClp8FW4IAVzGX0AWw2uz6e0T/kSkI1xCT8dzXfM7GhAUF8LPJABgmlLJRm/0N
HnzGRDwl0xPbbe9VNvhI+yCaI7HYkSuDlVHW1oujd/AoRcso5LV6TMAgnPUYyvm7
d1HZlbDP2G35Ypq+Z/EdQIb7kWvoDHd2Az3Hvslo5Chawx41S+s=
=IQqi
-----END PGP SIGNATURE-----
Merge 5.10.141 into android12-5.10-lts
Changes in 5.10.141
mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
x86/nospec: Unwreck the RSB stuffing
x86/nospec: Fix i386 RSB stuffing
crypto: lib - remove unneeded selection of XOR_BLOCKS
s390/mm: do not trigger write fault when vma does not allow VM_WRITE
kbuild: Fix include path in scripts/Makefile.modpost
Bluetooth: L2CAP: Fix build errors in some archs
Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()"
HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
udmabuf: Set the DMA mask for the udmabuf device (v2)
media: pvrusb2: fix memory leak in pvr_probe
HID: hidraw: fix memory leak in hidraw_release()
net: fix refcount bug in sk_psock_get (2)
fbdev: fb_pm2fb: Avoid potential divide by zero error
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
bpf: Don't redirect packets with invalid pkt_len
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
mmc: mtk-sd: Clear interrupts when cqe off/disable
drm/amd/display: Avoid MPC infinite loop
drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
drm/amd/display: clear optc underflow before turn off odm clock
neigh: fix possible DoS due to net iface start/stop loop
s390/hypfs: avoid error message under KVM
drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
drm/amd/display: Fix pixel clock programming
drm/amdgpu: Increase tlb flush timeout for sriov
netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()
kprobes: don't call disarm_kprobe() for disabled kprobes
io_uring: disable polling pollfree files
xfs: remove infinite loop when reserving free block pool
xfs: always succeed at setting the reserve pool size
xfs: fix overfilling of reserve pool
xfs: fix soft lockup via spinning in filestream ag selection loop
xfs: revert "xfs: actually bump warning counts when we send warnings"
net/af_packet: check len when min_header_len equals to 0
net: neigh: don't call kfree_skb() under spin_lock_irqsave()
Linux 5.10.141
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8b6a1e0bd31df051b90433857f126c183771d367
|
||
|
Jann Horn
|
98f401d363 |
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
commit 2555283eb40df89945557273121e9393ef9b542b upstream.
anon_vma->degree tracks the combined number of child anon_vmas and VMAs
that use the anon_vma as their ->anon_vma.
anon_vma_clone() then assumes that for any anon_vma attached to
src->anon_vma_chain other than src->anon_vma, it is impossible for it to
be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
elevated by 1 because of a child anon_vma, meaning that if ->degree
equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.
This assumption is wrong because the ->degree optimization leads to leaf
nodes being abandoned on anon_vma_clone() - an existing anon_vma is
reused and no new parent-child relationship is created. So it is
possible to reuse an anon_vma for one VMA while it is still tied to
another VMA.
This is an issue because is_mergeable_anon_vma() and its callers assume
that if two VMAs have the same ->anon_vma, the list of anon_vmas
attached to the VMAs is guaranteed to be the same. When this assumption
is violated, vma_merge() can merge pages into a VMA that is not attached
to the corresponding anon_vma, leading to dangling page->mapping
pointers that will be dereferenced during rmap walks.
Fix it by separately tracking the number of child anon_vmas and the
number of VMAs using the anon_vma as their ->anon_vma.
Fixes:
|
||
|
Jann Horn
|
895428ee12 |
mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream.
Some drivers rely on having all VMAs through which a PFN might be
accessible listed in the rmap for correctness.
However, on X86, it was possible for a VMA with stale TLB entries
to not be listed in the rmap.
This was fixed in mainline with
commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"),
but that commit relies on preceding refactoring in
commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma()
implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch
tlb_{start,end}_vma()").
This patch provides equivalent protection without needing that
refactoring, by forcing a TLB flush between removing PTEs in
unmap_vmas() and the call to unlink_file_vma() in free_pgtables().
[This is a stable-specific rewrite of the upstream commit!]
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
5939035887 |
This is the 5.10.140 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMPexEACgkQONu9yGCS aT7SIg//QPmoJq2ho7oqDXzdxW67Eay3QZEPDoBol34RxEXoAUpxFB1nQlC3u1aI OyPNXqQSPkObkXRMAVYStTZWgN3iUngorbsDOM+svGpAxt9zC/6d7JGNdhstaQLG p/OoWaV7qwnNUsvndhohdmwU9TqjwpbvQwSa570uWQ47nIoxMyIz0iR80GjBSNGf a2QiJg4OsaVxqxoySB6I6qAceRMbLOZVxW6p963IYC9Fj4j1NmhsPDIy95aidEN5 RG+Ng9GnuYRo0ktlhSje9YKyE5bYhUNCi6GWsCyArAFo0db/2GzRFweZRy5w7MC/ IaFQf93pDZinIBfDJliXfFMBx4YLdI3IHdtILPJvF7d1U5n6pG44knrPkPHzNouf Ife8SckAPLzZeffobIcOXgoZqM3Xj/5mpHWffPQ2wIpL0ylf4bshPiC8mIRoyblh ufrzUV6r7uBesp18c6nhjwAKgNVaw4w9+CpDk0qLlDELKNfENJ9wMRAJpcifYJKL jJVWJh2wXG4kBWbp/2SetMkNNEeqn/PQUVY843uRE2iE76J2lzly5/+gI4DsSN6+ z2ZQL5tzguZvLw0s+si+doU+orbpzXluJncNdJyw8+1A7J2kxSn/Xfks9X3BKDyi 69pxUx627rMJZi4Pwsc1tyoeTVj32EAmUqronHD9tsQKsujIX0M= =DO69 -----END PGP SIGNATURE----- Merge 5.10.140 into android12-5.10-lts Changes in 5.10.140 audit: fix potential double free on error path from fsnotify_add_inode_mark parisc: Fix exception handler for fldw and fstw instructions kernel/sys_ni: add compat entry for fadvise64_64 pinctrl: amd: Don't save/restore interrupt status and wake status bits xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* fs: remove __sync_filesystem vfs: make sync_filesystem return errors from ->sync_fs xfs: return errors in xfs_fs_sync_fs xfs: only bother with sync_filesystem during readonly remount kernel/sched: Remove dl_boosted flag comment xfrm: fix refcount leak in __xfrm_policy_check() xfrm: clone missing x->lastused in xfrm_do_migrate af_key: Do not call xfrm_probe_algs in parallel xfrm: policy: fix metadata dst->dev xmit null pointer dereference NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() NFSv4.2 fix problems with __nfs42_ssc_open SUNRPC: RPC level errors should set task->tk_rpc_status mm/huge_memory.c: use helper function migration_entry_to_page() mm/smaps: don't access young/dirty bit if pte unpresent rose: check NULL rose_loopback_neigh->loopback nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout ice: xsk: Force rings to be sized to power of 2 ice: xsk: prohibit usage of non-balanced queue id net/mlx5e: Properly disable vlan strip on non-UL reps net: ipa: don't assume SMEM is page-aligned net: moxa: get rid of asymmetry in DMA mapping/unmapping bonding: 802.3ad: fix no transmission of LACPDUs net: ipvtap - add __init/__exit annotations to module init/exit funcs netfilter: ebtables: reject blobs that don't provide all entry points bnxt_en: fix NQ resource accounting during vf creation on 57500 chips netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nft_tunnel: restrict it to netdev family netfilter: nftables: remove redundant assignment of variable err netfilter: nf_tables: consolidate rule verdict trace call netfilter: nft_cmp: optimize comparison for 16-bytes netfilter: bitwise: improve error goto labels netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: nf_tables: disallow jump to implicit chain from set element netfilter: nf_tables: disallow binding to already bound chain tcp: tweak len/truesize ratio for coalesce candidates net: Fix data-races around sysctl_[rw]mem(_offset)?. net: Fix data-races around sysctl_[rw]mem_(max|default). net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_max_backlog. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). bpf: Folding omem_charge() into sk_storage_charge() net: Fix data-races around sysctl_optmem_max. net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix a data-race around sysctl_somaxconn. ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter rxrpc: Fix locking in rxrpc's sendmsg ionic: fix up issues with handling EAGAIN on FW cmds btrfs: fix silent failure when deleting root reference btrfs: replace: drop assert for suspended replace btrfs: add info when mount fails due to stale replace target btrfs: check if root is readonly while setting security xattr perf/x86/lbr: Enable the branch type for the Arch LBR by default x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry x86/bugs: Add "unknown" reporting for MMIO Stale Data loop: Check for overflow while configuring loop asm-generic: sections: refactor memory_intersects s390: fix double free of GS and RI CBs on fork() failure ACPI: processor: Remove freq Qos request for all CPUs xen/privcmd: fix error exit of privcmd_ioctl_dm_op() mm/hugetlb: fix hugetlb not supporting softdirty tracking Revert "md-raid: destroy the bitmap after destroying the thread" md: call __md_stop_writes in md_stop arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 Documentation/ABI: Mention retbleed vulnerability info file for sysfs blk-mq: fix io hung due to missing commit_rqs perf python: Fix build when PYTHON_CONFIG is user supplied perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU scsi: ufs: core: Enable link lost interrupt scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq bpf: Don't use tnum_range on array range checking for poke descriptors Linux 5.10.140 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I29f4b4af2a584dc2f2789aac613583603002464a |
||
|
David Hildenbrand
|
62af37c5cd |
mm/hugetlb: fix hugetlb not supporting softdirty tracking
commit f96f7a40874d7c746680c0b9f57cef2262ae551f upstream.
Patch series "mm/hugetlb: fix write-fault handling for shared mappings", v2.
I observed that hugetlb does not support/expect write-faults in shared
mappings that would have to map the R/O-mapped page writable -- and I
found two case where we could currently get such faults and would
erroneously map an anon page into a shared mapping.
Reproducers part of the patches.
I propose to backport both fixes to stable trees. The first fix needs a
small adjustment.
This patch (of 2):
Staring at hugetlb_wp(), one might wonder where all the logic for shared
mappings is when stumbling over a write-protected page in a shared
mapping. In fact, there is none, and so far we thought we could get away
with that because e.g., mprotect() should always do the right thing and
map all pages directly writable.
Looks like we were wrong:
--------------------------------------------------------------------------
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <sys/mman.h>
#define HUGETLB_SIZE (2 * 1024 * 1024u)
static void clear_softdirty(void)
{
int fd = open("/proc/self/clear_refs", O_WRONLY);
const char *ctrl = "4";
int ret;
if (fd < 0) {
fprintf(stderr, "open(clear_refs) failed\n");
exit(1);
}
ret = write(fd, ctrl, strlen(ctrl));
if (ret != strlen(ctrl)) {
fprintf(stderr, "write(clear_refs) failed\n");
exit(1);
}
close(fd);
}
int main(int argc, char **argv)
{
char *map;
int fd;
fd = open("/dev/hugepages/tmp", O_RDWR | O_CREAT);
if (!fd) {
fprintf(stderr, "open() failed\n");
return -errno;
}
if (ftruncate(fd, HUGETLB_SIZE)) {
fprintf(stderr, "ftruncate() failed\n");
return -errno;
}
map = mmap(NULL, HUGETLB_SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
if (map == MAP_FAILED) {
fprintf(stderr, "mmap() failed\n");
return -errno;
}
*map = 0;
if (mprotect(map, HUGETLB_SIZE, PROT_READ)) {
fprintf(stderr, "mmprotect() failed\n");
return -errno;
}
clear_softdirty();
if (mprotect(map, HUGETLB_SIZE, PROT_READ|PROT_WRITE)) {
fprintf(stderr, "mmprotect() failed\n");
return -errno;
}
*map = 0;
return 0;
}
--------------------------------------------------------------------------
Above test fails with SIGBUS when there is only a single free hugetlb page.
# echo 1 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
# ./test
Bus error (core dumped)
And worse, with sufficient free hugetlb pages it will map an anonymous page
into a shared mapping, for example, messing up accounting during unmap
and breaking MAP_SHARED semantics:
# echo 2 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
# ./test
# cat /proc/meminfo | grep HugePages_
HugePages_Total: 2
HugePages_Free: 1
HugePages_Rsvd: 18446744073709551615
HugePages_Surp: 0
Reason in this particular case is that vma_wants_writenotify() will
return "true", removing VM_SHARED in vma_set_page_prot() to map pages
write-protected. Let's teach vma_wants_writenotify() that hugetlb does not
support softdirty tracking.
Link: https://lkml.kernel.org/r/20220811103435.188481-1-david@redhat.com
Link: https://lkml.kernel.org/r/20220811103435.188481-2-david@redhat.com
Fixes:
|
||
|
Miaohe Lin
|
c7c77185fa |
mm/huge_memory.c: use helper function migration_entry_to_page()
[ Upstream commit a44f89dc6c5f8ba70240b81a570260d29d04bcb0 ] It's more recommended to use helper function migration_entry_to_page() to get the page via migration entry. We can also enjoy the PageLocked() check there. Link: https://lkml.kernel.org/r/20210318122722.13135-7-linmiaohe@huawei.com Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Reviewed-by: Peter Xu <peterx@redhat.com> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Michel Lespinasse <walken@google.com> Cc: Ralph Campbell <rcampbell@nvidia.com> Cc: Thomas Hellstrm (Intel) <thomas_os@shipmail.org> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Wei Yang <richard.weiyang@linux.alibaba.com> Cc: William Kucharski <william.kucharski@oracle.com> Cc: Yang Shi <yang.shi@linux.alibaba.com> Cc: yuleixzhang <yulei.kernel@gmail.com> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Charan Teja Kalla
|
99f0160022 |
ANDROID: mm: page_pinner: use page_ext_get/put() to work with page_ext
Use page_ext_get/put() to work with the page extended information without which the page extended information may not be valid. Bug: 2129036 Change-Id: Ibfe036b9ecef0e2551b5d0da1011cacbb0a5c3e6 Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com> |
||
|
Charan Teja Kalla
|
2b3f9b8187 |
FROMLIST: mm: fix use-after free of page_ext after race with memory-offline
The below is one path where race between page_ext and offline of the respective memory blocks will cause use-after-free on the access of page_ext structure. process1 process2 --------- --------- a)doing /proc/page_owner doing memory offline through offline_pages. b)PageBuddy check is failed thus proceed to get the page_owner information through page_ext access. page_ext = lookup_page_ext(page); migrate_pages(); ................. Since all pages are successfully migrated as part of the offline operation,send MEM_OFFLINE notification where for page_ext it calls: offline_page_ext()--> __free_page_ext()--> free_page_ext()--> vfree(ms->page_ext) mem_section->page_ext = NULL c) Check for the PAGE_EXT flags in the page_ext->flags access results into the use-after-free(leading to the translation faults). As mentioned above, there is really no synchronization between page_ext access and its freeing in the memory_offline. The memory offline steps(roughly) on a memory block is as below: 1) Isolate all the pages 2) while(1) try free the pages to buddy.(->free_list[MIGRATE_ISOLATE]) 3) delete the pages from this buddy list. 4) Then free page_ext.(Note: The struct page is still alive as it is freed only during hot remove of the memory which frees the memmap, which steps the user might not perform). This design leads to the state where struct page is alive but the struct page_ext is freed, where the later is ideally part of the former which just representing the page_flags (check [3] for why this design is chosen). The above mentioned race is just one example __but the problem persists in the other paths too involving page_ext->flags access(eg: page_is_idle())__. Fix all the paths where offline races with page_ext access by maintaining synchronization with rcu lock and is achieved in 3 steps: 1) Invalidate all the page_ext's of the sections of a memory block by storing a flag in the LSB of mem_section->page_ext. 2) Wait till all the existing readers to finish working with the ->page_ext's with synchronize_rcu(). Any parallel process that starts after this call will not get page_ext, through lookup_page_ext(), for the block parallel offline operation is being performed. 3) Now safely free all sections ->page_ext's of the block on which offline operation is being performed. Note: If synchronize_rcu() takes time then optimizations can be done in this path through call_rcu()[2]. Thanks to David Hildenbrand for his views/suggestions on the initial discussion[1] and Pavan kondeti for various inputs on this patch. [1] https://lore.kernel.org/linux-mm/59edde13-4167-8550-86f0-11fc67882107@quicinc.com/ [2] https://lore.kernel.org/all/a26ce299-aed1-b8ad-711e-a49e82bdd180@quicinc.com/T/#u [3] https://lore.kernel.org/all/6fa6b7aa-731e-891c-3efb-a03d6a700efa@redhat.com/ Bug: 236222283 Link: https://lore.kernel.org/all/1661496993-11473-1-git-send-email-quic_charante@quicinc.com/ Change-Id: Ib439ae19c61a557a5c70ea90e3c4b35a5583ba0d Suggested-by: David Hildenbrand <david@redhat.com> Suggested-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com> (fixed merge conflicts and still exported lookup_page_ext) |
||
|
Sivasri Kumar, Vanka
|
0a292918e3 |
Merge keystone/android12-5.10-keystone-qcom-release.110+ (fc6bdd0) into msm-5.10
* refs/heads/tmp-fc6bdd0: ANDROID: abi_gki_aarch64_qcom: Add skb and scatterlist helpers ANDROID: Use rq_clock_task without CONFIG_SMP ANDROID: GKI: Update symbol list for transsion ANDROID: vendor_hook: Add hook in __free_pages() ANDROID: vendor_hooks: Add hooks to extend the struct swap_info_struct ANDROID: vendor_hook: Add hook in si_swapinfo() FROMGIT: arm64: fix oops in concurrently setting insn_emulation sysctls FROMGIT: io_uring: Use original task for req identity in io_identity_cow() FROMLIST: binder: fix UAF of ref->proc caused by race condition FROMGIT: arm64: fix oops in concurrently setting insn_emulation sysctls FROMGIT: io_uring: Use original task for req identity in io_identity_cow() FROMLIST: binder: fix UAF of ref->proc caused by race condition ANDROID: Guard rq_clock_task_mult with CONFIG_SMP ANDROID: sched: Introducing PELT multiplier ANDROID: Guard hooks with their CONFIG_ options FROMGIT: binder: fix redefinition of seq_file attributes ANDROID: vendor_hook: Add hook in shmem_writepage() BACKPORT: iommu/dma: Fix race condition during iova_domain initialization FROMGIT: usb: dwc3: core: Deprecate GCTL.CORESOFTRESET FROMGIT: usb: dwc3: gadget: Prevent repeat pullup() FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn BACKPORT: FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration UPSTREAM: usb: gadget: f_uac2: allow changing interface name via configfs UPSTREAM: usb: gadget: f_uac1: allow changing interface name via configfs UPSTREAM: usb: gadget: f_uac1: Add suspend callback UPSTREAM: usb: gadget: f_uac2: Add suspend callback UPSTREAM: usb: gadget: u_audio: Add suspend call UPSTREAM: usb: gadget: u_audio: Rate ctl notifies about current srate (0=stopped) UPSTREAM: usb: gadget: f_uac1: Support multiple sampling rates UPSTREAM: usb: gadget: f_uac2: Support multiple sampling rates UPSTREAM: usb: gadget:audio: Replace deprecated macro S_IRUGO UPSTREAM: usb: gadget: u_audio: Add capture/playback srate getter UPSTREAM: usb: gadget: u_audio: Move dynamic srate from params to rtd UPSTREAM: usb: gadget: u_audio: Support multiple sampling rates UPSTREAM: docs: ABI: fixed formatting in configfs-usb-gadget-uac2 UPSTREAM: usb: gadget: u_audio: Subdevice 0 for capture ctls UPSTREAM: usb: gadget: u_audio: fix calculations for small bInterval UPSTREAM: docs: ABI: fixed req_number desc in UAC1 UPSTREAM: docs: ABI: added missing num_requests param to UAC2 UPSTREAM: usb:gadget: f_uac1: fixed sync playback UPSTREAM: usb: gadget: u_audio.c: Adding Playback Pitch ctl for sync playback UPSTREAM: ABI: configfs-usb-gadget-uac2: fix a broken table UPSTREAM: ABI: configfs-usb-gadget-uac1: fix a broken table UPSTREAM: usb: gadget: f_uac1: fixing inconsistent indenting UPSTREAM: docs: usb: fix malformed table UPSTREAM: usb: gadget: f_uac1: add volume and mute support BACKPORT: usb: gadget: f_uac2: add volume and mute support UPSTREAM: usb: gadget: u_audio: add bi-directional volume and mute support UPSTREAM: usb: audio-v2: add ability to define feature unit descriptor ANDROID: mm: shmem: use reclaim_pages() to recalim pages from a list UPSTREAM: usb: gadget: f_uac1: disable IN/OUT ep if unused ANDROID: GKI: Add symbols to abi_gki_aarch64_transsion BACKPORT: nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs ANDROID: vendor_hook: Add hook in __free_pages() ANDROID: create and export is_swap_slot_cache_enabled ANDROID: vendor_hook: Add hook in swap_slots ANDROID: mm: export swapcache_free_entries ANDROID: mm: export symbols used in vendor hook android_vh_get_swap_page() ANDROID: vendor_hooks: Add hooks to extend struct swap_slots_cache ANDROID: mm: export swap_type_to_swap_info ANDROID: vendor_hook: Add hook in si_swapinfo() ANDROID: vendor_hooks: Add hooks to extend the struct swap_info_struct ANDROID: vendor_hook: Add hooks in unuse_pte_range() and try_to_unuse() ANDROID: vendor_hook: Add hooks in free_swap_slot() ANDROID: vendor_hook: Add hook to update nr_swap_pages and total_swap_pages ANDROID: vendor_hook: Add hook in page_referenced_one() ANDROID: vendor_hooks: Add hooks to record the I/O statistics of swap: ANDROID: vendor_hook: Add hook in migrate_page_states() ANDROID: vendor_hook: Add hook in __migration_entry_wait() ANDROID: vendor_hook: Add hook in handle_pte_fault() ANDROID: vendor_hook: Add hook in do_swap_page() ANDROID: vendor_hook: Add hook in wp_page_copy() ANDROID: vendor_hooks: Add hooks to madvise_cold_or_pageout_pte_range() ANDROID: vendor_hook: Add hook in snapshot_refaults() ANDROID: vendor_hook: Add hook in inactive_is_low() FROMGIT: usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io() FROMGIT: usb: gadget: f_fs: change ep->status safe in ffs_epfile_io() ANDROID: GKI: forward declare struct cgroup_taskset in vendor hooks ANDROID: Fix build error with CONFIG_UCLAMP_TASK disabled ANDROID: GKI: include more type definitions in vendor hooks ANDROID: Update symbol list for mtk ANDROID: dma/debug: fix warning of check_sync FROMGIT: usb: common: usb-conn-gpio: Allow wakeup from system suspend BACKPORT: FROMLIST: usb: gadget: uvc: fix list double add in uvcg_video_pump BACKPORT: exfat: improve write performance when dirsync enabled FROMLIST: devcoredump : Serialize devcd_del work Change-Id: Ie85e8cf4ecd3c3c218a45fc6be04204ea55a4c70 Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com> |
||
|
Greg Kroah-Hartman
|
fbe6a13851 |
This is the 5.10.137 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMCMDQACgkQONu9yGCS aT6TwRAAvj1dnV1nLVVNET3jcelTO65SVUUpQjiyGD1npZQaQdH5PoGR0VhMWk7y mLUIwJyp/rR7+OLD3BMFwxDimDWHviFGdbmm/8fsyDrARuOeRd/M1fvtHXjIRQdb nOvfo1yTQWp4xA1k/JwJZslkvRFDsofXWHCRf+ffEryTRanFAVc7u5aFIg92W0b/ JWYWEFe99C4TJ7LACpDoGaP9gE6WXsupaxSZBIu+Wxa+PfDmIeRRTkQn+j4Khn0h I6w+LkLd6ZP3l7sbe9KfS9ZGo1wWLgSng4zz742Z9IaFgxyj2ArS9tNsYCLkkhAM gLSXXkiPBAxUvAtDxR1tc0YROHc1bjAttSoxNXcaaacspSo/Vi0VAtp7t6boK0bI /8P3dh+Hq9u/Q1ClhZtVoFpp+GVj0fDbDd56qVcr2Cp6IokpqRJog1Jhgj0CVCoG iElr3n0+y7/IZfmE6/U1cK00SNcW86e2YduuIy4ifCawRT574zkRiSYZalpaO3qM z1lF9p+zUNq3v2q0wxXuBDLi/yPoJzbJgmCGScj4ryjjr6TOvR1udSVWkJ02dR4H s9km3lNLgoUPCYCLBMlZl7em4T49E09/+4YCrnj/Ezp+YdImf2+QzZyd/gG3ITl2 fW7lpbK1dx3d/19JFP6Xkj9PaIlMl9e8Ne04G+Dabv67uN+0U+g= =Z4rz -----END PGP SIGNATURE----- Merge 5.10.137 into android12-5.10-lts Changes in 5.10.137 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" ALSA: bcd2000: Fix a UAF bug on the error path of probing ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: s390: pv: don't present the ecall interrupt twice KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP KVM: x86: Tag kvm_mmu_x86_module_init() with __init riscv: set default pm_power_off to NULL mm: Add kvrealloc() xfs: only set IOMAP_F_SHARED when providing a srcmap to a write xfs: fix I_DONTCACHE mm/mremap: hold the rmap lock in write mode when moving page table entries. ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters fbcon: Fix accelerated fbdev scrolling while logo is still shown usbnet: Fix linkwatch use-after-free on disconnect ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: Check the return value of ioremap() in lba_driver_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/vc4: hdmi: Disable audio if dmas property is present but empty drm/nouveau: fix another off-by-one in nvbios_addr drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime drm/amdgpu: Check BO's requested pinning domains against its preferred_domains mtd: rawnand: arasan: Update NAND bus clock instead of system clock iio: light: isl29028: Fix the warning in isl29028_remove() scsi: sg: Allow waiting for commands to complete on removed device scsi: qla2xxx: Fix incorrect display of max frame size scsi: qla2xxx: Zero undefined mailbox IN registers fuse: limit nsec serial: mvebu-uart: uart2 error bits clearing md-raid: destroy the bitmap after destroying the thread md-raid10: fix KASAN warning media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC usb: dwc3: gadget: refactor dwc3_repare_one_trb usb: dwc3: gadget: fix high speed multiplier setting lockdep: Allow tuning tracing capacity constants. netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls ext2: Add more validity checks for inode counts genirq: Don't return error on missing optional irq_request_resources() irqchip/mips-gic: Only register IPI domain when SMP is enabled genirq: GENERIC_IRQ_IPI depends on SMP irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix keypad compatible ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible ARM: dts: BCM5301X: Add DT for Meraki MR26 spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference firmware: tegra: Fix error check return value of debugfs_create_file() PM: hibernate: defer device probing when resuming from hibernation selinux: Add boundary check in put_entry() powerpc/64s: Disable stack variable initialisation for prom_init spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init arm64: dts: renesas: beacon: Fix regulator node names ARM: bcm: Fix refcount leak in bcm_kona_smc_init ACPI: processor/idle: Annotate more functions to live in cpuidle section ARM: dts: imx7d-colibri-emmc: add cpu1 supply Input: atmel_mxt_ts - fix up inverted RESET handler soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values soc: amlogic: Fix refcount leak in meson-secure-pwrc.c arm64: dts: renesas: Fix thermal-sensors on single-zone sensors x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible hexagon: select ARCH_WANT_LD_ORPHAN_WARN arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 locking/lockdep: Fix lockdep_init_map_*() confusion soc: fsl: guts: machine variable might be unset block: fix infinite loop for invalid zone append ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init cpufreq: zynq: Fix refcount leak in zynq_get_revision regulator: qcom_smd: Fix pm8916_pldo range ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP soc: qcom: ocmem: Fix refcount leak in of_get_ocmem soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() arm64: dts: mt7622: fix BPI-R64 WPS button arm64: tegra: Fix SDMMC1 CD on P2888 erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created hwmon: (drivetemp) Add module alias block: remove the request_queue to argument request based tracepoints blktrace: Trace remapped requests correctly regulator: of: Fix refcount leak bug in of_get_regulation_constraints() soc: qcom: Make QCOM_RPMPD depend on PM arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() selftests/seccomp: Fix compile warning when CC=clang thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended pwm: sifive: Don't check the return code of pwmchip_remove() pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource() drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function drm/bridge: tc358767: Make sure Refclk clock are enabled ath10k: do not enforce interrupt trigger type drm/st7735r: Fix module autoloading for Okaya RH128128T wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() ath11k: fix netdev open race drm/mipi-dbi: align max_chunk to 2 in spi_transfer ath11k: Fix incorrect debug_mask mappings drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Modify dsi funcs to atomic operations drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function i2c: npcm: Remove own slave addresses 2:10 i2c: npcm: Correct slave role behavior virtio-gpu: fix a missing check to avoid NULL dereference drm: adv7511: override i2c address of cec before accessing it crypto: sun8i-ss - do not allocate memory when handling hash requests crypto: sun8i-ss - fix error codes in allocate_flows() net: fix sk_wmem_schedule() and sk_rmem_schedule() errors i2c: Fix a potential use after free crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs() media: tw686x: Register the irq at the end of probe ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm/radeon: fix incorrrect SPDX-License-Identifiers test_bpf: fix incorrect netdev features crypto: ccp - During shutdown, check SEV data pointer before using drm: bridge: adv7511: Add check for mipi_dsi_driver_register drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set media: tw686x: Fix memory leak in tw686x_video_init drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/vc4: dsi: Correct DSI divider calculations drm/vc4: dsi: Correct pixel order for DSI0 drm/vc4: drv: Remove the DSI pointer in vc4_drv drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array drm/vc4: dsi: Introduce a variant structure drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type drm/vc4: dsi: Fix dsi0 interrupt support drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration drm/vc4: hdmi: Remove firmware logic for MAI threshold setting drm/vc4: hdmi: Avoid full hdmi audio fifo writes drm/vc4: hdmi: Don't access the connector state in reset if kmalloc fails drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling drm/vc4: hdmi: Fix timings for interlaced modes drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0 drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one lib: bitmap: order includes alphabetically lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc() hinic: Use the bitmap API when applicable net: hinic: fix bug that ethtool get wrong stats net: hinic: avoid kernel hung in hinic_get_stats64() drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon/sec - fixes some coding style crypto: hisilicon/sec - don't sleep when in softirq crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child bpf: Fix subprog names in stack traces. fs: check FMODE_LSEEK to control internal pipe splicing wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() media: cedrus: hevc: Add check for invalid timestamp net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/sec - fix auth key size error inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if() ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() tcp: Fix data-races around sysctl_tcp_l3mdev_accept. net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set iavf: Fix max_rate limiting netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes net: ionic: fix error check for vlan flags in ionic_set_nic_features() dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock wireguard: ratelimiter: use hrtimer in selftest wireguard: allowedips: don't corrupt stack when detecting overflow clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init() usb: xhci: tegra: Fix error check netfilter: xtables: Bring SPDX identifier back iio: accel: bma400: Fix the scale min and max macro values platform/chrome: cros_ec: Always expose last resume result iio: accel: bma400: Reordering of header files clk: mediatek: reset: Fix written reset bit offset KVM: Don't set Accessed/Dirty bits for ZERO_PAGE mwifiex: Ignore BTCOEX events from the 88W8897 firmware mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion usb: host: xhci: use snprintf() in xhci_decode_trb() clk: qcom: ipq8074: fix NSS core PLL-s clk: qcom: ipq8074: SW workaround for UBI32 PLL lock clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists soundwire: bus_type: fix remove and shutdown support KVM: arm64: Don't return from void function dmaengine: sf-pdma: apply proper spinlock flags in sf_pdma_prep_dma_memcpy() dmaengine: sf-pdma: Add multithread support for a DMA channel PCI: endpoint: Don't stop controller when unbinding endpoint function intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R mmc: block: Add single read for 4k sector cards KVM: s390: pv: leak the topmost page table when destroy fails PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks scsi: smartpqi: Fix DMA direction for RAID requests xtensa: iss/network: provide release() callback xtensa: iss: fix handling error cases in iss_net_configure() usb: gadget: udc: amd5536 depends on HAS_DMA usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() usb: dwc3: core: Deprecate GCTL.CORESOFTRESET usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup usb: dwc3: qcom: fix missing optional irq warnings eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() interconnect: imx: fix max_node_id um: random: Don't initialise hwrng struct with zero RDMA/rtrs: Define MIN_CHUNK_SIZE RDMA/rtrs: Avoid Wtautological-constant-out-of-range-compare RDMA/rtrs-srv: Fix modinfo output for stringify RDMA/qedr: Improve error logs for rdma_alloc_tid error return RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence USB: serial: fix tty-port initialized comments usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() platform/olpc: Fix uninitialized data in debugfs write RDMA/srpt: Duplicate port name members RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Fix a use-after-free mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region selftests: kvm: set rax before vmcall RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Fix error unwind in rxe_create_qp() null_blk: fix ida error handling in null_add_dev() nvme: use command_id instead of req->tag in trace_nvme_complete_rq() jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe ASoC: samsung: Fix error handling in aries_audio_probe ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250: Export ICR access helpers for internal use serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV rpmsg: mtk_rpmsg: Fix circular locking dependency remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init selftests/livepatch: better synchronize test_klp_callbacks_busy profiling: fix shift too large makes kernel panic ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables tty: n_gsm: Delete gsmtty open SABM frame when config requester tty: n_gsm: fix user open not possible at responder until initiator open tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() remoteproc: qcom: wcnss: Fix handling of IRQs vfio: Remove extra put/gets around vfio_device->group vfio: Simplify the lifetime logic for vfio_device vfio: Split creation of a vfio_device into init and register ops vfio/mdev: Make to_mdev_device() into a static inline vfio/ccw: Do not change FSM state in subchannel event tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() iommu/exynos: Handle failed IOMMU device registration properly rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type lib/smp_processor_id: fix imbalanced instrumentation_end() call remoteproc: sysmon: Wait for SSCTL service to come up mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop perf tools: Fix dso_id inode generation comparison s390/dump: fix old lowcore virtual vs physical address confusion s390/zcore: fix race when reading from hardware system area ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() ASoC: mchp-spdifrx: disable end of block interrupt on failures powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias f2fs: don't set GC_FAILURE_PIN for background GC f2fs: write checkpoint during FG_GC f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations sched: Fix the check of nr_running at queue wakelist x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests x86/bugs: Enable STIBP for IBPB mitigated RETBleed ftrace/x86: Add back ftrace_expected assignment x86/olpc: fix 'logical not is only applied to the left hand side' posix-cpu-timers: Cleanup CPU timers before freeing them during exec Input: gscps2 - check return value of ioremap() in gscps2_probe() __follow_mount_rcu(): verify that mount_lock remains unchanged spmi: trace: fix stack-out-of-bound access in SPMI tracing functions drm/i915/dg1: Update DMC_DEBUG3 register drm/mediatek: Allow commands to be sent during video mode drm/mediatek: Keep dsi as LP00 before dcs cmds transfer HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx HID: hid-input: add Surface Go battery quirk drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component mtd: rawnand: Add a helper to clarify the interface configuration mtd: rawnand: arasan: Check the proposed data interface is supported mtd: rawnand: Add NV-DDR timings mtd: rawnand: arasan: Fix a macro parameter mtd: rawnand: arasan: Support NV-DDR interface mtd: rawnand: arasan: Fix clock rate in NV-DDR usbnet: smsc95xx: Don't clear read-only PHY interrupt usbnet: smsc95xx: Avoid link settings race on interrupt reception firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails intel_th: pci: Add Meteor Lake-P support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Raptor Lake-S CPU support KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) PCI/AER: Write AER Capability only when we control it PCI/ERR: Bind RCEC devices to the Root Port driver PCI/ERR: Rename reset_link() to reset_subordinates() PCI/ERR: Simplify by using pci_upstream_bridge() PCI/ERR: Simplify by computing pci_pcie_type() once PCI/ERR: Use "bridge" for clarity in pcie_do_recovery() PCI/ERR: Avoid negated conditional for clarity PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery() PCI/ERR: Recover from RCEC AER errors PCI/AER: Iterate over error counters instead of error strings serial: 8250: Dissociate 4MHz Titan ports from Oxford ports serial: 8250: Correct the clock for OxSemi PCIe devices serial: 8250_pci: Refactor the loop in pci_ite887x_init() serial: 8250_pci: Replace dev_*() by pci_*() macros serial: 8250: Fold EndRun device support into OxSemi Tornado code dm writecache: set a default MAX_WRITEBACK_JOBS kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification dm thin: fix use-after-free crash in dm_sm_register_threshold_callback timekeeping: contribute wall clock to rng on time change um: Allow PM with suspend-to-idle btrfs: reject log replay if there is unsupported RO compat flag btrfs: reset block group chunk force if we have to wait ACPI: CPPC: Do not prevent CPPC from working in the future KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4() KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4() KVM: SVM: Drop VMXE check from svm_set_cr4() KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops hook KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh KVM: x86/pmu: Use binary search to check filtered events KVM: x86/pmu: Use different raw event masks for AMD and Intel KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl xen-blkback: fix persistent grants negotiation xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkfront: Apply 'feature_persistent' parameter when connect KEYS: asymmetric: enforce SM2 signature use pkey algo tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH tracing: Use a struct alignof to determine trace event field alignment ext4: check if directory block is within i_size ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: fix warning in ext4_iomap_begin as race between bmap and write ext4: make sure ext4_append() always allocates new block ext4: fix use-after-free in ext4_xattr_set_entry ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode dm raid: fix address sanitizer warning in raid_resume dm raid: fix address sanitizer warning in raid_status net_sched: cls_route: remove from list when handle is 0 KVM: Add infrastructure and macro to mark VM as bugged KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() mac80211: fix a memory leak where sta_info is not freed tcp: fix over estimation in sk_forced_mem_schedule() Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function drm/vc4: change vc4_dma_range_matches from a global to static Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression mtd: rawnand: arasan: Prevent an unsupported configuration kvm: x86/pmu: Fix the compare function used by the pmu event filter tee: add overflow check in register_shm_helper() net/9p: Initialize the iounit field during fid creation net_sched: cls_route: disallow handle of 0 sched/fair: Fix fault in reweight_entity btrfs: only write the sectors in the vertical stripe which has data stripes btrfs: raid56: don't trust any cached sector in __raid56_parity_recover() Linux 5.10.137 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5775ddfad6460c5a737b1ad3f8e0b8f798338786 |
||
xiaofeng
|
dec2f52d08 |
ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath.
add vendor hook in __alloc_pages_slowpath ahead of __alloc_pages_direct_reclaim and warn_alloc. Bug: 243629905 Change-Id: Ieacc6cf79823c0bfacfdeec9afb55ed66f40d0b0 Signed-off-by: xiaofeng <xiaofeng5@xiaomi.com> (cherry picked from commit 0312e9cd22b100a088ff64ab36b2db2eb9f28b7c) |
||
|
Greg Kroah-Hartman
|
7b0822a261 |
Revert "ANDROID: vendor_hooks: tune reclaim scan type for specified mem_cgroup"
This reverts commit
|
||
|
Suren Baghdasaryan
|
425c0f18ed |
ANDROID: Fix a build warning inside early_memblock_nomap
Fix a warning caused by ignoring the return value of kstrtobool:
mm/memblock.c: In function 'early_memblock_nomap':
>> mm/memblock.c:1910:9: warning: ignoring return value of 'kstrtobool' declared with attribute 'warn_unused_result' [-Wunused-result]
1910 | kstrtobool(str, &memblock_nomap_remove);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fixes:
|
||
|
Patrick Daly
|
84a0d243b6 |
ANDROID: mm/memory_hotplug: Fix error path handling
Correct a resource leak if arch_add_memory() returns failure.
Bug: 243477359
Change-Id: I1dce82a18c2242d7b6fd9fb1fe3a8b2ba67853de
Fixes:
|
||
|
Greg Kroah-Hartman
|
98e5fb34d1 |
Revert "ANDROID: add for tuning readahead size"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
a634d58881 |
Merge branch 'android12-5.10' into branch 'android12-5.10-lts'
Sync up with android12-5.10 for the following commits: |
||
|
Peifeng Li
|
9ecb2fcca3 |
ANDROID: avoid huge-page not to clear trylock-bit after shrink_page_list.
Clearing trylock-bit of page shrinked by shrnk_page_list in advance
which avoids huge-page not to clear trylock-bit after shrink_page_list.
Fixes:
|
||
Vijayanand Jitta
|
3c2f107ad2 |
ANDROID: mm: memblock: avoid to create memmap for memblock nomap regions
This 'commit 86588296acbf ("fdt: Properly handle "no-map" field in the
memory region")' is keeping the no-map regions in memblock.memory with
MEMBLOCK_NOMAP flag set to use no-map memory for EFI using memblock
api's, but during the initialization sparse_init mark all memblock.memory
as present using for_each_mem_pfn_range, which is creating the memmap for
no-map memblock regions.
Upstream has suggested to make use of bootloader to pass this as not a
memory,but because of possibility that some bootloaders might not support
this and also due to time constraints in evaluating this approach on 5.10,
Use command line parameter as a temporary solution. Get in the appropriate
solution later after further discussion with upstream.
Add kernel param "android12_only.will_be_removed_soon.memblock_nomap_remove"
which when enabled will remove page structs for these regions using memblock_remove.
With this change we will be able to save ~11MB memory for ~612MB carve out.
android12_only.will_be_removed_soon.memblock_nomap_remove=true:
[ 0.000000] memblock_alloc_exact_nid_raw: 115343360 bytes
align=0x200000 nid=0 from=0x0000000080000000 max_addr=0x0000000000000000
sparse_buffer_init+0x60/0x8c
[ 0.000000] memblock_reserve: [0x0000000932c00000-0x00000009399fffff]
memblock_alloc_range_nid+0xbc/0x1a0
[ 0.000000] On node 0 totalpages: 1627824
[ 0.000000] DMA32 zone: 5383 pages used for memmap
[ 0.000000] Normal zone: 20052 pages used for memmap
Default or android12_only.will_be_removed_soon.memblock_nomap_remove=false:
[ 0.000000] memblock_alloc_exact_nid_raw: 117440512 bytes
align=0x200000 nid=0 from=0x0000000080000000 max_addr=0x0000000000000000
sparse_buffer_init+0x60/0x8c
[ 0.000000] memblock_reserve: [0x0000000932a00000-0x00000009399fffff]
memblock_alloc_range_nid+0xbc/0x1a0
[ 0.000000] On node 0 totalpages: 1788416
[ 0.000000] DMA32 zone: 8192 pages used for memmap
[ 0.000000] Normal zone: 20052 pages used for memmap.
Change-Id: I34a7d46f02a6df7c769af3e53e44e49d6fc515af
Bug: 227974747
Link: https://lore.kernel.org/all/20210115172949.GA1495225@robh.at.kernel.org
Signed-off-by: Faiyaz Mohammed <quic_faiyazm@quicinc.com>
Signed-off-by: Vijayanand Jitta <quic_vjitta@quicinc.com>
|
||
|
Miaohe Lin
|
4ffa6cecb5 |
mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
[ Upstream commit 7f82f922319ede486540e8746769865b9508d2c2 ] Since the beginning, charged is set to 0 to avoid calling vm_unacct_memory twice because vm_unacct_memory will be called by above unmap_region. But since commit |
||
Aneesh Kumar K.V
|
2613baa3ab |
mm/mremap: hold the rmap lock in write mode when moving page table entries.
commit 97113eb39fa7972722ff490b947d8af023e1f6a2 upstream. To avoid a race between rmap walk and mremap, mremap does take_rmap_locks(). The lock was taken to ensure that rmap walk don't miss a page table entry due to PTE moves via move_pagetables(). The kernel does further optimization of this lock such that if we are going to find the newly added vma after the old vma, the rmap lock is not taken. This is because rmap walk would find the vmas in the same order and if we don't find the page table attached to older vma we would find it with the new vma which we would iterate later. As explained in commit |
||
Dave Chinner
|
f5f3e54f81 |
mm: Add kvrealloc()
commit de2860f4636256836450c6543be744a50118fc66 upstream.
During log recovery of an XFS filesystem with 64kB directory
buffers, rebuilding a buffer split across two log records results
in a memory allocation warning from krealloc like this:
xfs filesystem being mounted at /mnt/scratch supports timestamps until 2038 (0x7fffffff)
XFS (dm-0): Unmounting Filesystem
XFS (dm-0): Mounting V5 Filesystem
XFS (dm-0): Starting recovery (logdev: internal)
------------[ cut here ]------------
WARNING: CPU: 5 PID: 3435170 at mm/page_alloc.c:3539 get_page_from_freelist+0xdee/0xe40
.....
RIP: 0010:get_page_from_freelist+0xdee/0xe40
Call Trace:
? complete+0x3f/0x50
__alloc_pages+0x16f/0x300
alloc_pages+0x87/0x110
kmalloc_order+0x2c/0x90
kmalloc_order_trace+0x1d/0x90
__kmalloc_track_caller+0x215/0x270
? xlog_recover_add_to_cont_trans+0x63/0x1f0
krealloc+0x54/0xb0
xlog_recover_add_to_cont_trans+0x63/0x1f0
xlog_recovery_process_trans+0xc1/0xd0
xlog_recover_process_ophdr+0x86/0x130
xlog_recover_process_data+0x9f/0x160
xlog_recover_process+0xa2/0x120
xlog_do_recovery_pass+0x40b/0x7d0
? __irq_work_queue_local+0x4f/0x60
? irq_work_queue+0x3a/0x50
xlog_do_log_recovery+0x70/0x150
xlog_do_recover+0x38/0x1d0
xlog_recover+0xd8/0x170
xfs_log_mount+0x181/0x300
xfs_mountfs+0x4a1/0x9b0
xfs_fs_fill_super+0x3c0/0x7b0
get_tree_bdev+0x171/0x270
? suffix_kstrtoint.constprop.0+0xf0/0xf0
xfs_fs_get_tree+0x15/0x20
vfs_get_tree+0x24/0xc0
path_mount+0x2f5/0xaf0
__x64_sys_mount+0x108/0x140
do_syscall_64+0x3a/0x70
entry_SYSCALL_64_after_hwframe+0x44/0xae
Essentially, we are taking a multi-order allocation from kmem_alloc()
(which has an open coded no fail, no warn loop) and then
reallocating it out to 64kB using krealloc(__GFP_NOFAIL) and that is
then triggering the above warning.
This is a regression caused by converting this code from an open
coded no fail/no warn reallocation loop to using __GFP_NOFAIL.
What we actually need here is kvrealloc(), so that if contiguous
page allocation fails we fall back to vmalloc() and we don't
get nasty warnings happening in XFS.
Fixes:
|
||
|
Bing Han
|
a47fb6a9ae |
ANDROID: vendor_hook: Add hook in __free_pages()
This reverts commit
|
||
|
Bing Han
|
6c56a05b87 |
ANDROID: vendor_hooks: Add hooks to extend the struct swap_info_struct
This reverts commit:
|
||
|
Bing Han
|
7449d8120a |
ANDROID: vendor_hook: Add hook in si_swapinfo()
This reverts commit
|
||
|
Greg Kroah-Hartman
|
86be1a3d9f |
Revert "ANDROID: vendor_hook: Add hook in si_swapinfo()"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
d0590b99c9 |
Revert "ANDROID: vendor_hooks: Add hooks to extend the struct swap_info_struct"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
eb99e6d80e |
Revert "ANDROID: vendor_hook: Add hook in __free_pages()"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
ee965fe12d |
Merge branch 'android12-5.10' into branch 'android12-5.10-lts'
Sync up with android12-5.10 for the following commits: |
||
|
Peifeng Li
|
fb39cdb9ea |
ANDROID: export reclaim_pages
export reclaim_pages to support to reclaim pages in drivers-page-list. Bug: 240003372 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: If92ed66ec9ce9dd66565497e6774d89911652429 |
||
|
Peifeng Li
|
1f8f6d59a2 |
ANDROID: vendor_hook: Add hook to not be stuck ro rmap lock in kswapd or direct_reclaim
Add hooks to support trylock in rmaplock when reclaiming in kswapd or direct_reclaim, in order to avoid wait lock for a long time. - android_vh_handle_failed_page_trylock - android_vh_page_trylock_set - android_vh_page_trylock_clear - android_vh_page_trylock_get_result - android_vh_do_page_trylock Bug: 240003372 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: I0f605b35ae41f15b3ca7bc72cd5f003175c318a5 |
||
|
Greg Kroah-Hartman
|
30abcdabf2 |
This is the 5.10.135 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmLqR1oACgkQONu9yGCS aT7c0g//U5W0ZFtGtu8Q3LNObmdz1G+JIKveIPIWcBOSK0j6YVL7QgtiUw+wRtyH 53h9Bjopb6aU96ezutOxvmbcbjt7TcbSsDia7j1g3T8lkZHRxog0ym/vKPMxLdzC /LnHzHQu3a0pMiRXVTe3glQEAyZs4QsIlEc+lOIKGPkfFUbtt5s+hxjqDnKyewll jhreE+sIZuJ/z/vQDxJZwIzBAMpmSuSUv7pGOoG8zGkN69at7rzhgodhb1PDHCas o9QmvhUn3XF+QH/ish1slZhRTvpX7/VUEccvrqcw8wjzr1xfmz4v8LYC8fLtJltw 4fVfDjEDq7LZGKlEOQRuzh9IASHn6L+BuYOFevDFy+ud+2xno1DlPhFPRgaE37I3 iRABrNTFET16ow77/SJG6e6n29bSwrS8qKIUI0kBZn3W6Bdv/w5mbpuPiX9AZ7Jq A5eJO6pl+4xE6Ulv94Tdgb5Qnqq5lPKVAFnQC7eCMi8lr0+TrN5s3tWrRrNXBGqh +zC0eiYREA78BnB2PR9QVieilK6D2d9PP7C1n9VqWqHsE7tR3gq3omUu+cym/HGu T1Nv80YPtlj+1PmjCxcKVZbf0FD1hzkjI+h0SX8QqxcHWfzc86UDMK10VVXkPA70 9LGojHibU07tEdvIe0FMgWUbuHCvXDWtJjS2zvNd0V4KZ1sIBJU= =lCsB -----END PGP SIGNATURE----- Merge 5.10.135 into android12-5.10-lts Changes in 5.10.135 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put Revert "ocfs2: mount shared volume without ha stack" ntfs: fix use-after-free in ntfs_ucsncmp() s390/archrandom: prevent CPACF trng invocations in interrupt context nouveau/svm: Fix to migrate all requested pages watch_queue: Fix missing rcu annotation watch_queue: Fix missing locking in add_watch_to_object() tcp: Fix data-races around sysctl_tcp_dsack. tcp: Fix a data-race around sysctl_tcp_app_win. tcp: Fix a data-race around sysctl_tcp_adv_win_scale. tcp: Fix a data-race around sysctl_tcp_frto. tcp: Fix a data-race around sysctl_tcp_nometrics_save. tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save. ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS) ice: do not setup vlan for loopback VSI scsi: ufs: host: Hold reference returned by of_parse_phandle() Revert "tcp: change pingpong threshold to 3" tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf. tcp: Fix a data-race around sysctl_tcp_limit_output_bytes. tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. net: ping6: Fix memleak in ipv6_renew_options(). ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr net/tls: Remove the context from the list in tls_device_down igmp: Fix data-races around sysctl_igmp_qrv. net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() tcp: Fix a data-race around sysctl_tcp_min_tso_segs. tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. tcp: Fix a data-race around sysctl_tcp_autocorking. tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. Documentation: fix sctp_wmem in ip-sysctl.rst macsec: fix NULL deref in macsec_add_rxsa macsec: fix error message in macsec_add_rxsa and _txsa macsec: limit replay window size with XPN macsec: always read MACSEC_SA_ATTR_PN as a u64 net: macsec: fix potential resource leak in macsec_add_rxsa() and macsec_add_txsa() tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns. tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. tcp: Fix data-races around sysctl_tcp_reflect_tos. i40e: Fix interface init with MSI interrupts (no MSI-X) sctp: fix sleep in atomic context bug in timer handlers netfilter: nf_queue: do not allow packet truncation below transport header offset virtio-net: fix the race between refill work and close perf symbol: Correct address for bss symbols sfc: disable softirqs for ptp TX sctp: leave the err path free in sctp_stream_init to sctp_stream_free ARM: crypto: comment out gcc warning that breaks clang builds page_alloc: fix invalid watermark check on a negative value mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow EDAC/ghes: Set the DIMM label unconditionally docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed xfs: refactor xfs_file_fsync xfs: xfs_log_force_lsn isn't passed a LSN xfs: prevent UAF in xfs_log_item_in_current_chkpt xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes xfs: force the log offline when log intent item recovery fails xfs: hold buffer across unpin and potential shutdown processing xfs: remove dead stale buf unpin handling code xfs: logging the on disk inode LSN can make it go backwards xfs: Enforce attr3 buffer recovery order x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available bpf: Consolidate shared test timing code bpf: Add PROG_TEST_RUN support for sk_lookup programs selftests: bpf: Don't run sk_lookup in verifier tests Linux 5.10.135 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3bcd5c460b652174673d9911710b1904f338d8d8 |
||
|
Peifeng Li
|
2b377175a3 |
ANDROID: add two func in mm/memcontrol.c
- page_to_lruvec: get lruvec from page and pgdat. - do_traversal_all_lruvec: traversal all lruvec and do hookss. Bug: 236578020 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: I3d4f5159faaca1ee71ffa65f2fc1341f51da637c |
||
|
Peifeng Li
|
e56f8712cf |
ANDROID: vendor_hooks: protect multi-mapcount pages in kernel
Support two hooks as follows to protect multi-mapcount pages in kernel: - trace_android_vh_page_should_be_protect - trace_android_vh_mapped_page_try_sorthead Bug: 236578020 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: I688aceabf17d9de2feac7c3ad7144d307de6ef29 |
||
|
Peifeng Li
|
3f775b9367 |
ANDROID: vendor_hooks: account page-mapcount
Support five hooks as follows to account the amount of multi-mapped pages in kernel: - android_vh_show_mapcount_pages - android_vh_do_traversal_lruvec - android_vh_update_page_mapcount - android_vh_add_page_to_lrulist - android_vh_del_page_from_lrulist Bug: 236578020 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: Ia2c7015aab442be7dbb496b8b630b9dff59ab935 |
||
|
Greg Kroah-Hartman
|
f6ce9a9115 |
This is the 5.10.134 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmLj+okACgkQONu9yGCS aT7ULhAA2D1qxAvJsuhLK3HAG3ii4jKb+lPZO4Gx7MGbt6H0ktsHKcAppVCMOiQ/ zr8z695+GjO9RcFqiVVEYVkXGuBSwEI34MWYkHk6+567Y47d9HX09tehvGmwSYB/ 2eFkhL7Am6XXY8fK1p5L3iFQ4pn2O1LT90oC6IX2PbgPBh9SqA/cL2RoFjrtLKYI s+ok/P6qiDz/7jn1V3AzvESs9n0h7fviGYwpe+jEcXRr+7Glu8A23n7goOpCn5k1 NydT0S69fiVb14NhzDGhgSMp/Ft4u8pb12n2UWrR6pueE/Ea7VbC/AOhh2CYCOpJ VpjZlFQDSJhTNmlAEiFADmejzyfjRyFaaQkq52odOV9YljbX9u4XCI9w42E3kgfi ClEJNGNSRWc35LR69sAV2TzKmAQX8DcYCyvkk8uFpOkoEr9ANbqOn5rXgGk3jllT RoFcOmXvN4t+mYebvxjtOvC56OOopUte6a/hGzLoOvf1Uy36CaRQ4izURZpOAKAT lMN8P/s/NQxE9g3Aq4ABydCxPaLnJkIobfFqoc8wFVnopmUd4+wspklwWeo+MGps oZ2nt5BLlweQ7Yr1wif+Sff5q3jkR9ppUxMYiwRHUW9fTy3QL7uMJqs3qa5s6wLH AQJXuKjuA7mpbmE8csBPUGP+LL2d/RalLKjzqpwNcSJ0IPk6lW8= =9KOJ -----END PGP SIGNATURE----- Merge 5.10.134 into android12-5.10-lts Changes in 5.10.134 pinctrl: stm32: fix optional IRQ support to gpios riscv: add as-options for modules with assembly compontents mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication lockdown: Fix kexec lockdown bypass with ima policy io_uring: Use original task for req identity in io_identity_cow() xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE docs: net: explain struct net_device lifetime net: make free_netdev() more lenient with unregistering devices net: make sure devices go through netdev_wait_all_refs net: move net_set_todo inside rollback_registered() net: inline rollback_registered() net: move rollback_registered_many() net: inline rollback_registered_many() Revert "m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch" PCI: hv: Fix multi-MSI to allow more than one MSI vector PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() PCI: hv: Fix interrupt mapping for multi-MSI serial: mvebu-uart: correctly report configured baudrate value xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe pinctrl: ralink: Check for null return of devm_kcalloc perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() drm/amdgpu/display: add quirk handling for stutter mode igc: Reinstate IGC_REMOVED logic and implement it properly ip: Fix data-races around sysctl_ip_no_pmtu_disc. ip: Fix data-races around sysctl_ip_fwd_use_pmtu. ip: Fix data-races around sysctl_ip_fwd_update_priority. ip: Fix data-races around sysctl_ip_nonlocal_bind. ip: Fix a data-race around sysctl_ip_autobind_reuse. ip: Fix a data-race around sysctl_fwmark_reflect. tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. tcp: Fix data-races around sysctl_tcp_mtu_probing. tcp: Fix data-races around sysctl_tcp_base_mss. tcp: Fix data-races around sysctl_tcp_min_snd_mss. tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. tcp: Fix a data-race around sysctl_tcp_probe_threshold. tcp: Fix a data-race around sysctl_tcp_probe_interval. net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow i2c: cadence: Change large transfer count reset logic to be unconditional net: stmmac: fix dma queue left shift overflow issue net/tls: Fix race in TLS device down flow igmp: Fix data-races around sysctl_igmp_llm_reports. igmp: Fix a data-race around sysctl_igmp_max_memberships. igmp: Fix data-races around sysctl_igmp_max_msf. tcp: Fix data-races around keepalive sysctl knobs. tcp: Fix data-races around sysctl_tcp_syncookies. tcp: Fix data-races around sysctl_tcp_reordering. tcp: Fix data-races around some timeout sysctl knobs. tcp: Fix a data-race around sysctl_tcp_notsent_lowat. tcp: Fix a data-race around sysctl_tcp_tw_reuse. tcp: Fix data-races around sysctl_max_syn_backlog. tcp: Fix data-races around sysctl_tcp_fastopen. tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. iavf: Fix handling of dummy receive descriptors i40e: Fix erroneous adapter reinitialization during recovery process ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero gpio: pca953x: only use single read/write for No AI mode gpio: pca953x: use the correct range when do regmap sync gpio: pca953x: use the correct register address when regcache sync during init be2net: Fix buffer overflow in be_get_module_eeprom drm/imx/dcss: Add missing of_node_put() in fail path ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. ip: Fix data-races around sysctl_ip_prot_sock. udp: Fix a data-race around sysctl_udp_l3mdev_accept. tcp: Fix data-races around sysctl knobs related to SYN option. tcp: Fix a data-race around sysctl_tcp_early_retrans. tcp: Fix data-races around sysctl_tcp_recovery. tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. tcp: Fix a data-race around sysctl_tcp_retrans_collapse. tcp: Fix a data-race around sysctl_tcp_stdurg. tcp: Fix a data-race around sysctl_tcp_rfc1337. tcp: Fix data-races around sysctl_tcp_max_reordering. spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers KVM: Don't null dereference ops->destroy mm/mempolicy: fix uninit-value in mpol_rebind_policy() bpf: Make sure mac_header was set before using it sched/deadline: Fix BUG_ON condition for deboosted tasks x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts dlm: fix pending remove if msg allocation fails drm/imx/dcss: fix unused but set variable warnings bitfield.h: Fix "type of reg too small for mask" test ALSA: memalloc: Align buffer allocations in page size Bluetooth: Add bt_skb_sendmsg helper Bluetooth: Add bt_skb_sendmmsg helper Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg Bluetooth: Fix passing NULL to PTR_ERR Bluetooth: SCO: Fix sco_send_frame returning skb->len Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks x86/amd: Use IBPB for firmware calls x86/alternative: Report missing return thunk details watchqueue: make sure to serialize 'wqueue->defunct' properly tty: drivers/tty/, stop using tty_schedule_flip() tty: the rest, stop using tty_schedule_flip() tty: drop tty_schedule_flip() tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() net: usb: ax88179_178a needs FLAG_SEND_ZLP watch-queue: remove spurious double semicolon Linux 5.10.134 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I55defdcdd6658e3ec9a3684b7e8cdfe114772a19 |
||
Jaewon Kim
|
2670f76a56 |
page_alloc: fix invalid watermark check on a negative value
commit 9282012fc0aa248b77a69f5eb802b67c5a16bb13 upstream. There was a report that a task is waiting at the throttle_direct_reclaim. The pgscan_direct_throttle in vmstat was increasing. This is a bug where zone_watermark_fast returns true even when the free is very low. The commit |
||
|
Peifeng Li
|
6532784c78 |
ANDROID: vendor_hooks: add hooks for remove_vm_area.
Provide a vendor hook to remove additional fields when remove_vm_area for slab/vmalloc memory leak debugging. Bug: 240869642 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: Iafecd7c6e75cdc2df0e77ae105283590d8852f74 |
||
Wang Cheng
|
ddb3f0b688 |
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
commit 018160ad314d75b1409129b2247b614a9f35894c upstream. mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc This patch seems to fix below bug too. KMSAN: uninit-value in mpol_rebind_mm (2) https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode = MPOL_LOCAL; ... policy->mode = mode; policy->flags = flags; will be executed. So in mpol_set_nodemask(), mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol->mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). Link: https://lkml.kernel.org/r/20220512123428.fq3wofedp6oiotd4@ppc.localdomain Signed-off-by: Wang Cheng <wanngchenng@gmail.com> Reported-by: <syzbot+217f792c92599518a2ab@syzkaller.appspotmail.com> Tested-by: <syzbot+217f792c92599518a2ab@syzkaller.appspotmail.com> Cc: David Rientjes <rientjes@google.com> Cc: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
0c724b692d |
This is the 5.10.132 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmLZpvwACgkQONu9yGCS
aT43nBAAhxJzkIcRI/641//eBLQrmbeNsS4TerYlpPIJAXwfXlF6KX6Ixl0rYcp/
GUid3QlXyDG4TTUB519M1FpaknDGq5vUCzNik82AogzMFLf/KWP6urx4FSeZCt1D
xAdYQHHWKFiyNUlqjT22dPM3/QR1D0BtUKE6QLUdWWhyc1W+gvYx1m10GG6O1z55
eljZScRYvaacvVZ4LiN0ClU9J0n16SqfTg8/jEASr+3yqe4ZKdzFdngGlJrWUCZa
SrR5ijscqoIQ5yTSA5DUZ/N4aAeTgSSXcMfXeZh1CoD4Ak87e2kwBHZAUWQWJrEe
0nfILwU0okZmEOKtwCtYz0iwfFEfB/wKwrZjJ0jV03dL3Ncm7ddj2bQDk0+fLDYZ
AEjflhLZfusQEprM+jr0Qx9UlJo1TA4KssRn1A+cfocKvhfTrVneWO5LcR1Jf6Gq
9z7lgh8iRs4ncEfqh2cCRcSpIJLlPOmACmtA4eD2tk7heGRhfBpL9Hv2KBCHss5o
iMaqRsvVXFZn2KCxZFOR4l0cQvkKkxHWBjiVxrYTV5SrELJ4d2DBc7r93a5vM7W/
tKKGi0IG+0V7fgHvKrRDVZnYWV05NEbit0xd0lgY5YZsOuJIVy024YayuWDFxT5S
xulwcoSzAQiWnhqtrsD9eqWotA1E8i9wCuWHEAPMRmnzTBdENTA=
=cxaP
-----END PGP SIGNATURE-----
Merge 5.10.132 into android12-5.10-lts
Changes in 5.10.132
ALSA: hda - Add fixup for Dell Latitidue E5430
ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
ALSA: hda/realtek: Fix headset mic for Acer SF313-51
ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221
ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
fix race between exit_itimers() and /proc/pid/timers
mm: split huge PUD on wp_huge_pud fallback
tracing/histograms: Fix memory leak problem
net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer
ip: fix dflt addr selection for connected nexthop
ARM: 9213/1: Print message about disabled Spectre workarounds only once
ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction
wifi: mac80211: fix queue selection for mesh/OCB interfaces
cgroup: Use separate src/dst nodes when preloading css_sets for migration
btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents
drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error
drm/panfrost: Fix shrinker list corruption by madvise IOCTL
fs/remap: constrain dedupe of EOF blocks
nilfs2: fix incorrect masking of permission flags for symlinks
sh: convert nommu io{re,un}map() to static inline functions
Revert "evm: Fix memleak in init_desc"
ext4: fix race condition between ext4_write and ext4_convert_inline_data
ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count
spi: amd: Limit max transfer and message size
ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
ARM: 9210/1: Mark the FDT_FIXED sections as shareable
net/mlx5e: kTLS, Fix build time constant test in TX
net/mlx5e: kTLS, Fix build time constant test in RX
net/mlx5e: Fix capability check for updating vnic env counters
drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()
ima: Fix a potential integer overflow in ima_appraise_measurement
ASoC: sgtl5000: Fix noise on shutdown/remove
ASoC: tas2764: Add post reset delays
ASoC: tas2764: Fix and extend FSYNC polarity handling
ASoC: tas2764: Correct playback volume range
ASoC: tas2764: Fix amp gain register offset & default
ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks()
ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array
net: stmmac: dwc-qos: Disable split header for Tegra194
sysctl: Fix data races in proc_dointvec().
sysctl: Fix data races in proc_douintvec().
sysctl: Fix data races in proc_dointvec_minmax().
sysctl: Fix data races in proc_douintvec_minmax().
sysctl: Fix data races in proc_doulongvec_minmax().
sysctl: Fix data races in proc_dointvec_jiffies().
tcp: Fix a data-race around sysctl_tcp_max_orphans.
inetpeer: Fix data-races around sysctl.
net: Fix data-races around sysctl_mem.
cipso: Fix data-races around sysctl.
icmp: Fix data-races around sysctl.
ipv4: Fix a data-race around sysctl_fib_sync_mem.
ARM: dts: at91: sama5d2: Fix typo in i2s1 node
ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
drm/i915/selftests: fix a couple IS_ERR() vs NULL tests
drm/i915/gt: Serialize TLB invalidates with GT resets
sysctl: Fix data-races in proc_dointvec_ms_jiffies().
icmp: Fix a data-race around sysctl_icmp_ratelimit.
icmp: Fix a data-race around sysctl_icmp_ratemask.
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
ipv4: Fix data-races around sysctl_ip_dynaddr.
nexthop: Fix data-races around nexthop_compat_mode.
net: ftgmac100: Hold reference returned by of_get_child_by_name()
ima: force signature verification when CONFIG_KEXEC_SIG is configured
ima: Fix potential memory leak in ima_init_crypto()
sfc: fix use after free when disabling sriov
seg6: fix skb checksum evaluation in SRH encapsulation/insertion
seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
seg6: bpf: fix skb checksum in bpf_push_seg6_encap()
sfc: fix kernel panic when creating VF
net: atlantic: remove deep parameter on suspend/resume functions
net: atlantic: remove aq_nic_deinit() when resume
KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op()
net/tls: Check for errors in tls_device_init
mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE
virtio_mmio: Add missing PM calls to freeze/restore
virtio_mmio: Restore guest page size on resume
netfilter: br_netfilter: do not skip all hooks with 0 priority
scsi: hisi_sas: Limit max hw sectors for v3 HW
cpufreq: pmac32-cpufreq: Fix refcount leak bug
platform/x86: hp-wmi: Ignore Sanitization Mode event
net: tipc: fix possible refcount leak in tipc_sk_create()
NFC: nxp-nci: don't print header length mismatch on i2c error
nvme-tcp: always fail a request when sending it failed
nvme: fix regression when disconnect a recovering ctrl
net: sfp: fix memory leak in sfp_probe()
ASoC: ops: Fix off by one in range control validation
pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux()
ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow
ASoC: wm5110: Fix DRE control
ASoC: dapm: Initialise kcontrol data for mux/demux controls
ASoC: cs47l15: Fix event generation for low power mux control
ASoC: madera: Fix event generation for OUT1 demux
ASoC: madera: Fix event generation for rate controls
irqchip: or1k-pic: Undefine mask_ack for level triggered hardware
x86: Clear .brk area at early boot
soc: ixp4xx/npe: Fix unused match warning
ARM: dts: stm32: use the correct clock source for CEC on stm32mp151
Revert "can: xilinx_can: Limit CANFD brp to 2"
nvme-pci: phison e16 has bogus namespace ids
signal handling: don't use BUG_ON() for debugging
USB: serial: ftdi_sio: add Belimo device ids
usb: typec: add missing uevent when partner support PD
usb: dwc3: gadget: Fix event pending check
tty: serial: samsung_tty: set dma burst_size to 1
vt: fix memory overlapping when deleting chars in the buffer
serial: 8250: fix return error code in serial8250_request_std_resource()
serial: stm32: Clear prev values before setting RTS delays
serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
serial: 8250: Fix PM usage_count for console handover
x86/pat: Fix x86_has_pat_wp()
Linux 5.10.132
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I450f357105f90b1b9549dea5de62dc9a160d4ba9
|
||
|
Greg Kroah-Hartman
|
50c9c56f73 |
This is the 5.10.130 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmLNhfsACgkQONu9yGCS aT6srhAAjWF9gtiDTufsmNBW5X7DeEPzwsXFVJ1b5+8mTvc2NPzvxxTsc5xwL7QG Ml2LEMXQYxdhBrXzm6Av1FZSQgnjdv2BMw9FQfjPkOeuxaFWpta8qg0sxiZZvrHs 3rxiy9RKlSvaUpEGE2h/RcJFWL4ume9/bB+UhLLYXFKDfmZ7TKe2jA7b87W5Y0i9 6tYyS98weJPMNdkioM7Iewbugr9xaXTElG47hAL4pDlWd5xnxKf10rgNg5hdzkxA jEPQlyiVpLvRHdqb+ZlPKMxLcZu3i9kXsO+fGPe1AsXopyTuSEq+A61vuGSsrhaF vyPXIzn66rGCjYIM19ku8HgcMhdi3GcwztE/OSZrMIZS0vU7jECyisqHvT8cUPr6 caor6kYqrD8mdCvyDGp+8Fqaa+iGINX6PhC/0PkerX3HPwIXm+VPIjhAQ4QJzB/S ArJnzazDn1KbdAEldGB89JxI5+huh7COYg/c+zy1UOEHNttovdJZpXwxvBE+N6M4 XeKqM3s4cxs/S9D1xJXKl1bkeMpQ9UegtlWIfVkKfNmNbWhP3u4FUDFpxCsje1tf xfP2eb9tJWYzxiiS+Rb2Ib44+OiF3sE2MCzFpP+Fusna5Sz9FlhqNlYW7I+a2ros DwwfWUsMz+t8bwc+wNA4SPqhdrkh8z7lWTm8449QYZesCzzsexU= =AgJC -----END PGP SIGNATURE----- Merge 5.10.130 into android12-5.10-lts Changes in 5.10.130 mm/slub: add missing TID updates on slab deactivation ALSA: hda/realtek: Add quirk for Clevo L140PU can: bcm: use call_rcu() instead of costly synchronize_rcu() can: grcan: grcan_probe(): remove extra of_node_get() can: gs_usb: gs_usb_open/close(): fix memory leak bpf: Fix incorrect verifier simulation around jmp32's jeq/jne bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals usbnet: fix memory leak in error case net: rose: fix UAF bug caused by rose_t0timer_expiry netfilter: nft_set_pipapo: release elements in clone from abort path netfilter: nf_tables: stricter validation of element data iommu/vt-d: Fix PCI bus rescan device hot add fbdev: fbmem: Fix logo center image dx issue fbmem: Check virtual screen sizes in fb_set_var() fbcon: Disallow setting font bigger than screen size fbcon: Prevent that screen size is smaller than font size PM: runtime: Redefine pm_runtime_release_supplier() memregion: Fix memregion_free() fallback definition video: of_display_timing.h: include errno.h powerpc/powernv: delay rng platform device creation until later in boot can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits xfs: remove incorrect ASSERT in xfs_rename ARM: meson: Fix refcount leak in meson_smp_prepare_cpus pinctrl: sunxi: a83t: Fix NAND function name for some pins arm64: dts: qcom: msm8994: Fix CPU6/7 reg values arm64: dts: imx8mp-evk: correct mmc pad settings arm64: dts: imx8mp-evk: correct the uart2 pinctl value arm64: dts: imx8mp-evk: correct gpio-led pad settings arm64: dts: imx8mp-evk: correct I2C3 pad settings pinctrl: sunxi: sunxi_pconf_set: use correct offset arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo ARM: at91: pm: use proper compatible for sama5d2's rtc ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt ARM: dts: at91: sam9x60ek: fix eeprom compatible and size ARM: dts: at91: sama5d2_icp: fix eeprom compatibles xsk: Clear page contiguity bit when unmapping pool i40e: Fix dropped jumbo frames statistics ibmvnic: Properly dispose of all skbs during a failover. selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT selftests: forwarding: fix error message in learning_test r8169: fix accessing unset transport header i2c: cadence: Unregister the clk notifier in error path dmaengine: imx-sdma: Allow imx8m for imx7 FW revs misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer misc: rtsx_usb: use separate command and response buffers misc: rtsx_usb: set return value in rsp_buf alloc err path dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo ida: don't use BUG_ON() for debugging dmaengine: pl330: Fix lockdep warning about non-static key dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate Linux 5.10.130 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7590fa913189edca6550e770bbb7c60c273d9461 |
||
|
Greg Kroah-Hartman
|
9c2a5eef8f |
Merge tag 'android12-5.10.117_r00' into 'android12-5.10'
This is the merge of the upstream LTS release of 5.10.117 into the android12-5.10 branch. It contains the following commits: |
||
liuhailong
|
4536de1b70 |
ANDROID: vendor_hooks: add hooks in __alloc_pages_slowpath
Since android_vh_alloc_pages_slowpath is revert by
commit
|
||
|
Greg Kroah-Hartman
|
0e8e989142 |
This is the 5.10.121 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmKhrZIACgkQONu9yGCS
aT4bxhAAsahNlwa6uWf6brIeZkHy62w0LrZAEr6+TvO2CHLWwhcKIol5ZjdaJD5y
KX7A839Vcdo5iAk0eNUV2MTigp7YK0f7XH9y/u/L3yNLc9YA4isA9PQhnnPc4R7N
mgkmGT7Oz7BbQydyDiLvSwtXJDxBMOzCDTF3/4/42PsdmRmPzLBxzoTpH8wcY4vG
jwGyiyUjUVWAF99uHo0O/Yp8sw8UvudpOX+lbKed76V+fXsbH0PYk1yMMJfWhZ60
TrFh1dmZY7j2bW0+F7rkVPXVGeQGyOlLSUVSFWlugJ8qvxVNpAItjcBUXZ+nChGe
O25/5UiaBHprTIoms05yG1jPZtBbAO2MgLhw6zBCOySBr/e0bligNfJWpjt5D6H3
17+CQ1QeaL9BlzcYr4Ug/y60o2CkfUc/vr2CEQRQBRgj1gjsFWwBI4HVdO982fKC
QClnC55h1wYDsjSJ6Z4l4TKBuEN8rV9D3RfdIaPex5C6JJMAoUNeAojCL+6iyuem
ODSIufKm1I1eHeIS49+tw0Uu4jiAtn9RJfR4+uiV8zftfrDZ1qM/RPuHZTsE9wAl
3jHx6+8mT8NYjxb9Omn4Dp3aOl7Fcx/vPxx9uoj8YjrJtQ3L0EGgCnk0djmMi0b3
sBdKw15ftoJvNNrhQaLiCo+0M3XkcUUBk37ttNuIo4lvqIY23RE=
=piEC
-----END PGP SIGNATURE-----
Merge 5.10.121 into android12-5.10-lts
Changes in 5.10.121
binfmt_flat: do not stop relocating GOT entries prematurely on riscv
parisc/stifb: Implement fb_is_primary_device()
riscv: Initialize thread pointer before calling C functions
riscv: Fix irq_work when SMP is disabled
ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop
ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS
ALSA: usb-audio: Cancel pending work at closing a MIDI substream
USB: serial: option: add Quectel BG95 modem
USB: new quirk for Dell Gen 2 devices
usb: dwc3: gadget: Move null pinter check to proper place
usb: core: hcd: Add support for deferring roothub registration
cifs: when extending a file with falloc we should make files not-sparse
xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
Fonts: Make font size unsigned in font_desc
parisc/stifb: Keep track of hardware path of graphics card
x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails
perf/x86/intel: Fix event constraints for ICL
ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
btrfs: add "0x" prefix for unsupported optional features
btrfs: repair super block num_devices automatically
iommu/vt-d: Add RPLS to quirk list to skip TE disabling
drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
b43legacy: Fix assigning negative value to unsigned variable
b43: Fix assigning negative value to unsigned variable
ipw2x00: Fix potential NULL dereference in libipw_xmit()
ipv6: fix locking issues with loops over idev->addr_list
fbcon: Consistently protect deferred_takeover with console_lock()
x86/platform/uv: Update TSC sync state for UV5
ACPICA: Avoid cache flush inside virtual machines
drm/komeda: return early if drm_universal_plane_init() fails.
rcu-tasks: Fix race in schedule and flush work
rcu: Make TASKS_RUDE_RCU select IRQ_WORK
sfc: ef10: Fix assigning negative value to unsigned variable
ALSA: jack: Access input_dev under mutex
spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction
tools/power turbostat: fix ICX DRAM power numbers
drm/amd/pm: fix double free in si_parse_power_table()
ath9k: fix QCA9561 PA bias level
media: venus: hfi: avoid null dereference in deinit
media: pci: cx23885: Fix the error handling in cx23885_initdev()
media: cx25821: Fix the warning when removing the module
md/bitmap: don't set sb values if can't pass sanity check
mmc: jz4740: Apply DMA engine limits to maximum segment size
drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit
scsi: megaraid: Fix error check return value of register_chrdev()
scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
ath11k: disable spectral scan during spectral deinit
ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408
drm/plane: Move range check for format_count earlier
drm/amd/pm: fix the compile warning
ath10k: skip ath10k_halt during suspend for driver state RESTARTING
arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall
drm: msm: fix error check return value of irq_of_parse_and_map()
ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
net/mlx5: fs, delete the FTE when there are no rules attached to it
ASoC: dapm: Don't fold register value changes into notifications
mlxsw: spectrum_dcb: Do not warn about priority changes
mlxsw: Treat LLDP packets as control
drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
HID: bigben: fix slab-out-of-bounds Write in bigben_probe
ASoC: tscs454: Add endianness flag in snd_soc_component_driver
net: remove two BUG() from skb_checksum_help()
s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES
perf/amd/ibs: Cascade pmu init functions' return value
spi: stm32-qspi: Fix wait_cmd timeout in APM mode
dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
ipmi:ssif: Check for NULL msg when handling events and messages
ipmi: Fix pr_fmt to avoid compilation issues
rtlwifi: Use pr_warn instead of WARN_ONCE
media: rga: fix possible memory leak in rga_probe
media: coda: limit frame interval enumeration to supported encoder frame sizes
media: imon: reorganize serialization
media: cec-adap.c: fix is_configuring state
openrisc: start CPU timer early in boot
nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
ASoC: rt5645: Fix errorenous cleanup order
nbd: Fix hung on disconnect request if socket is closed before
net: phy: micrel: Allow probing without .driver_data
media: exynos4-is: Fix compile warning
ASoC: max98357a: remove dependency on GPIOLIB
ASoC: rt1015p: remove dependency on GPIOLIB
can: mcp251xfd: silence clang's -Wunaligned-access warning
x86/microcode: Add explicit CPU vendor dependency
m68k: atari: Make Atari ROM port I/O write macros return void
rxrpc: Return an error to sendmsg if call failed
rxrpc, afs: Fix selection of abort codes
eth: tg3: silence the GCC 12 array-bounds warning
selftests/bpf: fix btf_dump/btf_dump due to recent clang change
gfs2: use i_lock spin_lock for inode qadata
IB/rdmavt: add missing locks in rvt_ruc_loopback
ARM: dts: ox820: align interrupt controller node name with dtschema
ARM: dts: s5pv210: align DMA channels with dtschema
arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count
PM / devfreq: rk3399_dmc: Disable edev on remove()
crypto: ccree - use fine grained DMA mapping dir
soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc
fs: jfs: fix possible NULL pointer dereference in dbFree()
ARM: OMAP1: clock: Fix UART rate reporting algorithm
powerpc/fadump: Fix fadump to work with a different endian capture kernel
fat: add ratelimit to fat*_ent_bread()
pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()
ARM: versatile: Add missing of_node_put in dcscb_init
ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
ARM: hisi: Add missing of_node_put after of_find_compatible_node
PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr
powerpc/xics: fix refcount leak in icp_opal_init()
powerpc/powernv: fix missing of_node_put in uv_init()
macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
RDMA/hfi1: Prevent panic when SDMA is disabled
drm: fix EDID struct for old ARM OABI format
dt-bindings: display: sitronix, st7735r: Fix backlight in example
ath11k: acquire ab->base_lock in unassign when finding the peer by addr
ath9k: fix ar9003_get_eepmisc
drm/edid: fix invalid EDID extension block filtering
drm/bridge: adv7511: clean up CEC adapter when probe fails
spi: qcom-qspi: Add minItems to interconnect-names
ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
x86/delay: Fix the wrong asm constraint in delay_loop()
drm/ingenic: Reset pixclock rate when parent clock rate changes
drm/mediatek: Fix mtk_cec_mask()
drm/vc4: hvs: Reset muxes at probe time
drm/vc4: txp: Don't set TXP_VSTART_AT_EOF
drm/vc4: txp: Force alpha to be 0xff if it's disabled
libbpf: Don't error out on CO-RE relos for overriden weak subprogs
bpf: Fix excessive memory allocation in stack_map_alloc()
nl80211: show SSID for P2P_GO interfaces
drm/komeda: Fix an undefined behavior bug in komeda_plane_add()
drm: mali-dp: potential dereference of null pointer
spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
scftorture: Fix distribution of short handler delays
net: dsa: mt7530: 1G can also support 1000BASE-X link mode
NFC: NULL out the dev->rfkill to prevent UAF
efi: Add missing prototype for efi_capsule_setup_info
target: remove an incorrect unmap zeroes data deduction
drbd: fix duplicate array initializer
EDAC/dmc520: Don't print an error for each unconfigured interrupt line
mtd: rawnand: denali: Use managed device resources
HID: hid-led: fix maximum brightness for Dream Cheeky
HID: elan: Fix potential double free in elan_input_configured
drm/bridge: Fix error handling in analogix_dp_probe
sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
spi: img-spfi: Fix pm_runtime_get_sync() error checking
cpufreq: Fix possible race in cpufreq online error path
ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
media: hantro: Empty encoder capture buffers by default
drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
inotify: show inotify mask flags in proc fdinfo
fsnotify: fix wrong lockdep annotations
of: overlay: do not break notify on NOTIFY_{OK|STOP}
drm/msm/dpu: adjust display_v_end for eDP and DP
scsi: ufs: qcom: Fix ufs_qcom_resume()
scsi: ufs: core: Exclude UECxx from SFR dump list
selftests/resctrl: Fix null pointer dereference on open failed
libbpf: Fix logic for finding matching program for CO-RE relocation
mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check()
x86/pm: Fix false positive kmemleak report in msr_build_context()
mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()
x86/speculation: Add missing prototype for unpriv_ebpf_notify()
ASoC: rk3328: fix disabling mclk on pclk probe failure
perf tools: Add missing headers needed by util/data.h
drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
drm/msm/dp: stop event kernel thread when DP unbind
drm/msm/dp: fix error check return value of irq_of_parse_and_map()
drm/msm/dsi: fix error checks and return values for DSI xmit functions
drm/msm/hdmi: check return value after calling platform_get_resource_byname()
drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
drm/msm: add missing include to msm_drv.c
drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
perf tools: Use Python devtools for version autodetection rather than runtime
virtio_blk: fix the discard_granularity and discard_alignment queue limits
x86: Fix return value of __setup handlers
irqchip/exiu: Fix acknowledgment of edge triggered interrupts
irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
x86/mm: Cleanup the control_va_addr_alignment() __setup handler
arm64: fix types in copy_highpage()
regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
media: uvcvideo: Fix missing check to determine if element is found in list
iomap: iomap_write_failed fix
spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
Revert "cpufreq: Fix possible race in cpufreq online error path"
regulator: qcom_smd: Fix up PM8950 regulator configuration
perf/amd/ibs: Use interrupt regs ip for stack unwinding
ath11k: Don't check arvif->is_started before sending management frames
ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
ASoC: samsung: Use dev_err_probe() helper
ASoC: samsung: Fix refcount leak in aries_audio_probe
kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
scripts/faddr2line: Fix overlapping text section failures
media: aspeed: Fix an error handling path in aspeed_video_probe()
media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
media: st-delta: Fix PM disable depth imbalance in delta_probe
media: exynos4-is: Change clk_disable to clk_disable_unprepare
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
media: vsp1: Fix offset calculation for plane cropping
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Bluetooth: Interleave with allowlist scan
Bluetooth: L2CAP: Rudimentary typo fixes
Bluetooth: LL privacy allow RPA
Bluetooth: use inclusive language in HCI role comments
Bluetooth: use inclusive language when filtering devices
Bluetooth: use hdev lock for accept_list and reject_list in conn req
nvme: set dma alignment to dword
m68k: math-emu: Fix dependencies of math emulation support
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
sctp: read sk->sk_bound_dev_if once in sctp_rcv()
net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
media: ov7670: remove ov7670_power_off from ov7670_remove
media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()
media: rkvdec: h264: Fix dpb_valid implementation
media: rkvdec: h264: Fix bit depth wrap in pps packet
ext4: reject the 'commit' option on ext2 filesystems
drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
x86/sev: Annotate stack change in the #VC handler
drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
drm/i915: Fix CFI violation with show_dynamic_id()
thermal/drivers/bcm2711: Don't clamp temperature at zero
thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
thermal/drivers/core: Use a char pointer for the cooling device name
thermal/core: Fix memory leak in __thermal_cooling_device_register()
thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()
net: stmmac: selftests: Use kcalloc() instead of kzalloc()
net: stmmac: fix out-of-bounds access in a selftest
hv_netvsc: Fix potential dereference of NULL pointer
rxrpc: Fix listen() setting the bar too high for the prealloc rings
rxrpc: Don't try to resend the request if we're receiving the reply
rxrpc: Fix overlapping ACK accounting
rxrpc: Don't let ack.previousPacket regress
rxrpc: Fix decision on when to generate an IDLE ACK
net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()
hinic: Avoid some over memory allocation
net/smc: postpone sk_refcnt increment in connect()
arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
memory: samsung: exynos5422-dmc: Avoid some over memory allocation
ARM: dts: suniv: F1C100: fix watchdog compatible
soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
PCI: cadence: Fix find_first_zero_bit() limit
PCI: rockchip: Fix find_first_zero_bit() limit
PCI: dwc: Fix setting error return on MSI DMA mapping failure
ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry
KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault
platform/chrome: cros_ec: fix error handling in cros_ec_register()
ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
can: xilinx_can: mark bit timing constants as const
ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
ARM: dts: bcm2835-rpi-b: Fix GPIO line names
misc: ocxl: fix possible double free in ocxl_file_register_afu
crypto: marvell/cesa - ECB does not IV
gpiolib: of: Introduce hook for missing gpio-ranges
pinctrl: bcm2835: implement hook for missing gpio-ranges
arm: mediatek: select arch timer for mt7629
powerpc/fadump: fix PT_LOAD segment for boot memory area
mfd: ipaq-micro: Fix error check return value of platform_get_irq()
scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
firmware: arm_scmi: Fix list protocols enumeration in the base protocol
nvdimm: Fix firmware activation deadlock scenarios
nvdimm: Allow overwrite in the presence of disabled dimms
pinctrl: mvebu: Fix irq_of_parse_and_map() return value
drivers/base/node.c: fix compaction sysfs file leak
dax: fix cache flush on PMD-mapped pages
drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()
powerpc/8xx: export 'cpm_setbrg' for modules
pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()
powerpc/idle: Fix return value of __setup() handler
powerpc/4xx/cpm: Fix return value of __setup() handler
ASoC: atmel-pdmic: Remove endianness flag on pdmic component
ASoC: atmel-classd: Remove endianness flag on class d component
proc: fix dentry/inode overinstantiating under /proc/${pid}/net
ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()
PCI: imx6: Fix PERST# start-up sequence
tty: fix deadlock caused by calling printk() under tty_port->lock
crypto: sun8i-ss - rework handling of IV
crypto: sun8i-ss - handle zero sized sg
crypto: cryptd - Protect per-CPU resource by disabling BH.
Input: sparcspkr - fix refcount leak in bbc_beep_probe
PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits
hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume()
powerpc/64: Only WARN if __pa()/__va() called with bad addresses
powerpc/perf: Fix the threshold compare group constraint for power9
macintosh: via-pmu and via-cuda need RTC_LIB
powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()
mailbox: forward the hrtimer if not queued and under a lock
RDMA/hfi1: Prevent use of lock before it is initialized
Input: stmfts - do not leave device disabled in stmfts_input_open
OPP: call of_node_put() on error path in _bandwidth_supported()
f2fs: fix dereference of stale list iterator after loop body
iommu/mediatek: Add list_del in mtk_iommu_remove
i2c: at91: use dma safe buffers
cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init
cpufreq: mediatek: Use module_init and add module_exit
cpufreq: mediatek: Unregister platform device on exit
MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon
i2c: at91: Initialize dma_buf in at91_twi_xfer()
dmaengine: idxd: Fix the error handling path in idxd_cdev_register()
NFS: Do not report EINTR/ERESTARTSYS as mapping errors
NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS
NFS: Do not report flush errors in nfs_write_end()
NFS: Don't report errors from nfs_pageio_complete() more than once
NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout
video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
dmaengine: stm32-mdma: remove GISR1 register
dmaengine: stm32-mdma: rework interrupt handler
dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()
iommu/amd: Increase timeout waiting for GA log enablement
i2c: npcm: Fix timeout calculation
i2c: npcm: Correct register access width
i2c: npcm: Handle spurious interrupts
i2c: rcar: fix PM ref counts in probe error paths
perf c2c: Use stdio interface if slang is not supported
perf jevents: Fix event syntax error caused by ExtSel
f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
f2fs: fix to clear dirty inode in f2fs_evict_inode()
f2fs: fix deadloop in foreground GC
f2fs: don't need inode lock for system hidden quota
f2fs: fix to do sanity check on total_data_blocks
f2fs: fix fallocate to use file_modified to update permissions consistently
f2fs: fix to do sanity check for inline inode
wifi: mac80211: fix use-after-free in chanctx code
iwlwifi: mvm: fix assert 1F04 upon reconfig
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
efi: Do not import certificates from UEFI Secure Boot for T2 Macs
bfq: Split shared queues on move between cgroups
bfq: Update cgroup information before merging bio
bfq: Track whether bfq_group is still online
ext4: fix use-after-free in ext4_rename_dir_prepare
ext4: fix warning in ext4_handle_inode_extension
ext4: fix bug_on in ext4_writepages
ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
ext4: fix bug_on in __es_tree_search
ext4: verify dir block before splitting it
ext4: avoid cycles in directory h-tree
ACPI: property: Release subnode properties with data nodes
tracing: Fix potential double free in create_var_ref()
PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299
PCI: qcom: Fix runtime PM imbalance on probe errors
PCI: qcom: Fix unbalanced PHY init on probe errors
mm, compaction: fast_find_migrateblock() should return pfn in the target zone
s390/perf: obtain sie_block from the right address
dlm: fix plock invalid read
dlm: fix missing lkb refcount handling
ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
scsi: dc395x: Fix a missing check on list iterator
scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem
drm/nouveau/clk: Fix an incorrect NULL check on list iterator
drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator
drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
drm/i915/dsi: fix VBT send packet port selection for ICL+
md: fix an incorrect NULL check in does_sb_need_changing
md: fix an incorrect NULL check in md_reload_sb
mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
media: coda: Fix reported H264 profile
media: coda: Add more H264 levels for CODA960
ima: remove the IMA_TEMPLATE Kconfig option
Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug
RDMA/hfi1: Fix potential integer multiplication overflow errors
csky: patch_text: Fixup last cpu should be master
irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x
irqchip: irq-xtensa-mx: fix initial IRQ affinity
cfg80211: declare MODULE_FIRMWARE for regulatory.db
mac80211: upgrade passive scan to active scan on DFS channels after beacon rx
um: chan_user: Fix winch_tramp() return value
um: Fix out-of-bounds read in LDT setup
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
ftrace: Clean up hash direct_functions on register failures
iommu/msm: Fix an incorrect NULL check on list iterator
nodemask.h: fix compilation error with GCC12
hugetlb: fix huge_pmd_unshare address update
xtensa/simdisk: fix proc_read_simdisk()
rtl818x: Prevent using not initialized queues
ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
carl9170: tx: fix an incorrect use of list iterator
stm: ltdc: fix two incorrect NULL checks on list iterator
bcache: improve multithreaded bch_btree_check()
bcache: improve multithreaded bch_sectors_dirty_init()
bcache: remove incremental dirty sector counting for bch_sectors_dirty_init()
bcache: avoid journal no-space deadlock by reserving 1 journal bucket
serial: pch: don't overwrite xmit->buf[0] by x_char
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
gma500: fix an incorrect NULL check on list iterator
arm64: dts: qcom: ipq8074: fix the sleep clock frequency
phy: qcom-qmp: fix struct clk leak on probe errors
ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries
ARM: pxa: maybe fix gpio lookup tables
SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op
docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
dt-bindings: gpio: altera: correct interrupt-cells
vdpasim: allow to enable a vq repeatedly
blk-iolatency: Fix inflight count imbalances and IO hangs on offline
coresight: core: Fix coresight device probe failure issue
phy: qcom-qmp: fix reset-controller leak on probe errors
net: ipa: fix page free in ipa_endpoint_trans_release()
net: ipa: fix page free in ipa_endpoint_replenish_one()
xfs: set inode size after creating symlink
xfs: sync lazy sb accounting on quiesce of read-only mounts
xfs: fix chown leaking delalloc quota blocks when fssetxattr fails
xfs: fix incorrect root dquot corruption error when switching group/project quota types
xfs: restore shutdown check in mapped write fault path
xfs: force log and push AIL to clear pinned inodes when aborting mount
xfs: consider shutdown in bmapbt cursor delete assert
xfs: assert in xfs_btree_del_cursor should take into account error
kseltest/cgroup: Make test_stress.sh work if run interactively
thermal/core: fix a UAF bug in __thermal_cooling_device_register()
thermal/core: Fix memory leak in the error path
bfq: Avoid merging queues with different parents
bfq: Drop pointless unlock-lock pair
bfq: Remove pointless bfq_init_rq() calls
bfq: Get rid of __bio_blkcg() usage
bfq: Make sure bfqg for which we are queueing requests is online
block: fix bio_clone_blkg_association() to associate with proper blkcg_gq
Revert "random: use static branch for crng_ready()"
RDMA/rxe: Generate a completion for unsupported/invalid opcode
MIPS: IP27: Remove incorrect `cpu_has_fpu' override
MIPS: IP30: Remove incorrect `cpu_has_fpu' override
ext4: only allow test_dummy_encryption when supported
md: bcache: check the return value of kzalloc() in detached_dev_do_request()
Linux 5.10.121
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I52dd11dc43acfa0ebddd2b6e277c823b96b07327
|
||
|
Greg Kroah-Hartman
|
2de0a17df4 |
This is the 5.10.120 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmKdoegACgkQONu9yGCS
aT6ytRAAjBTL+El1JeJ5W14PjtQEl45XhEqJ300SuF9Ob0ZBgooPbBa3rwPBw05T
xpyT4/vLGmG87s2+KTUkAtfX8lhoWLbE+xx4zrOx49plbFVYYvqugzvzliXvZ8Zb
2h1aP0SG8hrIFHMsN+qOZnmY3k9m8Z7rNZu/Eyq8zQ/z0SCmQ0EExq3PiKskrfyb
4AcC5Y77UfUl9r7loyFVAPj5z5AOyE+d/5biFdLsJgHa+qHmoYTMKYy53BF8aD3v
jIOZ4JzYZ+ybtkGSrPtXmay02c15TqWXgzlYRjpYQm75C69yFugxFt5usBsVAZmK
JraaBEr13EdZhBvove2cV0ZK8afJfwoo2NuTBuxw52ZmEDvifkb7ESwPa/1kbAqI
267e+yTtqRoge2STMXqU4J3GNbMNf9vmOq4x6NaaPF+Q2K05Z9xO64yh0uxhYx7i
n/EoT2ESOrWguhICf+Gets58dmY6jbWNzlCKFJnbXiuYvx1AxcS1nzP0OrzeWsq8
qii9QS8VouzLnKGXanRZKmjznxSWMyQ3UjA/u4pqL4ISsDy25ICxeSemLvtHIdSU
Ksd+RQgL39e+V9ZXUZ+KQ6zm6a4gKXHsqxuq1UO4xzxYNnR7sgvDS4ACquLRae+N
ISNrz0LP0bDDXHFK4ElU0LBs5jwdYRm67TSVSAOVjCl5B5tB8zk=
=o88P
-----END PGP SIGNATURE-----
Merge 5.10.120 into android12-5.10-lts
Changes in 5.10.120
pinctrl: sunxi: fix f1c100s uart2 function
percpu_ref_init(): clean ->percpu_count_ref on failure
net: af_key: check encryption module availability consistency
nfc: pn533: Fix buggy cleanup order
net: ftgmac100: Disable hardware checksum on AST2600
i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
netfilter: nf_tables: disallow non-stateful expression in sets earlier
pipe: make poll_usage boolean and annotate its access
pipe: Fix missing lock in pipe_resize_ring()
cfg80211: set custom regdomain after wiphy registration
assoc_array: Fix BUG_ON during garbage collect
io_uring: don't re-import iovecs from callbacks
io_uring: fix using under-expanded iters
net: ipa: compute proper aggregation limit
xfs: detect overflows in bmbt records
xfs: show the proper user quota options
xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks
xfs: fix an ABBA deadlock in xfs_rename
xfs: Fix CIL throttle hang when CIL space used going backwards
drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
exfat: check if cluster num is valid
lib/crypto: add prompts back to crypto libraries
crypto: drbg - prepare for more fine-grained tracking of seeding state
crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
crypto: drbg - make reseeding from get_random_bytes() synchronous
netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
netfilter: conntrack: re-fetch conntrack after insertion
KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator
x86/kvm: Alloc dummy async #PF token outside of raw spinlock
x86, kvm: use correct GFP flags for preemption disabled
KVM: x86: avoid calling x86 emulator without a decoded instruction
crypto: caam - fix i.MX6SX entropy delay value
crypto: ecrdsa - Fix incorrect use of vli_cmp
zsmalloc: fix races between asynchronous zspage free and page migration
Bluetooth: hci_qca: Use del_timer_sync() before freeing
ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries
dm integrity: fix error code in dm_integrity_ctr()
dm crypt: make printing of the key constant-time
dm stats: add cond_resched when looping over entries
dm verity: set DM_TARGET_IMMUTABLE feature flag
raid5: introduce MD_BROKEN
HID: multitouch: Add support for Google Whiskers Touchpad
HID: multitouch: add quirks to enable Lenovo X12 trackpoint
tpm: Fix buffer access in tpm2_get_tpm_pt()
tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
docs: submitting-patches: Fix crossref to 'The canonical patch format'
NFS: Memory allocation failures are not server fatal errors
NFSD: Fix possible sleep during nfsd4_release_lockowner()
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
Linux 5.10.120
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I48c0d649a50bd16ad719b2cb9f0ffccd0a74519a
|
||
Gowans, James
|
931dbcc2e0 |
mm: split huge PUD on wp_huge_pud fallback
commit 14c99d65941538aa33edd8dc7b1bbbb593c324a2 upstream.
Currently the implementation will split the PUD when a fallback is taken
inside the create_huge_pud function. This isn't where it should be done:
the splitting should be done in wp_huge_pud, just like it's done for PMDs.
Reason being that if a callback is taken during create, there is no PUD
yet so nothing to split, whereas if a fallback is taken when encountering
a write protection fault there is something to split.
It looks like this was the original intention with the commit where the
splitting was introduced, but somehow it got moved to the wrong place
between v1 and v2 of the patch series. Rebase mistake perhaps.
Link: https://lkml.kernel.org/r/6f48d622eb8bce1ae5dd75327b0b73894a2ec407.camel@amazon.com
Fixes:
|
||
|
Greg Kroah-Hartman
|
f2eb31a498 |
Merge 5.10.119 into android12-5.10-lts
Changes in 5.10.119
lockdown: also lock down previous kgdb use
staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
KVM: x86: Properly handle APF vs disabled LAPIC situation
KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
tcp: change source port randomizarion at connect() time
secure_seq: use the 64 bits of the siphash for port offset calculation
media: vim2m: Register video device after setting up internals
media: vim2m: initialize the media device earlier
ACPI: sysfs: Make sparse happy about address space in use
ACPI: sysfs: Fix BERT error region memory mapping
random: avoid arch_get_random_seed_long() when collecting IRQ randomness
random: remove dead code left over from blocking pool
MAINTAINERS: co-maintain random.c
MAINTAINERS: add git tree for random.c
crypto: lib/blake2s - Move selftest prototype into header file
crypto: blake2s - define shash_alg structs using macros
crypto: x86/blake2s - define shash_alg structs using macros
crypto: blake2s - remove unneeded includes
crypto: blake2s - move update and final logic to internal/blake2s.h
crypto: blake2s - share the "shash" API boilerplate code
crypto: blake2s - optimize blake2s initialization
crypto: blake2s - add comment for blake2s_state fields
crypto: blake2s - adjust include guard naming
crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
lib/crypto: blake2s: include as built-in
lib/crypto: blake2s: move hmac construction into wireguard
lib/crypto: sha1: re-roll loops to reduce code size
lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI
random: document add_hwgenerator_randomness() with other input functions
random: remove unused irq_flags argument from add_interrupt_randomness()
random: use BLAKE2s instead of SHA1 in extraction
random: do not sign extend bytes for rotation when mixing
random: do not re-init if crng_reseed completes before primary init
random: mix bootloader randomness into pool
random: harmonize "crng init done" messages
random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
random: early initialization of ChaCha constants
random: avoid superfluous call to RDRAND in CRNG extraction
random: don't reset crng_init_cnt on urandom_read()
random: fix typo in comments
random: cleanup poolinfo abstraction
random: cleanup integer types
random: remove incomplete last_data logic
random: remove unused extract_entropy() reserved argument
random: rather than entropy_store abstraction, use global
random: remove unused OUTPUT_POOL constants
random: de-duplicate INPUT_POOL constants
random: prepend remaining pool constants with POOL_
random: cleanup fractional entropy shift constants
random: access input_pool_data directly rather than through pointer
random: selectively clang-format where it makes sense
random: simplify arithmetic function flow in account()
random: continually use hwgenerator randomness
random: access primary_pool directly rather than through pointer
random: only call crng_finalize_init() for primary_crng
random: use computational hash for entropy extraction
random: simplify entropy debiting
random: use linear min-entropy accumulation crediting
random: always wake up entropy writers after extraction
random: make credit_entropy_bits() always safe
random: remove use_input_pool parameter from crng_reseed()
random: remove batched entropy locking
random: fix locking in crng_fast_load()
random: use RDSEED instead of RDRAND in entropy extraction
random: get rid of secondary crngs
random: inline leaves of rand_initialize()
random: ensure early RDSEED goes through mixer on init
random: do not xor RDRAND when writing into /dev/random
random: absorb fast pool into input pool after fast load
random: use simpler fast key erasure flow on per-cpu keys
random: use hash function for crng_slow_load()
random: make more consistent use of integer types
random: remove outdated INT_MAX >> 6 check in urandom_read()
random: zero buffer after reading entropy from userspace
random: fix locking for crng_init in crng_reseed()
random: tie batched entropy generation to base_crng generation
random: remove ifdef'd out interrupt bench
random: remove unused tracepoints
random: add proper SPDX header
random: deobfuscate irq u32/u64 contributions
random: introduce drain_entropy() helper to declutter crng_reseed()
random: remove useless header comment
random: remove whitespace and reorder includes
random: group initialization wait functions
random: group crng functions
random: group entropy extraction functions
random: group entropy collection functions
random: group userspace read/write functions
random: group sysctl functions
random: rewrite header introductory comment
random: defer fast pool mixing to worker
random: do not take pool spinlock at boot
random: unify early init crng load accounting
random: check for crng_init == 0 in add_device_randomness()
random: pull add_hwgenerator_randomness() declaration into random.h
random: clear fast pool, crng, and batches in cpuhp bring up
random: round-robin registers as ulong, not u32
random: only wake up writers after zap if threshold was passed
random: cleanup UUID handling
random: unify cycles_t and jiffies usage and types
random: do crng pre-init loading in worker rather than irq
random: give sysctl_random_min_urandom_seed a more sensible value
random: don't let 644 read-only sysctls be written to
random: replace custom notifier chain with standard one
random: use SipHash as interrupt entropy accumulator
random: make consistent usage of crng_ready()
random: reseed more often immediately after booting
random: check for signal and try earlier when generating entropy
random: skip fast_init if hwrng provides large chunk of entropy
random: treat bootloader trust toggle the same way as cpu trust toggle
random: re-add removed comment about get_random_{u32,u64} reseeding
random: mix build-time latent entropy into pool at init
random: do not split fast init input in add_hwgenerator_randomness()
random: do not allow user to keep crng key around on stack
random: check for signal_pending() outside of need_resched() check
random: check for signals every PAGE_SIZE chunk of /dev/[u]random
random: allow partial reads if later user copies fail
random: make random_get_entropy() return an unsigned long
random: document crng_fast_key_erasure() destination possibility
random: fix sysctl documentation nits
init: call time_init() before rand_initialize()
ia64: define get_cycles macro for arch-override
s390: define get_cycles macro for arch-override
parisc: define get_cycles macro for arch-override
alpha: define get_cycles macro for arch-override
powerpc: define get_cycles macro for arch-override
timekeeping: Add raw clock fallback for random_get_entropy()
m68k: use fallback for random_get_entropy() instead of zero
riscv: use fallback for random_get_entropy() instead of zero
mips: use fallback for random_get_entropy() instead of just c0 random
arm: use fallback for random_get_entropy() instead of zero
nios2: use fallback for random_get_entropy() instead of zero
x86/tsc: Use fallback for random_get_entropy() instead of zero
um: use fallback for random_get_entropy() instead of zero
sparc: use fallback for random_get_entropy() instead of zero
xtensa: use fallback for random_get_entropy() instead of zero
random: insist on random_get_entropy() existing in order to simplify
random: do not use batches when !crng_ready()
random: use first 128 bits of input as fast init
random: do not pretend to handle premature next security model
random: order timer entropy functions below interrupt functions
random: do not use input pool from hard IRQs
random: help compiler out with fast_mix() by using simpler arguments
siphash: use one source of truth for siphash permutations
random: use symbolic constants for crng_init states
random: avoid initializing twice in credit race
random: move initialization out of reseeding hot path
random: remove ratelimiting for in-kernel unseeded randomness
random: use proper jiffies comparison macro
random: handle latent entropy and command line from random_init()
random: credit architectural init the exact amount
random: use static branch for crng_ready()
random: remove extern from functions in header
random: use proper return types on get_random_{int,long}_wait()
random: make consistent use of buf and len
random: move initialization functions out of hot pages
random: move randomize_page() into mm where it belongs
random: unify batched entropy implementations
random: convert to using fops->read_iter()
random: convert to using fops->write_iter()
random: wire up fops->splice_{read,write}_iter()
random: check for signals after page of pool writes
ALSA: ctxfi: Add SB046x PCI ID
Linux 5.10.119
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I65f898474b7704881a3dd528012e7e91b09b3767
|
||
|
Bing Han
|
0e1cb27700 |
ANDROID: vendor_hook: Add hook in shmem_writepage()
Add vendor hook android_vh_set_shmem_page_flag in shmem_writepage to set a flag in page_ext, which indicates that this page is a shmem page, to be used in android_vh_get_swap_page. The shared page should not be reclaimed to the extended memory, ie, the specified swap location. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: I33a9007c88b4d8aab3da044c8a05eb45d7e74f3a |
||
|
Jann Horn
|
6c32496964 |
mm/slub: add missing TID updates on slab deactivation
commit eeaa345e128515135ccb864c04482180c08e3259 upstream.
The fastpath in slab_alloc_node() assumes that c->slab is stable as long as
the TID stays the same. However, two places in __slab_alloc() currently
don't update the TID when deactivating the CPU slab.
If multiple operations race the right way, this could lead to an object
getting lost; or, in an even more unlikely situation, it could even lead to
an object being freed onto the wrong slab's freelist, messing up the
`inuse` counter and eventually causing a page to be freed to the page
allocator while it still contains slab objects.
(I haven't actually tested these cases though, this is just based on
looking at the code. Writing testcases for this stuff seems like it'd be
a pain...)
The race leading to state inconsistency is (all operations on the same CPU
and kmem_cache):
- task A: begin do_slab_free():
- read TID
- read pcpu freelist (==NULL)
- check `slab == c->slab` (true)
- [PREEMPT A->B]
- task B: begin slab_alloc_node():
- fastpath fails (`c->freelist` is NULL)
- enter __slab_alloc()
- slub_get_cpu_ptr() (disables preemption)
- enter ___slab_alloc()
- take local_lock_irqsave()
- read c->freelist as NULL
- get_freelist() returns NULL
- write `c->slab = NULL`
- drop local_unlock_irqrestore()
- goto new_slab
- slub_percpu_partial() is NULL
- get_partial() returns NULL
- slub_put_cpu_ptr() (enables preemption)
- [PREEMPT B->A]
- task A: finish do_slab_free():
- this_cpu_cmpxchg_double() succeeds()
- [CORRUPT STATE: c->slab==NULL, c->freelist!=NULL]
From there, the object on c->freelist will get lost if task B is allowed to
continue from here: It will proceed to the retry_load_slab label,
set c->slab, then jump to load_freelist, which clobbers c->freelist.
But if we instead continue as follows, we get worse corruption:
- task A: run __slab_free() on object from other struct slab:
- CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial)
- task A: run slab_alloc_node() with NUMA node constraint:
- fastpath fails (c->slab is NULL)
- call __slab_alloc()
- slub_get_cpu_ptr() (disables preemption)
- enter ___slab_alloc()
- c->slab is NULL: goto new_slab
- slub_percpu_partial() is non-NULL
- set c->slab to slub_percpu_partial(c)
- [CORRUPT STATE: c->slab points to slab-1, c->freelist has objects
from slab-2]
- goto redo
- node_match() fails
- goto deactivate_slab
- existing c->freelist is passed into deactivate_slab()
- inuse count of slab-1 is decremented to account for object from
slab-2
At this point, the inuse count of slab-1 is 1 lower than it should be.
This means that if we free all allocated objects in slab-1 except for one,
SLUB will think that slab-1 is completely unused, and may free its page,
leading to use-after-free.
Fixes:
|
||
|
Charan Teja Reddy
|
1002747429 |
ANDROID: mm: shmem: use reclaim_pages() to recalim pages from a list
Static code analysis tool reported NULL pointer access in
shrink_page_list() as the commit 26aa2d199d6f2 ("mm/migrate: demote
pages during reclaim") expects valid pgdat.
There is already an existing api, reclaim_pages, that tries to reclaim
pages from the list. use it instead of creating custom function.
Bug: 201263305
Fixes: 96f80f628451 ("ANDROID: mm: add reclaim_shmem_address_space() for faster reclaims")
Change-Id: Iaa11feac94c9e8338324ace0276c49d6a0adeb0c
Signed-off-by: Charan Teja Reddy <quic_charante@quicinc.com>
|
||
|
Sivasri Kumar, Vanka
|
9d60eef1f4 |
Merge keystone/android12-5.10-keystone-qcom-release.110+ (b92ac32) into msm-5.10
* refs/heads/tmp-b92ac32: FROMGIT: usb: gadget: uvc: calculate the number of request depending on framesize ANDROID: GKI: Add tracing_is_on interface into symbol list UPSTREAM: usb: gadget: f_mass_storage: Make CD-ROM emulation work with Mac OS-X BACKPORT: io_uring: fix race between timeout flush and removal BACKPORT: net/sched: cls_u32: fix netns refcount changes in u32_change() UPSTREAM: io_uring: always use original task when preparing req identity FROMLIST: remoteproc: Fix dma_mem leak after rproc_shutdown FROMLIST: dma-mapping: Add dma_release_coherent_memory to DMA API ANDROID: Update QCOM symbol list for __reset_control_get ANDROID: vendor_hooks: Add hooks for mutex BACKPORT: can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ANDROID: fix up abi issue with struct snd_pcm_runtime, again Revert "coredump: Snapshot the vmas in do_coredump" Revert "coredump: Remove the WARN_ON in dump_vma_snapshot" Revert "coredump: Use the vma snapshot in fill_files_note" Revert "pstore: Don't use semaphores in always-atomic-context code" Revert "PCI: Reduce warnings on possible RW1C corruption" ANDROID: GKI: fix crc issue with commit |
||
|
Greg Kroah-Hartman
|
fa7f6a5f56 |
Merge branch 'android12-5.10' into branch 'android12-5.10-lts'
Sync up with android12-5.10 for the following commits: |
||
|
Bing Han
|
01680ae117 |
ANDROID: vendor_hook: Add hook in __free_pages()
Provide a vendor hook android_vh_free_pages to clear the information in struct page_ext, when the page is freed. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: Iac8e3a72f59f8d3ae16dbc93d94034fe4b627d61 |
||
|
Bing Han
|
e064059673 |
ANDROID: create and export is_swap_slot_cache_enabled
Create and export a function is_swap_slot_cache_enabled to check whether the swap slot cache can be used. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: Iaca9519b838e0c3c8c06acbec83003f8309aa363 |
||
|
Bing Han
|
f6f18f7ffa |
ANDROID: vendor_hook: Add hook in swap_slots
Provide a vendor hook android_vh_swap_slot_cache_active to pass the active status of swap_slots_cache. This status will be used in the process of reclaiming the pages that is required to be reclaimed to a specified swap location. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: I8211760e0f37fe4a514f6ceaae9993925da8cd6d |
||
|
Bing Han
|
034877c195 |
ANDROID: mm: export swapcache_free_entries
Export swapcache_free_entries to be used in the alternative function android_vh_drain_slots_cache_cpu to swap entries in swap slot cache, it's usage is similar to the usage in drain_slots_cache_cpu. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: Ia89b1728d540c5cc8995a939a918e12c23057266 |