65020 Commits

Author	SHA1	Message	Date
Martynas Pumputis	cda90416c0	UPSTREAM: net: retrieve netns cookie via getsocketopt ... It's getting more common to run nested container environments for testing cloud software. One of such examples is Kind [1] which runs a Kubernetes cluster in Docker containers on a single host. Each container acts as a Kubernetes node, and thus can run any Pod (aka container) inside the former. This approach simplifies testing a lot, as it eliminates complicated VM setups. Unfortunately, such a setup breaks some functionality when cgroupv2 BPF programs are used for load-balancing. The load-balancer BPF program needs to detect whether a request originates from the host netns or a container netns in order to allow some access, e.g. to a service via a loopback IP address. Typically, the programs detect this by comparing netns cookies with the one of the init ns via a call to bpf_get_netns_cookie(NULL). However, in nested environments the latter cannot be used given the Kubernetes node's netns is outside the init ns. To fix this, we need to pass the Kubernetes node netns cookie to the program in a different way: by extending getsockopt() with a SO_NETNS_COOKIE option, the orchestrator which runs in the Kubernetes node netns can retrieve the cookie and pass it to the program instead. Thus, this is following up on Eric's commit 3d368ab87cf6 ("net: initialize net->net_cookie at netns setup") to allow retrieval via SO_NETNS_COOKIE. This is also in line in how we retrieve socket cookie via SO_COOKIE. [1] https://kind.sigs.k8s.io/ Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Martynas Pumputis <m@lambda.lt> Cc: Eric Dumazet <edumazet@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit e8b9eab99232c4e62ada9d7976c80fd5e8118289) Bug: 274789652 Tested: builds, net_test passes Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: If784a592450af38d70f16da61e36cbbaff80ebca	2023-03-23 15:42:38 +00:00
Eric Dumazet	78a559e2a9	UPSTREAM: net: initialize net->net_cookie at netns setup ... It is simpler to make net->net_cookie a plain u64 written once in setup_net() instead of looping and using atomic64 helpers. Lorenz Bauer wants to add SO_NETNS_COOKIE socket option and this patch would makes his patch series simpler. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Lorenz Bauer <lmb@cloudflare.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 3d368ab87cf6681f928de1ddf804d69600671bb2) Bug: 274789652 Tested: builds, net_test passes Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ia4d018b37af2792f0a21de028f724193797c5138	2023-03-23 15:42:38 +00:00
Greg Kroah-Hartman	fb0cece721	Merge tag 'android12-5.10.168_r00' into android12-5.10 ... This is the merge of the upstream LTS release of 5.10.168 into the android12-5.10 branch. It contains the following commits: * b34e092097a7 Revert "nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property" * 570621d64f37 Merge 5.10.168 into android12-5.10-lts |\ | * 707c48210a53 Linux 5.10.168 | * 0a626e27f984 Fix page corruption caused by racy check in __free_pages | * 0ef2490a876b arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive | * 5bfc8f09619a arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive | * 809f4acb7f01 arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive | * 8eee3521bca7 riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte | * 6ff8b4825392 ceph: flush cap releases when the session is flushed | * 4f518a4a79bd usb: typec: altmodes/displayport: Fix probe pin assign check | * f25fa93e5236 usb: core: add quirk for Alcor Link AK9563 smartcard reader | * dd965ad39de4 btrfs: free device in btrfs_close_devices for a single device filesystem | * 1be271c52bf3 net: USB: Fix wrong-direction WARNING in plusb.c | * 2b693fe3f760 cifs: Fix use-after-free in rdata->read_into_pages() | * bbc850904457 pinctrl: intel: Restore the pins that used to be in Direct IRQ mode | * 4863f46ddaf9 spi: dw: Fix wrong FIFO level setting for long xfers | * 6e2a0521e4e8 pinctrl: single: fix potential NULL dereference | * 61f8a493c076 pinctrl: aspeed: Fix confusing types in return value | * ef3edede7b73 ALSA: pci: lx6464es: fix a debug loop | * 3914b71dad5a selftests: forwarding: lib: quote the sysctl values | * c53f34ec3fbf rds: rds_rm_zerocopy_callback() use list_first_entry() | * 3eb04ef27811 net/mlx5: fw_tracer, Zero consumer index when reloading the tracer | * fac1fb80088a net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers | * 703c3efa4b0b net/mlx5e: IPoIB, Show unknown speed instead of error | * 896bd85688b4 net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" | * 1ad4112c9fcf ice: Do not use WQ_MEM_RECLAIM flag for workqueue | * 34a5af788ed4 uapi: add missing ip/ipv6 header dependencies for linux/stddef.h | * 4259a4082772 ionic: clean interrupt before enabling queue to avoid credit race | * 07097ad30b36 net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY | * cafa2ad4f1d7 bonding: fix error checking in bond_debug_reregister() | * 30fdf660356f xfrm: fix bug with DSCP copy to v6 from v4 tunnel | * 491b7a5fc8e2 RDMA/usnic: use iommu_map_atomic() under spin_lock() | * b1afb666c329 IB/IPoIB: Fix legacy IPoIB due to wrong number of queues | * a893cc644812 xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() | * 79b595d95914 IB/hfi1: Restore allocated resources on failed copyout | * 3797e94c1992 xfrm: compat: change expression for switch in xfrm_xlate64 | * bc9771cd6398 can: j1939: do not wait 250 ms if the same addr was already claimed | * edaf5c718314 of/address: Return an error when no valid dma-ranges are found | * b7d5fa8052ad tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw | * 35452bf986ab ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 | * e1646e2be956 ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() | * 1c6576239906 ALSA: hda/realtek: Add Positivo N14KP6-TG | * f1fd16cd9753 btrfs: zlib: zero-initialize zlib workspace | * a1406d5aa393 btrfs: limit device extents to the device size | * dbe5a11954d8 migrate: hugetlb: check for hugetlb shared PMD in node migration | * 97a5104d640d mm/migration: return errno when isolate_huge_page failed | * 91ad3104b211 iio:adc:twl6030: Enable measurement of VAC | * e4c3ea9b6045 bpf: Do not reject when the stack read size is different from the tracked scalar size | * 34ec4c7831c4 nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property | * b2e412879595 wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads | * 914e38f02a49 f2fs: fix to do sanity check on i_extra_isize in is_alive() | * 3931014367ef fbdev: smscufx: fix error handling code in ufx_usb_probe | * 6c8a2c67a9d6 serial: 8250_dma: Fix DMA Rx rearm race | * 967e726e57c3 serial: 8250_dma: Fix DMA Rx completion race | * 1fd7a6a57968 nvmem: core: fix cell removal on error | * bb875f0a34e7 nvmem: core: initialise nvmem->id early | * b591abac78e2 drm/i915: Fix potential bit_17 double-free | * 5c4d4a83bf1a Squashfs: fix handling and sanity checking of xattr_ids count | * 30187be29052 mm/swapfile: add cond_resched() in get_swap_pages() | * 639b40007a48 fpga: stratix10-soc: Fix return value check in s10_ops_write_init() | * 0139d61d28a2 x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses | * 556959327b19 mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps | * 50d31309c999 riscv: disable generation of unwind tables | * 71a4f39f99e8 parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case | * 2982b473d764 parisc: Fix return code of pdc_iodc_print() | * 170e1cc3c00f nvmem: qcom-spmi-sdam: fix module autoloading | * f11330b7ba51 iio: imu: fxos8700: fix MAGN sensor scale and unit | * 5b30998c7f05 iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN | * 42e34a08394a iio: imu: fxos8700: fix failed initialization ODR mode assignment | * ab976ecd0430 iio: imu: fxos8700: fix incorrect ODR mode readback | * 9d6502ed6314 iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback | * aff4add60998 iio: imu: fxos8700: fix map label of channel type to MAGN sensor | * 9545ce720ab1 iio: imu: fxos8700: fix IMU data bits returned to user space | * 6d43eddc567b iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback | * f7d996c953bf iio: imu: fxos8700: fix ACCEL measurement range selection | * 11ac43f7631e iio:adc:twl6030: Enable measurements of VUSB, VBAT and others | * 5602f6a244ab iio: adc: berlin2-adc: Add missing of_node_put() in error path | * 33483172b35c iio: hid: fix the retval in accel_3d_capture_sample | * 55cf65461b20 efi: Accept version 2 of memory attributes table | * 8fb515c8b127 ALSA: hda/realtek: Add Acer Predator PH315-54 | * 192fd121d04f watchdog: diag288_wdt: fix __diag288() inline assembly | * 5bcdcf437d3f watchdog: diag288_wdt: do not use stack buffers for hardware data | * 0c76eddc1f89 net: qrtr: free memory on error path in radix_tree_insert() | * 28d190882ba5 fbcon: Check font dimension limits | * 658e0d99dbfb Input: i8042 - add Clevo PCX0DX to i8042 quirk table | * a82d49360496 Input: i8042 - add TUXEDO devices to i8042 quirk tables | * 04d99a0a966a Input: i8042 - merge quirk tables | * ab85074c308f Input: i8042 - move __initconst to fix code styling warning | * 55515d7d8743 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF | * 434a36ed64ac usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait | * 6e5565aa0047 usb: dwc3: qcom: enable vbus override when in OTG dr-mode | * 1ca8629505fd usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API | * 30d0e2cf9900 iio: adc: stm32-dfsdm: fill module aliases | * 4bbc34401d97 net/x25: Fix to not accept on connected socket | * 2b1e8e20b984 platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table | * ac4d9c86e9f5 i2c: rk3x: fix a bunch of kernel-doc warnings | * 9758ffe1c07b scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress | * 1b28bf868fce scsi: target: core: Fix warning on RT kernels | * 4e66ba3cfb4f i2c: mxs: suppress probe-deferral error message | * d09b0bf9ffd3 qede: execute xdp_do_flush() before napi_complete_done() | * 8aba483f7034 qede: add netpoll support for qede driver | * 87d4ff18738f efi: fix potential NULL deref in efi_mem_reserve_persistent | * 70154489f531 net: openvswitch: fix flow memory leak in ovs_flow_cmd_new | * 4fb430c69878 virtio-net: Keep stop() to follow mirror sequence of open() | * 812236bb6a89 selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking | * 9e7e2887ccb8 selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs | * 4babbd1f594d selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided | * a4a493e599e3 selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning | * 4d9c9627161a ata: libata: Fix sata_down_spd_limit() when no link speed is reported | * b6d44072117b can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate | * 6362b861704f igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() | * 98c93a01608f net: phy: meson-gxl: Add generic dummy stubs for MMD register access | * de2785aa3448 squashfs: harden sanity check in squashfs_read_xattr_id_table | * f53c6e7e77df netfilter: br_netfilter: disable sabotage_in hook after first suppression | * dd6991251a13 netrom: Fix use-after-free caused by accept on already connected socket | * 362a2f5531dc net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices | * 6824169e7488 sfc: correctly advertise tunneled IPv6 segmentation | * 539fc3ef5104 virtio-net: execute xdp_do_flush() before napi_complete_done() | * 63d1c4edbfc1 fix "direction" argument of iov_iter_kvec() | * 0c67fb777508 fix iov_iter_bvec() "direction" argument | * b5437e0ba9e7 READ is "data destination", not source... | * fefb47a8331c WRITE is "data source", not destination... | * f9815b303e61 vhost/net: Clear the pending messages when the backend is removed | * de990d157179 scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" | * d08a9b0ad211 drm/vc4: hdmi: make CEC adapter name unique | * 8c6b46d426ed arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX | * 9bd6074e1872 bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener | * 36dbb8daf08a bpf: Fix to preserve reg parent/live fields when copying range info | * 8de8c4a25ed8 bpf: Support <8-byte scalar spill and refill | * 2b557fa635e7 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() | * 1b1f56cc0eaa bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers | * 2d0f276d504f powerpc/imc-pmu: Revert nest_init_lock to being a mutex | * 9ff2bebc2cea bpf: Fix incorrect state pruning for <8B spill/fill | * 60c27e0e37c8 bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() | * d5a2dcee53fa firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region * | b405332f4b62 Merge 5.10.167 into android12-5.10-lts |\| | * a5acb54d4066 Linux 5.10.167 | * 6446369fb9f0 net: fix NULL pointer in skb_segment_list | * 0f9db1209f59 Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt | * d744c03c04a7 ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems | * bd0050b7ffa8 dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init | * 19c9a2ba4699 blk-cgroup: fix missing pd_online_fn() while activating policy | * a1c0263f1eb4 bpf: Skip task with pid=1 in send_signal_common() | * f18546863123 arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI | * a26cef004146 ARM: dts: vf610: Fix pca9548 i2c-mux node names | * 67a8beb8544e ARM: dts: imx: Fix pca9547 i2c-mux node name * | 0ddb73d44659 Merge 5.10.166 into android12-5.10-lts |\| | * 8d823aaa220e Linux 5.10.166 | * 19f1f99be371 clk: Fix pointer casting to prevent oops in devm_clk_release() | * f84c9b72fb20 perf/x86/amd: fix potential integer overflow on shift of a int | * 743435cd1705 netfilter: conntrack: unify established states for SCTP paths | * e284c273dbb4 x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL | * 2eca102b350f block: fix and cleanup bio_check_ro | * 7fe4fab87061 Revert "selftests/ftrace: Update synthetic event syntax errors" | * 032a7d5ff519 nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted | * 8fe3e574b3ac nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf | * 9f3dd454fea5 Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" | * 230be65a18f8 tools: gpio: fix -c option of gpio-event-mon | * 7ff8128bb116 net: mdio-mux-meson-g12a: force internal PHY off on mux switch | * 62a0806eb4d2 net/tg3: resolve deadlock in tg3_reset_task() during EEH | * e9c1b1e1a00b thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() | * 3af20f63212d net: ravb: Fix possible hang if RIS2_QFF1 happen | * 6ef652f35dcf sctp: fail if no bound addresses can be used for a given scope | * cf9a2ce0383e net/sched: sch_taprio: do not schedule in taprio_reset() | * 7de16d75b20a netrom: Fix use-after-free of a listening socket. | * 498584ccf46c netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE | * 7f9828fb1f68 ipv4: prevent potential spectre v1 gadget in fib_metrics_match() | * 34c6142f0df9 ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() | * 870a565bd6fe netlink: annotate data races around sk_state | * 8583f52c23c3 netlink: annotate data races around dst_portid and dst_group | * eccb532adabc netlink: annotate data races around nlk->portid | * 0308b7dfea6f netfilter: nft_set_rbtree: skip elements in transaction from garbage collection | * 4aacf3d78424 netfilter: nft_set_rbtree: Switch to node list walk for overlap detection | * d4c008f3b7f7 net: fix UaF in netns ops registration error path | * 539ca5dcbc91 netlink: prevent potential spectre v1 gadgets | * ed173f77fd28 i2c: designware: use casting of u64 in clock multiplication to avoid overflow | * 8949ef3a7a0c i2c: designware: Use DIV_ROUND_CLOSEST() macro | * 8ebc2efcb6d6 units: Add SI metric prefix definitions | * 974aaf11804f units: Add Watt units | * 76d9ebb7f0bc EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info | * 511f6c7c40b0 EDAC/device: Respect any driver-supplied workqueue polling value | * 0cb922cef7e9 ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment | * 98d85586aace thermal: intel: int340x: Protect trip temperature from concurrent updates | * 76c5640737b8 KVM: x86/vmx: Do not skip segment attributes if unusable bit is set | * e037baee16e0 cifs: Fix oops due to uncleared server->smbd_conn in reconnect | * c42a6e687060 ftrace/scripts: Update the instructions for ftrace-bisect.sh | * 886aa449235f trace_events_hist: add check for return value of 'create_hist_field' | * de3930a4883d tracing: Make sure trace_printk() can output as soon as it can be used | * 083b3dda86f8 module: Don't wait for GOING modules | * ce3aa7694627 scsi: hpsa: Fix allocation size for scsi_host_alloc() | * 6da7055826a1 xhci: Set HCD flag to defer primary roothub registration | * 1d580d3e1311 Bluetooth: hci_sync: cancel cmd_timer if hci_open failed | * b98a8b731bd2 exit: Use READ_ONCE() for all oops/warn limit reads | * 53f177b50449 docs: Fix path paste-o for /sys/kernel/warn_count | * b0bd5dcfa608 panic: Expose "warn_count" to sysfs | * 8c99d4c4c192 panic: Introduce warn_limit | * 55eba18262cb panic: Consolidate open-coded panic_on_warn checks | * 530cdae5c2b2 exit: Allow oops_limit to be disabled | * 7cffbcd68f1c exit: Expose "oops_count" to sysfs | * de586785b981 exit: Put an upper limit on how often we can oops | * 191a3b17dd9b panic: Separate sysctl logic from CONFIG_SMP | * 1b9a33a94b9c ia64: make IA64_MCA_RECOVERY bool instead of tristate | * 6d971830da31 csky: Fix function name in csky_alignment() and die() | * 648d8b8c4938 h8300: Fix build errors from do_exit() to make_task_dead() transition | * 63d77c559678 hexagon: Fix function name in die() | * b2c178f31162 objtool: Add a missing comma to avoid string concatenation | * d9c740c765e5 exit: Add and use make_task_dead. | * 715a63588f56 kasan: no need to unset panic_on_warn in end_report() | * b857b42a8c09 ubsan: no need to unset panic_on_warn in ubsan_epilogue() | * 590ba6fee095 panic: unset panic_on_warn inside panic() | * e97ec099d7fd kernel/panic: move panic sysctls to its own file | * e6226917f4cf sysctl: add a new register_sysctl_init() interface | * c4097e844a6e fs: reiserfs: remove useless new_opts in reiserfs_remount | * 1f6768143bf7 x86: ACPI: cstate: Optimize C3 entry on AMD CPUs | * 5fb884d748e4 netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state | * a7345145e7bd Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" | * 20a02bc84508 lockref: stop doing cpu_relax in the cmpxchg loop | * f8ddf7dbf5e7 platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK | * 9968f9a86251 platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD | * 52249c2168af scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id | * 71bd134c4e9e KVM: s390: interrupt: use READ_ONCE() before cmpxchg() | * 300da569a128 spi: spidev: remove debug messages that access spidev->spi without locking | * a84def9b108a ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets | * d9a0752a6a11 ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC | * 00f230161187 cpufreq: armada-37xx: stop using 0 as NULL pointer | * 2ca345d19cbd s390/debug: add _ASM_S390_ prefix to header guard | * ae108a5fc929 drm: Add orientation quirk for Lenovo ideapad D330-10IGL | * 96f4899a3810 ASoC: fsl_micfil: Correct the number of steps on SX controls | * 3b154d5204ff kcsan: test: don't put the expect array on the stack | * b75e9fc402c4 cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist | * 6bc564f3fec0 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace | * d79e700680f9 tcp: fix rate_app_limited to default to 1 | * a84240df7079 net: dsa: microchip: ksz9477: port map correction in ALU table entry register | * 704a423c9379 driver core: Fix test_async_probe_init saves device in wrong array | * 216f35db6ec6 w1: fix WARNING after calling w1_process() | * 8e5be0ae5506 w1: fix deadloop in __w1_remove_master_device() | * ddf16dae65d3 tcp: avoid the lookup process failing to get sk in ehash table | * 5f10f7efe0fc nvme-pci: fix timeout request state check | * 98519ed69113 dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() | * 28fc6095da22 HID: betop: check shape of output reports | * 16791d5a7a9a l2tp: prevent lockdep issue in l2tp_tunnel_register() | * f96b2f690887 net: macb: fix PTP TX timestamp failure due to packet padding | * 42ecd72f02cd dmaengine: Fix double increment of client_count in dma_chan_get() | * 1e97e2e08e79 drm/panfrost: fix GENERIC_ATOMIC64 dependency | * 31f63c62a8e8 net: mlx5: eliminate anonymous module_init & module_exit | * 4b3b5cc1a7dc usb: gadget: f_fs: Ensure ep0req is dequeued before free_request | * 6dd9ea05534f usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait | * 55be77aa8974 HID: revert CHERRY_MOUSE_000C quirk | * 34f11949938b net: stmmac: fix invalid call to mdiobus_get_phy() | * 20fd4598762e HID: check empty report_list in bigben_probe() | * 5dc3469a1170 HID: check empty report_list in hid_validate_values() | * 4bc5f1f6bc94 net: mdio: validate parameter addr in mdiobus_get_phy() | * 67866b1e0ab9 net: usb: sr9700: Handle negative len | * 2d77e5c0ad79 l2tp: close all race conditions in l2tp_tunnel_register() | * 76c640d6a1e8 l2tp: convert l2tp_tunnel_list to idr | * 5b209b8c99d4 l2tp: Don't sleep and disable BH under writer-side sk_callback_lock | * e34a965f771f l2tp: Serialize access to sk_user_data with sk_callback_lock | * c60fe70078d6 net/sched: sch_taprio: fix possible use-after-free | * 802fd7623e9e wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid | * 1af8071bd08e gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode | * 613020d0489e net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs | * ad1baab3a5c0 net: nfc: Fix use-after-free in local_cleanup() | * 2a0156a4aaea phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() | * da75dec7c661 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation | * f351af45e203 amd-xgbe: Delay AN timeout during KR training | * a65a8727a2fe amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent | * aa8b584cec01 ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 | * fa566549a152 phy: ti: fix Kconfig warning and operator precedence | * b18490138dc6 PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() | * 39ab0fc49842 affs: initialize fsdata in affs_truncate() | * f6fa12fbb17c IB/hfi1: Remove user expected buffer invalidate race | * 6ce4382bd137 IB/hfi1: Immediately remove invalid memory from hardware | * 6dd8136fd1b3 IB/hfi1: Fix expected receive setup error exit issues | * ee474dd66e82 IB/hfi1: Reserve user expected TIDs | * 73e5666bf30d IB/hfi1: Reject a zero-length user expected buffer | * d66c1d4178c2 RDMA/core: Fix ib block iterator counter overflow | * eab7a920379a tomoyo: fix broken dependency on *.conf.default | * 6813d8ba7dac firmware: arm_scmi: Harden shared memory access in fetch_notification | * e85df1db28dc firmware: arm_scmi: Harden shared memory access in fetch_response | * 329fbd260352 EDAC/highbank: Fix memory leak in highbank_mc_probe() | * 7b4516ba56f1 HID: intel_ish-hid: Add check for ishtp_dma_tx_map | * d775671dccf4 ARM: imx: add missing of_node_put() | * 5c1dcedd5206 arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux | * cccb0aea9c3f ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' | * 6805e392f508 ARM: dts: imx7d-pico: Use 'clock-frequency' | * 2a3c3a01e2f0 ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' | * e57ea0c6ba7f memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() | * 53f55d6e07c4 memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() | * 935ec78de50e clk: Provide new devm_clk helpers for prepared and enabled clocks | * 0b8b21c0b38f clk: generalize devm_clk_get() a bit * | e5ea3c44c889 Revert "xhci: Add update_hub_device override for PCI xHCI hosts" * | a73c1dbdd5f4 Revert "xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables" * | fa89210a0e2d Revert "xhci: Add a flag to disable USB3 lpm on a xhci root port level." * | 78da590924db Merge 5.10.165 into android12-5.10-lts |\| | * 179624a57b78 Linux 5.10.165 | * e699cce29acc io_uring/rw: remove leftover debug statement | * 3d5f181bda25 io_uring/rw: ensure kiocb_end_write() is always called | * c1a279d79e31 io_uring: fix double poll leak on repolling | * ddaaadf22bea io_uring: Clean up a false-positive warning from GCC 9.3.0 | * 8bc72b4952cf mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma | * 217721b76313 Bluetooth: hci_qca: Fixed issue during suspend | * c208f1e84a67 Bluetooth: hci_qca: check for SSR triggered flag while suspend | * ef11bc4bb975 Bluetooth: hci_qca: Wait for SSR completion during suspend | * c392c350a042 soc: qcom: apr: Make qcom,protection-domain optional again | * 71e5cd1018d3 Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" | * be1067427abd net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() | * f6c201b4382d net/ulp: use consistent error code when blocking ULP | * fc2491562a9b io_uring/net: fix fast_iov assignment in io_setup_async_msg() | * 89a77271d254 io_uring: io_kiocb_update_pos() should not touch file for non -1 offset | * c6e3c12ff9fb tracing: Use alignof__(struct {type b;}) instead of offsetof() | * 03ba86bb3811 x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN | * 2f45b20c3999 Revert "drm/amdgpu: make display pinning more flexible (v2)" | * d6544bccc196 efi: rt-wrapper: Add missing include | * 4012603cbd46 arm64: efi: Execute runtime services from a dedicated stack | * bf1d287c1413 drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix | * 75105d943d7a drm/amd/display: Calculate output_color_space after pixel encoding adjustment | * a3ef53248399 drm/amd/display: Fix set scaling doesn's work | * 59590f50ec9d drm/i915: re-disable RC6p on Sandy Bridge | * d960fff8e2c0 mei: me: add meteor lake point M DID | * ae2a9dcc8caa gsmi: fix null-deref in gsmi_get_variable | * a75e80d11826 serial: atmel: fix incorrect baudrate setup | * 5a7a04079592 dmaengine: tegra210-adma: fix global intr clear | * c9da2cb968ea serial: pch_uart: Pass correct sg to dma_unmap_sg() | * e924f79e67d7 dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation | * 31132df12a93 dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation | * a9f2658a0192 usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 | * e92c70059178 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() | * 06600ae7e069 usb: gadget: g_webcam: Send color matching descriptor per frame | * 6107a8f15c0f usb: typec: altmodes/displayport: Fix pin assignment calculation | * d26f38d16fcb usb: typec: altmodes/displayport: Add pin assignment helper | * 9c58f1e9e693 usb: host: ehci-fsl: Fix module alias | * 3dc896db027b USB: serial: cp210x: add SCALANCE LPE-9000 device id | * 856e4b5e53f2 USB: gadgetfs: Fix race between mounting and unmounting | * 894681682dbe tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer | * c4ab24e3334b thunderbolt: Use correct function to calculate maximum USB3 link rate | * 531268a875dc cifs: do not include page data when checking signature | * 3bd433748571 btrfs: fix race between quota rescan and disable leading to NULL pointer deref | * 6ee8feca9150 mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting | * 79819909c223 mmc: sunxi-mmc: Fix clock refcount imbalance during unbind | * 2eed23765b7e comedi: adv_pci1760: Fix PWM instruction handling | * 7efeed828c90 usb: core: hub: disable autosuspend for TI TUSB8041 | * b171d0d2cf1b misc: fastrpc: Fix use-after-free race condition for maps | * 193cd853145b misc: fastrpc: Don't remove map on creater_process and device_release | * e0db5d44bc27 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 | * 20d0dedc7a04 staging: vchiq_arm: fix enum vchiq_status return types | * a06e9ec5abde USB: serial: option: add Quectel EM05CN modem | * 2f44c60bb89c USB: serial: option: add Quectel EM05CN (SG) modem | * fcd49b230906 USB: serial: option: add Quectel EC200U modem | * 21c5b618128b USB: serial: option: add Quectel EM05-G (RS) modem | * 46b898f9345d USB: serial: option: add Quectel EM05-G (CS) modem | * 3774654f7a63 USB: serial: option: add Quectel EM05-G (GR) modem | * 9f8e45720e0e prlimit: do_prlimit needs to have a speculation check | * 96562a23cfaf xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables | * 2551f8cbf2de usb: acpi: add helper to check port lpm capability using acpi _DSM | * 4d70a8a9ab8e xhci: Add a flag to disable USB3 lpm on a xhci root port level. | * 83e3a5be7475 xhci: Add update_hub_device override for PCI xHCI hosts | * 081105213ff6 xhci: Fix null pointer dereference when host dies | * 66fc1600855c usb: xhci: Check endpoint is valid before dereferencing it | * 8ca60d59b963 xhci-pci: set the dma max_seg_size | * ea2e6286e3e8 io_uring/rw: defer fsnotify calls to task context | * e90cfb969994 io_uring: do not recalculate ppos unnecessarily | * ea528ecac3ae io_uring: update kiocb->ki_pos at execution time | * 076f872314d4 io_uring: remove duplicated calls to io_kiocb_ppos | * e9c6556708d3 io_uring: ensure that cached task references are always put on exit | * e0140e9da31e io_uring: fix CQ waiting timeout handling | * de77faee2801 io_uring: lock overflowing for IOPOLL | * 78e8151f04f0 io_uring: check for valid register opcode earlier | * aa4c9b3e45e2 io_uring: fix async accept on O_NONBLOCK sockets | * 4bc17e6381bd io_uring: allow re-poll if we made progress | * f901b4bfd03e io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG) | * 96ccba4a1a59 io_uring: add flag for disabling provided buffer recycling | * aadd9b093018 io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly | * abdc16c8361b io_uring: improve send/recv error handling | * 2fd232bbd66f io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL | * e84ec6e25df9 Bluetooth: hci_qca: Fix driver shutdown on closed serdev | * 1ab0098333f5 Bluetooth: hci_qca: Wait for timeout during suspend | * 413638f61501 drm/i915/gt: Reset twice | * cab2123567af ALSA: hda/realtek - Turn on power early | * 5822baf9501a efi: fix userspace infinite retry read efivars after EFI runtime services page fault | * 712bd74eccb9 nilfs2: fix general protection fault in nilfs_btree_insert() | * 03bf73e09ad6 zonefs: Detect append writes at invalid locations | * 20d0a6d17e85 Add exception protection processing for vd in axi_chan_handle_err function | * 187523fa7c2d wifi: mac80211: sdata can be NULL during AMPDU start | * 2d1fd99e8e12 wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices | * 72009139a661 f2fs: let's avoid panic if extent_tree is not created | * bf6c7f180131 x86/asm: Fix an assembler warning with current binutils | * 18bd1c9c02e6 btrfs: always report error in run_one_delayed_ref() | * 936b8b15a23b RDMA/srp: Move large values to a new enum for gcc13 | * 0040e48492f3 net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats | * f7845de23f90 tools/virtio: initialize spinlocks in vring_test.c | * 3093027183f2 selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID | * c7c36bb6eafd pNFS/filelayout: Fix coalescing test for single DS | * 2cbd815970f8 btrfs: fix trace event name typo for FLUSH_DELAYED_REFS * | 1e32d1c96a75 Revert "xhci: Prevent infinite loop in transaction errors recovery for streams" * | b0d4a37a4359 Merge 5.10.164 into android12-5.10-lts |\| | * 3a9f1b907bc4 Linux 5.10.164 | * 74985c575767 Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" | * a88a0d16e18f io_uring/io-wq: only free worker if it was allocated for creation | * b912ed1363b3 io_uring/io-wq: free worker if task_work creation is canceled | * 68bcd0638570 drm/virtio: Fix GEM handle creation UAF | * 4ca71bc0e199 efi: fix NULL-deref in init error path | * 057f5ddfbc13 arm64: cmpxchg_double*: hazard against entire exchange variable | * 9a5fd0844e7f arm64: atomics: remove LL/SC trampolines | * 28840e46eaaf arm64: atomics: format whitespace consistently | * 5dac4c7212a7 x86/resctrl: Fix task CLOSID/RMID update race | * 446c7251f007 x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI | * 196c6f0c3e21 KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID | * 0027164b24f2 Documentation: KVM: add API issues section | * caaea2ab6b6d iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() | * cf38e7624179 iommu/mediatek-v1: Add error handle for mtk_iommu_probe | * 60806adc9be0 mm: Always release pages to the buddy allocator in memblock_free_late(). | * 092f0c2d1f83 net/mlx5e: Don't support encap rules with gbp option | * b3d47227f06f net/mlx5: Fix ptp max frequency adjustment range | * 453277feb41c net/sched: act_mpls: Fix warning during failed attribute validation | * 0ca78c99656f nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() | * 92b30a27e4fa hvc/xen: lock console list traversal | * 14e72a56e16c octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable | * 8e2bfcfaabc3 octeontx2-af: Map NIX block from CGX connection | * d9be5b57ab2c octeontx2-af: Update get/set resource count functions | * 0d0675bc33e6 tipc: fix unexpected link reset due to discovery messages | * d83cac6c00b8 ASoC: wm8904: fix wrong outputs volume after power reactivation | * d4aa749e0464 regulator: da9211: Use irq handler when ready | * 3ca8ef4d91ef EDAC/device: Fix period calculation in edac_device_reset_delay_period() | * 28b9a0e216db x86/boot: Avoid using Intel mnemonics in AT&T syntax asm | * 8cbeb60320ac powerpc/imc-pmu: Fix use of mutex in IRQs disabled section | * 4e6a70fd8404 netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. | * a3a1114aa615 xfrm: fix rcu lock in xfrm_notify_userpolicy() | * 091f85db4c3f ext4: fix uninititialized value in 'ext4_evict_inode' | * 98407a4ae34b usb: ulpi: defer ulpi_register on ulpi_read_id timeout | * 3d13818a9995 xhci: Prevent infinite loop in transaction errors recovery for streams | * 2f90fcedc5d6 xhci: move and rename xhci_cleanup_halted_endpoint() | * cad965cedbc4 xhci: store TD status in the td struct instead of passing it along | * 9b63a80c45e9 xhci: move xhci_td_cleanup so it can be called by more functions | * 44c635c60f78 xhci: Add xhci_reset_halted_ep() helper function | * 10287d18f524 xhci: adjust parameters passed to cleanup_halted_endpoint() | * aaaa7cc4aba1 xhci: get isochronous ring directly from endpoint structure | * a81ace065694 xhci: Avoid parsing transfer events several times | * ba20d6056b6b clk: imx: imx8mp: add shared clk gate for usb suspend clk | * 2b331d2137cc dt-bindings: clocks: imx8mp: Add ID for usb suspend clock | * cb769960ef48 clk: imx8mp: add clkout1/2 support | * 85eaaa17c0a9 clk: imx8mp: Add DISP2 pixel clock | * 6b21077146c5 iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options | * 5badda810f69 iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands | * ab9bb65b8519 bus: mhi: host: Fix race between channel preparation and M0 event | * 6c9e2c11c33c ipv6: raw: Deduct extension header length in rawv6_push_pending_frames | * 112df4cd2b09 ixgbe: fix pci device refcount leak | * f401062d8dbd platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe | * 785607e5e6fb drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer | * 8c71777b6a17 drm/msm/adreno: Make adreno quirks not overwrite each other | * afb6063aa89f cifs: Fix uninitialized memory read for smb311 posix symlink create | * 51dbedee2ff3 s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() | * bddb35526784 s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops | * 2adc64f3e669 ASoC: qcom: lpass-cpu: Fix fallback SD line index handling | * 5ee3083307ef s390/kexec: fix ipl report address for kdump | * d1725dbf2310 perf auxtrace: Fix address filter duplicate symbol selection | * eaabceae1b70 docs: Fix the docs build with Sphinx 6.0 | * 38c4a17c6b32 efi: tpm: Avoid READ_ONCE() for accessing the event log | * c47883105cff KVM: arm64: Fix S1PTW handling on RO memslots | * 443b390f2cc9 ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx | * 550efeff989b netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits * | 2702f0975871 Revert "ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire" * | 5417a09eec77 Revert "ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio" * | c35badfe0d91 Revert "net: add atomic_long_t to net_device_stats fields" * | f1242cd1469b Revert "PM/devfreq: governor: Add a private governor_data for governor" * | 49220499939b Merge 5.10.163 into android12-5.10-lts |\| | * 19ff2d645f7a Linux 5.10.163 | * de4a20e14823 ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 | * 0ad275c139a3 ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list | * df02234e6b87 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF | * f8ed0a93b5d5 net/ulp: prevent ULP without clone op from entering the LISTEN status | * 9f7bc28a6b8a net: sched: disallow noqueue for qdisc classes | * 6eb02c596ec0 mptcp: use proper req destructor for IPv6 | * f4c7afa951ea mptcp: dedicated request sock for subflow in v6 | * 31472f94c68f mptcp: remove MPTCP 'ifdef' in TCP SYN cookies | * 5aa15a8400cc mptcp: mark ops structures as ro_after_init | * f5ef26276bb0 serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way" | * 2ecf0819e441 fsl_lpuart: Don't enable interrupts too early | * 23ad034760dd ext4: don't set up encryption key during jbd2 transaction | * d9ff5ad203b6 ext4: disable fast-commit of encrypted dir operations | * 5b700b9c0402 parisc: Align parisc MADV_XXX constants with all other architectures | * 07b3672c4090 io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() | * b57d7b1dcda1 efi: random: combine bootloader provided RNG seed with RNG protocol output | * da20f56a3532 mbcache: Avoid nesting of cache->c_list_lock under bit locks | * be01f35efa87 hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling | * 1f881d9201f6 hfs/hfsplus: use WARN_ON for sanity check | * 434909edcae3 selftests: set the BUILD variable to absolute path | * a41d63f20471 ext4: don't allow journal inode to have encrypt flag | * af90f8b36d78 drm/i915/gvt: fix vgpu debugfs clean in remove | * bb7c7b2c89d2 drm/i915/gvt: fix gvt debugfs destroy | * bc847857fbd8 riscv: uaccess: fix type of 0 variable on error in get_user() | * f64e56fb285a fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB | * d0c46b55d6d9 nfsd: fix handling of readdir in v4root vs. mount upcall timeout | * 67e39c4f4cb3 x86/bugs: Flush IBP in ib_prctl_set() | * f13301a69aba nvme: fix multipath crash caused by flush request when blktrace is enabled | * 3f257a98e54c ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet | * 6df376e24569 udf: Fix extension of the last extent in the file | * 84b2cc7b36b7 caif: fix memory leak in cfctrl_linkup_request() | * e5a05837445e drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() | * 232ef345e5d7 usb: rndis_host: Secure rndis_query check against int overflow | * 2a9ee7c24b32 drivers/net/bonding/bond_3ad: return when there's no aggregator | * bc6a0993bf8f perf tools: Fix resources leak in perf_data__open_dir() | * ee756980e491 netfilter: ipset: Rework long task execution when adding/deleting entries | * ba5d27909745 netfilter: ipset: fix hash:net,port,net hang with /0 subnet | * b2c917e510e5 net: sched: cbq: dont intepret cls results when asked to drop | * 5f65f48516bf net: sched: atm: dont intepret cls results when asked to drop | * f4a2ad100200 gpio: sifive: Fix refcount leak in sifive_gpio_probe | * 7ec369e215bf ceph: switch to vfs_inode_has_locks() to fix file lock bug | * 407710427dd5 filelock: new helper: vfs_inode_has_locks | * 9f0ff5de3e81 drm/meson: Reduce the FIFO lines held when AFBC is not used | * ae2639cd2c8c RDMA/mlx5: Fix validation of max_rd_atomic caps for DC | * 106d0d33c9d1 net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe | * 398e14bb735d net: amd-xgbe: add missed tasklet_kill | * e3d90ca90652 net/mlx5e: Fix hw mtu initializing at XDP SQ allocation | * 6d655a9d8251 net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default | * 670b20617346 net/mlx5: Avoid recovery in probe flows | * 66b92b80c95e net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path | * b6c74d237648 vhost: fix range used in translate_desc() | * 264fb6dcbfde vringh: fix range used in iotlb_translate() | * eabb3ceb04cd vhost/vsock: Fix error handling in vhost_vsock_init() | * e0f5c962c066 nfc: Fix potential resource leaks | * 513787ff9a33 qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure | * b314f6c35121 net: sched: fix memory leak in tcindex_set_parms | * 4226ce95a934 net: hns3: add interrupts re-initialization while doing VF FLR | * 998ebbdc3bb1 nfsd: shut down the NFSv4 state objects before the filecache | * 69d896b60957 veth: Fix race with AF_XDP exposing old or uninitialized descriptors | * 5f41212dc2ec vmxnet3: correctly report csum_level for encapsulated packet | * 0b70f6ea4d4f drm/panfrost: Fix GEM handle creation ref-counting | * e68e088d0d6a bpf: pull before calling skb_postpull_rcsum() | * cb0d627bc711 SUNRPC: ensure the matching upcall is in-flight upon downcall | * 1be16a0c2f10 ext4: fix deadlock due to mbcache entry corruption | * 0da99012d3f7 mbcache: automatically delete entries from cache on freeing | * 1a56cd972ce1 ext4: fix race when reusing xattr blocks | * 4cc218e217bf ext4: unindent codeblock in ext4_xattr_block_set() | * 0e6fbc566fcc ext4: remove EA inode entry from mbcache on inode eviction | * 27c08673978e mbcache: add functions to delete entry if unused | * fb59d12ae7f9 mbcache: don't reclaim used entries | * 4c363e2961cd ext4: use kmemdup() to replace kmalloc + memcpy | * b8b7922374b0 ext4: fix leaking uninitialized memory in fast-commit journal | * a5584ba9b3b6 ext4: fix various seppling typos | * adfefe804b1f ext4: simplify ext4 error translation | * 95eaa8a95358 ext4: move functions in super.c | * 769469f8f188 fs: ext4: initialize fsdata in pagecache_write() | * b33e42d65efe ext4: use memcpy_to_page() in pagecache_write() | * 60d4383c1bda mm/highmem: Lift memcpy_[to|from]_page to core | * f86d3338c87c ext4: correct inconsistent error msg in nojournal mode | * 99017eb3deee ext4: goto right label 'failed_mount3a' | * 56d87959c654 riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument | * ecb8e8b2e55f riscv/stacktrace: Fix stack output without ra on the stack top | * b5c75efd0a6c ravb: Fix "failed to switch device to config mode" message during unbind | * 5451efb2ca30 staging: media: tegra-video: fix device_node use after free | * f899baf6cb0f x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK | * 5d112deb2a02 x86/kprobes: Convert to insn_decode() | * a1766efc5bbf perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data | * b5d0f7c24088 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor | * c0a3d2158437 media: s5p-mfc: Fix in register read and write for H264 | * 8ff64edf9d16 media: s5p-mfc: Clear workbit to handle error condition | * dcd1a4ade590 media: s5p-mfc: Fix to handle reference queue during finishing | * 97e7896000ce x86/MCE/AMD: Clear DFR errors found in THR handler | * ec75bc43681b x86/mce: Get rid of msr_ops | * 58de7a95f0e6 btrfs: replace strncpy() with strscpy() | * 7a04f8500924 perf/x86/intel/uncore: Clear attr_update properly | * 53d24a9592eb perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure | * 9620f8a5c72f ARM: renumber bits related to _TIF_WORK_MASK | * 630270978483 drm/amdgpu: make display pinning more flexible (v2) | * dfc01905b870 drm/amdgpu: handle polaris10/11 overlap asics (v2) | * 30e95fdc9609 ext4: allocate extended attribute value in vmalloc area | * 8d3e87d43c62 ext4: avoid unaccounted block allocation when expanding inode | * 15d0cf84df07 ext4: initialize quota before expanding inode in setproject ioctl | * 9882601ee689 ext4: fix inode leak in ext4_xattr_inode_create() on an error path | * 407f47728c6c ext4: avoid BUG_ON when creating xattrs | * 00092b218d2b ext4: fix error code return to user-space in ext4_get_branch() | * f06c980287f1 ext4: fix corruption when online resizing a 1K bigalloc fs | * 9404839e0c9d ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline | * 84a2f2ed49d6 ext4: init quota for 'old.inode' in 'ext4_rename' | * 71e99ec1315f ext4: fix bug_on in __es_tree_search caused by bad boot loader inode | * 9020f56a3cad ext4: check and assert if marking an no_delete evicting inode dirty | * 86c2a2ec4bd3 ext4: fix reserved cluster accounting in __es_remove_extent() | * 98004f926d27 ext4: fix bug_on in __es_tree_search caused by bad quota inode | * 20af66617eef ext4: add helper to check quota inums | * c0a738875c2e ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode | * f9cd6980800b ext4: fix undefined behavior in bit shift for ext4_check_flag_values | * 7223d5e75f26 ext4: fix use-after-free in ext4_orphan_cleanup | * d6d18d6e2d06 ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop | * bdc698ce91f2 ext4: silence the warning when evicting inode with dioread_nolock | * 68af1a4842b4 drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() | * bf83a303f2b5 drm/i915/dsi: fix VBT send packet port selection for dual link DSI | * 439cbbc15195 drm/vmwgfx: Validate the box size for the snooped cursor | * 0a0662d597de drm/connector: send hotplug uevent on connector cleanup | * 21a773ec8994 device_cgroup: Roll back to original exceptions after copy failure | * 3505c187b861 parisc: led: Fix potential null-ptr-deref in start_task() | * 2c7c487cd850 remoteproc: core: Do pm_relax when in RPROC_OFFLINE state | * e291dea722de iommu/amd: Fix ivrs_acpihid cmdline parsing code | * 28e71fd8d5d9 driver core: Fix bus_type.match() error handling in __driver_attach() | * 772dbbfc2084 crypto: n2 - add missing hash statesize | * 7c44205748ed PCI/sysfs: Fix double free in error path | * 99ef6cc79158 PCI: Fix pci_device_is_present() for VFs by checking PF | * f29d127b372e ipmi: fix use after free in _ipmi_destroy_user() | * bfe1e039a0fd ima: Fix a potential NULL pointer access in ima_restore_measurement_list | * 62307558e71e mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() | * 4e17819cb302 ipmi: fix long wait in unload when IPMI disconnect | * 24bc27ea4e71 ASoC: jz4740-i2s: Handle independent FIFO flush bits | * 652f1d66a8be wifi: wilc1000: sdio: fix module autoloading | * d9f6614a732b efi: Add iMac Pro 2017 to uefi skip cert quirk | * ffcf71676d3b md/bitmap: Fix bitmap chunk size overflow issues | * e94443252b46 rtc: ds1347: fix value written to century register | * 6155aed4768c cifs: fix missing display of three mount options | * 8c82733e2408 cifs: fix confusing debug message | * 3df07728abde media: dvb-core: Fix UAF due to refcount races at releasing | * 7dd5a68cdbbb media: dvb-core: Fix double free in dvb_register_device() | * 1032520b2109 ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod | * 1306614412b8 staging: media: tegra-video: fix chan->mipi value on error | * 52c0622e53ea tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line | * b838b1b9ca70 tracing/hist: Fix wrong return value in parse_action_params() | * ff3dd2c1befe x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK | * 362495bf451f ftrace/x86: Add back ftrace_expected for ftrace bug reports | * b677629caebb x86/microcode/intel: Do not retry microcode reloading on the APs | * 43dd254853aa KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails | * e61eacf99364 perf/core: Call LSM hook after copying perf_event_attr | * 0cb31bd88361 tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' | * 18a489a3fda7 dm cache: set needs_check flag after aborting metadata | * 2b17026685a2 dm cache: Fix UAF in destroy() | * 342cfd8426df dm clone: Fix UAF in clone_dtr() | * a506b5c92757 dm integrity: Fix UAF in dm_integrity_dtr() | * 34fe9c2251f1 dm thin: Fix UAF in run_timer_softirq() | * c84d1ca2285b dm thin: resume even if in FAIL mode | * 94f01ecc2aa0 dm thin: Use last transaction's pmd->root when commit failed | * 7e3757806973 dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata | * b45e77b79215 dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort | * d9fa243ab26c ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops | * 2437b0622342 ALSA: patch_realtek: Fix Dell Inspiron Plus 16 | * e379b88a8f8c cpufreq: Init completion before kobject_init_and_add() | * cea018aaf721 PM/devfreq: governor: Add a private governor_data for governor | * d1d73c303458 selftests: Use optional USERCFLAGS and USERLDFLAGS | * 12576d2ebf65 arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength | * 8546f11c42bd ARM: ux500: do not directly dereference __iomem | * 0061ab5153fb btrfs: fix resolving backrefs for inline extent followed by prealloc | * c0aa6e6ab08d mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K | * e918762f8a08 arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength | * c023597baecb jbd2: use the correct print format | * 8c444b3061f0 ktest.pl minconfig: Unset configs instead of just removing them | * 5148dfceab55 kest.pl: Fix grub2 menu handling for rebooting | * 780297af3c85 soc: qcom: Select REMAP_MMIO for LLCC driver | * d5db9aaf1b47 media: stv0288: use explicitly signed char | * 25dbd87379f8 net/af_packet: make sure to pull mac header | * c2137d565ceb net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO | * 7c15d7ecce00 rcu: Prevent lockdep-RCU splats on lock acquisition/release | * 4c57f612f433 torture: Exclude "NOHZ tick-stop error" from fatal errors | * 289f512d08c4 wifi: rtlwifi: 8192de: correct checking of IQK reload | * 0f6d6974b08e wifi: rtlwifi: remove always-true condition pointed out by GCC 12 | * 40b844796b6b net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow() | * 8b20aab8cfd0 ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire | * 185c141946e0 ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio | * 7b3631a2e17d kcsan: Instrument memcpy/memset/memmove with newer Clang | * 2cd6026e2573 SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails | * 3b6c822238da tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak | * 0bd9b4be721c tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak | * 8ddc48068ac8 tpm: acpi: Call acpi_put_table() to fix memory leak | * b51d5fed9f53 mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING | * 252a72088280 f2fs: should put a page when checking the summary info | * 882734bbc587 mm, compaction: fix fast_isolate_around() to stay within boundaries | * ae7793027766 md: fix a crash in mempool_free | * b591b2919d01 pnode: terminate at peers of source | * 66f359ad66d4 ALSA: line6: fix stack overflow in line6_midi_transmit | * 5e79f77ea42f ALSA: line6: correct midi status byte when receiving data from podxt | * 56abf8046bc1 ovl: Use ovl mounter's fsuid and fsgid in ovl_link() | * c3e8bbcbaa87 binfmt: Fix error return code in load_elf_fdpic_binary() | * 12407462d3fc hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount | * 44cf50587e82 pstore/zone: Use GFP_ATOMIC to allocate zone buffer | * 0d992c044cfb HID: plantronics: Additional PIDs for double volume key presses quirk | * eaf0b782269f HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint | * 6f7e2fcab733 powerpc/rtas: avoid scheduling in rtas_os_term() | * f2167f10fcca powerpc/rtas: avoid device tree lookups in rtas_os_term() | * 0af0e115ff59 objtool: Fix SEGFAULT | * 57ae492f620c nvmet: don't defer passthrough commands with trivial effects to the workqueue | * 4b3282a9779c nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition | * ab711f3eda7a ata: ahci: Fix PCS quirk application for suspend | * cc512539c44f nvme-pci: fix page size checks | * dfb6d54893d5 nvme-pci: fix mempool alloc size | * f5d8738fbe33 nvme-pci: fix doorbell buffer value endianness | * fe6ea044c4f0 cifs: fix oops during encryption | * f9089b95548f usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init | * ce2462bcf3ff pwm: tegra: Fix 32 bit build | * a8be7c2787b9 media: dvbdev: fix refcnt bug | * 153319671a08 media: dvbdev: fix build warning due to comments | * 740c537f52c1 ovl: fix use inode directly in rcu-walk mode | * f24474d12e68 gcov: add support for checksum field | * 36be7afca103 regulator: core: fix deadlock on regulator enable | * e12f4c321247 iio: adc128s052: add proper .data members in adc128_of_match table | * 9f604702b765 iio: adc: ad_sigma_delta: do not use internal iio_dev lock | * 582f5fc2c586 reiserfs: Add missing calls to reiserfs_security_free() | * 08371068fff8 HID: mcp2221: don't connect hidraw | * 7a203471b980 HID: wacom: Ensure bootloader PID is usable in hidraw mode | * 723ffde78af5 usb: dwc3: core: defer probe on ulpi_read_id timeout | * d17c82aad67a usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode | * 2b725b6fbbe6 ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list | * c863b673503e ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB | * d3767082ebfa ALSA: usb-audio: add the quirk for KT0206 device | * 7691fa41024e ima: Simplify ima_lsm_copy_rule | * 1d8dcc3dadf9 pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES | * 07b0ce902e28 afs: Fix lost servers_outstanding count | * 1080729b9a56 perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() | * 1c7b03d00c07 pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion | * c3607ed7edfb LoadPin: Ignore the "contents" argument of the LSM hooks | * 4138e1b7751c ASoC: rt5670: Remove unbalanced pm_runtime_put() | * fd49dc17c3d7 ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() | * c0ae46693b85 ASoC: wm8994: Fix potential deadlock | * e4a8573b0460 ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() | * 06c9d468c068 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() | * 812a18e48efb ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() | * c2eb1a3877f5 ASoC: Intel: Skylake: Fix driver hang during shutdown | * 72c0e552bc86 ALSA: hda: add snd_hdac_stop_streams() helper | * d3a8925d6c1d ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c | * 2727dbfe8d06 hwmon: (jc42) Fix missing unlock on error in jc42_write() | * a076490b0211 orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() | * b8affa0c6405 orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() | * 6e3c4d3fa5d4 drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() | * f3d3f3564e8b drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() | * dcd28191be9b hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() | * efd025f32fce clk: st: Fix memory leak in st_of_quadfs_setup() | * 1c6447d0fc68 media: si470x: Fix use-after-free in si470x_int_in_callback() | * a63a1ae13469 mmc: renesas_sdhi: better reset from HS400 mode | * 58e21146c0f9 mmc: f-sdh30: Add quirks for broken timeout clock capability | * 4b737246ff50 regulator: core: fix use_count leakage when handling boot-on | * 17c2eb9ce8c1 libbpf: Avoid enum forward-declarations in public API in C++ mode | * e8022da1fa2f blk-mq: fix possible memleak when register 'hctx' failed | * 7d7ab25ead96 media: dvb-usb: fix memory leak in dvb_usb_adapter_init() | * 2abd73433872 media: dvbdev: adopts refcnt to avoid UAF | * b42580c8d8aa media: dvb-frontends: fix leak of memory fw | * dd1e1bf916da ethtool: avoiding integer overflow in ethtool_phys_id() | * 329a76635548 bpf: Prevent decl_tag from being referenced in func_proto arg | * 148dcbd3af03 ppp: associate skb with a device at tx | * 755eb0879224 mrp: introduce active flags to prevent UAF when applicant uninit | * 037db10e3f93 net: add atomic_long_t to net_device_stats fields | * e2d60023aff4 drm/amd/display: fix array index out of bound error in bios parser | * 10d713532ffc md/raid1: stop mdx_raid1 thread when raid1 array run failed | * 100caacfa0ed drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() | * 7d86851c304a drm/sti: Use drm_mode_copy() | * dd31d7304018 drm/rockchip: Use drm_mode_copy() | * 4f238212c7c0 drm/msm: Use drm_mode_copy() | * ebc3c77785dc s390/lcs: Fix return type of lcs_start_xmit() | * 3ac0217ca918 s390/netiucv: Fix return type of netiucv_tx() | * eeb75f80bceb s390/ctcm: Fix return type of ctc{mp,}m_tx() | * 9606bbc271ac drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback | * a42a23bdae61 drm/amdgpu: Fix type of second parameter in trans_msg() callback | * 3cb18dea1119 igb: Do not free q_vector unless new one was allocated | * 87792567d9ed wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() | * e7aa8a4709d4 hamradio: baycom_epp: Fix return type of baycom_send_packet() | * 5b0b6553bf4a net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() | * 6d935a02658b bpf: make sure skb->len != 0 when redirecting to a tunneling device | * ebc2fb6afc98 qed (gcc13): use u16 for fid to be big enough | * 648cdb8bf376 drm/amd/display: prevent memory leak | * c69bc8e34df4 ipmi: fix memleak when unload ipmi driver | * be4cd23cd36b ASoC: codecs: rt298: Add quirk for KBL-R RVP platform | * 8af52492717e wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out | * 1824ccabee54 wifi: ath9k: verify the expected usb_endpoints are present | * 2e8bb402b060 brcmfmac: return error when getting invalid max_flowrings from dongle | * 6cd4865bb4be drm/etnaviv: add missing quirks for GC300 | * 4fd3a11804c8 hfs: fix OOB Read in __hfs_brec_find | * 6edd0cdee578 acct: fix potential integer overflow in encode_comp_t() | * ec93b5430ec0 nilfs2: fix shift-out-of-bounds due to too large exponent of block size | * d464b035c061 nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() | * b0b83d3f3ffa ACPICA: Fix error code path in acpi_ds_call_control_method() | * 911999b19373 fs: jfs: fix shift-out-of-bounds in dbDiscardAG | * 40dba68d4182 udf: Avoid double brelse() in udf_rename() | * 3e997e4ce8ae fs: jfs: fix shift-out-of-bounds in dbAllocAG | * dcbc51d31d0a binfmt_misc: fix shift-out-of-bounds in check_special_flags | * 22c1d8f24cdb x86/hyperv: Remove unregister syscore call from Hyper-V cleanup | * 9b267051c82a video: hyperv_fb: Avoid taking busy spinlock on panic path | * 0461a8c278b8 arm64: make is_ttbrX_addr() noinstr-safe | * 5a52380b8193 rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() | * 906249381167 net: stream: purge sk_error_queue in sk_stream_kill_queues() | * 7c3a20bfd23b myri10ge: Fix an error handling path in myri10ge_probe() | * 3c973736909f rxrpc: Fix missing unlock in rxrpc_do_sendmsg() | * 5c544c7c6afa net_sched: reject TCF_EM_SIMPLE case for complex ematch module | * a39b4de0804f mailbox: zynq-ipi: fix error handling while device_register() fails | * 821be5a5ab09 skbuff: Account for tail adjustment during pull operations | * 6736b61ecf23 openvswitch: Fix flow lookup to use unmasked key | * ea14220031b3 selftests: devlink: fix the fd redirect in dummy_reporter_test | * 57ce1a36c060 rtc: mxc_v2: Add missing clk_disable_unprepare() | * 1e2a27dab1e5 igc: Set Qbv start_time and end_time to end_time if not being configured in GCL | * edb995b5ec32 igc: Lift TAPRIO schedule restriction | * b48d3db89161 igc: recalculate Qbv end_time by considering cycle time | * 3f2a944c23e8 igc: Add checking for basetime less than zero | * a0e2295c2aed igc: Use strict cycles for Qbv scheduling | * 413fe82420aa igc: Enhance Qbv scheduling by using first flag bit | * a8f9698a05b5 net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME | * ae5d96bae3cc net: igc: use skb_csum_is_sctp instead of protocol check | * 4794d07fe635 net: add inline function skb_csum_is_sctp | * 67349025f00d net: switch to storing KCOV handle directly in sk_buff | * 3d5f83a62e82 r6040: Fix kmemleak in probe and remove | * aea9e64dec2c nfc: pn533: Clear nfc_target before being used | * 6939f84e5369 mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() | * b58c8719666d mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() | * 30e0a066b611 mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() | * 2a930b75bf93 net: macsec: fix net device access prior to holding a lock | * c1207219a4bf nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure | * 452e85cc3edf NFSD: Remove spurious cb_setup_err tracepoint | * 09c007e23923 rtc: pcf85063: fix pcf85063_clkout_control | * e9453c13ae9c rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() | * 34836c592345 rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() | * 8e65e707640b netfilter: flowtable: really fix NAT IPv6 offload | * 1f5571cb1d7b powerpc/pseries/eeh: use correct API for error log size | * 9dc96fee2648 powerpc/eeh: Drop redundant spinlock initialization | * 12654b7d8deb remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() | * be5816b27bff remoteproc: qcom_q6v5_pas: detach power domains on remove | * 582dd58a186c remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove | * e4539eb5c0c3 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() | * 6a65f4644b65 pwm: sifive: Call pwm_sifive_update_clock() while mutex is held | * 57f215a23167 iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY | * dc02d8e59d36 selftests/powerpc: Fix resource leaks | * 464506de9bb3 powerpc/hv-gpci: Fix hv_gpci event list | * 0abfe735be54 powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() | * da1a33795dfd powerpc/perf: callchain validate kernel stack pointer bounds | * 8d2ff5b3e28d kbuild: refactor single builds of *.ko | * e3bdda22b49e kbuild: unify modules(_install) for in-tree and external modules | * e2155129599f kbuild: remove unneeded mkdir for external modules_install | * 195cb98861dc powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() | * f0bd6504e580 powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds | * 76957b6aed99 powerpc/xmon: Enable breakpoints on 8xx | * 81c8bbf5b2b5 cxl: Fix refcount leak in cxl_calc_capp_routing | * 40b4be399e0d powerpc/52xx: Fix a resource leak in an error handling path | * 7fded04fbbb8 macintosh/macio-adb: check the return value of ioremap() | * 2ac0a7059b7b macintosh: fix possible memory leak in macio_add_one_device() | * 0d240ac0e4c3 iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() | * 03f51c729975 iommu/amd: Fix pci device refcount leak in ppr_notifier() | * 3929576f10ea rtc: pcf85063: Fix reading alarm | * aaed333e2237 rtc: snvs: Allow a time difference on clock register read | * f0c36ea4248a rtc: cmos: Disable ACPI RTC event on removal | * ca8cb20c2254 rtc: cmos: Rename ACPI-related functions | * 9f9923baa291 rtc: cmos: Eliminate forward declarations of some functions | * 462db582e8eb rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() | * 14ad1353c515 rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() | * 45b96601a6ec rtc: cmos: fix build on non-ACPI platforms | * f2ece2c722be rtc: cmos: Fix wake alarm breakage | * 0bcfccb48696 rtc: cmos: Fix event handler registration ordering issue | * 5814d77e2f72 rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 | * 490b233677de dmaengine: idxd: Fix crc_val field for completion record | * a42e95547522 pwm: tegra: Improve required rate calculation | * ddd2bb08bd99 include/uapi/linux/swab: Fix potentially missing __always_inline | * c2a98433421e phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices | * ca31ad0932af iommu/sun50i: Fix flush size | * 147af0c1e7fd iommu/sun50i: Fix R/W permission check | * 3a63c4ff57bf iommu/sun50i: Consider all fault sources for reset | * 160b92ab4a25 iommu/sun50i: Fix reset release | * aeef93416c09 RDMA/siw: Fix pointer cast warning | * 5beadb55f4e3 power: supply: fix null pointer dereferencing in power_supply_get_battery_info | * 72283ecfdc84 HSI: omap_ssi_core: Fix error handling in ssi_init() | * 73ca3b19d902 perf symbol: correction while adjusting symbol | * c8e77bd7499f perf trace: Handle failure when trace point folder is missed | * bd29da58046a perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number | * 6364577ae225 perf trace: Return error if a system call doesn't exist | * 1d6d90994a8d power: supply: fix residue sysfs file in error handle route of __power_supply_register() | * ae2eb995abb9 HSI: omap_ssi_core: fix possible memory leak in ssi_probe() | * 6ba4b00f8837 HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() | * ee13e2aec330 fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() | * 164857bc0223 fbdev: vermilion: decrease reference count in error path | * 71bca42bc44f fbdev: via: Fix error in via_core_init() | * 3922415e4c3f fbdev: pm2fb: fix missing pci_disable_device() | * f279a7af799d fbdev: ssd1307fb: Drop optional dependency | * c56c1449ccc3 thermal/drivers/imx8mm_thermal: Validate temperature range | * 86fa7bb4e2d5 samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() | * 962f869b3678 tracing/hist: Fix issue of losting command info in error_log | * b7bf15aa1973 usb: storage: Add check for kcalloc | * 9ac541a0898e i2c: ismt: Fix an out-of-bounds bug in ismt_access() | * 61df25c41b8e i2c: mux: reg: check return value after calling platform_get_resource() | * 6d79546622ba gpiolib: cdev: fix NULL-pointer dereferences | * aeee7ad0897f gpiolib: Get rid of redundant 'else' | * 37d3de40c1ff vme: Fix error not catched in fake_init() | * b9fa01fb3140 staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() | * daa8045a9913 staging: rtl8192u: Fix use after free in ieee80211_rx() | * 46b3885c8cb4 i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe | * c46db6088bcc chardev: fix error handling in cdev_device_add() | * 7b289b791a59 mcb: mcb-parse: fix error handing in chameleon_parse_gdd() | * 0d1c2c8db289 drivers: mcb: fix resource leak in mcb_probe() | * e88b89a096af usb: gadget: f_hid: fix refcount leak on error path | * 1b6a53e447ec usb: gadget: f_hid: fix f_hidg lifetime vs cdev | * 52302c30b218 usb: gadget: f_hid: optional SETUP/SET_REPORT mode | * c3767f81056b usb: roles: fix of node refcount leak in usb_role_switch_is_parent() | * 07905a92497c counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update | * bb5e9402b24e iio: adis: add '__adis_enable_irq()' implementation | * 3feb8fd8bf93 iio:imu:adis: Move exports into IIO_ADISLIB namespace | * 83e321a2ec4d iio: adis: stylistic changes | * d1b73eebc70d iio: adis: handle devices that cannot unmask the drdy pin | * 8eb2a679c603 iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable | * 50aaa6b1742c genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() | * 6b22e715bb5b iio: temperature: ltc2983: make bulk write buffer DMA-safe | * 0f63c0ddc2ea cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() | * 170e8c2d2b61 cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() | * d34742245e43 firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() | * 0f67ed565f20 misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os | * 57c857353d50 misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() | * a40e1b0a922a ocxl: fix pci device refcount leak when calling get_function_0() | * 7525741cb302 misc: ocxl: fix possible name leak in ocxl_file_register_afu() | * 0b5a89e8bce1 test_firmware: fix memory leak in test_firmware_init() | * d7c4331c073a serial: sunsab: Fix error handling in sunsab_init() | * a26b13d158ae serial: altera_uart: fix locking in polling mode | * 8ff88d007f1b tty: serial: altera_uart_{r,t}x_chars() need only uart_port | * af320d1a3cef tty: serial: clean up stop-tx part in altera_uart_tx_chars() | * 07f4ca68b0f6 serial: pch: Fix PCI device refcount leak in pch_request_dma() | * 46d08b0e0be5 serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. | * d5b16eb076f4 serial: amba-pl011: avoid SBSA UART accessing DMACR register | * fab27438abe2 usb: typec: tipd: Fix spurious fwnode_handle_put in error path | * d3b6c28a71f1 usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() | * 1ca02df871ad usb: typec: Check for ops->exit instead of ops->enter in altmode_exit | * 5d2b286eb034 staging: vme_user: Fix possible UAF in tsi148_dma_list_add | * 775a6f8bed87 usb: fotg210-udc: Fix ages old endianness issues | * 2fcb7c7d5219 uio: uio_dmem_genirq: Fix deadlock between irq config and handling | * 9bf7a0b2b15c uio: uio_dmem_genirq: Fix missing unlock in irq configuration | * 27b612bd09bd vfio: platform: Do not pass return buffer to ACPI _RST method | * 18a720064695 class: fix possible memory leak in __class_register() | * 7e74868a38b4 serial: tegra: Read DMA status before terminating | * fce9890e1be4 drivers: dio: fix possible memory leak in dio_init() | * d21714134505 IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces | * aa96aff394a5 hwrng: geode - Fix PCI device refcount leak | * 5998e5c30e83 hwrng: amd - Fix PCI device refcount leak | * 38da26c8552e crypto: img-hash - Fix variable dereferenced before check 'hdev->req' | * 15ca14894018 RDMA/hns: Fix page size cap from firmware | * 83b2c33b53b2 RDMA/hns: Fix PBL page MTR find | * 73ab1c956a32 orangefs: Fix sysfs not cleanup when dev init failed | * 0c53bb661f0a RDMA/srp: Fix error return code in srp_parse_options() | * 7cbf2fc276f7 RDMA/hfi1: Fix error return code in parse_platform_config() | * 61c5b47c5b28 riscv/mm: add arch hook arch_clear_hugepage_flags | * 09814c669d18 crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() | * 75c7b5d6b534 crypto: amlogic - Remove kcalloc without check | * 357f3e175630 RDMA/nldev: Fix failure to send large messages | * 25a8dabaabf6 f2fs: avoid victim selection from previous victim section | * d1b85d288345 RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() | * ad27f74e901f scsi: snic: Fix possible UAF in snic_tgt_create() | * 22e8c7a56bb1 scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails | * f4ba143b04a1 scsi: ipr: Fix WARNING in ipr_init() | * b520a3279681 scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() | * 9d0ad1e2bae7 scsi: fcoe: Fix possible name leak when device_register() fails | * 2b142f6046ce scsi: scsi_debug: Fix a warning in resp_report_zones() | * eaa71cdae88a scsi: scsi_debug: Fix a warning in resp_verify() | * ac5cfe8bbbf9 scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() | * f671a3f2869d scsi: hpsa: Fix error handling in hpsa_add_sas_host() | * ce1a69cc8500 scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() | * 7ccfc2bb5879 padata: Fix list iterator in padata_do_serial() | * 8e0681dd4eee padata: Always leave BHs disabled when running ->parallel() | * 4a99e6a1049c crypto: tcrypt - Fix multibuffer skcipher speed test mem leak | * c808edbf580b scsi: hpsa: Fix possible memory leak in hpsa_init_one() | * 6bb5a62bfd62 RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed | * 164fa80330a8 RDMA/hns: fix memory leak in hns_roce_alloc_mr() | * 3d47544ba0c7 crypto: ccree - Make cc_debugfs_global_fini() available for module init function | * 34bab85c2e1f RDMA/hfi: Decrease PCI device reference count in error path | * d8f2a0bc52a8 PCI: Check for alloc failure in pci_request_irq() | * 8b5f1af3352a RDMA/hns: Fix ext_sge num error when post send | * cc5e9153586a RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() | * ed97ade655ea crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() | * 2dfe1d221e1a crypto: cryptd - Use request context instead of stack for sub-request | * 1ab9e15b1441 crypto: ccree - Remove debugfs when platform_driver_register failed | * 33260f4c3ed3 scsi: scsi_debug: Fix a warning in resp_write_scat() | * 917bf4c0a76d RDMA/siw: Set defined status for work completion with undefined status | * 237a8936d621 RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port | * 75af03fdf35a RDMA/siw: Fix immediate work request flush to completion queue | * ef8e236832fb f2fs: fix normal discard process | * 9a32aa87a25d apparmor: Fix memleak in alloc_ns() | * 417ef568a725 crypto: rockchip - rework by using crypto_engine | * 6cd8bbb089be crypto: rockchip - delete unneeded variable initialization | * de041a2e7091 crypto: rockchip - remove non-aligned handling | * 0971bc99d124 crypto: rockchip - better handle cipher key | * b0b9635f09e0 crypto: rockchip - add fallback for ahash | * fbd5f112dc9d crypto: rockchip - add fallback for cipher | * 86f1e7f46ba9 crypto: rockchip - do not store mode globally | * a13c0ff862af crypto: rockchip - do not do custom power management | * f1acf7e69355 f2fs: Fix the race condition of resize flag between resizefs | * c42d8120bf47 PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled | * 16db9aaa4151 RDMA/core: Fix order of nldev_exit call | * 9784b01eb46c PCI: dwc: Fix n_fts[] array overrun | * 6962f682d0c3 apparmor: Use pointer to struct aa_label for lbs_cred | * f4c917a4b030 scsi: core: Fix a race between scsi_done() and scsi_timeout() | * 3bebfa5f9345 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() | * ee3cffc38efe crypto: sun8i-ss - use dma_addr instead u32 | * bf4d7c66a18a apparmor: Fix abi check to include v8 abi | * 78629ca972ac apparmor: fix lockdep warning when removing a namespace | * 935d86b29093 apparmor: fix a memleak in multi_transaction_new() | * f694e627c603 stmmac: fix potential division by 0 | * 815b961c71af Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() | * 4002180e0761 Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() | * 82256faaeb3a Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() | * 33af776a8d98 Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() | * 5991402fe091 Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() | * 0169acb41bc8 Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() | * f7dc27702b59 Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() | * 214346a51724 sctp: sysctl: make extra pointers netns aware | * 13286ad1c7c4 ntb_netdev: Use dev_kfree_skb_any() in interrupt context | * 4df544f592ad net: lan9303: Fix read error execution path | * 39b48a92edaf can: tcan4x5x: Remove invalid write in clear_interrupts | * 334c9fb89232 net: amd-xgbe: Check only the minimum speed for active/passive cables | * 03ea9ba5fd23 net: amd-xgbe: Fix logic around active and passive cables | * 8eb5f8ae5132 net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() | * ee3b1364af26 hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() | * b242358a27a7 net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() | * decede59ea06 net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() | * c43def060cae net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() | * 0e23250149f4 net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() | * 91f09a776ae3 net/tunnel: wait until all sk_user_data reader finish before releasing the sock | * 51e2d1b84aca net: farsync: Fix kmemleak when rmmods farsync | * 0b3f452d0cf7 ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() | * 2b4af99b4486 of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() | * 14b349a15c29 drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() | * 787d1bae7f11 net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() | * 8ed99944572b net: defxx: Fix missing err handling in dfx_init() | * e2227eee7ae1 net: vmw_vsock: vmci: Check memcpy_from_msg() | * 3e8fd1d0fab4 clk: socfpga: Fix memory leak in socfpga_gate_init() | * 4b672ee71c1c clk: socfpga: use clk_hw_register for a5/c5 | * ae8190f19f96 clk: socfpga: clk-pll: Remove unused variable 'rc' | * 782d0444eac9 blktrace: Fix output non-blktrace event when blk_classic option enabled | * 2484f1596480 wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() | * f89c0fbb8bdb wifi: rtl8xxxu: Fix the channel width reporting | * d43003724879 wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h | * 7f3b4fa48222 spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode | * da13355bb996 clk: samsung: Fix memory leak in _samsung_clk_register_pll() | * d9b37ea8869e media: coda: Add check for kmalloc | * 35ddd00b3658 media: coda: Add check for dcoda_iram_alloc | * 6fdb8661b964 media: c8sectpfe: Add of_node_put() when breaking out of loop | * 0b1e96d3fd6a mmc: mmci: fix return value check of mmc_add_host() | * 1922def5cb13 mmc: wbsd: fix return value check of mmc_add_host() | * 63400da6cd37 mmc: via-sdmmc: fix return value check of mmc_add_host() | * 64b2c441171f mmc: meson-gx: fix return value check of mmc_add_host() | * fb3d596267a9 mmc: omap_hsmmc: fix return value check of mmc_add_host() | * 00ac0f5f9592 mmc: atmel-mci: fix return value check of mmc_add_host() | * 9bedf64dda84 mmc: wmt-sdmmc: fix return value check of mmc_add_host() | * 3049a3b927a4 mmc: vub300: fix return value check of mmc_add_host() | * aabbedcb6c9a mmc: toshsd: fix return value check of mmc_add_host() | * 7fa922c7a3dd mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() | * b896a9b7a0c3 mmc: pxamci: fix return value check of mmc_add_host() | * 3904eb97bb78 mmc: mxcmmc: fix return value check of mmc_add_host() | * 7c3b301ca8b0 mmc: moxart: fix return value check of mmc_add_host() | * 4a6e5d022280 mmc: alcor: fix return value check of mmc_add_host() | * 81ea3d964f2b NFSv4.x: Fail client initialisation if state manager thread can't run | * 3fbc3c78fa32 SUNRPC: Fix missing release socket in rpc_sockname() | * be7d90fc3a8f xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() | * 064912935921 ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt | * 7df1fbe49bd2 media: saa7164: fix missing pci_disable_device() | * 46a9b31369d7 ALSA: pcm: Set missing stop_operating flag at undoing trigger start | * be719496ae6a bpf, sockmap: fix race in sock_map_free() | * 8c3ef38a0d58 hwmon: (jc42) Restore the min/max/critical temperatures on resume | * e7720ef53b23 hwmon: (jc42) Convert register access and caching to regmap/regcache | * 6a03c31d08f9 regulator: core: fix resource leak in regulator_register() | * 74ac7c9ee2d4 configfs: fix possible memory leak in configfs_create_dir() | * 0cf92d235692 hsr: Synchronize sequence number updates. | * c671f2d10d83 hsr: Synchronize sending frames to have always incremented outgoing seq nr. | * 28921ec555d5 hsr: Disable netpoll. | * 8cee8543f002 net: hsr: generate supervision frame without HSR/PRP tag | * 38d13a2a9e52 hsr: Add a rcu-read lock to hsr_forward_skb(). | * ee4425e81d9b clk: qcom: clk-krait: fix wrong div2 functions | * 6f25402d8a00 regulator: core: fix module refcount leak in set_supply() | * f532db69ab13 wifi: mt76: fix coverity overrun-call in mt76_get_txpower() | * 4ecb7a6e61b1 wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails | * b2c0b94f4837 wifi: mac80211: fix memory leak in ieee80211_if_add() | * b0163248dbaf spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE | * ab19f402a12d bonding: uninitialized variable in bond_miimon_inspect() | * c58df40e3e67 bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect | * 28e4a763cd4a bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data | * 429a2a4258d5 netfilter: conntrack: set icmpv6 redirects as RELATED | * cd0e9ee50cb5 ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe | * 7c1ddf7c664b drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() | * 3991d98a8a07 drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() | * a012cdd4fd62 drm/amd/pm/smu11: BACO is supported when it's in BACO state | * 57491967ad8f ASoC: mediatek: mt8173: Enable IRQ when pdata is ready | * 52c9ad56c19d ASoC: mediatek: mt8173: Fix debugfs registration for components | * ae966649f665 wifi: iwlwifi: mvm: fix double free on tx path. | * ae66695aa1eb ALSA: asihpi: fix missing pci_disable_device() | * 5458bc0f9df6 NFS: Fix an Oops in nfs_d_automount() | * bc60485b9347 NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn | * d16d7870fd8f NFSv4.2: Fix initialisation of struct nfs4_label | * 15feece7afcf NFSv4.2: Fix a memory stomp in decode_attr_security_label | * 58a1023eb5f7 NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding | * 193691ff5b76 ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd | * 6013c3de9557 ASoC: dt-bindings: wcd9335: fix reset line polarity in example | * cf2cbca71472 drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() | * 54ab1276001b media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC | * 559891d430e3 media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() | * e34cf6caccf5 media: dvb-core: Fix ignored return value in dvb_register_frontend() | * 05be5d56f7ad pinctrl: pinconf-generic: add missing of_node_put() | * 9916497a1239 clk: imx: replace osc_hdmi with dummy | * dabf7b675c16 media: imon: fix a race condition in send_packet() | * 14d85b600bb1 media: vimc: Fix wrong function called when vimc_init() fails | * 4518d7cc38b7 ASoC: qcom: Add checks for devm_kcalloc | * b73fac67f355 drbd: fix an invalid memory access caused by incorrect use of list iterator | * 1d0c2b762dad mtd: maps: pxa2xx-flash: fix memory leak in probe | * 7d1e0d237c4c bonding: fix link recovery in mode 2 when updelay is nonzero | * 3725a8f26bdb drm/amdgpu: fix pci device refcount leak | * f4d70c139d31 clk: rockchip: Fix memory leak in rockchip_clk_register_pll() | * a065be02433e regulator: core: use kfree_const() to free space conditionally | * d7198b63cbee ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT | * 88550b444647 ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT | * ad2d0a3dc224 HID: hid-sensor-custom: set fixed size for custom attributes | * 0d6ae25da5cb bpf: Move skb->len == 0 checks into __bpf_redirect | * 9920e87a84ec inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() | * 49aa080951aa media: videobuf-dma-contig: use dma_mmap_coherent | * 847006001953 media: platform: exynos4-is: Fix error handling in fimc_md_init() | * 49060c0da57a media: solo6x10: fix possible memory leak in solo_sysfs_init() | * 0369af6fe33d media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() | * 3afd738e7712 Input: elants_i2c - properly handle the reset GPIO when power is off | * 0919982a1744 mtd: lpddr2_nvm: Fix possible null-ptr-deref | * effbf636162b wifi: ath10k: Fix return value in ath10k_pci_init() | * adf03c309968 ima: Fix misuse of dereference of pointer in template_desc_init_fields() | * 3bd737289c26 integrity: Fix memory leakage in keyring allocation error path | * 102df01caf5e drm/fourcc: Fix vsub/hsub for Q410 and Q401 | * 6f6a99fb620d drm/fourcc: Add packed 10bit YUV 4:2:0 format | * 85273b4a7076 amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() | * f48c474efe05 regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() | * 21a1409e8cf7 ASoC: pxa: fix null-pointer dereference in filter() | * 698bbaf0b4ed drm/mediatek: Modify dpi power on/off sequence. | * b4b30f56ec51 drm/radeon: Add the missed acpi_put_table() to fix memory leak | * cea79ae89b6b rxrpc: Fix ack.bufferSize to be 0 when generating an ack | * 00fce49d142d net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() | * 3d5cab726e3b media: camss: Clean up received buffers on failed start of streaming | * 61c96d99d42c wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port | * 624438195c32 Input: joystick - fix Kconfig warning for JOYSTICK_ADC | * 330bc5533e8a mtd: Fix device name leak when register device failed in add_mtd_device() | * 1a79539f4e8b clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs | * e1989d808b86 bpf: propagate precision across all frames, not just the last one | * cdd73a5ed084 bpf: Check the other end of slot_type for STACK_SPILL | * 42b2b7382aab bpf: propagate precision in ALU/ALU64 operations | * 7fc38327fd64 media: platform: exynos4-is: fix return value check in fimc_md_probe() | * f9d19f3a044c media: vivid: fix compose size exceed boundary | * 72e8d9c731a7 bpf: Fix slot type check in check_stack_write_var_off | * d959ff7fa9e5 drm/msm/hdmi: drop unused GPIO support | * b12f354fe61f drm/msm/hdmi: switch to drm_bridge_connector | * c4b035b1f036 ima: Handle -ESTALE returned by ima_filter_rule_match() | * d5b227f0d28d ima: Fix fall-through warnings for Clang | * 576828e59a0e drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure | * f1aa976857a3 spi: Update reference to struct spi_controller | * dd958c7f3e77 clk: renesas: r9a06g032: Repair grave increment error | * 110bf15825ed drm/rockchip: lvds: fix PM usage counter unbalance in poweron | * 1874f9143fba can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming | * 669bdf121fa4 can: kvaser_usb: Add struct kvaser_usb_busparams | * a50ad6772f6f can: kvaser_usb_leaf: Fix bogus restart events | * cd56718e7cb6 can: kvaser_usb_leaf: Fix wrong CAN state after stopping | * f83742285f77 can: kvaser_usb_leaf: Fix improved state not being reported | * fbd155fe14c8 can: kvaser_usb_leaf: Set Warning state even without bus errors | * 96af45b1b46e can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT | * caea629409dc can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event | * eafcf1b5997e can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device | * cd50258e9c28 can: kvaser_usb: do not increase tx statistics when sending error message frames | * 580c79fd57f3 media: exynos4-is: don't rely on the v4l2_async_subdev internals | * c93cac58a7e5 media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev | * 4882492ad3f0 venus: pm_helpers: Fix error check in vcodec_domains_get() | * 86d531c1d794 media: i2c: ad5820: Fix error path | * 83f7e3c98871 media: coda: jpeg: Add check for kmalloc | * 7e0ba56c7e5f pata_ipx4xx_cf: Fix unsigned comparison with less than zero | * 85b297d7986c libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() | * c61650b869e0 libbpf: Fix use-after-free in btf_dump_name_dups | * 26ce3f0c8f61 drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge | * 9b6851c18263 wifi: rtl8xxxu: Fix reading the vendor of combo chips | * 98d9172822dc wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() | * c3fb3e9a2c0c wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() | * 53915ecc43c5 rapidio: devices: fix missing put_device in mport_cdev_open | * cff9fefdfbf5 hfs: Fix OOB Write in hfs_asc2mac | * 93cdd1263691 relay: fix type mismatch when allocating memory in relay_create_buf() | * bbaa9ca06329 eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD | * 5ee850645e42 rapidio: fix possible UAF when kfifo_alloc() fails | * ad4842634d68 fs: sysv: Fix sysv_nblocks() returns wrong value | * 6f8ef1de8c65 MIPS: OCTEON: warn only once if deprecated link status is being used | * 7b88747d6d98 MIPS: BCM63xx: Add check for NULL for clk in clk_enable | * d4c38ee665a2 platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() | * 17cd8c46cbec platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() | * f983afc4326c PM: runtime: Do not call __rpm_callback() from rpm_idle() | * 2cbbd78e08bc PM: runtime: Improve path in rpm_idle() when no callback | * 46026bb057c3 xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() | * 70e7f308d7a8 x86/xen: Fix memory leak in xen_init_lock_cpu() | * fc134c355b52 x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() | * 95dbcb7e1c34 uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix | * 02617006b5a4 ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() | * 7bc9c5ad522b clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() | * 270700e7df96 cpu/hotplug: Make target_store() a nop when target == state | * fc89b8853aec futex: Resend potentially swallowed owner death notification | * 4750cac4df68 futex: Move to kernel/futex/ | * d8e7a44f488c clocksource/drivers/sh_cmt: Access registers according to spec | * 0853787db28e clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled | * 97d9eb45ffa6 rapidio: rio: fix possible name leak in rio_register_mport() | * 88fa351b20ca rapidio: fix possible name leaks when rio_add_device() fails | * 2b7e59ed2e77 ocfs2: fix memory leak in ocfs2_mount_volume() | * 45dabd8fe8a8 ocfs2: rewrite error handling of ocfs2_fill_super | * e403024c832b ocfs2: ocfs2_mount_volume does cleanup job before return error | * 81d26aa9036a debugfs: fix error when writing negative value to atomic_t debugfs file | * f649e18c9c10 docs: fault-injection: fix non-working usage of negative values | * 869a37ad6f78 lib/notifier-error-inject: fix error when writing -errno to debugfs file | * c39aa503f471 libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value | * 0080461624e9 cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() | * 9346517ed2c2 genirq/irqdesc: Don't try to remove non-existing sysfs files | * d97e58f72875 nfsd: don't call nfsd_file_put from client states seqfile display | * 2db53c705916 EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() | * f870d5863e8e irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() | * 5c0cacdd3549 platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() | * 0afcb759f6f6 perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() | * d2afced51108 perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() | * c0539d5d474e perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() | * dac87e295cdd PNP: fix name memory leak in pnp_alloc_dev() | * e1049bf0ca5b selftests/efivarfs: Add checking of the test return value | * 911773f08ce6 MIPS: vpe-cmp: fix possible memory leak while module exiting | * 48d42f4464d7 MIPS: vpe-mt: fix possible memory leak while module exiting | * f5f2682d3a34 ocfs2: fix memory leak in ocfs2_stack_glue_init() | * c9a9aa02f0fa lib/fonts: fix undefined behavior in bit shift for get_default_font | * 9f6ea28f295f proc: fixup uptime selftest | * d5bf025c5b71 timerqueue: Use rb_entry_safe() in timerqueue_getnext() | * 2f2ae35c0012 platform/x86: huawei-wmi: fix return value calculation | * a1014fbc83e7 lib/debugobjects: fix stat count and optimize debug_objects_mem_init | * 60a7a0aa9dd8 perf: Fix possible memleak in pmu_dev_alloc() | * 294ed8bfc937 selftests/ftrace: event_triggers: wait longer for test_event_enable | * 3ef12a4a8ef5 cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() | * aa5f2912bb2e fs: don't audit the capability check in simple_xattr_list() | * 9e760e0cf28f PM: hibernate: Fix mistake in kerneldoc comment | * ef875e1c07dd alpha: fix syscall entry in !AUDUT_SYSCALL case | * 1498d2723e74 cpuidle: dt: Return the correct numbers of parsed idle states | * 2ff401441711 sched/uclamp: Fix relationship between uclamp and migration margin | * ca9ef12bf765 sched/fair: Cleanup task_util and capacity type | * 6389c163c92b tpm/tpm_crb: Fix error message in __crb_relinquish_locality() | * 5b217f4e79c0 tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() | * 295f59cd2cde pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP | * 480bc6a165d6 ARM: mmp: fix timer_read delay | * d1b3164d0e11 pstore/ram: Fix error return code in ramoops_probe() | * 4dad729f7c24 arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC | * 872865db3b95 ARM: dts: turris-omnia: Add switch port 6 node | * c1322d5f6969 ARM: dts: turris-omnia: Add ethernet aliases | * d050513e6f59 ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port | * bac1a77b85e0 ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port | * ea907f303205 ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port | * ea8e313bb9ba ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port | * 697b92a648f2 ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port | * 73ab831afdc8 ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port | * c2cb1683d121 arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name | * 126135283611 arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings | * 853d57e9612e arm64: dts: mt2712-evb: Fix usb vbus regulators unit names | * 436ac713a4a3 arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names | * 148e77355797 arm64: dts: mt2712e: Fix unit address for pinctrl node | * a938c2a77492 arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators | * a455b0c509c9 arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node | * 42d97a024ef6 arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node | * 359286f886fe perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() | * 9afac95b87fa perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() | * 5e88aec62e7f soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe | * 6a9a31c57887 soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe | * e325b4ee414b soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync | * 0542d56e6333 arm: dts: spear600: Fix clcd interrupt | * a8d4fb0bf10b soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index | * 6213df4f5fc2 soc: qcom: apr: make code more reuseable | * 45d180a9f64b soc: qcom: llcc: make irq truly optional | * 8fb204a4b5ac drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static | * 6a2faf6fcefd ARM: dts: stm32: Fix AV96 WLAN regulator gpio property | * 6d1b6dc38fe0 ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 | * 933499bed78d objtool, kcsan: Add volatile read/write instrumentation to whitelist | * 275a67e909f7 arm64: dts: qcom: msm8916: Drop MSS fallback compatible | * 82baee2263b7 arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias | * 82569f7e4044 arm64: dts: qcom: sdm630: fix UART1 pin bias | * 4cef81dec2f1 ARM: dts: qcom: apq8064: fix coresight compatible | * 5465b9a813fb arm64: dts: qcom: msm8996: fix GPU OPP table | * 6cad948c9f4a arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins | * 60184b1437db usb: musb: remove extra check in musb_gadget_vbus_draw * | 9e60339cb4bb ANDROID: Update .xml due to ABI preservation fix * | 1cd4863ea874 ANDROID: struct io_uring ABI preservation hack for 5.10.162 changes * | 4c961b9302a7 ANDROID: fix up struct task_struct ABI change in 5.10.162 * | 332c489d8bb3 ANDROID: add flags variable back to struct proto_ops * | 8596b998848a Merge 5.10.162 into android12-5.10-lts |\| | * 0fe4548663f7 Linux 5.10.162 | * 189556b05e17 io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups | * 4ef66581d7fd eventfd: provide a eventfd_signal_mask() helper | * 2f093775022b eventpoll: add EPOLL_URING_WAKE poll wakeup flag | * b76c5373f084 Revert "proc: don't allow async path resolution of /proc/self components" | * 87cb08dc6b4f Revert "proc: don't allow async path resolution of /proc/thread-self components" | * a3025359ffa7 net: remove cmsg restriction from io_uring based send/recvmsg calls | * 6ef2b4728a00 task_work: unconditionally run task_work from get_signal() | * c91ab04781f9 signal: kill JOBCTL_TASK_WORK | * 788d0824269b io_uring: import 5.15-stable io_uring | * ed3005032993 task_work: add helper for more targeted task_work canceling | * 831cb78a2a5e kernel: don't call do_exit() for PF_IO_WORKER threads | * 9ded44b69c71 kernel: stop masking signals in create_io_thread() | * f0a5f0dc0131 x86/process: setup io_threads more like normal user space threads | * dd26e2cec74f arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() | * 320c8057eceb arch: setup PF_IO_WORKER threads like PF_KTHREAD | * 000de389ad7b entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set | * 0f735cf52bd0 kernel: allow fork with TIF_NOTIFY_SIGNAL pending | * 4b4d2c79921a coredump: Limit what can interrupt coredumps | * 90a2c3821bbf kernel: remove checking for TIF_NOTIFY_SIGNAL | * 61bdeb142e8f task_work: remove legacy TWA_SIGNAL path | * 6e2bce21acb4 alpha: fix TIF_NOTIFY_SIGNAL handling | * db911277a2b3 ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling | * a1240cc413eb ia64: don't call handle_signal() unless there's actually a signal queued | * e1402ba4df20 sparc: add support for TIF_NOTIFY_SIGNAL | * 78a53ff02656 riscv: add support for TIF_NOTIFY_SIGNAL | * 57e833a0a03d nds32: add support for TIF_NOTIFY_SIGNAL | * 751fedb9ba5d ia64: add support for TIF_NOTIFY_SIGNAL | * 48e9e35d33d6 h8300: add support for TIF_NOTIFY_SIGNAL | * c82617d9decc c6x: add support for TIF_NOTIFY_SIGNAL | * 30b78a17ac8f alpha: add support for TIF_NOTIFY_SIGNAL | * bf0b619593cd xtensa: add support for TIF_NOTIFY_SIGNAL | * 1bee9dbbcabb arm: add support for TIF_NOTIFY_SIGNAL | * 02d383a59cbf microblaze: add support for TIF_NOTIFY_SIGNAL | * 19f3e328b4c6 hexagon: add support for TIF_NOTIFY_SIGNAL | * c2037d61dec2 csky: add support for TIF_NOTIFY_SIGNAL | * 12284aec880f openrisc: add support for TIF_NOTIFY_SIGNAL | * 3fde31e96262 sh: add support for TIF_NOTIFY_SIGNAL | * dc808ffd9778 um: add support for TIF_NOTIFY_SIGNAL | * 0aef2ec06394 s390: add support for TIF_NOTIFY_SIGNAL | * 8ca2e5709922 mips: add support for TIF_NOTIFY_SIGNAL | * abab3d4444b5 powerpc: add support for TIF_NOTIFY_SIGNAL | * 45b365bc6c1b parisc: add support for TIF_NOTIFY_SIGNAL | * cf3c64867319 nios32: add support for TIF_NOTIFY_SIGNAL | * fe137f46d41f m68k: add support for TIF_NOTIFY_SIGNAL | * 79a9991e87fe arm64: add support for TIF_NOTIFY_SIGNAL | * 2dbb0354517b arc: add support for TIF_NOTIFY_SIGNAL | * 4b1dcf8ec9b2 x86: Wire up TIF_NOTIFY_SIGNAL | * eb42e7b30431 task_work: Use TIF_NOTIFY_SIGNAL if available | * 3c295bd2ddae entry: Add support for TIF_NOTIFY_SIGNAL | * d2136fc145be fs: provide locked helper variant of close_fd_get_file() | * 57b20530363d file: Rename __close_fd_get_file close_fd_get_file | * 214f80e25176 fs: make do_renameat2() take struct filename | * 52cfde6bbf64 signal: Add task_sigpending() helper | * ad0b0137953a net: add accept helper not installing fd | * 069ac28d9243 net: provide __sys_shutdown_sock() that takes a socket | * 0b8cd5d814cb tools headers UAPI: Sync openat2.h with the kernel sources | * 5683caa7350f fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED | * 0cf0ce8fb5b1 Make sure nd->path.mnt and nd->path.dentry are always valid pointers | * 146fe79fff13 fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* | * c1fe7bd3e1aa fs: add support for LOOKUP_CACHED | * 36ec31201a3d saner calling conventions for unlazy_child() | * e86db87191d8 iov_iter: add helper to save iov_iter state | * 1500fed00878 kernel: provide create_io_thread() helper * | bf760358eac3 Merge branch 'android12-5.10' into android12-5.10-lts * | 416c4356f372 Merge 5.10.161 into android12-5.10-lts |/ * 1a9148dfd8e0 Linux 5.10.161 * eec1c3ade48b net: loopback: use NET_NAME_PREDICTABLE for name_assign_type * f3fe6817156a Bluetooth: L2CAP: Fix u8 overflow * 7c3a523c9b19 HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk * 1d5db0c322ae HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 * 263a1782a618 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E * a20b5eec0742 HID: ite: Add support for Acer S1002 keyboard-dock * f2479c3daaab igb: Initialize mailbox message for VF reset * 9ff7aff40ef5 xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N * c8bf31a00f4f USB: serial: f81534: fix division by zero on line-speed change * 5b75a0041674 USB: serial: f81232: fix division by zero on line-speed change * 9895ce5ea283 USB: serial: cp210x: add Kamstrup RF sniffer PIDs * 398215f78338 USB: serial: option: add Quectel EM05-G modem * c79538f32df1 usb: gadget: uvc: Prevent buffer overflow in setup handler * 8b2f86f82c0e udf: Fix extending file within last block * db873b770d8a udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size * 1a075f4a5494 udf: Fix preallocation discarding at indirect extent boundary * 1f7f7365aee8 udf: Discard preallocation before extending file with a hole Change-Id: I1463ff16fd85e32614dc83f585aa6b3957024a74 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-23 11:09:43 +00:00
Pedro Tammela	193b312b2f	UPSTREAM: net/sched: tcindex: update imperfect hash filters respecting rcu ... commit ee059170b1f7e94e55fa6cadee544e176a6e59c2 upstream. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. CPU 0: CPU 1: tcindex_set_parms tcindex_classify tcindex_lookup tcindex_lookup tcf_exts_change tcf_exts_exec [UAF] Stop operating on the shared area directly, by using a local copy, and update the filter with 'rcu_replace_pointer()'. Delete the old filter version only after a rcu grace period elapsed. Bug: 272274675 Fixes: 9b0d4446b569 ("net: sched: avoid atomic swap in tcf_exts_change") Reported-by: valis <sec@valis.email> Suggested-by: valis <sec@valis.email> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Pedro Tammela <pctammela@mojatatu.com> Link: https://lore.kernel.org/r/20230209143739.279867-1-pctammela@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I02ce525a338242efdb8080e2e2c705d3b59d9a68	2023-03-09 11:27:04 +00:00
Luca Weiss	5692e2bb4e	UPSTREAM: net: qrtr: combine nameservice into main module ... Previously with CONFIG_QRTR=m a separate ns.ko would be built which wasn't done on purpose and should be included in qrtr.ko. Rename qrtr.c to af_qrtr.c so we can build a qrtr.ko with both af_qrtr.c and ns.c. Bug: 270636606 Change-Id: Ied36534abd1d589a5a1a5853e3440526271440b0 Signed-off-by: Luca Weiss <luca@z3ntu.xyz> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Tested-By: Steev Klimaszewski <steev@kali.org> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://lore.kernel.org/r/20210928171156.6353-1-luca@z3ntu.xyz Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit a365023a76f231cc2fc6e33797e66f3bcaa9f9a9) Signed-off-by: Srinivasarao Pathipati <quic_spathi@quicinc.com>	2023-02-25 00:36:57 +00:00
Cong Wang	a4d6d4d1e7	UPSTREAM: net_sched: reject TCF_EM_SIMPLE case for complex ematch module ... [ Upstream commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 ] When TCF_EM_SIMPLE was introduced, it is supposed to be convenient for ematch implementation: https://lore.kernel.org/all/20050105110048.GO26856@postel.suug.ch/ "You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE set will simply result in allocating & copy. It's an optimization, nothing more." So if an ematch module provides ops->datalen that means it wants a complex data structure (saved in its em->data) instead of a simple u32 value. We should simply reject such a combination, otherwise this u32 could be misinterpreted as a pointer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+4caeae4c7103813598ae@syzkaller.appspotmail.com Reported-by: Jun Nie <jun.nie@linaro.org> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Cong Wang <cong.wang@bytedance.com> Acked-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> Bug: 262113355 Bug: 262114215 Change-Id: I03be57351f76f699d4635cf31178e0f3a19e61a5 Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>	2023-02-20 17:28:31 +00:00
Greg Kroah-Hartman	570621d64f	Merge 5.10.168 into android12-5.10-lts ... Changes in 5.10.168 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() bpf: Fix incorrect state pruning for <8B spill/fill powerpc/imc-pmu: Revert nest_init_lock to being a mutex bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() bpf: Support <8-byte scalar spill and refill bpf: Fix to preserve reg parent/live fields when copying range info bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX drm/vc4: hdmi: make CEC adapter name unique scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" vhost/net: Clear the pending messages when the backend is removed WRITE is "data source", not destination... READ is "data destination", not source... fix iov_iter_bvec() "direction" argument fix "direction" argument of iov_iter_kvec() virtio-net: execute xdp_do_flush() before napi_complete_done() sfc: correctly advertise tunneled IPv6 segmentation net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices netrom: Fix use-after-free caused by accept on already connected socket netfilter: br_netfilter: disable sabotage_in hook after first suppression squashfs: harden sanity check in squashfs_read_xattr_id_table net: phy: meson-gxl: Add generic dummy stubs for MMD register access igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ata: libata: Fix sata_down_spd_limit() when no link speed is reported selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking virtio-net: Keep stop() to follow mirror sequence of open() net: openvswitch: fix flow memory leak in ovs_flow_cmd_new efi: fix potential NULL deref in efi_mem_reserve_persistent qede: add netpoll support for qede driver qede: execute xdp_do_flush() before napi_complete_done() i2c: mxs: suppress probe-deferral error message scsi: target: core: Fix warning on RT kernels scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress i2c: rk3x: fix a bunch of kernel-doc warnings platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table net/x25: Fix to not accept on connected socket iio: adc: stm32-dfsdm: fill module aliases usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Input: i8042 - move __initconst to fix code styling warning Input: i8042 - merge quirk tables Input: i8042 - add TUXEDO devices to i8042 quirk tables Input: i8042 - add Clevo PCX0DX to i8042 quirk table fbcon: Check font dimension limits net: qrtr: free memory on error path in radix_tree_insert() watchdog: diag288_wdt: do not use stack buffers for hardware data watchdog: diag288_wdt: fix __diag288() inline assembly ALSA: hda/realtek: Add Acer Predator PH315-54 efi: Accept version 2 of memory attributes table iio: hid: fix the retval in accel_3d_capture_sample iio: adc: berlin2-adc: Add missing of_node_put() in error path iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix incorrect ODR mode readback iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix MAGN sensor scale and unit nvmem: qcom-spmi-sdam: fix module autoloading parisc: Fix return code of pdc_iodc_print() parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case riscv: disable generation of unwind tables mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm/swapfile: add cond_resched() in get_swap_pages() Squashfs: fix handling and sanity checking of xattr_ids count drm/i915: Fix potential bit_17 double-free nvmem: core: initialise nvmem->id early nvmem: core: fix cell removal on error serial: 8250_dma: Fix DMA Rx completion race serial: 8250_dma: Fix DMA Rx rearm race fbdev: smscufx: fix error handling code in ufx_usb_probe f2fs: fix to do sanity check on i_extra_isize in is_alive() wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property bpf: Do not reject when the stack read size is different from the tracked scalar size iio:adc:twl6030: Enable measurement of VAC mm/migration: return errno when isolate_huge_page failed migrate: hugetlb: check for hugetlb shared PMD in node migration btrfs: limit device extents to the device size btrfs: zlib: zero-initialize zlib workspace ALSA: hda/realtek: Add Positivo N14KP6-TG ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw of/address: Return an error when no valid dma-ranges are found can: j1939: do not wait 250 ms if the same addr was already claimed xfrm: compat: change expression for switch in xfrm_xlate64 IB/hfi1: Restore allocated resources on failed copyout xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() IB/IPoIB: Fix legacy IPoIB due to wrong number of queues RDMA/usnic: use iommu_map_atomic() under spin_lock() xfrm: fix bug with DSCP copy to v6 from v4 tunnel bonding: fix error checking in bond_debug_reregister() net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY ionic: clean interrupt before enabling queue to avoid credit race uapi: add missing ip/ipv6 header dependencies for linux/stddef.h ice: Do not use WQ_MEM_RECLAIM flag for workqueue net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" net/mlx5e: IPoIB, Show unknown speed instead of error net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers net/mlx5: fw_tracer, Zero consumer index when reloading the tracer rds: rds_rm_zerocopy_callback() use list_first_entry() selftests: forwarding: lib: quote the sysctl values ALSA: pci: lx6464es: fix a debug loop pinctrl: aspeed: Fix confusing types in return value pinctrl: single: fix potential NULL dereference spi: dw: Fix wrong FIFO level setting for long xfers pinctrl: intel: Restore the pins that used to be in Direct IRQ mode cifs: Fix use-after-free in rdata->read_into_pages() net: USB: Fix wrong-direction WARNING in plusb.c btrfs: free device in btrfs_close_devices for a single device filesystem usb: core: add quirk for Alcor Link AK9563 smartcard reader usb: typec: altmodes/displayport: Fix probe pin assign check ceph: flush cap releases when the session is flushed riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive Fix page corruption caused by racy check in __free_pages Linux 5.10.168 Change-Id: I98d1e73edfaab3ce45c15283ae0964527d5e547e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-17 15:23:41 +00:00
Greg Kroah-Hartman	b405332f4b	Merge 5.10.167 into android12-5.10-lts ... Changes in 5.10.167 ARM: dts: imx: Fix pca9547 i2c-mux node name ARM: dts: vf610: Fix pca9548 i2c-mux node names arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI bpf: Skip task with pid=1 in send_signal_common() blk-cgroup: fix missing pd_online_fn() while activating policy dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt net: fix NULL pointer in skb_segment_list Linux 5.10.167 Change-Id: Ida463e2847a19315e53ecbe120a82a58924d8047 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-17 15:21:25 +00:00
Greg Kroah-Hartman	0ddb73d446	Merge 5.10.166 into android12-5.10-lts ... Changes in 5.10.166 clk: generalize devm_clk_get() a bit clk: Provide new devm_clk helpers for prepared and enabled clocks memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux ARM: imx: add missing of_node_put() HID: intel_ish-hid: Add check for ishtp_dma_tx_map EDAC/highbank: Fix memory leak in highbank_mc_probe() firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Harden shared memory access in fetch_notification tomoyo: fix broken dependency on *.conf.default RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Remove user expected buffer invalidate race affs: initialize fsdata in affs_truncate() PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() phy: ti: fix Kconfig warning and operator precedence ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid net/sched: sch_taprio: fix possible use-after-free l2tp: Serialize access to sk_user_data with sk_callback_lock l2tp: Don't sleep and disable BH under writer-side sk_callback_lock l2tp: convert l2tp_tunnel_list to idr l2tp: close all race conditions in l2tp_tunnel_register() net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() HID: revert CHERRY_MOUSE_000C quirk usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding l2tp: prevent lockdep issue in l2tp_tunnel_register() HID: betop: check shape of output reports dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() nvme-pci: fix timeout request state check tcp: avoid the lookup process failing to get sk in ehash table w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array net: dsa: microchip: ksz9477: port map correction in ALU table entry register tcp: fix rate_app_limited to default to 1 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist kcsan: test: don't put the expect array on the stack ASoC: fsl_micfil: Correct the number of steps on SX controls drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK lockref: stop doing cpu_relax in the cmpxchg loop Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state x86: ACPI: cstate: Optimize C3 entry on AMD CPUs fs: reiserfs: remove useless new_opts in reiserfs_remount sysctl: add a new register_sysctl_init() interface kernel/panic: move panic sysctls to its own file panic: unset panic_on_warn inside panic() ubsan: no need to unset panic_on_warn in ubsan_epilogue() kasan: no need to unset panic_on_warn in end_report() exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() ia64: make IA64_MCA_RECOVERY bool instead of tristate panic: Separate sysctl logic from CONFIG_SMP exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Bluetooth: hci_sync: cancel cmd_timer if hci_open failed xhci: Set HCD flag to defer primary roothub registration scsi: hpsa: Fix allocation size for scsi_host_alloc() module: Don't wait for GOING modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect KVM: x86/vmx: Do not skip segment attributes if unusable bit is set thermal: intel: int340x: Protect trip temperature from concurrent updates ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info units: Add Watt units units: Add SI metric prefix definitions i2c: designware: Use DIV_ROUND_CLOSEST() macro i2c: designware: use casting of u64 in clock multiplication to avoid overflow netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope net: ravb: Fix possible hang if RIS2_QFF1 happen thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net/tg3: resolve deadlock in tg3_reset_task() during EEH net: mdio-mux-meson-g12a: force internal PHY off on mux switch tools: gpio: fix -c option of gpio-event-mon Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted Revert "selftests/ftrace: Update synthetic event syntax errors" block: fix and cleanup bio_check_ro x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int clk: Fix pointer casting to prevent oops in devm_clk_release() Linux 5.10.166 Change-Id: Ibf582f7504221c6ee1648da95c49b45e3678708c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-17 12:18:56 +00:00
Greg Kroah-Hartman	78da590924	Merge 5.10.165 into android12-5.10-lts ... Changes in 5.10.165 btrfs: fix trace event name typo for FLUSH_DELAYED_REFS pNFS/filelayout: Fix coalescing test for single DS selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID tools/virtio: initialize spinlocks in vring_test.c net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats RDMA/srp: Move large values to a new enum for gcc13 btrfs: always report error in run_one_delayed_ref() x86/asm: Fix an assembler warning with current binutils f2fs: let's avoid panic if extent_tree is not created wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices wifi: mac80211: sdata can be NULL during AMPDU start Add exception protection processing for vd in axi_chan_handle_err function zonefs: Detect append writes at invalid locations nilfs2: fix general protection fault in nilfs_btree_insert() efi: fix userspace infinite retry read efivars after EFI runtime services page fault ALSA: hda/realtek - Turn on power early drm/i915/gt: Reset twice Bluetooth: hci_qca: Wait for timeout during suspend Bluetooth: hci_qca: Fix driver shutdown on closed serdev io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL io_uring: improve send/recv error handling io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly io_uring: add flag for disabling provided buffer recycling io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG) io_uring: allow re-poll if we made progress io_uring: fix async accept on O_NONBLOCK sockets io_uring: check for valid register opcode earlier io_uring: lock overflowing for IOPOLL io_uring: fix CQ waiting timeout handling io_uring: ensure that cached task references are always put on exit io_uring: remove duplicated calls to io_kiocb_ppos io_uring: update kiocb->ki_pos at execution time io_uring: do not recalculate ppos unnecessarily io_uring/rw: defer fsnotify calls to task context xhci-pci: set the dma max_seg_size usb: xhci: Check endpoint is valid before dereferencing it xhci: Fix null pointer dereference when host dies xhci: Add update_hub_device override for PCI xHCI hosts xhci: Add a flag to disable USB3 lpm on a xhci root port level. usb: acpi: add helper to check port lpm capability using acpi _DSM xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables prlimit: do_prlimit needs to have a speculation check USB: serial: option: add Quectel EM05-G (GR) modem USB: serial: option: add Quectel EM05-G (CS) modem USB: serial: option: add Quectel EM05-G (RS) modem USB: serial: option: add Quectel EC200U modem USB: serial: option: add Quectel EM05CN (SG) modem USB: serial: option: add Quectel EM05CN modem staging: vchiq_arm: fix enum vchiq_status return types USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 misc: fastrpc: Don't remove map on creater_process and device_release misc: fastrpc: Fix use-after-free race condition for maps usb: core: hub: disable autosuspend for TI TUSB8041 comedi: adv_pci1760: Fix PWM instruction handling mmc: sunxi-mmc: Fix clock refcount imbalance during unbind mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting btrfs: fix race between quota rescan and disable leading to NULL pointer deref cifs: do not include page data when checking signature thunderbolt: Use correct function to calculate maximum USB3 link rate tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer USB: gadgetfs: Fix race between mounting and unmounting USB: serial: cp210x: add SCALANCE LPE-9000 device id usb: host: ehci-fsl: Fix module alias usb: typec: altmodes/displayport: Add pin assignment helper usb: typec: altmodes/displayport: Fix pin assignment calculation usb: gadget: g_webcam: Send color matching descriptor per frame usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation serial: pch_uart: Pass correct sg to dma_unmap_sg() dmaengine: tegra210-adma: fix global intr clear serial: atmel: fix incorrect baudrate setup gsmi: fix null-deref in gsmi_get_variable mei: me: add meteor lake point M DID drm/i915: re-disable RC6p on Sandy Bridge drm/amd/display: Fix set scaling doesn's work drm/amd/display: Calculate output_color_space after pixel encoding adjustment drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix arm64: efi: Execute runtime services from a dedicated stack efi: rt-wrapper: Add missing include Revert "drm/amdgpu: make display pinning more flexible (v2)" x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN tracing: Use alignof__(struct {type b;}) instead of offsetof() io_uring: io_kiocb_update_pos() should not touch file for non -1 offset io_uring/net: fix fast_iov assignment in io_setup_async_msg() net/ulp: use consistent error code when blocking ULP net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" soc: qcom: apr: Make qcom,protection-domain optional again Bluetooth: hci_qca: Wait for SSR completion during suspend Bluetooth: hci_qca: check for SSR triggered flag while suspend Bluetooth: hci_qca: Fixed issue during suspend mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma io_uring: Clean up a false-positive warning from GCC 9.3.0 io_uring: fix double poll leak on repolling io_uring/rw: ensure kiocb_end_write() is always called io_uring/rw: remove leftover debug statement Linux 5.10.165 Change-Id: Icb91157d9fa1b56cd79eedb8a9cc6118d0705244 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-16 16:43:59 +00:00
Greg Kroah-Hartman	b0d4a37a43	This is the 5.10.164 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPHzb8ACgkQONu9yGCS aT5DUxAAvqTdbbizm4D4EV4ZtdE/N0IJ63VhREMdR1Y21hCuvv5V4Zeh0gpGFKKy RljvUXxDXaZjVzJsTPgsmPaEJOrftzZNU1Mq3ucviCXYFl3tWFiJy/FuTaCNCY+r YhvjnZWFjwh+mvHyV3wzFdn41XG2GKxq2vgqUFI9BGCM9tw5T4Z6moLPTvcibt2X yldJ9U76NgxNDVV0IYilQrMjPe3Pm819Z3ZP9S0O6LJEPjmssB6omlFHyLxUcpC+ 8DiRb49Iild6HJsrbqqv0oHMNSiykx+VDMid/vQtTk4HrAL+eD2Ym17yRnlLzots dmuUSdZEpZriH2bCIbNeBDV300x8atLhELtA885wEYj0BKe1QBJMyA0q1PFdKip3 73wPyi/MCVtCxv752O//PaxynUwZaWlQFH1G8Ry2VpSeiK5A7ZiWWkBDTqLhkRJL b0e3crODlZM0ng4nRRMrXZZAw+FKzghVSO8ae/4+q5Y9vyj6iadd7UcwXG4cmZXN ZYXT3+3O7P08dyHW4EL8tD7AmxprP7ccePyKsMu6T7wQPuEgFltaJUDHsGnJ68Jx I+5QzrVED3OTjt9jpYVbYjJ1HjL0jQHxfuBNKCgC34wMzwdlZhHUQVbi0DECk2Qf 40MCrjEsAXJWlX/Rr2bsVeYFSyi4aCI1kckXKxRQznOnFZirA5M= =WjXh -----END PGP SIGNATURE----- Merge 5.10.164 into android12-5.10-lts Changes in 5.10.164 netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx KVM: arm64: Fix S1PTW handling on RO memslots efi: tpm: Avoid READ_ONCE() for accessing the event log docs: Fix the docs build with Sphinx 6.0 perf auxtrace: Fix address filter duplicate symbol selection s390/kexec: fix ipl report address for kdump ASoC: qcom: lpass-cpu: Fix fallback SD line index handling s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() cifs: Fix uninitialized memory read for smb311 posix symlink create drm/msm/adreno: Make adreno quirks not overwrite each other drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe ixgbe: fix pci device refcount leak ipv6: raw: Deduct extension header length in rawv6_push_pending_frames bus: mhi: host: Fix race between channel preparation and M0 event iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options clk: imx8mp: Add DISP2 pixel clock clk: imx8mp: add clkout1/2 support dt-bindings: clocks: imx8mp: Add ID for usb suspend clock clk: imx: imx8mp: add shared clk gate for usb suspend clk xhci: Avoid parsing transfer events several times xhci: get isochronous ring directly from endpoint structure xhci: adjust parameters passed to cleanup_halted_endpoint() xhci: Add xhci_reset_halted_ep() helper function xhci: move xhci_td_cleanup so it can be called by more functions xhci: store TD status in the td struct instead of passing it along xhci: move and rename xhci_cleanup_halted_endpoint() xhci: Prevent infinite loop in transaction errors recovery for streams usb: ulpi: defer ulpi_register on ulpi_read_id timeout ext4: fix uninititialized value in 'ext4_evict_inode' xfrm: fix rcu lock in xfrm_notify_userpolicy() netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. powerpc/imc-pmu: Fix use of mutex in IRQs disabled section x86/boot: Avoid using Intel mnemonics in AT&T syntax asm EDAC/device: Fix period calculation in edac_device_reset_delay_period() regulator: da9211: Use irq handler when ready ASoC: wm8904: fix wrong outputs volume after power reactivation tipc: fix unexpected link reset due to discovery messages octeontx2-af: Update get/set resource count functions octeontx2-af: Map NIX block from CGX connection octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable hvc/xen: lock console list traversal nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() net/sched: act_mpls: Fix warning during failed attribute validation net/mlx5: Fix ptp max frequency adjustment range net/mlx5e: Don't support encap rules with gbp option mm: Always release pages to the buddy allocator in memblock_free_late(). iommu/mediatek-v1: Add error handle for mtk_iommu_probe iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() Documentation: KVM: add API issues section KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI x86/resctrl: Fix task CLOSID/RMID update race arm64: atomics: format whitespace consistently arm64: atomics: remove LL/SC trampolines arm64: cmpxchg_double*: hazard against entire exchange variable efi: fix NULL-deref in init error path drm/virtio: Fix GEM handle creation UAF io_uring/io-wq: free worker if task_work creation is canceled io_uring/io-wq: only free worker if it was allocated for creation Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" Linux 5.10.164 Change-Id: I049d9a56837b18c20b2245687f03eb75d3413e0f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-16 13:59:20 +00:00
Pietro Borrello	c53f34ec3f	rds: rds_rm_zerocopy_callback() use list_first_entry() ... [ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ] rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Use list_first_entry() to actually access the first element of the rs_zcookie_queue list. Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:25 +01:00
Christian Hopps	30fdf66035	xfrm: fix bug with DSCP copy to v6 from v4 tunnel ... [ Upstream commit 6028da3f125fec34425dbd5fec18e85d372b2af6 ] When copying the DSCP bits for decap-dscp into IPv6 don't assume the outer encap is always IPv6. Instead, as with the inner IPv4 case, copy the DSCP bits from the correctly saved "tos" value in the control block. Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input") Signed-off-by: Christian Hopps <chopps@chopps.org> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:23 +01:00
Eric Dumazet	a893cc6448	xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() ... [ Upstream commit b6ee896385380aa621102e8ea402ba12db1cabff ] int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be used as a Spectre v1 gadget. if (nla_len(nla) < compat_policy[type].len) { array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Dmitry Safonov <dima@arista.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Reviewed-by: Dmitry Safonov <dima@arista.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:23 +01:00
Anastasia Belova	3797e94c19	xfrm: compat: change expression for switch in xfrm_xlate64 ... [ Upstream commit eb6c59b735aa6cca77cdbb59cc69d69a0d63d986 ] Compare XFRM_MSG_NEWSPDINFO (value from netlink configuration messages enum) with nlh_src->nlmsg_type instead of nlh_src->nlmsg_type - XFRM_MSG_BASE. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4e9505064f58 ("net/xfrm/compat: Copy xfrm_spdattr_type_t atributes") Signed-off-by: Anastasia Belova <abelova@astralinux.ru> Acked-by: Dmitry Safonov <0x7f454c46@gmail.com> Tested-by: Dmitry Safonov <0x7f454c46@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:23 +01:00
Devid Antonio Filoni	bc9771cd63	can: j1939: do not wait 250 ms if the same addr was already claimed ... commit 4ae5e1e97c44f4654516c1d41591a462ed62fa7b upstream. The ISO 11783-5 standard, in "4.5.2 - Address claim requirements", states: d) No CF shall begin, or resume, transmission on the network until 250 ms after it has successfully claimed an address except when responding to a request for address-claimed. But "Figure 6" and "Figure 7" in "4.5.4.2 - Address-claim prioritization" show that the CF begins the transmission after 250 ms from the first AC (address-claimed) message even if it sends another AC message during that time window to resolve the address contention with another CF. As stated in "4.4.2.3 - Address-claimed message": In order to successfully claim an address, the CF sending an address claimed message shall not receive a contending claim from another CF for at least 250 ms. As stated in "4.4.3.2 - NAME management (NM) message": 1) A commanding CF can d) request that a CF with a specified NAME transmit the address- claimed message with its current NAME. 2) A target CF shall d) send an address-claimed message in response to a request for a matching NAME Taking the above arguments into account, the 250 ms wait is requested only during network initialization. Do not restart the timer on AC message if both the NAME and the address match and so if the address has already been claimed (timer has expired) or the AC message has been sent to resolve the contention with another CF (timer is still running). Signed-off-by: Devid Antonio Filoni <devid.filoni@egluetechnologies.com> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://lore.kernel.org/all/20221125170418.34575-1-devid.filoni@egluetechnologies.com Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-15 17:22:23 +01:00
Natalia Petrova	0c76eddc1f	net: qrtr: free memory on error path in radix_tree_insert() ... commit 29de68c2b32ce58d64dea496d281e25ad0f551bd upstream. Function radix_tree_insert() returns errors if the node hasn't been initialized and added to the tree. "kfree(node)" and return value "NULL" of node_get() help to avoid using unclear node in other calls. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: <stable@vger.kernel.org> # 5.7 Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Natalia Petrova <n.petrova@fintech.ru> Reviewed-by: Simon Horman <simon.horman@corigine.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://lore.kernel.org/r/20230125134831.8090-1-n.petrova@fintech.ru Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-15 17:22:16 +01:00
Hyunwoo Kim	4bbc34401d	net/x25: Fix to not accept on connected socket ... [ Upstream commit f2b0b5210f67c56a3bcdf92ff665fb285d6e0067 ] When listen() and accept() are called on an x25 socket that connect() succeeds, accept() succeeds immediately. This is because x25_connect() queues the skb to sk->sk_receive_queue, and x25_accept() dequeues it. This creates a child socket with the sk of the parent x25 socket, which can cause confusion. Fix x25_listen() to return -EINVAL if the socket has already been successfully connect()ed to avoid this issue. Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:15 +01:00
Fedor Pchelkin	70154489f5	net: openvswitch: fix flow memory leak in ovs_flow_cmd_new ... [ Upstream commit 0c598aed445eb45b0ee7ba405f7ece99ee349c30 ] Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is not freed when an allocation of a key fails. BUG: memory leak unreferenced object 0xffff888116668000 (size 632): comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline] [<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77 [<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957 [<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739 [<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800 [<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515 [<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 [<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] [<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339 [<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934 [<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline] [<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671 [<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356 [<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410 [<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439 [<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 [<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 To fix this the patch rearranges the goto labels to reflect the order of object allocations and adds appropriate goto statements on the error paths. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 68bb10101e6b ("openvswitch: Fix flow lookup to use unmasked key") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Acked-by: Eelco Chaudron <echaudro@redhat.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/20230201210218.361970-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:14 +01:00
Ziyang Xuan	b6d4407211	can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ... [ Upstream commit d0553680f94c49bbe0e39eb50d033ba563b4212d ] The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80 Fixes: 0c71437dd50d ("can: j1939: j1939_session_deactivate(): clarify lifetime of session object") Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://lore.kernel.org/all/20210906094200.95868-1-william.xuanziyang@huawei.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:13 +01:00
Florian Westphal	f53c6e7e77	netfilter: br_netfilter: disable sabotage_in hook after first suppression ... [ Upstream commit 2b272bb558f1d3a5aa95ed8a82253786fd1a48ba ] When using a xfrm interface in a bridged setup (the outgoing device is bridged), the incoming packets in the xfrm interface are only tracked in the outgoing direction. $ brctl show bridge name interfaces br_eth1 eth1 $ conntrack -L tcp 115 SYN_SENT src=192... dst=192... [UNREPLIED] ... If br_netfilter is enabled, the first (encrypted) packet is received onR eth1, conntrack hooks are called from br_netfilter emulation which allocates nf_bridge info for this skb. If the packet is for local machine, skb gets passed up the ip stack. The skb passes through ip prerouting a second time. br_netfilter ip_sabotage_in supresses the re-invocation of the hooks. After this, skb gets decrypted in xfrm layer and appears in network stack a second time (after decryption). Then, ip_sabotage_in is called again and suppresses netfilter hook invocation, even though the bridge layer never called them for the plaintext incarnation of the packet. Free the bridge info after the first suppression to avoid this. I was unable to figure out where the regression comes from, as far as i can see br_netfilter always had this problem; i did not expect that skb is looped again with different headers. Fixes: c4b0e771f906 ("netfilter: avoid using skb->nf_bridge directly") Reported-and-tested-by: Wolfgang Nothdurft <wolfgang@linogate.de> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:12 +01:00
Hyunwoo Kim	dd6991251a	netrom: Fix use-after-free caused by accept on already connected socket ... [ Upstream commit 611792920925fb088ddccbe2783c7f92fdfb6b64 ] If you call listen() and accept() on an already connect()ed AF_NETROM socket, accept() can successfully connect. This is because when the peer socket sends data to sendmsg, the skb with its own sk stored in the connected socket's sk->sk_receive_queue is connected, and nr_accept() dequeues the skb waiting in the sk->sk_receive_queue. As a result, nr_accept() allocates and returns a sock with the sk of the parent AF_NETROM socket. And here use-after-free can happen through complex race conditions: ``` cpu0 cpu1 1. socket_2 = socket(AF_NETROM) . . listen(socket_2) accepted_socket = accept(socket_2) 2. socket_1 = socket(AF_NETROM) nr_create() // sk refcount : 1 connect(socket_1) 3. write(accepted_socket) nr_sendmsg() nr_output() nr_kick() nr_send_iframe() nr_transmit_buffer() nr_route_frame() nr_loopback_queue() nr_loopback_timer() nr_rx_frame() nr_process_rx_frame(sk, skb); // sk : socket_1's sk nr_state3_machine() nr_queue_rx_frame() sock_queue_rcv_skb() sock_queue_rcv_skb_reason() __sock_queue_rcv_skb() __skb_queue_tail(list, skb); // list : socket_1's sk->sk_receive_queue 4. listen(socket_1) nr_listen() uaf_socket = accept(socket_1) nr_accept() skb_dequeue(&sk->sk_receive_queue); 5. close(accepted_socket) nr_release() nr_write_internal(sk, NR_DISCREQ) nr_transmit_buffer() // NR_DISCREQ nr_route_frame() nr_loopback_queue() nr_loopback_timer() nr_rx_frame() // sk : socket_1's sk nr_process_rx_frame() // NR_STATE_3 nr_state3_machine() // NR_DISCREQ nr_disconnect() nr_sk(sk)->state = NR_STATE_0; 6. close(socket_1) // sk refcount : 3 nr_release() // NR_STATE_0 sock_put(sk); // sk refcount : 0 sk_free(sk); close(uaf_socket) nr_release() sock_hold(sk); // UAF ``` KASAN report by syzbot: ``` BUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520 Write of size 4 at addr ffff8880235d8080 by task syz-executor564/5128 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] sock_hold include/net/sock.h:775 [inline] nr_release+0x66/0x460 net/netrom/af_netrom.c:520 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6c19e3c9b9 Code: Unable to access opcode bytes at 0x7f6c19e3c98f. RSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9 RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006 RBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0 R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_release+0x39e/0x460 net/netrom/af_netrom.c:554 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd ``` To fix this issue, nr_listen() returns -EINVAL for sockets that successfully nr_connect(). Reported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:12 +01:00
Jakub Sitnicki	9bd6074e18	bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener ... [ Upstream commit ddce1e091757d0259107c6c0c7262df201de2b66 ] A listening socket linked to a sockmap has its sk_prot overridden. It points to one of the struct proto variants in tcp_bpf_prots. The variant depends on the socket's family and which sockmap programs are attached. A child socket cloned from a TCP listener initially inherits their sk_prot. But before cloning is finished, we restore the child's proto to the listener's original non-tcp_bpf_prots one. This happens in tcp_create_openreq_child -> tcp_bpf_clone. Today, in tcp_bpf_clone we detect if the child's proto should be restored by checking only for the TCP_BPF_BASE proto variant. This is not correct. The sk_prot of listening socket linked to a sockmap can point to to any variant in tcp_bpf_prots. If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then the child socket unintentionally is left if the inherited sk_prot by tcp_bpf_clone. This leads to issues like infinite recursion on close [1], because the child state is otherwise not set up for use with tcp_bpf_prot operations. Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants. Note that it wouldn't be sufficient to check the socket state when overriding the sk_prot in tcp_bpf_update_proto in order to always use the TCP_BPF_BASE variant for listening sockets. Since commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage") it is possible for a socket to transition to TCP_LISTEN state while already linked to a sockmap, e.g. connect() -> insert into map -> connect(AF_UNSPEC) -> listen(). [1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/ Fixes: e80251555f0b ("tcp_bpf: Don't let child socket inherit parent protocol ops on copy") Reported-by: syzbot+04c21ed96d861dccc5cd@syzkaller.appspotmail.com Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-2-1e0ee7ac2f90@cloudflare.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-15 17:22:10 +01:00
Greg Kroah-Hartman	c35badfe0d	Revert "net: add atomic_long_t to net_device_stats fields" ... This reverts commit 037db10e3f93f0d51ab3f52fbdaa7e67a7edd0b8 which is commit 6c1c5097781f563b70a81683ea6fdac21637573b upstream. It breaks the CRC checking for the Android KABI (doesn't really break any actual ABI, but it isn't nice.) As this isn't needed for Android systems at this point in time, just revert it to keep the CRC abi stable. If it is needed to come back, it can be reworked to be a CRC-abi neutral change if so desired. Bug: 161946584 Fixes: 037db10e3f93 ("net: add atomic_long_t to net_device_stats fields") Cc: Eric Dumazet <edumazet@google.com> Change-Id: I9d3d9fb55ab5482a4ea92fcc4a2fb70c4471edec Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-15 16:02:05 +00:00
Jens Axboe	4b17dea786	UPSTREAM: net: remove cmsg restriction from io_uring based send/recvmsg calls ... [ Upstream commit e54937963fa249595824439dc839c948188dea83 ] No need to restrict these anymore, as the worker threads are direct clones of the original task. Hence we know for a fact that we can support anything that the regular task can. Since the only user of proto_ops->flags was to flag PROTO_CMSG_DATA_ONLY, kill the member and the flag definition too. Change-Id: Ie87e4ff3c621cf53a8e9589a7689e62d759de983 Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a3025359ffa707b484b23f4df37425f36e6955fd) Bug: 268174392 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-07 13:38:15 +00:00
Pavel Begunkov	13f03f5275	UPSTREAM: net: add accept helper not installing fd ... [ Upstream commit d32f89da7fa8ccc8b3fb8f909d61e42b9bc39329 ] Introduce and reuse a helper that acts similarly to __sys_accept4_file() but returns struct file instead of installing file descriptor. Will be used by io_uring. Change-Id: I27ff49709d0c3332ca9b831a62fecc14f7ef3304 Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Acked-by: David S. Miller <davem@davemloft.net> Link: https://lore.kernel.org/r/c57b9e8e818d93683a3d24f8ca50ca038d1da8c4.1629888991.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit ad0b0137953a2c973958dadf6d222e120e278856) Bug: 268174392 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-07 13:38:09 +00:00
Jens Axboe	af091af9db	UPSTREAM: net: provide __sys_shutdown_sock() that takes a socket ... [ Upstream commit b713c195d59332277a31a59c91f755e53b5b302b ] No functional changes in this patch, needed to provide io_uring support for shutdown(2). Cc: netdev@vger.kernel.org Cc: David S. Miller <davem@davemloft.net> Acked-by: Jakub Kicinski <kuba@kernel.org> Change-Id: I57af3873e6d10fd244dcc8ed261d715a35a7434d Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 069ac28d92432dd7cdac0a2c141a1b3b8d4330d5) Bug: 268174392 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-07 13:38:08 +00:00
Greg Kroah-Hartman	4922049993	This is the 5.10.163 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPCczkACgkQONu9yGCS aT4tnRAAsW8h/ohmhP+O2lQ9Ekw6s9VB6KB4aJzLhQXqIZlrzk2DP3CiLxQ7DkFc AcHwFYq+sERo8O7dK6pbCW0zNvLUpbK2wJhwMHujJfSUFboXX85NR6u90U67pBKS p+yVkDSx8LNc7c676xQ7ey5rO1K2fQQ266gexjI9WOkjIFOfplVkZ7tkvt51VwAD mNvOQsZdCE6xs+T3t9YMOtAx3wW8vl1wW3QDWCHznQwOJiMEjfNEOUY/+xELnnWz DVONWPHTFNKQHZwIuVUFZdNuORq5WXoIaMZdaEFkhuOtRMnQ9l+wi8iMxX8zkgBn Ji/dPu3GdAZsJU4/rXHkY2AeZV1oJc3NLYmevoRZirTqMQCqyM+blif7Rf34kBi7 6jlGPWOjyMNe58shfHmjWTl/u4pMDoYOnm5XO+1oL+2Xg8QWCucqAlfPFB3uMh6n aL4ymzo5QRy1+tx8v7o1NOjnGWydvYn3O4fwJVkYTFaJZZr9EI7gpTmEBw/gwfuf 4TH6BC++Ai/8vgKUhpdnWuTrjomWalPTcPBgQYG4gD7ak2TM1rmgMaCl/THUe36R zPC8m2sIXKeI4zGi8TeqTgaRvFSKJnuEmVo5OPkG98fZkjekCzWHp0q1+PG2Ecy8 Mu2/AOnwb1aSfOJh2Qajoke/Wed0U6qszop8C/jPRh8D1uTmRbI= =sOTj -----END PGP SIGNATURE----- Merge 5.10.163 into android12-5.10-lts Changes in 5.10.163 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static soc: qcom: llcc: make irq truly optional soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix syscall entry in !AUDUT_SYSCALL case PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file docs: fault-injection: fix non-working usage of negative values debugfs: fix error when writing negative value to atomic_t debugfs file ocfs2: ocfs2_mount_volume does cleanup job before return error ocfs2: rewrite error handling of ocfs2_fill_super ocfs2: fix memory leak in ocfs2_mount_volume() rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled clocksource/drivers/sh_cmt: Access registers according to spec futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Improve path in rpm_idle() when no callback PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() pata_ipx4xx_cf: Fix unsigned comparison with less than zero media: coda: jpeg: Add check for kmalloc media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev media: exynos4-is: don't rely on the v4l2_async_subdev internals can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Fix fall-through warnings for Clang ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: switch to drm_bridge_connector drm/msm/hdmi: drop unused GPIO support bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() wifi: ath10k: Fix return value in ath10k_pci_init() mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: fix an invalid memory access caused by incorrect use of list iterator ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx: replace osc_hdmi with dummy pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). net: hsr: generate supervision frame without HSR/PRP tag hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled clk: socfpga: clk-pll: Remove unused variable 'rc' clk: socfpga: use clk_hw_register for a5/c5 clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - delete unneeded variable initialization crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix normal discard process RDMA/siw: Fix immediate work request flush to completion queue RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Fix spurious fwnode_handle_put in error path serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: optional SETUP/SET_REPORT mode usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info RDMA/siw: Fix pointer cast warning iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Enable breakpoints on 8xx powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() kbuild: remove unneeded mkdir for external modules_install kbuild: unify modules(_install) for in-tree and external modules kbuild: refactor single builds of *.ko powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control NFSD: Remove spurious cb_setup_err tracepoint nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() nfc: pn533: Clear nfc_target before being used r6040: Fix kmemleak in probe and remove net: switch to storing KCOV handle directly in sk_buff net: add inline function skb_csum_is_sctp net: igc: use skb_csum_is_sctp instead of protocol check net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key skbuff: Account for tail adjustment during pull operations mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw reiserfs: Add missing calls to reiserfs_security_free() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable gcov: add support for checksum field ovl: fix use inode directly in rcu-walk mode media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug pwm: tegra: Fix 32 bit build usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init cifs: fix oops during encryption nvme-pci: fix doorbell buffer value endianness nvme-pci: fix mempool alloc size nvme-pci: fix page size checks ata: ahci: Fix PCS quirk application for suspend nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition nvmet: don't defer passthrough commands with trivial effects to the workqueue objtool: Fix SEGFAULT powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtas: avoid scheduling in rtas_os_term() HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: plantronics: Additional PIDs for double volume key presses quirk pstore/zone: Use GFP_ATOMIC to allocate zone buffer hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount binfmt: Fix error return code in load_elf_fdpic_binary() ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ALSA: line6: correct midi status byte when receiving data from podxt ALSA: line6: fix stack overflow in line6_midi_transmit pnode: terminate at peers of source md: fix a crash in mempool_free mm, compaction: fix fast_isolate_around() to stay within boundaries f2fs: should put a page when checking the summary info mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING tpm: acpi: Call acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails kcsan: Instrument memcpy/memset/memmove with newer Clang ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow() wifi: rtlwifi: remove always-true condition pointed out by GCC 12 wifi: rtlwifi: 8192de: correct checking of IQK reload torture: Exclude "NOHZ tick-stop error" from fatal errors rcu: Prevent lockdep-RCU splats on lock acquisition/release net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO net/af_packet: make sure to pull mac header media: stv0288: use explicitly signed char soc: qcom: Select REMAP_MMIO for LLCC driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them jbd2: use the correct print format arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength selftests: Use optional USERCFLAGS and USERLDFLAGS PM/devfreq: governor: Add a private governor_data for governor cpufreq: Init completion before kobject_init_and_add() ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: resume even if in FAIL mode dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' perf/core: Call LSM hook after copying perf_event_attr KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails x86/microcode/intel: Do not retry microcode reloading on the APs ftrace/x86: Add back ftrace_expected for ftrace bug reports x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK tracing/hist: Fix wrong return value in parse_action_params() tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line staging: media: tegra-video: fix chan->mipi value on error ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options rtc: ds1347: fix value written to century register md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk wifi: wilc1000: sdio: fix module autoloading ASoC: jz4740-i2s: Handle independent FIFO flush bits ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path crypto: n2 - add missing hash statesize driver core: Fix bus_type.match() error handling in __driver_attach() iommu/amd: Fix ivrs_acpihid cmdline parsing code remoteproc: core: Do pm_relax when in RPROC_OFFLINE state parisc: led: Fix potential null-ptr-deref in start_task() device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor drm/i915/dsi: fix VBT send packet port selection for dual link DSI drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() ext4: silence the warning when evicting inode with dioread_nolock ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: check and assert if marking an no_delete evicting inode dirty ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: avoid BUG_ON when creating xattrs ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area drm/amdgpu: handle polaris10/11 overlap asics (v2) drm/amdgpu: make display pinning more flexible (v2) ARM: renumber bits related to _TIF_WORK_MASK perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure perf/x86/intel/uncore: Clear attr_update properly btrfs: replace strncpy() with strscpy() x86/mce: Get rid of msr_ops x86/MCE/AMD: Clear DFR errors found in THR handler media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data x86/kprobes: Convert to insn_decode() x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK staging: media: tegra-video: fix device_node use after free ravb: Fix "failed to switch device to config mode" message during unbind riscv/stacktrace: Fix stack output without ra on the stack top riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument ext4: goto right label 'failed_mount3a' ext4: correct inconsistent error msg in nojournal mode mm/highmem: Lift memcpy_[to|from]_page to core ext4: use memcpy_to_page() in pagecache_write() fs: ext4: initialize fsdata in pagecache_write() ext4: move functions in super.c ext4: simplify ext4 error translation ext4: fix various seppling typos ext4: fix leaking uninitialized memory in fast-commit journal ext4: use kmemdup() to replace kmalloc + memcpy mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused ext4: remove EA inode entry from mbcache on inode eviction ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption SUNRPC: ensure the matching upcall is in-flight upon downcall bpf: pull before calling skb_postpull_rcsum() drm/panfrost: Fix GEM handle creation ref-counting vmxnet3: correctly report csum_level for encapsulated packet veth: Fix race with AF_XDP exposing old or uninitialized descriptors nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure nfc: Fix potential resource leaks vhost/vsock: Fix error handling in vhost_vsock_init() vringh: fix range used in iotlb_translate() vhost: fix range used in translate_desc() net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path net/mlx5: Avoid recovery in probe flows net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default net/mlx5e: Fix hw mtu initializing at XDP SQ allocation net: amd-xgbe: add missed tasklet_kill net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe RDMA/mlx5: Fix validation of max_rd_atomic caps for DC drm/meson: Reduce the FIFO lines held when AFBC is not used filelock: new helper: vfs_inode_has_locks ceph: switch to vfs_inode_has_locks() to fix file lock bug gpio: sifive: Fix refcount leak in sifive_gpio_probe net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop netfilter: ipset: fix hash:net,port,net hang with /0 subnet netfilter: ipset: Rework long task execution when adding/deleting entries perf tools: Fix resources leak in perf_data__open_dir() drivers/net/bonding/bond_3ad: return when there's no aggregator usb: rndis_host: Secure rndis_query check against int overflow drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet nvme: fix multipath crash caused by flush request when blktrace is enabled x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB riscv: uaccess: fix type of 0 variable on error in get_user() drm/i915/gvt: fix gvt debugfs destroy drm/i915/gvt: fix vgpu debugfs clean in remove ext4: don't allow journal inode to have encrypt flag selftests: set the BUILD variable to absolute path hfs/hfsplus: use WARN_ON for sanity check hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling mbcache: Avoid nesting of cache->c_list_lock under bit locks efi: random: combine bootloader provided RNG seed with RNG protocol output io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() parisc: Align parisc MADV_XXX constants with all other architectures ext4: disable fast-commit of encrypted dir operations ext4: don't set up encryption key during jbd2 transaction fsl_lpuart: Don't enable interrupts too early serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way" mptcp: mark ops structures as ro_after_init mptcp: remove MPTCP 'ifdef' in TCP SYN cookies mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 net: sched: disallow noqueue for qdisc classes net/ulp: prevent ULP without clone op from entering the LISTEN status ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 Linux 5.10.163 Change-Id: I9026971760be8484f1e1fa607f9f91243cc87785 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-06 12:30:05 +00:00
Sungwoo Kim	4373e5def3	UPSTREAM: Bluetooth: L2CAP: Fix u8 overflow ... [ Upstream commit bcd70260ef56e0aee8a4fc6cd214a419900b0765 ] By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@... Change-Id: Id3b87180787bdded28e876ed0500ca6156579fb8 Signed-off-by: Sungwoo Kim <iam@sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit f3fe6817156a2ad4b06f01afab04638a34d7c9a6) Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-06 11:31:45 +00:00
Yan Zhai	6446369fb9	net: fix NULL pointer in skb_segment_list ... commit 876e8ca8366735a604bac86ff7e2732fc9d85d2d upstream. Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on frag_list being untouched when passing through the network stack. This assumption can be broken sometimes, where frag_list itself gets pulled into linear area, leaving frag_list being NULL. When this happens it can trigger following NULL pointer dereference, and panic the kernel. Reverse the test condition should fix it. [19185.577801][ C1] BUG: kernel NULL pointer dereference, address: ... [19185.663775][ C1] RIP: 0010:skb_segment_list+0x1cc/0x390 ... [19185.834644][ C1] Call Trace: [19185.841730][ C1] <TASK> [19185.848563][ C1] __udp_gso_segment+0x33e/0x510 [19185.857370][ C1] inet_gso_segment+0x15b/0x3e0 [19185.866059][ C1] skb_mac_gso_segment+0x97/0x110 [19185.874939][ C1] __skb_gso_segment+0xb2/0x160 [19185.883646][ C1] udp_queue_rcv_skb+0xc3/0x1d0 [19185.892319][ C1] udp_unicast_rcv_skb+0x75/0x90 [19185.900979][ C1] ip_protocol_deliver_rcu+0xd2/0x200 [19185.910003][ C1] ip_local_deliver_finish+0x44/0x60 [19185.918757][ C1] __netif_receive_skb_one_core+0x8b/0xa0 [19185.927834][ C1] process_backlog+0x88/0x130 [19185.935840][ C1] __napi_poll+0x27/0x150 [19185.943447][ C1] net_rx_action+0x27e/0x5f0 [19185.951331][ C1] ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core] [19185.960848][ C1] __do_softirq+0xbc/0x25d [19185.968607][ C1] irq_exit_rcu+0x83/0xb0 [19185.976247][ C1] common_interrupt+0x43/0xa0 [19185.984235][ C1] asm_common_interrupt+0x22/0x40 ... [19186.094106][ C1] </TASK> Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") Suggested-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Yan Zhai <yan@cloudflare.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/Y9gt5EUizK1UImEP@debian Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-06 07:56:16 +01:00
Soenke Huster	0f9db1209f	Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt ... commit 3afee2118132e93e5f6fa636dfde86201a860ab3 upstream. This event is just specified for SCO and eSCO link types. On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, LE link type and a status that triggers the second case of the packet processing a NULL pointer dereference happens, as conn->link is NULL. Signed-off-by: Soenke Huster <soenke.huster@eknoes.de> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Ovidiu Panait <ovidiu.panait@eng.windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-06 07:56:16 +01:00
Greg Kroah-Hartman	8596b99884	Merge 5.10.162 into android12-5.10-lts ... Changes in 5.10.162 kernel: provide create_io_thread() helper iov_iter: add helper to save iov_iter state saner calling conventions for unlazy_child() fs: add support for LOOKUP_CACHED fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* Make sure nd->path.mnt and nd->path.dentry are always valid pointers fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED tools headers UAPI: Sync openat2.h with the kernel sources net: provide __sys_shutdown_sock() that takes a socket net: add accept helper not installing fd signal: Add task_sigpending() helper fs: make do_renameat2() take struct filename file: Rename __close_fd_get_file close_fd_get_file fs: provide locked helper variant of close_fd_get_file() entry: Add support for TIF_NOTIFY_SIGNAL task_work: Use TIF_NOTIFY_SIGNAL if available x86: Wire up TIF_NOTIFY_SIGNAL arc: add support for TIF_NOTIFY_SIGNAL arm64: add support for TIF_NOTIFY_SIGNAL m68k: add support for TIF_NOTIFY_SIGNAL nios32: add support for TIF_NOTIFY_SIGNAL parisc: add support for TIF_NOTIFY_SIGNAL powerpc: add support for TIF_NOTIFY_SIGNAL mips: add support for TIF_NOTIFY_SIGNAL s390: add support for TIF_NOTIFY_SIGNAL um: add support for TIF_NOTIFY_SIGNAL sh: add support for TIF_NOTIFY_SIGNAL openrisc: add support for TIF_NOTIFY_SIGNAL csky: add support for TIF_NOTIFY_SIGNAL hexagon: add support for TIF_NOTIFY_SIGNAL microblaze: add support for TIF_NOTIFY_SIGNAL arm: add support for TIF_NOTIFY_SIGNAL xtensa: add support for TIF_NOTIFY_SIGNAL alpha: add support for TIF_NOTIFY_SIGNAL c6x: add support for TIF_NOTIFY_SIGNAL h8300: add support for TIF_NOTIFY_SIGNAL ia64: add support for TIF_NOTIFY_SIGNAL nds32: add support for TIF_NOTIFY_SIGNAL riscv: add support for TIF_NOTIFY_SIGNAL sparc: add support for TIF_NOTIFY_SIGNAL ia64: don't call handle_signal() unless there's actually a signal queued ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling alpha: fix TIF_NOTIFY_SIGNAL handling task_work: remove legacy TWA_SIGNAL path kernel: remove checking for TIF_NOTIFY_SIGNAL coredump: Limit what can interrupt coredumps kernel: allow fork with TIF_NOTIFY_SIGNAL pending entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() x86/process: setup io_threads more like normal user space threads kernel: stop masking signals in create_io_thread() kernel: don't call do_exit() for PF_IO_WORKER threads task_work: add helper for more targeted task_work canceling io_uring: import 5.15-stable io_uring signal: kill JOBCTL_TASK_WORK task_work: unconditionally run task_work from get_signal() net: remove cmsg restriction from io_uring based send/recvmsg calls Revert "proc: don't allow async path resolution of /proc/thread-self components" Revert "proc: don't allow async path resolution of /proc/self components" eventpoll: add EPOLL_URING_WAKE poll wakeup flag eventfd: provide a eventfd_signal_mask() helper io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups Linux 5.10.162 Change-Id: I50a7b8bc8d38fac612113281b218cf5323b0af5e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 16:13:18 +00:00
Sriram Yagnaraman	743435cd17	netfilter: conntrack: unify established states for SCTP paths ... commit a44b7651489f26271ac784b70895e8a85d0cebf4 upstream. An SCTP endpoint can start an association through a path and tear it down over another one. That means the initial path will not see the shutdown sequence, and the conntrack entry will remain in ESTABLISHED state for 5 days. By merging the HEARTBEAT_ACKED and ESTABLISHED states into one ESTABLISHED state, there remains no difference between a primary or secondary path. The timeout for the merged ESTABLISHED state is set to 210 seconds (hb_interval * max_path_retrans + rto_max). So, even if a path doesn't see the shutdown sequence, it will expire in a reasonable amount of time. With this change in place, there is now more than one state from which we can transition to ESTABLISHED, COOKIE_ECHOED and HEARTBEAT_SENT, so handle the setting of ASSURED bit whenever a state change has happened and the new state is ESTABLISHED. Removed the check for dir==REPLY since the transition to ESTABLISHED can happen only in the reply direction. Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-01 08:23:27 +01:00
Marcelo Ricardo Leitner	6ef652f35d	sctp: fail if no bound addresses can be used for a given scope ... [ Upstream commit 458e279f861d3f61796894cd158b780765a1569f ] Currently, if you bind the socket to something like: servaddr.sin6_family = AF_INET6; servaddr.sin6_port = htons(0); servaddr.sin6_scope_id = 0; inet_pton(AF_INET6, "::1", &servaddr.sin6_addr); And then request a connect to: connaddr.sin6_family = AF_INET6; connaddr.sin6_port = htons(20000); connaddr.sin6_scope_id = if_nametoindex("lo"); inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr); What the stack does is: - bind the socket - create a new asoc - to handle the connect - copy the addresses that can be used for the given scope - try to connect But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface. The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer. Reported-by: Pietro Borrello <borrello@diag.uniroma1.it> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Link: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.1674496737.git.marcelo.leitner@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:25 +01:00
Eric Dumazet	cf9a2ce038	net/sched: sch_taprio: do not schedule in taprio_reset() ... [ Upstream commit ea4fdbaa2f7798cb25adbe4fd52ffc6356f097bb ] As reported by syzbot and hinted by Vinicius, I should not have added a qdisc_synchronize() call in taprio_reset() taprio_reset() can be called with qdisc spinlock held (and BH disabled) as shown in included syzbot report [1]. Only taprio_destroy() needed this synchronization, as explained in the blamed commit changelog. [1] BUG: scheduling while atomic: syz-executor150/5091/0x00000202 2 locks held by syz-executor150/5091: Modules linked in: Preemption disabled at: [<0000000000000000>] 0x0 Kernel panic - not syncing: scheduling while atomic: panic_on_warn set ... CPU: 1 PID: 5091 Comm: syz-executor150 Not tainted 6.2.0-rc3-syzkaller-00219-g010a74f52203 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 panic+0x2cc/0x626 kernel/panic.c:318 check_panic_on_warn.cold+0x19/0x35 kernel/panic.c:238 __schedule_bug.cold+0xd5/0xfe kernel/sched/core.c:5836 schedule_debug kernel/sched/core.c:5865 [inline] __schedule+0x34e4/0x5450 kernel/sched/core.c:6500 schedule+0xde/0x1b0 kernel/sched/core.c:6682 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167 schedule_timeout_uninterruptible kernel/time/timer.c:2201 [inline] msleep+0xb6/0x100 kernel/time/timer.c:2322 qdisc_synchronize include/net/sch_generic.h:1295 [inline] taprio_reset+0x93/0x270 net/sched/sch_taprio.c:1703 qdisc_reset+0x10c/0x770 net/sched/sch_generic.c:1022 dev_reset_queue+0x92/0x130 net/sched/sch_generic.c:1285 netdev_for_each_tx_queue include/linux/netdevice.h:2464 [inline] dev_deactivate_many+0x36d/0x9f0 net/sched/sch_generic.c:1351 dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1374 qdisc_graft+0xe4a/0x1380 net/sched/sch_api.c:1080 tc_modify_qdisc+0xb6b/0x19a0 net/sched/sch_api.c:1689 rtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6141 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline] Fixes: 3a415d59c1db ("net/sched: sch_taprio: fix possible use-after-free") Link: https://lore.kernel.org/netdev/167387581653.2747.13878941339893288655.git-patchwork-notify@kernel.org/T/ Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Vinicius Costa Gomes <vinicius.gomes@intel.com> Link: https://lore.kernel.org/r/20230123084552.574396-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:25 +01:00
Kuniyuki Iwashima	7de16d75b2	netrom: Fix use-after-free of a listening socket. ... [ Upstream commit 409db27e3a2eb5e8ef7226ca33be33361b3ed1c9 ] syzbot reported a use-after-free in do_accept(), precisely nr_accept() as sk_prot_alloc() allocated the memory and sock_put() frees it. [0] The issue could happen if the heartbeat timer is fired and nr_heartbeat_expiry() calls nr_destroy_socket(), where a socket has SOCK_DESTROY or a listening socket has SOCK_DEAD. In this case, the first condition cannot be true. SOCK_DESTROY is flagged in nr_release() only when the file descriptor is close()d, but accept() is being called for the listening socket, so the second condition must be true. Usually, the AF_NETROM listener neither starts timers nor sets SOCK_DEAD. However, the condition is met if connect() fails before listen(). connect() starts the t1 timer and heartbeat timer, and t1timer calls nr_disconnect() when timeout happens. Then, SOCK_DEAD is set, and if we call listen(), the heartbeat timer calls nr_destroy_socket(). nr_connect nr_establish_data_link(sk) nr_start_t1timer(sk) nr_start_heartbeat(sk) nr_t1timer_expiry nr_disconnect(sk, ETIMEDOUT) nr_sk(sk)->state = NR_STATE_0 sk->sk_state = TCP_CLOSE sock_set_flag(sk, SOCK_DEAD) nr_listen if (sk->sk_state != TCP_LISTEN) sk->sk_state = TCP_LISTEN nr_heartbeat_expiry switch (nr->state) case NR_STATE_0 if (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD)) nr_destroy_socket(sk) This path seems expected, and nr_destroy_socket() is called to clean up resources. Initially, there was sock_hold() before nr_destroy_socket() so that the socket would not be freed, but the commit 517a16b1a88b ("netrom: Decrease sock refcount when sock timers expire") accidentally removed it. To fix use-after-free, let's add sock_hold(). [0]: BUG: KASAN: use-after-free in do_accept+0x483/0x510 net/socket.c:1848 Read of size 8 at addr ffff88807978d398 by task syz-executor.3/5315 CPU: 0 PID: 5315 Comm: syz-executor.3 Not tainted 6.2.0-rc3-syzkaller-00165-gd9fc1511728c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 do_accept+0x483/0x510 net/socket.c:1848 __sys_accept4_file net/socket.c:1897 [inline] __sys_accept4+0x9a/0x120 net/socket.c:1927 __do_sys_accept net/socket.c:1944 [inline] __se_sys_accept net/socket.c:1941 [inline] __x64_sys_accept+0x75/0xb0 net/socket.c:1941 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa436a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa437784168 EFLAGS: 00000246 ORIG_RAX: 000000000000002b RAX: ffffffffffffffda RBX: 00007fa436bac050 RCX: 00007fa436a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007fa436ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffebc6700df R14: 00007fa437784300 R15: 0000000000022000 </TASK> Allocated by task 5294: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 14: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_heartbeat_expiry+0x1d7/0x460 net/netrom/nr_timer.c:148 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1700 expire_timers+0x2c6/0x5c0 kernel/time/timer.c:1751 __run_timers kernel/time/timer.c:2022 [inline] __run_timers kernel/time/timer.c:1995 [inline] run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035 __do_softirq+0x1fb/0xadc kernel/softirq.c:571 Fixes: 517a16b1a88b ("netrom: Decrease sock refcount when sock timers expire") Reported-by: syzbot+5fafd5cfe1fc91f6b352@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20230120231927.51711-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:25 +01:00
Sriram Yagnaraman	498584ccf4	netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE ... [ Upstream commit a9993591fa94246b16b444eea55d84c54608282a ] RFC 9260, Sec 8.5.1 states that for ABORT/SHUTDOWN_COMPLETE, the chunk MUST be accepted if the vtag of the packet matches its own tag and the T bit is not set OR if it is set to its peer's vtag and the T bit is set in chunk flags. Otherwise the packet MUST be silently dropped. Update vtag verification for ABORT/SHUTDOWN_COMPLETE based on the above description. Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:25 +01:00
Eric Dumazet	7f9828fb1f	ipv4: prevent potential spectre v1 gadget in fib_metrics_match() ... [ Upstream commit 5e9398a26a92fc402d82ce1f97cc67d832527da0 ] if (!type) continue; if (type > RTAX_MAX) return false; ... fi_val = fi->fib_metrics->metrics[type - 1]; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Fixes: 5f9ae3d9e7e4 ("ipv4: do metrics match when looking up and deleting a route") Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20230120133140.3624204-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:25 +01:00
Eric Dumazet	34c6142f0d	ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ... [ Upstream commit 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8 ] if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Fixes: 6cf9dfd3bd62 ("net: fib: move metrics parsing to a helper") Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20230120133040.3623463-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Eric Dumazet	870a565bd6	netlink: annotate data races around sk_state ... [ Upstream commit 9b663b5cbb15b494ef132a3c937641c90646eb73 ] netlink_getsockbyportid() reads sk_state while a concurrent netlink_connect() can change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Eric Dumazet	8583f52c23	netlink: annotate data races around dst_portid and dst_group ... [ Upstream commit 004db64d185a5f23dfb891d7701e23713b2420ee ] netlink_getname(), netlink_sendmsg() and netlink_getsockbyportid() can read nlk->dst_portid and nlk->dst_group while another thread is changing them. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Eric Dumazet	eccb532ada	netlink: annotate data races around nlk->portid ... [ Upstream commit c1bb9484e3b05166880da8574504156ccbd0549e ] syzbot reminds us netlink_getname() runs locklessly [1] This first patch annotates the race against nlk->portid. Following patches take care of the remaining races. [1] BUG: KCSAN: data-race in netlink_getname / netlink_insert write to 0xffff88814176d310 of 4 bytes by task 2315 on cpu 1: netlink_insert+0xf1/0x9a0 net/netlink/af_netlink.c:583 netlink_autobind+0xae/0x180 net/netlink/af_netlink.c:856 netlink_sendmsg+0x444/0x760 net/netlink/af_netlink.c:1895 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2476 ___sys_sendmsg net/socket.c:2530 [inline] __sys_sendmsg+0x19a/0x230 net/socket.c:2559 __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88814176d310 of 4 bytes by task 2316 on cpu 0: netlink_getname+0xcd/0x1a0 net/netlink/af_netlink.c:1144 __sys_getsockname+0x11d/0x1b0 net/socket.c:2026 __do_sys_getsockname net/socket.c:2041 [inline] __se_sys_getsockname net/socket.c:2038 [inline] __x64_sys_getsockname+0x3e/0x50 net/socket.c:2038 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0xc9a49780 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 2316 Comm: syz-executor.2 Not tainted 6.2.0-rc3-syzkaller-00030-ge8f60cd7db24-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Pablo Neira Ayuso	0308b7dfea	netfilter: nft_set_rbtree: skip elements in transaction from garbage collection ... [ Upstream commit 5d235d6ce75c12a7fdee375eb211e4116f7ab01b ] Skip interference with an ongoing transaction, do not perform garbage collection on inactive elements. Reset annotated previous end interval if the expired element is marked as busy (control plane removed the element right before expiration). Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support") Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Pablo Neira Ayuso	4aacf3d784	netfilter: nft_set_rbtree: Switch to node list walk for overlap detection ... [ Upstream commit c9e6978e2725a7d4b6cd23b2facd3f11422c0643 ] ...instead of a tree descent, which became overly complicated in an attempt to cover cases where expired or inactive elements would affect comparisons with the new element being inserted. Further, it turned out that it's probably impossible to cover all those cases, as inactive nodes might entirely hide subtrees consisting of a complete interval plus a node that makes the current insertion not overlap. To speed up the overlap check, descent the tree to find a greater element that is closer to the key value to insert. Then walk down the node list for overlap detection. Starting the overlap check from rb_first() unconditionally is slow, it takes 10 times longer due to the full linear traversal of the list. Moreover, perform garbage collection of expired elements when walking down the node list to avoid bogus overlap reports. For the insertion operation itself, this essentially reverts back to the implementation before commit 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion"), except that cases of complete overlap are already handled in the overlap detection phase itself, which slightly simplifies the loop to find the insertion point. Based on initial patch from Stefano Brivio, including text from the original patch description too. Fixes: 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion") Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Paolo Abeni	d4c008f3b7	net: fix UaF in netns ops registration error path ... [ Upstream commit 71ab9c3e2253619136c31c89dbb2c69305cc89b1 ] If net_assign_generic() fails, the current error path in ops_init() tries to clear the gen pointer slot. Anyway, in such error path, the gen pointer itself has not been modified yet, and the existing and accessed one is smaller than the accessed index, causing an out-of-bounds error: BUG: KASAN: slab-out-of-bounds in ops_init+0x2de/0x320 Write of size 8 at addr ffff888109124978 by task modprobe/1018 CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9f print_address_description.constprop.0+0x86/0x2b5 print_report+0x11b/0x1fb kasan_report+0x87/0xc0 ops_init+0x2de/0x320 register_pernet_operations+0x2e4/0x750 register_pernet_subsys+0x24/0x40 tcf_register_action+0x9f/0x560 do_one_initcall+0xf9/0x570 do_init_module+0x190/0x650 load_module+0x1fa5/0x23c0 __do_sys_finit_module+0x10d/0x1b0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f42518f778d Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003 RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000 </TASK> This change addresses the issue by skipping the gen pointer de-reference in the mentioned error-path. Found by code inspection and verified with explicit error injection on a kasan-enabled kernel. Fixes: d266935ac43d ("net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/cec4e0f3bb2c77ac03a6154a8508d3930beb5f0f.1674154348.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:24 +01:00
Archie Pusaka	1d580d3e13	Bluetooth: hci_sync: cancel cmd_timer if hci_open failed ... commit 97dfaf073f5881c624856ef293be307b6166115c upstream. If a command is already sent, we take care of freeing it, but we also need to cancel the timeout as well. Signed-off-by: Archie Pusaka <apusaka@chromium.org> Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:21 +01:00
Florian Westphal	5fb884d748	netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state ... [ Upstream commit e15d4cdf27cb0c1e977270270b2cea12e0955edd ] Consider: client -----> conntrack ---> Host client sends a SYN, but $Host is unreachable/silent. Client eventually gives up and the conntrack entry will time out. However, if the client is restarted with same addr/port pair, it may prevent the conntrack entry from timing out. This is noticeable when the existing conntrack entry has no NAT transformation or an outdated one and port reuse happens either on client or due to a NAT middlebox. This change prevents refresh of the timeout for SYN retransmits, so entry is going away after nf_conntrack_tcp_timeout_syn_sent seconds (default: 60). Entry will be re-created on next connection attempt, but then nat rules will be evaluated again. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:18 +01:00
David Morley	d79e700680	tcp: fix rate_app_limited to default to 1 ... [ Upstream commit 300b655db1b5152d6101bcb6801d50899b20c2d6 ] The initial default value of 0 for tp->rate_app_limited was incorrect, since a flow is indeed application-limited until it first sends data. Fixing the default to be 1 is generally correct but also specifically will help user-space applications avoid using the initial tcpi_delivery_rate value of 0 that persists until the connection has some non-zero bandwidth sample. Fixes: eb8329e0a04d ("tcp: export data delivery rate") Suggested-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: David Morley <morleyd@google.com> Signed-off-by: Neal Cardwell <ncardwell@google.com> Tested-by: David Morley <morleyd@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:16 +01:00
Jason Xing	ddf16dae65	tcp: avoid the lookup process failing to get sk in ehash table ... [ Upstream commit 3f4ca5fafc08881d7a57daa20449d171f2887043 ] While one cpu is working on looking up the right socket from ehash table, another cpu is done deleting the request socket and is about to add (or is adding) the big socket from the table. It means that we could miss both of them, even though it has little chance. Let me draw a call trace map of the server side. CPU 0 CPU 1 ----- ----- tcp_v4_rcv() syn_recv_sock() inet_ehash_insert() -> sk_nulls_del_node_init_rcu(osk) __inet_lookup_established() -> __sk_nulls_add_node_rcu(sk, list) Notice that the CPU 0 is receiving the data after the final ack during 3-way shakehands and CPU 1 is still handling the final ack. Why could this be a real problem? This case is happening only when the final ack and the first data receiving by different CPUs. Then the server receiving data with ACK flag tries to search one proper established socket from ehash table, but apparently it fails as my map shows above. After that, the server fetches a listener socket and then sends a RST because it finds a ACK flag in the skb (data), which obeys RST definition in RFC 793. Besides, Eric pointed out there's one more race condition where it handles tw socket hashdance. Only by adding to the tail of the list before deleting the old one can we avoid the race if the reader has already begun the bucket traversal and it would possibly miss the head. Many thanks to Eric for great help from beginning to end. Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions") Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jason Xing <kernelxing@tencent.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/lkml/20230112065336.41034-1-kerneljasonxing@gmail.com/ Link: https://lore.kernel.org/r/20230118015941.1313-1-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:15 +01:00
Eric Dumazet	16791d5a7a	l2tp: prevent lockdep issue in l2tp_tunnel_register() ... [ Upstream commit b9fb10d131b8c84af9bb14e2078d5c63600c7dea ] lockdep complains with the following lock/unlock sequence: lock_sock(sk); write_lock_bh(&sk->sk_callback_lock); [1] release_sock(sk); [2] write_unlock_bh(&sk->sk_callback_lock); We need to swap [1] and [2] to fix this issue. Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") Reported-by: syzbot+bbd35b345c7cab0d9a08@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/netdev/20230114030137.672706-1-xiyou.wangcong@gmail.com/T/#m1164ff20628671b0f326a24cb106ab3239c70ce3 Cc: Cong Wang <cong.wang@bytedance.com> Cc: Guillaume Nault <gnault@redhat.com> Reviewed-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:23:14 +01:00