android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,004,913 Commits 2 Branches 0 Tags 2.3 GiB
e22e091f95
Commit Graph

1004913 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Greg Kroah-Hartman
e22e091f95 Merge de5a059e36 ("RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ie75a10f12b4c90baa487a120d138956dd5a09da8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-17 08:15:32 +00:00
Greg Kroah-Hartman
2a22a03cae Merge 2622c805ab ("kallsyms: Make module_kallsyms_on_each_symbol generally available") into android12-5.10-lts 
Steps on the way to 5.10.227

Resolves merge conflicts in:
	include/linux/kallsyms.h
	include/linux/module.h
	kernel/kallsyms.c

Change-Id: I207acf2f76d2f2bc3be7b811edec98d988365f60
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-17 08:15:15 +00:00
Greg Kroah-Hartman
96a5139526 Merge 570e257621 ("drm/rockchip: vop: clear DMA stop bit on RK3066") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I91493ff89340657e9b05839438143526a89905e7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-17 08:14:37 +00:00
Greg Kroah-Hartman
042d3e2676 Merge 24afda0421 ("arm64: errata: Expand speculative SSBS workaround once more") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I3bd2cd77909ddbf15f7eaf95b1724ad0cbf0b275
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-17 08:14:20 +00:00
Greg Kroah-Hartman
ce691439c0 Revert "ext4: properly sync file size update after O_SYNC direct IO" 
This reverts commit dde4c1e166 which is
commit 91562895f8030cb9a0470b1db49de79346a69f91 upstream.

It breaks the Android kernel tests, and can be brought back in the future
if it is really needed.

Bug: 161946584
Change-Id: Ia4acc78370c913f2c3691a68148db000f3034eaf
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 18:27:09 +00:00
Greg Kroah-Hartman
f46870ab3d Revert "ext4: dax: fix overflowing extents beyond inode size when partially writing" 
This reverts commit f8a7c34232 which is
commit dda898d7ffe85931f9cca6d702a51f33717c501e upstream.

It breaks the Android kernel tests, and can be brought back in the future
if it is really needed.

Bug: 161946584
Change-Id: I8c5a06731ef7830612591c6f818ac69cf169d78a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 18:26:45 +00:00
Greg Kroah-Hartman
5d9c84863f Merge f8a7c34232 ("ext4: dax: fix overflowing extents beyond inode size when partially writing") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ifa9c84d819e26b5ec9a4503dbf77f3e48ff0782c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:40:19 +00:00
Greg Kroah-Hartman
8fb88ba5de Merge dde4c1e166 ("ext4: properly sync file size update after O_SYNC direct IO") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: If19e4b34d65d6f90dabc6fce79809aea1675bd0a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:40:14 +00:00
Greg Kroah-Hartman
e62d85f9ba Merge 6ff56ef7f7 ("i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I594d13d640c0694fad4d1511963ef76b40d8818b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:40:09 +00:00
Greg Kroah-Hartman
b5e0cda160 Merge d223126bb0 ("i2c: xiic: Use devm_clk_get_enabled()") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ieba130e61fc0d92a3bd5e5471132b17d93c93f1e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:40:03 +00:00
Greg Kroah-Hartman
ed3c358943 Merge 9bd3443e34 ("i2c: xiic: Simplify with dev_err_probe()") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I6fb758dbcca37ace6ef85f11bc1efdd712b01960
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:58 +00:00
Greg Kroah-Hartman
93d28c0f5a Merge 8b55076b7b ("kconfig: qconf: fix buffer overflow in debug links") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ic48fc002c22cc00235a97bff5a5db275e3d640d5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:52 +00:00
Greg Kroah-Hartman
6e988ae353 Merge bfab5fbc12 ("drm/sched: Add locking to drm_sched_entity_modify_sched") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ic04a46a30a66439afd37834665fe6c0266a7f7ab
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:47 +00:00
Greg Kroah-Hartman
25d36c65fb Merge c54aa7d750 ("gpio: davinci: fix lazy disable") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I0d838d0b3e25a560019d5cded5d63d1ac50f7cd5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:41 +00:00
Greg Kroah-Hartman
9fbdcfe7bb Merge 70b60c8d9b ("btrfs: wait for fixup workers before stopping cleaner kthread during umount") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ie897a82549a26d8832c1cd233ac507bdaa083cdb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:36 +00:00
Greg Kroah-Hartman
d476e18cbf Merge d73d48acf3 ("btrfs: fix a NULL pointer dereference when failed to start a new trasacntion") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Id9261beea462bed16ae80004e8eb46eb8cb4cbeb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:30 +00:00
Greg Kroah-Hartman
657f07546b Merge 67db431b85 ("ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ief87e635485bb4122454767617ca6554622f86e8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:24 +00:00
Greg Kroah-Hartman
17c42250e8 Merge 1a819c7f85 ("ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I36820b61ab1aa5f069ef03a15fce6f8c51947e3d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-16 16:39:19 +00:00
Greg Kroah-Hartman
c53240428e Revert "clk: qcom: clk-rpmh: Fix overflow in BCM vote" 
This reverts commit 4445bc6e9f which is
commit a4e5af27e6f6a8b0d14bc0d7eb04f4a6c7291586 upstream.

It breaks the Android kernel build and can be brought back in the future
if it is really needed.

Bug: 161946584
Change-Id: I964efba1123a8e6c7342a5cda1920a65ad9f3364
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 17:07:31 +00:00
Greg Kroah-Hartman
509ddbb2b8 Merge f976d964a6 ("Input: adp5589-keys - fix adp5589_gpio_get_value()") into android12-5.10-lts 
Steps on the way to 5.10.227

Resolves merge conflicts in:
	fs/nfsd/nfs4xdr.c
	fs/nfsd/vfs.c

Change-Id: I8ed4156759977aa5c53d577990f4b72e61530ebf
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 11:34:30 +00:00
Greg Kroah-Hartman
6a00671aec Merge 2c08dfc99f ("ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9") into android12-5.10-lts 
Steps on the way to 5.10.227

Resolves merge conflicts in:
	fs/ext4/namei.c

Change-Id: I7dfbf5a9d8837593f8e4a7ddb5ba34e256d94953
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 11:33:02 +00:00
Greg Kroah-Hartman
b48eba851f Merge 1ebfa66638 ("drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I5e69192f2ecbbda523c18c2749bb1f181837e99c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 11:32:05 +00:00
Greg Kroah-Hartman
baa474b078 Merge 74c63fd016 ("ACPICA: Fix memory leak if acpi_ps_get_next_field() fails") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ie190b64ce17dea26ec0ac8910bbcb5fb144aede0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 11:30:34 +00:00
Greg Kroah-Hartman
6f91c0260d Merge 531754952f ("netfilter: nf_tables: prevent nf_skb_duplicated corruption") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: Ib618ae4b21061bc48e1a821a0bdb35811495f7b2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 10:00:24 +00:00
Greg Kroah-Hartman
6136b834d6 Merge cdd86fb75f ("net/mlx5: Added cond_resched() to crdump collection") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I780b041f7c72ac3204110981ba8c0ce36764d971
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 09:58:25 +00:00
Greg Kroah-Hartman
f6317d304f Merge e0dbda9f26 ("netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I0b10c995547c8a307f9f22bfec8158d76554904f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:22:25 +00:00
Greg Kroah-Hartman
0e233e78a8 Merge db9c5f08ee ("netfilter: nf_tables: Keep deleted flowtable hooks until after RCU") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I8c3d60e94c855f9577feac89b5a7a94160a60409
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:22:20 +00:00
Greg Kroah-Hartman
e45c637aa5 Merge 6c36857fe5 ("net: qrtr: Update packets cloning when broadcasting") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I6aae8d9eaa56b925be94f78db8370923ae39cfea
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:22:14 +00:00
Greg Kroah-Hartman
8acb711851 Merge ec31cf42fc ("tcp: check skb is non-NULL in tcp_rto_delta_us()") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I993f751bd8d257ba26650e6b879ef5a729344d50
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:22:08 +00:00
Greg Kroah-Hartman
69acbd5795 Merge 98d14164c0 ("net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I84ad7d7d2ac58b270427706e75d3d0cc71aadbe6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:22:03 +00:00
Greg Kroah-Hartman
13cdfa4cd3 Merge 338a0582b2 ("net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I5311c40af63e811a025fbc88b8de68169067b573
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:21:57 +00:00
Greg Kroah-Hartman
973b583bb8 Merge dcf48ab3ca ("netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I19961d9222e571548302376f06845533f21f1496
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:21:52 +00:00
Greg Kroah-Hartman
0407f5e40e Merge 1429a9260f ("Revert "dm: requeue IO if mapping table not yet available"") into android12-5.10-lts 
Steps on the way to 5.10.226

Resolves merge conflicts in:
	fs/f2fs/xattr.c
	fs/nfsd/filecache.c

Change-Id: I09ff012f62cfc2cd08550684766f05eac93951fb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 07:16:40 +00:00
Greg Kroah-Hartman
da5751e56b Revert "device property: Add const qualifier to device_get_match_data() parameter" 
This reverts commit 167e4371ef which is
commit aade55c86033bee868a93e4bf3843c9c99e84526 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ibe2a0a95fe742a59be4c97fab2bdf3833cdb64f0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:31 +00:00
Greg Kroah-Hartman
47d930c2c7 Revert "i2c: Add i2c_get_match_data()" 
This reverts commit 514a1508c3 which is
commit 564d73c4d9201526bd976b9379d2aaf1a7133e84 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I127ac41f68d2ba04f0955272f8b38d9fb67b12c2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:31 +00:00
Greg Kroah-Hartman
a99e4337ab Revert "hwmon: (max16065) Remove use of i2c_match_id()" 
This reverts commit 932559f25a which is
commit 5a71654b398e3471f0169c266a3587cf09e1200c upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ib7eb0b28a9f4270f583417865037771c8cfa050c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:31 +00:00
Greg Kroah-Hartman
9c428fa328 Revert "hwmon: (max16065) Fix alarm attributes" 
This reverts commit d7a7dd2966 which is
commit 119abf7d1815f098f7f91ae7abc84324a19943d7 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I8630a6c46b19589150df1ee35a6b1b00d5105984
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:31 +00:00
Greg Kroah-Hartman
246d613c20 Revert "cgroup: Make operations on the cgroup root_list RCU safe" 
This reverts commit 45a81667e0 which is
commit d23b5c577715892c87533b13923306acc6243f93 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ib735fb56a5adb6b0198eebc51b0f9737eaff944b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:31 +00:00
Greg Kroah-Hartman
77867ef6d4 Revert "cgroup: Move rcu_head up near the top of cgroup_root" 
This reverts commit 4abf184168 which is
commit a7fb0423c201ba12815877a0b5a68a6a1710b23a upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I1561314f01cdd49442735838c4aae3e3da9232c6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:30 +00:00
Greg Kroah-Hartman
8cf71990ea Revert "inet: inet_defrag: prevent sk release while still in use" 
This reverts commit 9705f447bf which is
commit 18685451fc4e546fc0e718580d32df3c0e5c8272 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I049667ee9c932c352643b7f1c743b2025c4b284c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:20 +00:00
Greg Kroah-Hartman
3ce4532099 Revert "bareudp: Pull inner IP header in bareudp_udp_encap_recv()." 
This reverts commit 76851c70a5 which is
commit 45fa29c85117170b0508790f878b13ec6593c888 upstream.

It breaks the Android kernel build and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ic4c22cf6bfa12bdc130cf846cfb5554b8f5580eb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:33:17 +00:00
Greg Kroah-Hartman
9e57ad4546 Merge 0ce9d89343 ("clk: ti: dra7-atl: Fix leak of of_nodes") into android12-5.10-lts 
Steps on the way to 5.10.226

Resolves merge conflicts in:
	drivers/dma-buf/heaps/heap-helpers.c
	drivers/usb/dwc3/core.h
	fs/ext4/inline.c

Change-Id: Id7ab496884e549fc85b6fff8254fb56d6785d78c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:29:46 +00:00
Greg Kroah-Hartman
1f05cd743b Merge ae96b02b9d ("soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"") into android12-5.10-lts 
Steps on the way to 5.10.226

Change-Id: I92c594018a2ec1c562a580e493117d780fade779
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 12:44:11 +00:00
Greg Kroah-Hartman
8441327954 Revert "Merge 8a30bee7f5 ("usb: dwc3: core: update LC timer as per USB Spec V3.2") into android12-5.10-lts" 
This reverts commit 18eef3d55a, reversing
changes made to e477d44e5f.

Merge away the dwc3 changes in 5.10.227 as they break the abi and the
build tests.  If these are needed in the future, they can come back in
an abi-safe way.

Change-Id: I2f5057d0fc82e9b0bd2a6d93676d9fc1757cc95b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 11:36:30 +00:00
Greg Kroah-Hartman
18eef3d55a Merge 8a30bee7f5 ("usb: dwc3: core: update LC timer as per USB Spec V3.2") into android12-5.10-lts 
Steps on the way to 5.10.226

Resolves merge conflicts in:
	drivers/usb/dwc3/core.h

Change-Id: Ie3b5dacb1e9c6f8ff2f20e3f3a77edd8128746ff
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 10:57:19 +00:00
Greg Kroah-Hartman
e477d44e5f Merge branch 'android12-5.10' into android12-5.10-lts 
Merge the changes in the non-lts branch into the lts branch to keep it
up to date.  Changes in here include:

* 9b6fc2bc30 UPSTREAM: dma-buf: heaps: Fix off-by-one in CMA heap fault handler
* b9d4c135c7 Merge tag 'android12-5.10.226_r00' into android12-5.10
* 1ef7612897 BACKPORT: firmware: arm_scmi: Queue in scmi layer for mailbox implementation
* 53a61c62da BACKPORT: gso: fix udp gso fraglist segmentation after pull from frag_list
* f22586e750 ANDROID: usb: Optimization the transfer rate of accessory mode in USB3.2 mode
* 51b9e859a4 UPSTREAM: unicode: Don't special case ignorable code points
* 66aebe42e6 ANDROID: 16K: Fixup padding vm_flags bits on VMA splits
* 0e3d191eaf ANDROID: 16K: Introduce pgsize_migration_inline.h
* 4c7b897f39 BACKPORT: netem: fix return value if duplicate enqueue fails
* 7b9f6a0ecd ANDROID: GKI: Update the ABI symbol list
* 6b967696c1 ANDROID: GKI: Update symbol list for vivo
* ac8da910db ANDROID: GKI: export sys_exit tracepoint
* f3eef39b58 ANDROID: GKI: Update symbol list for vivo
* 2205d34fb2 ANDROID: GKI: Update symbol list for vivo
* 8884166229 ANDROID: GKI: add percpu_rwsem vendor hooks
* 2521fb1dd7 ANDROID: vendor_hooks: add hooks in rwsem
* 5b9bc4b198 ANDROID: delete tool added by mistake
* 0c025265d8 ANDROID: GKI: Add initialization for rwsem's oem_data and vendor_data.
* 2c00661c3f ANDROID: GKI: Add initialization for mutex oem_data.
* 8e78d8ae8a ANDROID: fix ENOMEM check of binder_proc_ext
* 587d04a070 ANDROID: binder: fix KMI issues due to frozen notification
* 69d87eed07 BACKPORT: FROMGIT: binder: frozen notification binder_features flag
* 0e10c6560f BACKPORT: FROMGIT: binder: frozen notification
* 014a9ca18f UPSTREAM: selftests/binderfs: add test for feature files
* fe8ef2d5db UPSTREAM: docs: binderfs: add section about feature files
* 433a83ab08 UPSTREAM: binderfs: add support for feature files
* d7881f1c8f ANDROID: GKI: Add symbol to symbol list for vivo.
* 284a6a930d ANDROID: vendor_hooks: add hooks to modify pageflags
* a5d073d697 ANDROID: GKI: Add pageflags for OEM
* c7d7f8476d ANDROID: GKI: Update symbol list for vivo
* 89d09e01fa ANDROID: vendor_hooks: add vendor hooks for fuse request
* 9ac177ec5c UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune()

Change-Id: Id1fceaefc8261e4c59d90b24a039ee3e3ff21fa5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-07 16:06:33 +00:00
T.J. Mercier
9b6fc2bc30 UPSTREAM: dma-buf: heaps: Fix off-by-one in CMA heap fault handler 
commit ea5ff5d351b520524019f7ff7f9ce418de2dad87 upstream.

Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps:
Don't track CMA dma-buf pages under RssFile") it was possible to obtain
a mapping larger than the buffer size via mremap and bypass the overflow
check in dma_buf_mmap_internal. When using such a mapping to attempt to
fault past the end of the buffer, the CMA heap fault handler also checks
the fault offset against the buffer size, but gets the boundary wrong by
1. Fix the boundary check so that we don't read off the end of the pages
array and insert an arbitrary page in the mapping.

Bug: 363259128
Reported-by: Xingyu Jin <xingyuj@google.com>
Fixes: a5d2d29e24be ("dma-buf: heaps: Move heap-helper logic into the cma_heap implementation")
Cc: stable@vger.kernel.org # Applicable >= 5.10. Needs adjustments only for 5.10.
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Acked-by: John Stultz <jstultz@google.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20240830192627.2546033-1-tjmercier@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 79cce5e81d20fa9ad553be439d665ac3302d3c95)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ifc9c940e0a3cd721d29c783753b0dfd13a8aafc6
 2024-10-30 09:12:05 +00:00
Greg Kroah-Hartman
b9d4c135c7 Merge tag 'android12-5.10.226_r00' into android12-5.10 
This merges up to the 5.10.226 LTS release into android12-5.10.
Included in here are the following commits:

* bfa0f472d5 Revert "udf: Avoid excessive partition lengths"
* 90336334a0 Revert "bareudp: Fix device stats updates."
* bcfc839140 ANDROID: fix up change to pti_clone_pgtable()
* ebdacb6176 Revert "perf/aux: Fix AUX buffer serialization"
* 3c59c9aebf Revert "clocksource/drivers/timer-of: Remove percpu irq related code"
*   7d3ca1ed3f Merge 5.10.226 into android12-5.10-lts
|\
| * ceb091e2c4 Linux 5.10.226
| * 912736a043 memcg: protect concurrent access to mem_cgroup_idr
| * 02ee1976ed net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
| * dad75cf2c3 x86/mm: Fix PTI for i386 some more
| * 1401da1486 rtmutex: Drop rt_mutex::wait_lock before scheduling
| * c6bd80f585 mmc: cqhci: Fix checking of CQHCI_HALT state
| * b35d3c8181 drm/i915/fence: Mark debug_fence_free() with __maybe_unused
| * b8dfa35f00 drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
| * 50632b877c nvmet-tcp: fix kernel crash if commands allocation fails
| * 4c3b21204a arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
| * ccb95b37e9 arm64: acpi: Move get_cpu_for_acpi_id() to a header
| * 3658388cd3 ACPI: processor: Fix memory leaks in error paths of processor_add()
| * 5dac987d1b ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
| * 157c0d94b4 nilfs2: protect references to superblock parameters exposed in sysfs
| * 0630e3d435 nilfs2: replace snprintf in show functions with sysfs_emit
| * 7882923f1c perf/aux: Fix AUX buffer serialization
| * 0f511f2840 uprobes: Use kzalloc to allocate xol area
| * 0af6b80dac clocksource/drivers/timer-of: Remove percpu irq related code
| * 3ded318cf0 clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
| * cf6ffb1688 clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
| * 6c563a2985 VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
| * 359ea5edc9 Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
| * 1d8e020e51 uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
| * 38cd8bde8a nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
| * 3a8154bb4a binder: fix UAF caused by offsets overwrite
| * d0d3edb56e iio: adc: ad7124: fix chip ID mismatch
| * 1719ebc8e3 iio: fix scale application in iio_convert_raw_to_processed_unlocked
| * f3a54c27ba iio: buffer-dmaengine: fix releasing dma channel on error
| * 41cc91e313 staging: iio: frequency: ad9834: Validate frequency parameter value
| * d8a61e69f8 NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
| * 6fb7b7f5ba ata: pata_macio: Use WARN instead of BUG
| * d3ff0f98a5 MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
| * 99418ec776 lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
| * 9d1e9f0876 of/irq: Prevent device address out-of-bounds read in interrupt map walk
| * 5c8906de98 Squashfs: sanity check symbolic link size
| * 2f14160d9f usbnet: ipheth: race between ipheth_close and error handling
| * 51fa08edd8 Input: uinput - reject requests with unreasonable number of slots
| * 34185de73d HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
| * 3206e4a4b0 s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
| * 912bcdc51b btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry()
| * 3eaad59258 kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
| * e6f3008de8 net: dpaa: avoid on-stack arrays of NR_CPUS elements
| * e2355d513b PCI: Add missing bridge lock to pci_bus_lock()
| * c60676b81f btrfs: clean up our handling of refs == 0 in snapshot delete
| * ed1b61398c btrfs: replace BUG_ON with ASSERT in walk_down_proc()
| * 8780129cbc smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
| * 9813770f25 wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
| * fb2257089a libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
| * 56cfdeb2c7 hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
| * 8a1e958e26 hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
| * 59c1fb9874 hwmon: (lm95234) Fix underflows seen when writing limit attributes
| * 2a3add62f1 hwmon: (adc128d818) Fix underflows seen when writing limit attributes
| * bc1faed19d pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
| * 9b884bdc29 devres: Initialize an uninitialized struct member
| * c8944d449f um: line: always fill *error_out in setup_one_line()
| * 1434b72a2d cgroup: Protect css->cgroup write under css_set_lock
| * 70854bf003 iommu/vt-d: Handle volatile descriptor status read
| * 8a7ef20bf7 dm init: Handle minors larger than 255
| * 583b5d2d43 ASoC: topology: Properly initialize soc_enum values
| * 43b442c972 net: dsa: vsc73xx: fix possible subblocks range of CAPT block
| * 19af8a23a1 net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
| * 231c235d2f fou: Fix null-ptr-deref in GRO.
| * 0ea3f2798d gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
| * 77ad44ee33 gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
| * bc18f3c806 fou: remove sparse errors
| * 3c0cedc22c bareudp: Fix device stats updates.
| * 32cbafeebf usbnet: modern method to get random MAC
| * 594cc1dba0 net: usb: don't write directly to netdev->dev_addr
| * 98a4cabf87 drivers/net/usb: Remove all strcpy() uses
| * acd2985137 igc: Unlock on error in igc_io_resume()
| * 3efe53eb22 tcp_bpf: fix return value of tcp_bpf_sendmsg()
| * ee1c2ecf7b platform/x86: dell-smbios: Fix error path in dell_smbios_init()
| * 45c0c747df svcrdma: Catch another Reply chunk overflow case
| * 449d70b16b igb: Fix not clearing TimeSync interrupts for 82580
| * aec92dbebd can: bcm: Remove proc entry when dev is unregistered.
| * ee50abebdc pcmcia: Use resource_size function on resource object
| * 9380fe33ab media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
| * ebbdbbc580 PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
| * 1fa40e0d27 media: vivid: don't set HDMI TX controls if there are no HDMI outputs
| * 44a595f897 usb: uas: set host status byte on data completion error
| * 3ab3ee4125 wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
| * 9e28a1df18 leds: spi-byte: Call of_node_put() on error path
| * e73b63f138 media: vivid: fix wrong sizeimage value for mplane
| * 551966371e udf: Avoid excessive partition lengths
| * 66234da64d netfilter: nf_conncount: fix wrong variable type
| * f56089a180 iommu: sun50i: clear bypass register
| * 1c5bad90e0 af_unix: Remove put_pid()/put_cred() in copy_peercred().
| * ec08e30082 irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
| * 500e4bf673 smack: unix sockets: fix accept()ed socket label
| * 414736fcb7 ALSA: hda: Add input value sanity checks to HDMI channel map controls
* | 70fe52b634 Revert "Merge 751777a79a ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts"
* | c3e9a280ba Merge 751777a79a ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts
|\|
| * 751777a79a nfsd: make svc_stat per-network namespace instead of global
| * f8219c4b80 nfsd: remove nfsd_stats, make th_cnt a global counter
| * f2fe1ec906 nfsd: make all of the nfsd stats per-network namespace
| * 5545496966 nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
| * fec6561e75 nfsd: rename NFSD_NET_* to NFSD_STATS_*
| * 9eb5d44b8f sunrpc: use the struct net as the svc proc private
| * e0fba78ab9 sunrpc: remove ->pg_stats from svc_program
| * 7f2476914e sunrpc: pass in the sv_stats struct through svc_create_pooled
| * d06254ae7d nfsd: stop setting ->pg_stats for unused stats
| * 2197b23eda sunrpc: don't change ->sv_stats if it doesn't exist
| * d47c660e8c NFSD: Fix frame size warning in svc_export_parse()
| * a8aaffc0c1 NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
| * c532274202 NFSD: simplify error paths in nfsd_svc()
| * ebfce8dd7e NFSD: Refactor the duplicate reply cache shrinker
| * 895807268a NFSD: Replace nfsd_prune_bucket()
| * a02f9d6ea3 NFSD: Rename nfsd_reply_cache_alloc()
| * 73b72f4b3b NFSD: Refactor nfsd_reply_cache_free_locked()
| * 3025d489f9 nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
| * 4e18b58b10 nfsd: move reply cache initialization into nfsd startup
* | 00588cd66d Revert "hwspinlock: Introduce hwspin_lock_bust()"
* | c2345ad899 Revert "bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode"
* | fe709a1a77 Revert "bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt"
* | b22678f8ef Merge ddee5b4b6a ("mptcp: pm: avoid possible UaF when selecting endp") into android12-5.10-lts
|\|
| * ddee5b4b6a mptcp: pm: avoid possible UaF when selecting endp
| * 91fb0512a0 mptcp: pr_debug: add missing \n at the end
| * 7e4c72dbaf btrfs: fix use-after-free after failure to create a snapshot
| * efdde00d4a nilfs2: fix state management in error path of log writing function
| * 07e4dc2fe0 nilfs2: fix missing cleanup on rollforward recovery error
| * 7725152b54 sched: sch_cake: fix bulk flow accounting logic for host fairness
| * 93ee345ba3 ila: call nf_unregister_net_hooks() sooner
| * e3ad85c477 tracing: Avoid possible softlockup in tracing_iter_reset()
| * 3a49b6b1ca can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
| * 6949a97f6d clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
| * f540bc71d5 clk: qcom: clk-alpha-pll: Fix the pll post div mask
| * 0811d57384 fuse: use unsigned type for getxattr/listxattr size truncation
| * 9d38c704b4 fuse: update stats for pages in dropped aux writeback list
| * 4be36d9d18 mmc: sdhci-of-aspeed: fix module autoloading
| * 2793f42389 mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
| * b2ead09489 Bluetooth: MGMT: Ignore keys being loaded with invalid type
| * 029e462bb4 Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
| * cb27399b3d irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
| * e0b122a8f6 ata: libata: Fix memory leak for error path in ata_host_alloc()
| * 0f27b8c07e ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
| * 2ef683b058 ALSA: hda/realtek: add patch for internal mic in Lenovo V145
| * adc688a505 ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
| * 8ca21e7a27 ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
| * 98c75d7618 sch/netem: fix use after free in netem_dequeue
| * 06e7be6934 bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt
| * b140074560 i2c: Use IS_REACHABLE() for substituting empty ACPI functions
| * dfc8eb4d7e ext4: handle redirtying in ext4_bio_write_page()
| * 5895541d73 udf: Limit file size to 4TB
| * 17c43211d4 rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
| * 842a97b5e4 virtio_net: Fix napi_skb_cache_put warning
| * c8e5439b5b net: set SOCK_RCU_FREE before inserting socket into hashtable
| * cf002be3b8 bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode
| * 2ac9deb7e0 drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
| * 3fd11fe4f2 block: initialize integrity buffer to zero before writing it to media
| * 0623c9f371 media: uvcvideo: Enforce alignment of frame and interval
| * c083c8be6b drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
| * 5eb04f9894 block: remove the blk_flush_integrity call in blk_integrity_unregister
| * 0305a885cc wifi: cfg80211: make hash table duplicates more survivable
| * d24bc270b7 drm/meson: plane: Add error handling
| * a948ec9935 smack: tcp: ipv4, fix incorrect labeling
| * 3f3ef1d9f6 fsnotify: clear PARENT_WATCHED flags lazily
| * 7e64cabe81 usb: typec: ucsi: Fix null pointer dereference in trace
| * bd13c1119a usbip: Don't submit special requests twice
| * c7975f09ae ionic: fix potential irq name truncation
| * e85cf9a5a4 hwspinlock: Introduce hwspin_lock_bust()
| * 7eb7888021 PCI: al: Check IORESOURCE_BUS existence during probe
| * 9aa7dd5e31 wifi: iwlwifi: remove fw_running op
| * ed7e9ed973 drm/amd/pm: check negtive return for table entries
| * 614564a5b2 drm/amdgpu: the warning dereferencing obj for nbio_v7_4
| * 008933832a drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
| * 52338a3aa7 apparmor: fix possible NULL pointer dereference
| * 0842db679d drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
| * 310b9d8363 drm/amdgpu: fix mc_data out-of-bounds read warning
| * 5f09fa5e0a drm/amdgpu: fix ucode out-of-bounds read warning
| * 725b728cc0 drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
| * c253b87c7c drm/amdgpu: Fix out-of-bounds write warning
| * 60097df938 drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
| * 74c5d8b057 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
| * 9160830546 drm/amd/display: Check msg_id before processing transcation
| * 7c47dd2e92 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
| * 2a63c90c7a drm/amd/display: Add array index check for hdcp ddc access
| * 754321ed63 drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
| * 40c2e8bc11 drm/amd/display: Check gpio_id before used as array index
| * e24fa82729 drm/amdgpu: avoid reading vf2pf info size from FB
| * 1d0c85d0fc drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
| * 59ac791297 drm/amdgpu: fix uninitialized scalar variable warning
| * 38e32a0d83 drm/amd/pm: fix the Out-of-bounds read warning
| * d592768c17 drm/amd/pm: fix warning using uninitialized value of max_vid_step
| * a601129c78 drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
| * 774bae3b8d drm/amdgpu: fix overflowed array index read warning
| * 28b539bbcc drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
| * 40d0fedacf net: usb: qmi_wwan: add MeiG Smart SRM825L
| * ff5af3f9b5 dma-debug: avoid deadlock between dma debug vs printk and netconsole
| * 712921d2ab i2c: Fix conditional for substituting empty ACPI functions
| * 0e69cf9b65 ALSA: hda/conexant: Mute speakers at suspend / shutdown
| * 221ebded43 ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
| * e78bc7099c drm: panel-orientation-quirks: Add quirk for OrangePi Neo
* | 52c4910c65 ANDROID: fix up crc issue for cpuset_cpus_allowed()
* | 4951c68022 Merge 5.10.225 into android12-5.10-lts
|\|
| * b57d01c66f Linux 5.10.225
| * 7e8bad2cf3 apparmor: fix policy_unpack_test on big endian systems
| * 9e96dea7ef scsi: aacraid: Fix double-free on probe failure
| * 4538335cc2 usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
| * 59579a627a usb: dwc3: st: add missing depopulate in probe error path
| * 6aee4c5635 usb: dwc3: st: fix probed platform device ref count on probe error path
| * b72da4d89b usb: dwc3: core: Prevent USB core invalid event buffer address access
| * 16cc6114c9 usb: dwc3: omap: add missing depopulate in probe error path
| * f84d5dccc8 USB: serial: option: add MeiG Smart SRM825L
| * 612843f842 cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
| * f5a5a5a0e9 soc: qcom: cmd-db: Map shared memory as WC, not WB
| * 8ddaea033d nfc: pn533: Add poll mod list filling check
| * 7e5d5c4ae7 net: busy-poll: use ktime_get_ns() instead of local_clock()
| * 8bbb9e4e0e gtp: fix a potential NULL pointer dereference
| * 842a40c727 ethtool: check device is present when getting link settings
| * 2e8e93dea0 dmaengine: dw: Add memory bus width verification
| * 9cfe7c53fe dmaengine: dw: Add peripheral bus width verification
| * f8e1c92868 soundwire: stream: fix programming slave ports for non-continous port maps
| * acddd7c6b7 ovl: do not fail because of O_NOATIME
| * 338a3ba30c net:rds: Fix possible deadlock in rds_message_put
| * 688325078a cgroup/cpuset: Prevent UAF in proc_cpuset_show()
| * e83405e75d ata: libata-core: Fix null pointer dereference on error
| * f2b6cd1335 Revert "Input: ioc3kbd - convert to platform remove callback returning void"
| * 777d9c223e media: uvcvideo: Fix integer overflow calculating timestamp
| * f7276cdc19 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
| * 0365c9029a ipc: replace costly bailout check in sysvipc_find_ipc()
| * 2933b4f8a6 mptcp: sched: check both backup in retrans
| * 1388df72dc wifi: mwifiex: duplicate static structs used in driver instances
| * 4e9436375f pinctrl: single: fix potential NULL dereference in pcs_get_function()
| * d57e6298cc pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
| * a45ee4c98d KVM: arm64: Don't use cbz/adr with external symbols
| * df02642c21 drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
| * 239b1cacce tools: move alignment-related macros to new <linux/align.h>
| * 05dd9aabd0 Input: MT - limit max slots
| * 56b82e6ff3 Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
| * 93000b2949 nfsd: Don't call freezable_schedule_timeout() after each successful page allocation in svc_alloc_arg().
| * b009444700 ALSA: timer: Relax start tick time check for slave timer elements
| * b891438bc3 Revert "drm/amd/display: Validate hw_points_num before using it"
| * 92915fa734 mmc: dw_mmc: allow biu and ciu clocks to defer
| * 15818af2f7 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
| * 65e79c9437 cxgb4: add forgotten u64 ivlan cast before shift
| * d1623e7b43 HID: microsoft: Add rumble support to latest xbox controllers
| * 8c0a21d37d HID: wacom: Defer calculation of resolution until resolution_code is known
| * fc73103a94 MIPS: Loongson64: Set timer mode in cpu-probe
| * 7fd3a59268 binfmt_misc: pass binfmt_misc flags to the interpreter
| * 9df9783bd8 Bluetooth: MGMT: Add error handling to pair_device()
| * 9b9ba386d7 mmc: mmc_test: Fix NULL dereference on allocation failure
| * 4370448fca drm/msm/dp: reset the link phy params before link training
| * e54b082752 drm/msm/dpu: don't play tricks with debug macros
| * ff6607a477 net: xilinx: axienet: Fix dangling multicast addresses
| * 2884e73978 net: xilinx: axienet: Always disable promiscuous mode
| * cb5880a0de ipv6: prevent UAF in ip6_send_skb()
| * c414000da1 netem: fix return value if duplicate enqueue fails
| * 050e7274ab net: dsa: mv88e6xxx: Fix out-of-bound access
| * 5885217d66 net: dsa: mv88e6xxx: replace ATU violation prints with trace points
| * 5d8aed3ca6 net: dsa: mv88e6xxx: read FID when handling ATU violations
| * 544571911b ice: fix ICE_LAST_OFFSET formula
| * 5c14483544 bonding: fix xfrm state handling when clearing active slave
| * 21816b696c bonding: fix xfrm real_dev null pointer dereference
| * 81216b9352 bonding: fix null pointer deref in bond_ipsec_offload_ok
| * e8c85f2ff3 bonding: fix bond_ipsec_offload_ok return type
| * 6e630e1d77 ip6_tunnel: Fix broken GRO
| * 4d42a2257b netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
| * eb06c8d302 kcm: Serialise kcm_sendmsg() for the same socket.
| * f4b762cf7e tc-testing: don't access non-existent variable on exception
| * 095a1f19d4 Bluetooth: SMP: Fix assumption of Central always being Initiator
| * 7a4e7a0c6b Bluetooth: hci_core: Fix LE quote calculation
| * ce70b09150 dm suspend: return -ERESTARTSYS instead of -EINTR
| * 0ba3401777 media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
| * d1bd8e0a11 block: use "unsigned long" for blk_validate_block_size().
| * cbb9a969fc gtp: pull network headers in gtp_dev_xmit()
| * 5970a540da hrtimer: Prevent queuing of hrtimer without a function callback
| * b09a5ec8de nvmet-rdma: fix possible bad dereference when freeing rsps
| * 2143cba143 ext4: set the type of max_zeroout to unsigned int to avoid overflow
| * f14cd61826 irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
| * 9e1c4d0d6a usb: dwc3: core: Skip setting event buffers for host only controllers
| * 1b8e318f99 s390/iucv: fix receive buffer virtual vs physical address confusion
| * d0414f5436 openrisc: Call setup_memory() earlier in the init sequence
| * e5272645a0 NFS: avoid infinite loop in pnfs_update_layout.
| * 9e0414220b nvmet-tcp: do not continue for invalid icreq
| * 5ee7495ac2 net: hns3: add checking for vf id of mailbox
| * c7c43a784f Bluetooth: bnep: Fix out-of-bound access
| * bf2f79970b usb: gadget: fsl: Increase size of name buffer for endpoints
| * bf0c603ab4 f2fs: fix to do sanity check in update_sit_entry
| * 8ec052c544 btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
| * 0c1d7b960f btrfs: send: handle unexpected data in header buffer in begin_cmd()
| * 94a7dff229 btrfs: handle invalid root reference found in may_destroy_subvol()
| * 3dd13074e7 btrfs: change BUG_ON to assertion when checking for delayed_node root
| * e21448a49b powerpc/boot: Only free if realloc() succeeds
| * 486fb5ebd5 powerpc/boot: Handle allocation failure in simple_realloc()
| * 05c21f285d parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
| * 4e5464005b memory: stm32-fmc2-ebi: check regmap_read return value
| * 25d31baf92 x86: Increase brk randomness entropy for 64-bit systems
| * 76ec27b709 md: clean up invalid BUG_ON in md_ioctl
| * 95e49b9258 netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
| * 316bf51edd virtiofs: forbid newlines in tags
| * be49c4f2a1 drm/lima: set gp bus_stop bit before hard reset
| * aa469c3d28 net/sun3_82586: Avoid reading past buffer in debug output
| * 5fb0cbf84b scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
| * a441ce39ad fs: binfmt_elf_efpic: don't use missing interpreter's properties
| * e7385510e2 media: pci: cx23885: check cx23885_vdev_init() return
| * 00d4f971fa quota: Remove BUG_ON from dqget()
| * 239c5e988e ext4: do not trim the group with corrupted block bitmap
| * 0f6425d90d nvmet-trace: avoid dereferencing pointer too early
| * 5380f1b2b9 powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
| * 372928e8be IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
| * 7138c59856 wifi: iwlwifi: abort scan when rfkill on but device enabled
| * d483de53d4 gfs2: setattr_chown: Add missing initialization
| * 80456d39f0 scsi: spi: Fix sshdr use
| * 3663e78fab media: qcom: venus: fix incorrect return value
| * a43edc7abc binfmt_misc: cleanup on filesystem umount
| * c13541c5ef staging: ks7010: disable bh on tx_dev_lock
| * db3b679f66 drm/amd/display: Validate hw_points_num before using it
| * cc49ee3433 staging: iio: resolver: ad2s1210: fix use before initialization
| * 01fa4415c3 media: radio-isa: use dev_name to fill in bus_info
| * 0f83d77926 s390/smp,mcck: fix early IPI handling
| * aeda7043c4 RDMA/rtrs: Fix the problem of variable not initialized fully
| * bbb662d0c2 i2c: riic: avoid potential division by zero
| * 5335c7f8db wifi: cw1200: Avoid processing an invalid TIM IE
| * 11b0c7323c wifi: mac80211: fix BA session teardown race
| * 5fe7bdbe4f ssb: Fix division by zero issue in ssb_calc_clock_rate
| * dfa894f7ea ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
| * fc250eca15 net: hns3: fix a deadlock problem when config TC during resetting
| * dbdbadec8a net: hns3: fix wrong use of semaphore up
| * e5ceff2196 netfilter: flowtable: initialise extack before use
| * 50c914b0e6 mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
| * 8e8d306f3b net: dsa: vsc73xx: check busy flag in MDIO operations
| * 351ad72c50 net: dsa: vsc73xx: use read_poll_timeout instead delay loop
| * 665a4caa9c net: dsa: vsc73xx: pass value in phy_write operation
| * aa9ce4193c net: axienet: Fix register defines comment description
| * 1cece837e3 atm: idt77252: prevent use after free in dequeue_rx()
| * 4b730a1475 net/mlx5e: Correctly report errors for ethtool rx flows
| * 8e0e6b15ab s390/uv: Panic for set and remove shared access UVC errors
| * 6bcd0f95b8 btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
| * c10ac31a72 s390/cio: rename bitmap_size() -> idset_bitmap_size()
| * e24625310c drm/amdgpu/jpeg2: properly set atomics vmid field
| * ad149f5585 memcg_write_event_control(): fix a user-triggerable oops
| * 0452e15e7f drm/amdgpu: Actually check flags for all context ops.
| * d88083916f btrfs: tree-checker: add dev extent item checks
| * bbcdda4b0d selinux: fix potential counting error in avc_add_xperms_decision()
| * fe5bf14881 fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
| * de7be1940c bitmap: introduce generic optimized bitmap_size()
| * 03880af02a vfs: Don't evict inode under the inode lru traversing context
| * ee030e4ffa dm persistent data: fix memory allocation failure
| * 63fd38af88 dm resume: don't return EINVAL when signalled
| * 1b21a791af arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
| * e245a18281 s390/dasd: fix error recovery leading to data corruption on ESE devices
| * 747bc15457 thunderbolt: Mark XDomain as unplugged when router is removed
| * 0f0654318e xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
| * 4905e56f7b ALSA: usb-audio: Support Yamaha P-125 quirk entry
| * 4690e2171f fuse: Initialize beyond-EOF page contents before setting uptodate
* | 39a8a0618d ANDROID: Fix gki allmodconfig build errors in mptcp
* | 0c105dabe6 Revert "genirq: Allow the PM device to originate from irq domain"
* | e62a1579e0 Revert "genirq: Allow irq_chip registration functions to take a const irq_chip"
* | b5df17128a Revert "irqchip/imx-irqsteer: Constify irq_chip struct"
* | 6943c015b0 Revert "irqchip/imx-irqsteer: Add runtime PM support"
* | 3141b23999 Revert "irqchip/imx-irqsteer: Handle runtime power management correctly"
* | b84ad15be5 Merge 5.10.224 into android12-5.10-lts
|\|
| * b2add7c50b Linux 5.10.224
| * 2de18b5cc3 media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
| * e1ee1c4198 ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
| * 80ac0cc9c0 wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
| * a563f12430 vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
| * 06e9e6ac59 vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro
| * b21ea49e6e nvme/pci: Add APST quirk for Lenovo N60z laptop
| * 15469d46ba exec: Fix ToCToU between perm check and set-uid/gid usage
| * d39e0f582b media: uvcvideo: Use entity get_cur in uvc_ctrl_set
| * ec54634f91 arm64: cpufeature: Fix the visibility of compat hwcaps
| * fb6675db04 powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
| * 50111a8098 drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
| * 31c35f9f89 netfilter: nf_tables: prefer nft_chain_validate
| * d5f87c1111 netfilter: nf_tables: allow clone callbacks to sleep
| * 7b17de2a71 netfilter: nf_tables: use timestamp to check for set element timeout
| * 191fc44395 netfilter: nf_tables: set element extended ACK reporting support
| * c52f9e1a9e PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
| * 7e62564d5e Fix gcc 4.9 build issue in 5.10.y
| * 329eae03d0 Add gitignore file for samples/fanotify/ subdirectory
| * 9bdf0624bd samples: Make fs-monitor depend on libc and headers
| * 5b9f49cc86 samples: Add fs error monitoring example
| * 3f84b37abb mptcp: pm: fix backup support in signal endpoints
| * 44165604dd mptcp: export local_address
| * 9b9a64ef9a mptcp: mib: count MPJ with backup flag
| * 96f3c8a850 mptcp: fix NL PM announced address accounting
| * 1008f2bcbc mptcp: distinguish rcv vs sent backup flag in requests
| * 381cad7a08 mptcp: sched: check both directions for backup
| * 32b133fb78 drm/mgag200: Set DDC timeout in milliseconds
| * fd65cf86ca drm/bridge: analogix_dp: properly handle zero sized AUX transactions
| * 450b6b22ac x86/mtrr: Check if fixed MTRRs exist before saving them
| * ab8b397d59 padata: Fix possible divide-by-0 panic in padata_mt_helper()
| * eb223bf01e tracing: Fix overflow in get_free_elt()
| * ca2ea2dec1 power: supply: axp288_charger: Round constant_charge_voltage writes down
| * 51e8360d94 power: supply: axp288_charger: Fix constant_charge_voltage writes
| * a26bcfeea3 genirq/irqdesc: Honor caller provided affinity in alloc_desc()
| * db959cdfe6 irqchip/xilinx: Fix shift out of bounds
| * 52b138f102 serial: core: check uartclk for zero to avoid divide by zero
| * 227d455e6c irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
| * 7dddf560e2 irqchip/meson-gpio: support more than 8 channels gpio irq
| * 5f1aa8ce64 scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
| * 8f209716ea scsi: mpt3sas: Remove scsi_dma_map() error messages
| * f3405f4997 ntp: Safeguard against time_constant overflow
| * f098e8fc72 driver core: Fix uevent_show() vs driver detach race
| * dc335b92e5 ntp: Clamp maxerror and esterror to operating range
| * 668c6c4a7e tick/broadcast: Move per CPU pointer access into the atomic section
| * 005c318981 scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
| * ef1b208ca8 usb: gadget: u_serial: Set start_delayed during suspend
| * 7cc9ebcfe5 usb: gadget: core: Check for unset descriptor
| * f1205a5aad USB: serial: debug: do not echo input by default
| * 4dacdb9720 usb: vhci-hcd: Do not drop references before new references are gained
| * d993cb25ef ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
| * c7c1ca6e25 ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
| * e7e7d2b180 ALSA: line6: Fix racy access to midibuf
| * 5291d4f734 drm/client: fix null pointer dereference in drm_client_modeset_probe
| * 44e11ae8f9 ALSA: usb-audio: Re-add ScratchAmp quirk entries
| * c9c11ece5a spi: spi-fsl-lpspi: Fix scldiv calculation
| * c6ba514732 kprobes: Fix to check symbol prefixes correctly
| * 9ddd5e7835 bpf: kprobe: remove unused declaring of bpf_kprobe_override
| * 455769ebb6 i2c: smbus: Send alert notifications to all devices if source not found
| * 56f106d2c4 ASoC: codecs: wsa881x: Correct Soundwire ports mask
| * 5605992ad4 i2c: smbus: Improve handling of stuck alerts
| * 706f18a8fa arm64: errata: Expand speculative SSBS workaround (again)
| * f261c5d8d0 arm64: cputype: Add Cortex-A725 definitions
| * bdae104b09 arm64: cputype: Add Cortex-X1C definitions
| * 4a500d4bdc arm64: errata: Expand speculative SSBS workaround
| * bf0d247dfb arm64: errata: Unify speculative SSBS errata logic
| * 17ff37fe45 arm64: cputype: Add Cortex-X925 definitions
| * 77741cdc25 arm64: cputype: Add Cortex-A720 definitions
| * b8d683f5b5 arm64: cputype: Add Cortex-X3 definitions
| * 9f7ba00782 arm64: errata: Add workaround for Arm errata 3194386 and 3312417
| * d8029a49c8 arm64: cputype: Add Neoverse-V3 definitions
| * c46b7570c9 arm64: cputype: Add Cortex-X4 definitions
| * 55920e407a arm64: Add Neoverse-V2 part
| * 5b9ae6bb33 arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
| * 69299a4282 ext4: fix wrong unit use in ext4_mb_find_by_goal
| * 1d21d41750 sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
| * 3b2b169fad SUNRPC: Fix a race to wake a sync task
| * a3e52a4c22 s390/sclp: Prevent release of buffer in I/O
| * 1a6b4240b0 jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
| * e48a901ce6 media: uvcvideo: Fix the bandwdith quirk on USB 3.x
| * de305abd36 media: uvcvideo: Ignore empty TS packets
| * c1749313f3 drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
| * d81c1eeb33 drm/amdgpu: Fix the null pointer dereference to ras_manager
| * 1d4e65fa62 btrfs: fix bitmap leak when loading free space cache on duplicate entry
| * 29ce18d767 wifi: nl80211: don't give key data to userspace
| * 934f815345 udf: prevent integer overflow in udf_bitmap_free_blocks()
| * 65b982b9af PCI: Add Edimax Vendor ID to pci_ids.h
| * 55985e3aa1 selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
| * 8e665ccc52 ACPI: SBS: manage alarm sysfs attribute through psy core
| * 85d8fe79a3 ACPI: battery: create alarm sysfs attribute atomically
| * 64ac0c0235 clocksource/drivers/sh_cmt: Address race condition for clock events
| * c384dd4f1f md/raid5: avoid BUG_ON() while continue reshape after reassembling
| * 5ccf99545c md: do not delete safemode_timer in mddev_suspend
| * 464d242868 rcutorture: Fix rcu_torture_fwd_cb_cr() data race
| * adc491f3e7 net: fec: Stop PPS on driver remove
| * 865948628a l2tp: fix lockdep splat
| * b7b8d9f5e6 net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
| * 01150020c0 Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
| * 085fb116c4 net: linkwatch: use system_unbound_wq
| * e87f52225e net: usb: qmi_wwan: fix memory leak for not ip packets
| * 52319d9d2f sctp: Fix null-ptr-deref in reuseport_add_sock().
| * 17a93a8201 sctp: move hlist_node and hashent out of sctp_ep_common
| * ba4e59f34c x86/mm: Fix pti_clone_entry_text() for i386
| * d00c9b4bbc x86/mm: Fix pti_clone_pgtable() alignment assumption
| * 75880302cf irqchip/mbigen: Fix mbigen node address layout
| * c476c5c7bb genirq: Allow irq_chip registration functions to take a const irq_chip
| * 12fa993433 netfilter: ipset: Add list flush to cancel_gc
| * e93fa44f07 mptcp: fix duplicate data handling
| * 3deac6f686 r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
| * 646e9e9071 net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
| * 8b0a5709ac ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
| * 7b745257ff ALSA: usb-audio: Correct surround channels in UAC1 channel map
| * 08775b3d6e protect the fetch of ->fd[fd] in do_dup2() from mispredictions
| * e4b2b0306b HID: wacom: Modify pen IDs
| * b12a67976b platform/chrome: cros_ec_proto: Lock device when updating MKBP version
| * 59be4a1677 riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
| * 7d72f51951 ipv6: fix ndisc_is_useropt() handling for PIO
| * 8e97cc828d net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
| * c65f72eec6 net/iucv: fix use after free in iucv_sock_close()
| * 7c03ab555e sched: act_ct: take care of padding in struct zones_ht_key
| * b17eeed7cd drm/vmwgfx: Fix overlay when using Screen Targets
| * 906372e753 drm/nouveau: prime: fix refcount underflow
| * 6b50462b47 remoteproc: imx_rproc: Skip over memory region when node value is NULL
| * 5991ef8e7a remoteproc: imx_rproc: Fix ignoring mapping vdev regions
| * a4ed3286a5 remoteproc: imx_rproc: ignore mapping vdev regions
| * 3a2884a44e irqchip/imx-irqsteer: Handle runtime power management correctly
| * 0548b54d0a irqchip/imx-irqsteer: Add runtime PM support
| * 06a93b7203 irqchip/imx-irqsteer: Constify irq_chip struct
| * 652e7b4d73 genirq: Allow the PM device to originate from irq domain
| * ef56dcdca8 devres: Fix memory leakage caused by driver API devm_free_percpu()
| * 81484ab285 driver core: Cast to (void *) with __force for __percpu pointer
| * 6bb9cc6e25 drivers: soc: xilinx: check return status of get_api_version()
| * 79ec4cde1d soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver
| * 58b07286ae ext4: check the extent status again before inserting delalloc block
| * 4b6d9a0fe7 ext4: factor out a common helper to query extent map
| * b2591c89a6 sysctl: always initialize i_uid/i_gid
| * 88f053a1dd fuse: verify {g,u}id mount options correctly
| * 997d3c9cbe fuse: name fs_context consistently
| * 2fa82af6fd powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
| * d28869a145 fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
| * be23ae6308 nvme-pci: add missing condition check for existence of mapped data
| * ce90f30157 nvme: split command copy into a helper
| * b59013d264 ceph: fix incorrect kmalloc size of pagevec mempool
| * eb1b7575fe ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
| * 3ff4316953 lirc: rc_dev_get_from_fd(): fix file leak
| * ea72a88810 powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
| * 347dcb84a4 apparmor: Fix null pointer deref when receiving skb during sock creation
| * 9460ac3dd1 mISDN: Fix a use after free in hfcmulti_tx()
| * dda518dea6 bpf: Fix a segment issue when downgrading gso_size
| * 5cc4d71dda net: nexthop: Initialize all fields in dumped nexthops
| * dc2a655437 net: stmmac: Correct byte order of perfect_match
| * aa38bf7489 tipc: Return non-zero value from tipc_udp_addr2str() on error
| * cf791b98fe netfilter: nft_set_pipapo_avx2: disable softinterrupts
| * c8ae5939f4 net: bonding: correctly annotate RCU in bond_should_notify_peers()
| * 3bf09eab40 ipv4: Fix incorrect source address in Record Route option
| * f62a9cc0c2 MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
| * 257193083e dma: fix call order in dmam_free_coherent
| * 641b7a8920 libbpf: Fix no-args func prototype BTF dumping syntax
| * ff2387553f f2fs: fix start segno of large section
| * 721190921a um: time-travel: fix time-travel-start option
| * 538a27c804 jfs: Fix array-index-out-of-bounds in diFree
| * 1c089efe76 kdb: Use the passed prompt in kdb_position_cursor()
| * f0ad62559f kdb: address -Wformat-security warnings
| * 65dba3c9ce kernel: rerun task_work while freezing in get_signal()
| * b839175c06 io_uring/io-wq: limit retrying worker initialisation
| * 5f0a6800b8 nilfs2: handle inconsistent state in nilfs_btnode_create_block()
| * 9fa8eca259 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
| * 4d3eb40ccd Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
| * 1fccae3fd7 rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
| * 52d8d27fd6 rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
| * 76b62f3035 drm/panfrost: Mark simple_ondemand governor as softdep
| * 77411a2d22 MIPS: Loongson64: env: Hook up Loongsson-2K
| * 636163de03 MIPS: ip30: ip30-console: Add missing include
| * 4e8f70d3cc rbd: don't assume rbd_is_lock_owner() for exclusive mappings
| * 24933a55bf selftests/sigaltstack: Fix ppc64 GCC build
| * 94ee7ff99b RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
| * 9667d46f8a platform: mips: cpu_hwmon: Disable driver on unsupported hardware
| * 19f108b3d1 watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
| * 9cba1ec637 rtc: isl1208: Fix return value of nvmem callbacks
| * a49321257f perf/x86/intel/pt: Fix a topa_entry base address calculation
| * 3b8e1b7d26 perf/x86/intel/pt: Fix topa_entry base length
| * a3ab508a48 scsi: qla2xxx: validate nvme_local_port correctly
| * 57ba756371 scsi: qla2xxx: Complete command early within lock
| * b0c39dcbd8 scsi: qla2xxx: Fix flash read failure
| * 87db8d7b75 scsi: qla2xxx: Fix for possible memory corruption
| * e5ed6a26ff scsi: qla2xxx: During vport delete send async logout explicitly
| * 2fcd485289 rtc: cmos: Fix return value of nvmem callbacks
| * d4d814159f devres: Fix devm_krealloc() wasting memory
| * 648d549046 kobject_uevent: Fix OOB access within zap_modalias_env()
| * 41dd963641 kbuild: Fix '-S -c' in x86 stack protector scripts
| * 0730ea8502 decompress_bunzip2: fix rare decompression failure
| * bed9580165 ubi: eba: properly rollback inside self_check_eba
| * ae99754cd8 clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
| * 54bc4e8844 f2fs: fix to don't dirty inode for readonly filesystem
| * b848b40794 scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
| * a44f88f757 dev/parport: fix the array out-of-bounds risk
| * 388ee7a4d3 binder: fix hang of unregistered readers
| * ac2459460c PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
| * e5bae95306 PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
| * af1d27f88e hwrng: amd - Convert PCIBIOS_* return codes to errnos
| * 43aab4483d tools/memory-model: Fix bug in lock.cat
| * 9d289ce917 KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
| * cdbcb4e9f6 jbd2: make jbd2_journal_get_max_txn_bufs() internal
| * 6d5223be13 leds: ss4200: Convert PCIBIOS_* return codes to errnos
| * 35f8c9ac0c wifi: mwifiex: Fix interface type change
| * de2a011a13 ext4: make sure the first directory block is not a hole
| * 42d4205170 ext4: check dot and dotdot of dx_root before making dir indexed
| * 3846394785 m68k: amiga: Turn off Warp1260 interrupts during boot
| * 2199e157a4 udf: Avoid using corrupted block bitmap buffer
| * 5c59cb8dd9 task_work: Introduce task_work_cancel() again
| * 1fd27cc6f0 task_work: s/task_work_cancel()/task_work_cancel_func()/
| * 973155ca67 apparmor: use kvfree_sensitive to free data->data
| * eb46367187 sched/fair: Use all little CPUs for CPU-bound workloads
| * 9ce89824ff drm/amd/display: Check for NULL pointer
| * 748e9ad7c0 scsi: qla2xxx: Fix optrom version displayed in FDMI
| * 6735d02ead drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
| * b6ac46a001 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
| * 86f4ca8b3b ext2: Verify bitmap and itable block numbers before using them
| * 10f7163bfb hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
| * 4c9d235630 media: venus: fix use after free in vdec_close
| * e65cccfae7 char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
| * cf0c713c69 sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
| * 5c5b02d489 ipv6: take care of scope when choosing the src addr
| * 83e2dfadcb af_packet: Handle outgoing VLAN packets without hardware offloading
| * 7e36a3c701 net: netconsole: Disable target before netpoll cleanup
| * 9ef7190228 tick/broadcast: Make takeover of broadcast hrtimer reliable
| * f2c2c4cc5a dt-bindings: thermal: correct thermal zone node name limit
| * 14083dc69b rtc: interface: Add RTC offset to alarm after fix-up
| * 84ffa27eb0 nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
| * 9d6571b1c4 fs/nilfs2: remove some unused macros to tame gcc
| * 3c6fa67023 fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
| * 21a15d52bc pinctrl: freescale: mxs: Fix refcount of child
| * d2de7746e5 pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
| * 73303a4a8f pinctrl: ti: ti-iodelay: Drop if block with always false condition
| * 15014206f9 pinctrl: single: fix possible memory leak when pinctrl_enable() fails
| * 8c3bef7ca8 pinctrl: core: fix possible memory leak when pinctrl_enable() fails
| * 53f2d5bce1 pinctrl: rockchip: update rk3308 iomux routes
| * 01c0341e98 net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
| * ef6af29942 net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
| * eb4ca1a97e netfilter: ctnetlink: use helper function to calculate expect ID
| * 9118c408ee bnxt_re: Fix imm_data endianness
| * edc2dee07a RDMA/hns: Fix missing pagesize and alignment check in FRMR
| * 29723ad948 macintosh/therm_windtunnel: fix module unload.
| * 445ffbccd0 powerpc/xmon: Fix disassembly CPU feature checks
| * 38a7e4b8bf MIPS: Octeron: remove source file executable bit
| * 3009d371a2 Input: elan_i2c - do not leave interrupt disabled on suspend failure
| * 37a484f771 RDMA/device: Return error earlier if port in not valid
| * 695d70c60b mtd: make mtd_test.c a separate module
| * ab2114f6ff ASoC: max98088: Check for clk_prepare_enable() error
| * 771f129bed RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
| * 506e71b0e1 RDMA/mlx4: Fix truncated output warning in alias_GUID.c
| * 6bf3cf61f3 RDMA/mlx4: Fix truncated output warning in mad.c
| * 26b6512d5d Input: qt1050 - handle CHIP_ID reading error
| * 2be7e24056 coresight: Fix ref leak when of_coresight_parse_endpoint() fails
| * 3d1c4bf57d PCI: Fix resource double counting on remove & rescan
| * 8105318210 SUNRPC: Fixup gss_status tracepoint error output
| * 8f1dc3f33f sparc64: Fix incorrect function signature and add prototype for prom_cif_init
| * 3d096f2a99 ext4: avoid writing unitialized memory to disk in EA inodes
| * 91c22df701 SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
| * 84edcf61bd xprtrdma: Fix rpcrdma_reqs_reset()
| * 974294806b xprtrdma: Rename frwr_release_mr()
| * cf9141d2f7 mfd: omap-usb-tll: Use struct_size to allocate tll
| * 72ac78ec1a media: venus: flush all buffers in output plane streamoff
| * 5ed0496e38 ext4: fix infinite loop when replaying fast_commit
| * c9106ad5ea Revert "leds: led-core: Fix refcount leak in of_led_get()"
| * 4e87f592a4 drm/qxl: Add check for drm_cvt_mode
| * cd105977b1 drm/etnaviv: fix DMA direction handling for cached RW buffers
| * 6ef4f1e981 perf report: Fix condition in sort__sym_cmp()
| * 09c1583f0e leds: trigger: Unregister sysfs attributes before calling deactivate()
| * 3c9071a871 media: renesas: vsp1: Store RPF partition configuration per RPF instance
| * 3944484005 media: renesas: vsp1: Fix _irqsave and _irq mix
| * 9459f33175 media: uvcvideo: Override default flags
| * 115d814d6a media: uvcvideo: Allow entity-defined get_info and get_cur
| * e470e95616 saa7134: Unchecked i2c_transfer function result fixed
| * f3968b3d3c media: imon: Fix race getting ictx->lock
| * bcc963f591 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
| * 7aaa368c68 drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
| * fb20da8338 drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
| * be9d08ff10 xdp: fix invalid wait context of page_pool_destroy()
| * 96178b12c8 selftests: forwarding: devlink_lib: Wait for udev events after reloading
| * 859bc76374 bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
| * 6ce46045f9 bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
| * 28c8fce207 bpf: annotate BTF show functions with __printf
| * 1ccb1399bd selftests/bpf: Close fd in error path in drop_on_reuseport
| * be53b70fc0 wifi: virt_wifi: don't use strlen() in const context
| * f851ff5c6e gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
| * 05c4488a0e wifi: virt_wifi: avoid reporting connection success with wrong SSID
| * b33dd45086 qed: Improve the stack space of filter_config()
| * 7f132aca18 perf: Prevent passing zero nr_pages to rb_alloc_aux()
| * a2450206c0 perf: Fix perf_aux_size() for greater-than 32-bit size
| * a497a6b72b perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
| * d4f4188ecf netfilter: nf_tables: rise cap on SELinux secmark context
| * 0d08015bee ipvs: Avoid unnecessary calls to skb_is_gso_sctp
| * 2912a0d136 net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
| * 29254059a1 net: fec: Refactor: #define magic constants
| * 2e201b3d16 wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
| * 72e470089f wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
| * 4055275ca3 wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
| * 2aa1739334 ath11k: dp: stop rx pktlog before suspend
| * dae1ab7040 mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
| * aa98eb0740 mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
| * 36a9996e02 mlxsw: spectrum_acl_erp: Fix object nesting warning
| * 22ae17a267 lib: objagg: Fix general protection fault
| * ada0c31925 selftests/bpf: Check length of recv in test_sockmap
| * 249adb30cb net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
| * 15c2ec7c28 net/smc: Allow SMC-D 1MB DMB allocations
| * 8d0d50a8b7 net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
| * 2f5738bdd6 selftests/bpf: Fix prog numbers in test_sockmap
| * 1302433dc6 wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
| * 1eb5751e23 firmware: turris-mox-rwtm: Initialize completion before mailbox
| * 085dc94289 firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
| * 6f3cb1fd6b ARM: spitz: fix GPIO assignment for backlight
| * 7b7d06a310 ARM: pxa: spitz: use gpio descriptors for audio
| * 3ae2ec97d8 m68k: cmpxchg: Fix return value for default case in __arch_xchg()
| * ba1d2ecfcf x86/xen: Convert comma to semicolon
| * 4a49ce2d63 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
| * e04654f425 arm64: dts: amlogic: gx: correct hdmi clocks
| * 4745535fce arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
| * be5ca40647 arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
| * b1e9396ac4 ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
| * a992c88fbb ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
| * c79a7cad41 ARM: dts: imx6qdl-kontron-samx6i: fix board reset
| * efd89b5db5 ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
| * bbfa9a71ae ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
| * 31a9a0958b arm64: dts: rockchip: Increase VOP clk rate on RK3328
| * 5cc525351b soc: qcom: pdr: fix parsing of domains lists
| * eab05737ee soc: qcom: pdr: protect locator_addr with the main mutex
| * a584e5d3f7 arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
| * eedd9fd986 soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers
| * 39f4cb508e arm64: dts: qcom: sdm845: add power-domain to UFS PHY
| * d3e6b30c9c hwmon: (max6697) Fix swapped temp{1,8} critical alarms
| * 15770a1476 hwmon: (max6697) Fix underflow when writing limit attributes
| * ae8bd075a9 pwm: stm32: Always do lazy disabling
| * d8571b9a83 hwmon: (adt7475) Fix default duty on fan is disabled
| * 685976438b x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
| * 010441f083 x86/pci/xen: Fix PCIBIOS_* return code handling
| * c995bea85e x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
| * e2fdf7b79f x86/of: Return consistent error type from x86_of_pci_irq_enable()
| * 97795f23a8 hfsplus: fix to avoid false alarm of circular locking
| * c0748b7684 platform/chrome: cros_ec_debugfs: fix wrong EC message version
| * 3070e81609 EDAC, i10nm: make skx_common.o a separate module
| * 9bff9479e1 EDAC/skx_common: Add new ADXL components for 2-level memory
* 767b3cdf4f Merge branch 'android12-5.10' into android12-5.10-lts

Change-Id: I0e05e42a679534cd2d7254df19f21f2d8732df5f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-10-28 18:51:06 +00:00
Justin Chen
1ef7612897 BACKPORT: firmware: arm_scmi: Queue in scmi layer for mailbox implementation 
send_message() does not block in the MBOX implementation. This is
because the mailbox layer has its own queue. However, this confuses
the per xfer timeouts as they all start their timeout ticks in
parallel.

Consider a case where the xfer timeout is 30ms and a SCMI transaction
takes 25ms:

  | 0ms: Message #0 is queued in mailbox layer and sent out, then sits
  |      at scmi_wait_for_message_response() with a timeout of 30ms
  | 1ms: Message #1 is queued in mailbox layer but not sent out yet.
  |      Since send_message() doesn't block, it also sits at
  |      scmi_wait_for_message_response() with a timeout of 30ms
  |  ...
  | 25ms: Message #0 is completed, txdone is called and message #1 is sent
  | 31ms: Message #1 times out since the count started at 1ms. Even though
  |       it has only been inflight for 6ms.

Bug: 374939101
Fixes: 5c8a47a5a9 ("firmware: arm_scmi: Make scmi core independent of the transport type")
Change-Id: I0ab132221c28d4594f0bbc161f431ceb49830824
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Message-Id: <20241014160717.1678953-1-justin.chen@broadcom.com>
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Tested-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
(cherry picked from commit da1642bc97c4ef67f347edcd493bd0a52f88777b)
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Signed-off-by: Pierre Couillaud <pierre@broadcom.com>
(cherry picked from commit e02772c76d6fa54bd75b3961bb08c3a01122dbc9)
 2024-10-23 18:23:51 +00:00
Willem de Bruijn
53a61c62da BACKPORT: gso: fix udp gso fraglist segmentation after pull from frag_list 
Detect gso fraglist skbs with corrupted geometry (see below) and
pass these to skb_segment instead of skb_segment_list, as the first
can segment them correctly.

Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size

Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify these skbs, breaking these invariants.

In extreme cases they pull all data into skb linear. For UDP, this
causes a NULL ptr deref in __udpv4_gso_segment_list_csum at
udp_hdr(seg->next)->dest.

Detect invalid geometry due to pull, by checking head_skb size.
Don't just drop, as this may blackhole a destination. Convert to be
able to pass to regular skb_segment.

Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediatek.com/
Fixes: 9fd1ff5d2a ("udp: Support UDP fraglist GRO/GSO.")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20241001171752.107580-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Bug: 373245346
Bug: 333849117
Change-Id: I5a317e002f149cf9d399dce9bf87cd649a24da19
(cherry picked from commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab)
Signed-off-by: Lena Wang <lena.wang@mediatek.corp-partner.google.com>
(cherry picked from commit 42c2d1ea7c1bf984372f0ca1711d91165cbb87a6)
(cherry picked from commit 7376b8e51c4ddaa8e36b2b33d6ac3392135183b1)
 2024-10-21 19:59:57 +00:00