android_kernel_xiaomi_sm8450

Author	SHA1	Message	Date
Todd Kjos	3cf9365660	Merge tag 'android12-5.10.189_r00' into android12-5.10 This is the merge of 5.10.189 into the android12-5.10 branch. It contains the following commits: * `f50fa8d8ce` Merge 5.10.189 into android12-5.10-lts \|\ \| * `de5f63612d` Linux 5.10.189 \| * `2ae9a73819` x86: fix backwards merge of GDS/SRSO bit \| * `f9167a2d6b` xen/netback: Fix buffer overrun triggered by unusual packet \| * `8457fb5740` x86/srso: Tie SBPB bit setting to microcode patch detection \| * `4873939c0e` x86/srso: Fix return thunks in generated code \| * `384d41bea9` x86/srso: Add IBPB on VMEXIT \| * `4acaea47e3` x86/srso: Add IBPB \| * `e47af0c255` x86/srso: Add SRSO_NO support \| * `df76a59feb` x86/srso: Add IBPB_BRTYPE support \| * `3f9b7101be` x86/srso: Add a Speculative RAS Overflow mitigation \| * `34f23ba8a3` x86/cpu, kvm: Add support for CPUID_80000021_EAX \| * `073a28a9b5` x86/bugs: Increase the x86 bugs vector size to two u32s \| * `9b7fe7c6fb` tools headers cpufeatures: Sync with the kernel sources \| * `437fa179f2` x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX] \| * `baf6d6c39e` x86/cpu: Add VM page flush MSR availablility as a CPUID feature \| * `6750468784` Documentation/x86: Fix backwards on/off logic about YMM support \| * `79972c2b95` x86/mm: Initialize text poking earlier \| * `1ff14defdf` mm: Move mm_cachep initialization to mm_init() \| * `6ee042fd24` x86/mm: Use mm_alloc() in poking_init() \| * `f076d08178` x86/mm: fix poking_init() for Xen PV guests \| * `583016037a` x86/xen: Fix secondary processors' FPU initialization \| * `eb13cce488` KVM: Add GDS_NO support to KVM \| * `7db4ddcb8d` x86/speculation: Add Kconfig option for GDS \| * `363c98f9cf` x86/speculation: Add force option to GDS mitigation \| * `288a2f6bc1` x86/speculation: Add Gather Data Sampling mitigation \| * `4ae1cbb730` x86/fpu: Move FPU initialization into arch_cpu_finalize_init() \| * `2462bc3ef0` x86/fpu: Mark init functions __init \| * `7a2f42bce9` x86/fpu: Remove cpuinfo argument from init functions \| * `18fcd72da1` init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() \| * `09658b81d1` init: Invoke arch_cpu_finalize_init() earlier \| * `bf2fa3a9d0` init: Remove check_bugs() leftovers \| * `b05031c2bc` um/cpu: Switch to arch_cpu_finalize_init() \| * `2edb3b39ca` sparc/cpu: Switch to arch_cpu_finalize_init() \| * `3c45134b38` sh/cpu: Switch to arch_cpu_finalize_init() \| * `75bb54c951` mips/cpu: Switch to arch_cpu_finalize_init() \| * `1cd3fc18eb` m68k/cpu: Switch to arch_cpu_finalize_init() \| * `12d93c6c98` ia64/cpu: Switch to arch_cpu_finalize_init() \| * `c0fff20d4e` ARM: cpu: Switch to arch_cpu_finalize_init() \| * `e5eb18e164` x86/cpu: Switch to arch_cpu_finalize_init() \| * `6e606e6818` init: Provide arch_cpu_finalize_init() * \| `49c25af89c` Revert "bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE" * \| `117f73f9a7` Revert "sctp: add bpf_bypass_getsockopt proto callback" * \| `64414277da` Revert "net: Introduce net.ipv4.tcp_migrate_req." * \| `2afed824a4` Revert "tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries." * \| `08315eedaa` Revert "tcp: annotate data-races around icsk->icsk_syn_retries" * \| `938b8658b9` Revert "posix-timers: Ensure timer ID search-loop limit is valid" * \| `986fd89af0` Revert "Revert "8250: add support for ASIX devices with a FIFO bug"" * \| `477f5e6b9e` Merge 5.10.188 into android12-5.10-lts \|\\| \| * `3602dbc57b` Linux 5.10.188 \| * `edce5fba78` ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() \| * `115b19f893` ftrace: Store the order of pages allocated in ftrace_page \| * `1a1e793e02` tracing: Fix memory leak of iter->temp when reading trace_pipe \| * `43e786aa51` tracing/histograms: Return an error if we fail to add histogram to hist_vars list \| * `e3da59f428` net: phy: prevent stale pointer dereference in phy_init() \| * `e0ac63e194` tcp: annotate data-races around fastopenq.max_qlen \| * `d01afbfc2f` tcp: annotate data-races around icsk->icsk_user_timeout \| * `3cf0a0f11d` tcp: annotate data-races around tp->notsent_lowat \| * `9c786d5faf` tcp: annotate data-races around rskq_defer_accept \| * `f891375eba` tcp: annotate data-races around tp->linger2 \| * `9168bd8f54` tcp: annotate data-races around icsk->icsk_syn_retries \| * `7b0084918c` tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries. \| * `cf6c06ac74` net: Introduce net.ipv4.tcp_migrate_req. \| * `a5c30a5187` tcp: annotate data-races around tp->keepalive_probes \| * `93715448f1` tcp: annotate data-races around tp->keepalive_intvl \| * `7b52a78a91` tcp: annotate data-races around tp->keepalive_time \| * `1d4f2c4be1` tcp: annotate data-races around tp->tcp_tx_delay \| * `30e5460d69` netfilter: nf_tables: skip bound chain on rule flush \| * `94c10c0fa5` netfilter: nf_tables: skip bound chain in netns release path \| * `3a91099ecd` netfilter: nft_set_pipapo: fix improper element removal \| * `9c2df17e3c` netfilter: nf_tables: can't schedule in nft_chain_validate \| * `533193a239` netfilter: nf_tables: fix spurious set element insertion failure \| * `a6f1988780` llc: Don't drop packet from non-root netns. \| * `49e435ca02` fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe \| * `bc9d4d432f` Revert "tcp: avoid the lookup process failing to get sk in ehash table" \| * `d06fc7b391` net:ipv6: check return value of pskb_trim() \| * `1a478ad129` net: ipv4: Use kfree_sensitive instead of kfree \| * `937105d2b0` tcp: annotate data-races around tcp_rsk(req)->ts_recent \| * `41b0023869` octeontx2-pf: Dont allocate BPIDs for LBK interfaces \| * `5bc78ba889` security: keys: Modify mismatched function name \| * `b92defe4e8` iavf: Fix out-of-bounds when setting channels on remove \| * `a4635f190f` iavf: Fix use-after-free in free_netdev \| * `b37bc3b07e` bridge: Add extack warning when enabling STP in netns. \| * `f6d311b953` net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() \| * `54aa4c0386` pinctrl: amd: Use amd_pinconf_set() for all config options \| * `7041605e85` fbdev: imxfb: warn about invalid left/right margin \| * `6e88cc510f` spi: bcm63xx: fix max prepend length \| * `994c2ceb70` igb: Fix igb_down hung on surprise removal \| * `a956c3af70` wifi: iwlwifi: mvm: avoid baid size integer overflow \| * `85cf0d5f45` wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() \| * `2864cc9a1f` devlink: report devlink_port_type_warn source device \| * `b6d9a4062c` bpf: Address KCSAN report on bpf_lru_list \| * `532f8bac60` wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range \| * `6b0c79aa33` sched/fair: Don't balance task to its current running CPU \| * `32020fc2a8` arm64: mm: fix VA-range sanity check \| * `c71d6934c6` arm64: set __exception_irq_entry with __irq_entry as a default \| * `71e3f23540` ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) \| * `776a72f612` ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 \| * `e090f70ae4` ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A \| * `ae51eb90bc` btrfs: add xxhash to fast checksum implementations \| * `322377cc90` posix-timers: Ensure timer ID search-loop limit is valid \| * `634daf6b2c` md/raid10: prevent soft lockup while flush writes \| * `b02939413e` md: fix data corruption for raid456 when reshape restart while grow up \| * `4a2c62c8d6` nbd: Add the maximum limit of allocated index in nbd_dev_add \| * `5f84a34b64` debugobjects: Recheck debug_objects_enabled before reporting \| * `5d5aa5b648` ext4: correct inline offset when handling xattrs in inode body \| * `48aa539375` ASoC: fsl_sai: Disable bit clock with transmitter \| * `5f2a12f643` drm/client: Fix memory leak in drm_client_modeset_probe \| * `105275879a` drm/client: Fix memory leak in drm_client_target_cloned \| * `cf254b4f68` can: bcm: Fix UAF in bcm_proc_show() \| * `3e412b6e2b` regmap: Account for register length in SMBus I/O limits \| * `8b3dd8d23f` regmap: Drop initial version of maximum transfer length fixes \| * `4935761daa` selftests: tc: add 'ct' action kconfig dep \| * `1ab5aa1846` selftests: tc: set timeout to 15 minutes \| * `dad97c205a` fuse: revalidate: don't invalidate if interrupted \| * `d2c667cc18` btrfs: fix warning when putting transaction with qgroups enabled after abort \| * `4410f4a938` perf probe: Add test for regression introduced by switch to die_get_decl_file() \| * `0a6b0ca586` keys: Fix linking a duplicate key to a keyring's assoc_array \| * `a26208e184` ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx \| * `ce2a7e7b50` ALSA: hda/realtek - remove 3k pull low procedure \| * `f09c0ac142` drm/atomic: Fix potential use-after-free in nonblocking commits \| * `9a085fa9b7` RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests \| * `73e72a5380` net/sched: sch_qfq: reintroduce lmax bound check for MTU \| * `0b1ce92fab` scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue \| * `5addd62586` scsi: qla2xxx: Pointer may be dereferenced \| * `e8de73238d` scsi: qla2xxx: Correct the index of array \| * `921d684462` scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() \| * `2bea9c1c98` scsi: qla2xxx: Fix potential NULL pointer dereference \| * `eecb8a491c` scsi: qla2xxx: Fix buffer overrun \| * `bcd773969a` scsi: qla2xxx: Array index may go out of bound \| * `a9fe97fb7b` scsi: qla2xxx: Wait for io return on terminate rport \| * `6ea2a408d3` tracing/probes: Fix not to count error code to total length \| * `7060e5aac6` tracing: Fix null pointer dereference in tracing_err_log_open() \| * `81fb8a58d4` xtensa: ISS: fix call to split_if_spec \| * `5e68f1f3a2` ring-buffer: Fix deadloop issue on reading trace_pipe \| * `1e760b2d18` net: ena: fix shift-out-of-bounds in exponential backoff \| * `1f2a8f0835` samples: ftrace: Save required argument registers in sample trampolines \| * `1576f0df7b` tracing/histograms: Add histograms to hist_vars if they have referenced variables \| * `07edd294b1` s390/decompressor: fix misaligned symbol build error \| * `5f4a1111ad` Revert "8250: add support for ASIX devices with a FIFO bug" \| * `7f2f0e6ec5` meson saradc: fix clock divider mask length \| * `790e4e82c5` xhci: Show ZHAOXIN xHCI root hub speed correctly \| * `c52e04c58d` xhci: Fix TRB prefetch issue of ZHAOXIN hosts \| * `b56a07c2a5` xhci: Fix resume issue of some ZHAOXIN hosts \| * `8e807eadf0` ceph: don't let check_caps skip sending responses for revoke msgs \| * `c04ed61ebf` firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() \| * `1962717c46` tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk \| * `a49e5a0512` tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error \| * `08673739ed` serial: atmel: don't enable IRQs prematurely \| * `4016d36fec` drm/amd/display: Correct `DMUB_FW_VERSION` macro \| * `d89bd2ecd3` drm/rockchip: vop: Leave vblank enabled in self-refresh \| * `b9ec9372a4` drm/atomic: Allow vblank-enabled + self-refresh "disable" \| * `23d5004ee7` fs: dlm: return positive pid value for F_GETLK \| * `5e9aff5b10` md/raid0: add discard support for the 'original' layout \| * `8e3c777640` misc: pci_endpoint_test: Re-init completion for every test \| * `cdf9a7e2cd` misc: pci_endpoint_test: Free IRQs before removing the device \| * `8c90c466e3` PCI: rockchip: Set address alignment for endpoint mode \| * `f1986416cf` PCI: rockchip: Use u32 variable to access 32-bit registers \| * `36eb130312` PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core \| * `c417a4c7de` PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked \| * `ddda61419a` PCI: rockchip: Write PCI Device ID to correct register \| * `bec3e0f7f2` PCI: rockchip: Assert PCI Configuration Enable bit after probe \| * `48e11e7c81` PCI: qcom: Disable write access to read only registers for IP v2.3.3 \| * `aca71b004a` PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 \| * `d3bab5de91` PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold \| * `5a89a5cc81` hwrng: imx-rngc - fix the timeout for init and self check \| * `47b7eaae08` jfs: jfs_dmap: Validate db_l2nbperpage while mounting \| * `84293af545` ext4: only update i_reserved_data_blocks on successful block allocation \| * `0a5d12e710` ext4: fix wrong unit use in ext4_mb_new_blocks \| * `514220246a` ext4: get block from bh in ext4_free_blocks for fast commit replay \| * `d054422eb6` ext4: fix wrong unit use in ext4_mb_clear_bb \| * `be99faf0c4` ext4: Fix reusing stale buffer heads from last failed mounting \| * `8fbe951d65` MIPS: Loongson: Fix cpu_probe_loongson() again \| * `8c723eef98` erofs: fix compact 4B support for 16k block size \| * `3bd4d316b1` misc: fastrpc: Create fastrpc scalar with correct buffer count \| * `3d1d037f27` powerpc: Fail build if using recordmcount with binutils v2.37 \| * `fe1ae1fb50` net: bcmgenet: Ensure MDIO unregistration has clocks enabled \| * `21d5d3eb36` mtd: rawnand: meson: fix unaligned DMA buffers handling \| * `9ff7fcb3a2` tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation \| * `59490249c2` pinctrl: amd: Only use special debounce behavior for GPIO 0 \| * `4f77a87ce9` pinctrl: amd: Detect internal GPIO0 debounce handling \| * `3674b9c056` pinctrl: amd: Fix mistake in handling clearing pins at startup \| * `b39ef5b52f` f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() \| * `f4ff379812` nvme-pci: fix DMA direction of unmapping integrity data \| * `8359ee85fd` net/sched: sch_qfq: account for stab overhead in qfq_enqueue \| * `5bef780e06` net/sched: sch_qfq: refactor parsing of netlink parameters \| * `1d7ae38daa` net/sched: make psched_mtu() RTNL-less safe \| * `d5ca61b764` netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() \| * `9b69cdb6e5` net/sched: flower: Ensure both minimum and maximum ports are specified \| * `934c85b8ec` wifi: airo: avoid uninitialized warning in airo_get_rate() \| * `4511499138` erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF \| * `bbc500ff3f` riscv, bpf: Fix inconsistent JIT image generation \| * `a976adc3bc` bpf, riscv: Support riscv jit to provide bpf_line_info \| * `eb3d1d84f3` riscv: bpf: Avoid breaking W^X \| * `7c61643798` riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core \| * `83579a6261` igc: Fix inserting of empty frame for launchtime \| * `c48e8ee81a` igc: Fix launchtime before start of cycle \| * `cdf5b9af92` platform/x86: wmi: Break possible infinite loop when parsing GUID \| * `7157ee0de5` platform/x86: wmi: move variables \| * `4bb2bb69bd` platform/x86: wmi: use guid_t and guid_equal() \| * `88dfb592d2` platform/x86: wmi: remove unnecessary argument \| * `2ad31ce40e` ipv6/addrconf: fix a potential refcount underflow for idev \| * `8271145523` NTB: ntb_tool: Add check for devm_kcalloc \| * `41c6d8ff71` NTB: ntb_transport: fix possible memory leak while device_register() fails \| * `03cfa06534` ntb: intel: Fix error handling in intel_ntb_pci_driver_init() \| * `23e09f0a86` NTB: amd: Fix error handling in amd_ntb_pci_driver_init() \| * `0bb2683b0c` ntb: idt: Fix error handling in idt_pci_driver_init() \| * `3e8fed805c` udp6: fix udp6_ehashfn() typo \| * `d30ddd7ff1` icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). \| * `bc3ab5d2ab` net: prevent skb corruption on frag list segmentation \| * `cddd04f341` net: bgmac: postpone turning IRQs off to avoid SoC hangs \| * `f8cc4fd99a` ionic: remove WARN_ON to prevent panic_on_warn \| * `9085429821` gve: Set default duplex configuration to full \| * `80e0e8d5f5` net/sched: cls_fw: Fix improper refcount update leads to use-after-free \| * `d341f24612` net: mvneta: fix txq_map in case of txq_number==1 \| * `c175603d84` scsi: qla2xxx: Fix error code in qla2x00_start_sp() \| * `b687b78361` igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings \| * `30c281a77f` net/mlx5e: Check for NOT_READY flag state after locking \| * `de6e6b0797` net/mlx5e: fix double free in mlx5e_destroy_flow_table \| * `3d4bba694a` igc: Remove delay during TX ring configuration \| * `2a587b71c5` drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags \| * `547ab8ea86` drm/panel: simple: Add connector_type for innolux_at043tn24 \| * `13c353dc5c` workqueue: clean up WORK_* constant types, clarify masking \| * `fc359e5b45` net: lan743x: Don't sleep in atomic context \| * `dc4a25fa75` io_uring: add reschedule point to handle_tw_list() \| * `297883bbca` io_uring: Use io_schedule* in cqring wait \| * `bb2f7e4bfe` block/partition: fix signedness issue for Amiga partitions \| * `4f91de9a81` rcu-tasks: Simplify trc_read_check_handler() atomic operations \| * `3a64cd01cd` rcu-tasks: Mark ->trc_reader_special.b.need_qs data races \| * `058f077d09` rcu-tasks: Mark ->trc_reader_nesting data races \| * `83be9fd784` tty: serial: fsl_lpuart: add earlycon for imx8ulp platform \| * `999f3b6104` wireguard: netlink: send staged packets when setting initial private key \| * `1b71070405` wireguard: queueing: use saner cpu selection wrapping \| * `ea21392224` netfilter: nf_tables: prevent OOB access in nft_byteorder_eval \| * `4ae2e50133` netfilter: nf_tables: do not ignore genmask when looking up chain by id \| * `8289d422f5` netfilter: conntrack: Avoid nf_ct_helper_hash uses after free \| * `be6478f5cc` netfilter: nf_tables: fix scheduling-while-atomic splat \| * `a07e415be3` netfilter: nf_tables: unbind non-anonymous set if rule construction fails \| * `a136b7942a` netfilter: nf_tables: drop map element references from preparation phase \| * `21cf0d66ef` netfilter: nftables: rename set element data activation/deactivation functions \| * `237f37f7b9` netfilter: nf_tables: reject unbound chain set before commit phase \| * `0205dd16ed` netfilter: nf_tables: reject unbound anonymous set before commit phase \| * `34d09fe49f` netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain \| * `d53c295c1f` netfilter: nf_tables: fix chain binding transaction logic \| * `8180fc2fad` netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE \| * `e546e6ebb1` netfilter: nf_tables: add rescheduling points during loop detection walks \| * `3f51f1157f` netfilter: nf_tables: use net_generic infra for transaction data \| * `01248dd651` sh: pgtable-3level: Fix cast to pointer from integer of different size \| * `87410743b5` block: add overflow checks for Amiga partition support \| * `f0aec6c403` selftests/bpf: Add verifier test for PTR_TO_MEM spill \| * `88bffb61bc` tpm, tpm_tis: Claim locality in interrupt handler \| * `5bf73af8b3` fanotify: disallow mount/sb marks on kernel internal pseudo fs \| * `5cb46b80ec` fs: no need to check source \| * `66a0647cdc` leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename \| * `5d6fbb6245` ARM: orion5x: fix d2net gpio initialization \| * `9b0f7940e2` ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path \| * `1dac8584be` ASoC: mediatek: mt8173: Fix irq error path \| * `6819bb0b85` btrfs: fix race when deleting quota root from the dirty cow roots list \| * `a3fbd156bd` btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile \| * `59efb86711` fs: Lock moved directories \| * `c5b5e72df1` fs: Establish locking order for unrelated directories \| * `4b03f503b7` Revert "f2fs: fix potential corruption when moving a directory" \| * `2b563acd2d` ext4: Remove ext4 locking of moved directory \| * `5e7d18a52c` fs: avoid empty option when generating legacy mount string \| * `988a5d7911` jffs2: reduce stack usage in jffs2_build_xattr_subsystem() \| * `5fada37511` shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs \| * `79bef379d5` autofs: use flexible array in ioctl structure \| * `8bf91a8d48` integrity: Fix possible multiple allocation in integrity_inode_get() \| * `9658a03f80` um: Use HOST_DIR for mrproper \| * `a4405f6ee0` bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent \| * `db9439cef0` bcache: Remove unnecessary NULL point check in node allocations \| * `bcb295778a` bcache: fixup btree_cache_wait list damage \| * `dc3287206a` mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. \| * `191628e2d9` mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS \| * `02c8c2b5f6` mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M \| * `6f9708e5c1` mmc: core: disable TRIM on Kingston EMMC04G-M627 \| * `28e649dc99` io_uring: wait interruptibly for request completions on exit \| * `8482ac2e5a` NFSD: add encoding of op_recall flag for write delegation \| * `8d36cb6d1a` i2c: qup: Add missing unwind goto in qup_i2c_probe() \| * `e41a8e4615` ALSA: jack: Fix mutex call in snd_jack_report() \| * `e71714ad24` i2c: xiic: Don't try to handle more interrupt events after error \| * `b6eefa7a27` i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() \| * `023bd9dc41` apparmor: fix missing error check for rhashtable_insert_fast \| * `d1c946552a` sh: dma: Fix DMA channel offset calculation \| * `37750131d2` s390/qeth: Fix vipa deletion \| * `9f5548e421` net: dsa: tag_sja1105: fix MAC DA patching from meta frames \| * `2758fb81bb` pptp: Fix fib lookup calls. \| * `0b08ff091f` net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX \| * `2434a6715f` xsk: Honor SO_BINDTODEVICE on bind \| * `b785ba0acc` tcp: annotate data races in __tcp_oow_rate_limited() \| * `73f512bedf` net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode \| * `9a9d468fdc` powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y \| * `f970b05c9b` octeontx2-af: Fix mapping for NIX block from CGX connection \| * `5ded9e8aa5` f2fs: fix error path handling in truncate_dnode() \| * `358145cc37` mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 \| * `32b9c8f789` spi: bcm-qspi: return error if neither hif_mspi nor mspi is available \| * `1f3643f9cf` net: dsa: vsc73xx: fix MTU configuration \| * `c377451012` Add MODULE_FIRMWARE() for FIRMWARE_TG357766. \| * `6d2243ab78` sctp: fix potential deadlock on &net->sctp.addr_wq_lock \| * `620993d5ee` media: cec: i2c: ch7322: also select REGMAP \| * `f733a7bfe8` rtc: st-lpc: Release some resources in st_rtc_probe() in case of error \| * `aa70e5dd72` pwm: sysfs: Do not apply state to already disabled PWMs \| * `8a0413be8a` pwm: imx-tpm: force 'real_period' to be zero in suspend \| * `e4845cdea7` phy: tegra: xusb: check return value of devm_kzalloc() \| * `442e1a98bd` mfd: stmpe: Only disable the regulators if they are enabled \| * `724448d602` KVM: s390: vsie: fix the length of APCB bitmap \| * `c5e2f6f2bb` mfd: stmfx: Nullify stmfx->vdd in case of error \| * `30ead8b9bf` mfd: stmfx: Fix error path in stmfx_chip_init \| * `4d24051473` test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation \| * `5b31ac1d6d` serial: 8250_omap: Use force_suspend and resume for system suspend \| * `8e00ae25a3` Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" \| * `a81e1f22e1` mfd: intel-lpss: Add missing check for platform_get_resource \| * `1dc07edc01` usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() \| * `7ade555ac5` usb: common: usb-conn-gpio: Set last role to unknown before initial detection \| * `0e9e127835` usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() \| * `a617145208` usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() \| * `96898fb476` KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes \| * `4e8e838fce` media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() \| * `b754ea60e6` media: venus: helpers: Fix ALIGN() of non power of two \| * `02b2266023` mfd: rt5033: Drop rt5033-battery sub-device \| * `e52019c095` coresight: Fix loss of connection info when a module is unloaded \| * `018eddcb6b` kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR \| * `a59f64a835` serial: 8250: lock port for UART_IER access in omap8250_irq() \| * `8d65d0a2bf` serial: 8250: lock port for stop_rx() in omap8250_irq() \| * `d66ddb61fa` usb: hide unused usbfs_notify_suspend/resume functions \| * `56901de563` usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() \| * `6538e5d9f7` extcon: Fix kernel doc of property capability fields to avoid warnings \| * `dac7d7efcb` extcon: Fix kernel doc of property fields to avoid warnings \| * `2788a3553f` usb: gadget: u_serial: Add null pointer check in gserial_suspend \| * `74f8606ddf` usb: dwc3: qcom: Fix potential memory leak \| * `bdce16c1e6` clk: qcom: ipq6018: fix networking resets \| * `ee3f494cfc` clk: qcom: reset: support resetting multiple bits \| * `35fd1a213f` clk: qcom: reset: Allow specifying custom reset delay \| * `d87ef4e857` media: usb: siano: Fix warning due to null work_func_t function pointer \| * `300388887c` media: videodev2.h: Fix struct v4l2_input tuner index comment \| * `5f3f4aa673` media: usb: Check az6007_read() return value \| * `32809afb60` clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks \| * `bb81ca33ac` serial: 8250: omap: Fix freeing of resources on failed register \| * `ed68e8e22e` sh: j2: Use ioremap() to translate device tree address into kernel memory \| * `a7890637b3` w1: fix loop in w1_fini() \| * `a27aeae714` w1: w1_therm: fix locking behavior in convert_t \| * `cd5ec3ee52` SUNRPC: Fix UAF in svc_tcp_listen_data_ready() \| * `e4a9b3333e` block: change all __u32 annotations to __be32 in affs_hardblocks.h \| * `54da6c4c14` block: fix signed int overflow in Amiga partition support \| * `b6a107c520` phy: tegra: xusb: Clear the driver reference in usb-phy dev \| * `fac7be49f1` usb: dwc3: gadget: Propagate core init errors to UDC during pullup \| * `8b0a55b592` USB: serial: option: add LARA-R6 01B PIDs \| * `810e401b34` io_uring: ensure IOPOLL locks around deferred work \| * `cd5837564f` hwrng: st - keep clock enabled while hwrng is registered \| * `557e528255` dax: Introduce alloc_dev_dax_id() \| * `94a85474f5` dax: Fix dax_mapping_release() use after free \| * `7c9f5a14d9` NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION \| * `bab0bf5677` ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard \| * `cb0cdca5c9` modpost: fix off by one in is_executable_section() \| * `f0350516b9` crypto: marvell/cesa - Fix type mismatch warning \| * `b540694455` modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} \| * `88978ef7fd` modpost: fix section mismatch message for R_ARM_ABS32 \| * `31195ee328` crypto: nx - fix build warnings when DEBUG_FS is not enabled \| * `77471e4912` hwrng: virtio - Fix race on data_avail and actual data \| * `e8f51401d6` hwrng: virtio - always add a pending request \| * `ffc5ce9c27` hwrng: virtio - don't waste entropy \| * `d13ea82bfe` hwrng: virtio - don't wait on cleanup \| * `5f23dae018` hwrng: virtio - add an internal buffer \| * `aba192bb31` powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary \| * `7afd0de0cc` powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo \| * `7289ca7a51` mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t * \| * `bfad110188` mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * \| * `07c19c0ad4` powerpc/powernv/sriov: perform null check on iov before dereferencing iov \| * `f3c7b95c99` pinctrl: at91-pio4: check return value of devm_kasprintf() \| * `b7a38fc3f3` perf dwarf-aux: Fix off-by-one in die_get_varname() \| * `75a3cb1e23` perf script: Fix allocation of evsel->priv related to per-event dump files \| * `647c6d35cc` perf script: Fixup 'struct evsel_script' method prefix \| * `958acb479e` kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures \| * `5533f0eb0a` pinctrl: cherryview: Return correct value if pin in push-pull mode \| * `4b63caf86e` perf bench: Add missing setlocale() call to allow usage of %'d style formatting \| * `345ee85216` perf bench: Use unbuffered output when pipe/tee'ing to a file \| * `f0d2310f6b` PCI: Add pci_clear_master() stub for non-CONFIG_PCI \| * `b65fe59b2d` PCI: ftpci100: Release the clock resources \| * `cb389e8edf` PCI: pciehp: Cancel bringup sequence if card is not present \| * `b9895a4c95` scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() \| * `7badf4d6f4` PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free \| * `d27238fc83` pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors \| * `ac64019e4d` scsi: qedf: Fix NULL dereference in error handling \| * `8e9907e921` PCI: cadence: Fix Gen2 Link Retraining process \| * `07be8e60f2` ASoC: imx-audmix: check return value of devm_kasprintf() \| * `714ba10a6d` ovl: update of dentry revalidate flags after copy up \| * `47f4d875aa` drivers: meson: secure-pwrc: always enable DMA domain \| * `5f149d0538` clk: ti: clkctrl: check return value of kasprintf() \| * `fd9324fa4d` clk: keystone: sci-clk: check return value of kasprintf() \| * `0b754f9cfd` clk: si5341: free unused memory on probe failure \| * `dc8d0178d5` clk: si5341: check return value of {devm_}kasprintf() \| * `dc3eef6480` clk: si5341: return error if one synth clock registration fails \| * `0401139800` clk: si5341: Add sysfs properties to allow checking/resetting device faults \| * `fc813d0573` clk: si5341: Allow different output VDD_SEL values \| * `f64fcd3acf` clk: cdce925: check return value of kasprintf() \| * `866d4340c6` clk: vc5: check memory returned by kasprintf() \| * `c67a55f7cc` drm/msm/dp: Free resources after unregistering them \| * `c3b63584d8` drm/msm/dpu: do not enable color-management if DSPPs are not available \| * `f923a58221` ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer \| * `404e9f741a` clk: tegra: tegra124-emc: Fix potential memory leak \| * `cb047c13bb` clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() \| * `294321349b` clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe \| * `e749bc5a90` RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context \| * `9341501e2f` RDMA/bnxt_re: wraparound mbox producer index \| * `968e27fd03` amdgpu: validate offset_in_bo of drm_amdgpu_gem_va \| * `e070120e6d` drm/radeon: fix possible division-by-zero errors \| * `a77b80825b` drm/amdkfd: Fix potential deallocation of previously deallocated memory. \| * `245aa7c023` ARM: dts: BCM5301X: fix duplex-full => full-duplex \| * `7e2edb84fe` hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 \| * `580e9b987b` hwmon: (adm1275) Allow setting sample averaging \| * `a3c5d148b7` hwmon: (adm1275) enable adm1272 temperature reporting \| * `4610efa404` hwmon: (gsc-hwmon) fix fan pwm temperature scaling \| * `6e12311dce` ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx \| * `badeb7fe24` ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 \| * `17cd31487d` arm64: dts: ti: k3-j7200: Fix physical address of pin \| * `ce6e0434e5` fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() \| * `34e1e2f3cf` arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 \| * `6817914c67` ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier \| * `220f86cc19` RDMA/hns: Fix hns_roce_table_get return value \| * `9196f44239` RDMA/hns: Clean the hardware related code for HEM \| * `aa495b927f` RDMA/hns: Use refcount_t APIs for HEM \| * `de1049dd18` RDMA/hns: Fix coding style issues \| * `cc1b04b699` RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions \| * `7dcb9ea3ee` IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate \| * `6cf8f3d690` IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors \| * `2d38866a99` IB/hfi1: Use bitmap_zalloc() when applicable \| * `42b6865bf5` soc/fsl/qe: fix usb.c build errors \| * `9c14d14066` ARM: dts: meson8: correct uart_B and uart_C clock references \| * `684a2f180e` ASoC: es8316: Do not set rate constraints for unsupported MCLKs \| * `d883e16c7f` ASoC: es8316: Increment max value for ALC Capture Target Volume control \| * `105af71974` memory: brcmstb_dpfe: fix testing array offset after use \| * `ddc74d6ea3` ARM: dts: stm32: Shorten the AV96 HDMI sound card name \| * `392ee3cc99` arm64: dts: qcom: apq8096: fix fixed regulator name property \| * `c85a076215` ARM: omap2: fix missing tick_broadcast() prototype \| * `aec18da741` ARM: ep93xx: fix missing-prototype warnings \| * `b574cd7e4d` drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H \| * `02d8b008ff` arm64: dts: qcom: msm8996: correct camss unit address \| * `6d103b1cc1` arm64: dts: qcom: msm8994: correct SPMI unit address \| * `160ac75a5a` arm64: dts: qcom: msm8916: correct camss unit address \| * `e8b131d216` ARM: dts: gta04: Move model property out of pinctrl node \| * `b0b180a712` RDMA/bnxt_re: Fix to remove an unnecessary log \| * `446092f136` RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid \| * `b54b26ac50` RDMA/bnxt_re: Use unique names while registering interrupts \| * `11bd3882c3` RDMA/bnxt_re: Fix to remove unnecessary return labels \| * `7080ef46ad` RDMA/bnxt_re: Disable/kill tasklet only if it is enabled \| * `2a9895df80` arm64: dts: microchip: sparx5: do not use PSCI on reference boards \| * `726fdf47c1` bus: ti-sysc: Fix dispc quirk masking bool variables \| * `8ee24ddf45` ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards \| * `617a4da09d` drm/panel: sharp-ls043t1le01: adjust mode settings \| * `3c87c98225` drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` \| * `39305592dc` Input: adxl34x - do not hardcode interrupt trigger type \| * `e629efc6d6` ARM: dts: meson8b: correct uart_B and uart_C clock references \| * `bd46ade714` ARM: dts: BCM5301X: Drop "clock-names" from the SPI node \| * `20ecae1af5` drm/vram-helper: fix function names in vram helper doc \| * `46a34e1459` drm/bridge: tc358768: fix THS_TRAILCNT computation \| * `f2f7d0a4a2` drm/bridge: tc358768: fix TXTAGOCNT computation \| * `8e47328fe0` drm/bridge: tc358768: fix THS_ZEROCNT computation \| * `6b9450723b` drm/bridge: tc358768: fix TCLK_TRAILCNT computation \| * `33abcfbb17` drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation \| * `43b2d11ccf` drm/bridge: tc358768: fix TCLK_ZEROCNT computation \| * `46b7417189` drm/bridge: tc358768: fix PLL target frequency \| * `825b00c685` drm/bridge: tc358768: fix PLL parameters computation \| * `1b4f23fdf2` drm/bridge: tc358768: always enable HS video mode \| * `4e0fd4f54b` Input: drv260x - sleep between polling GO bit \| * `2780d58448` drm/amd/display: Explicitly specify update type per plane info change \| * `b2213fc60b` radeon: avoid double free in ci_dpm_init() \| * `472a615e66` netlink: Add __sock_i_ino() for __netlink_diag_dump(). \| * `d10b380369` ipvlan: Fix return value of ipvlan_queue_xmit() \| * `5215c00968` netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. \| * `9bdcda7aba` netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one \| * `36e07e8acf` lib/ts_bm: reset initial match offset for every block of text \| * `96f2c6f272` net: nfc: Fix use-after-free caused by nfc_llcp_find_local \| * `a3a1550c4d` nfc: llcp: simplify llcp_sock_connect() error paths \| * `cb1aa7cc56` sfc: fix crash when reading stats while NIC is resetting \| * `6ccfec84f0` net: axienet: Move reset before 64-bit DMA detection \| * `bccc7ace12` gtp: Fix use-after-free in __gtp_encap_destroy(). \| * `4d9cd4b330` selftests: rtnetlink: remove netdevsim device after ipsec offload test \| * `44db85c6e1` netlink: do not hard code device address lenth in fdb dumps \| * `cde7b90e05` netlink: fix potential deadlock in netlink_set_err() \| * `0c9e48428f` net: stmmac: fix double serdes powerdown \| * `1ba91ffa1a` igc: Fix race condition in PTP tx code \| * `660d4e73ef` wifi: ath9k: convert msecs to jiffies where needed \| * `150ca0768b` wifi: cfg80211: rewrite merging of inherited elements \| * `4e321c18ef` wifi: iwlwifi: pull from TXQs with softirqs disabled \| * `2715617c2a` rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO \| * `581401cd3c` wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() \| * `6b22c2c649` memstick r592: make memstick_debug_get_tpc_name() static \| * `6cb477e722` kexec: fix a memory leak in crash_shrink_memory() \| * `fdb07728d8` watchdog/perf: more properly prevent false positives with turbo modes \| * `ac23d7f414` watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config \| * `22da8363e3` wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown \| * `b2aeb97fd4` wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled \| * `1044187e72` wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes \| * `c10c6ea9b3` wifi: ray_cs: Fix an error handling path in ray_probe() \| * `8825991838` wifi: ray_cs: Drop useless status variable in parse_addr() \| * `a66e3fd380` wifi: ray_cs: Utilize strnlen() in parse_addr() \| * `18d71562f7` wifi: wl3501_cs: Fix an error handling path in wl3501_probe() \| * `b6f793de61` wl3501_cs: use eth_hw_addr_set() \| * `cbd44a9e1c` net: create netdev->dev_addr assignment helpers \| * `13cf0e3894` wl3501_cs: Fix misspelling and provide missing documentation \| * `5512db9bd4` wifi: atmel: Fix an error handling path in atmel_probe() \| * `86ebbcbdc7` wifi: orinoco: Fix an error handling path in orinoco_cs_probe() \| * `fb7d78feb5` wifi: orinoco: Fix an error handling path in spectrum_cs_probe() \| * `8782dc2504` regulator: core: Streamline debugfs operations \| * `92bcd84941` regulator: core: Fix more error checking for debugfs_create_dir() \| * `78f390aa0e` bpftool: JIT limited misreported as negative value on aarch64 \| * `107e849f3c` nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() \| * `0be9de2ea0` nfc: constify several pointers to u8, char and sk_buff \| * `ef7fe1b5c4` libbpf: fix offsetof() and container_of() to work with CO-RE \| * `b190ced50a` sctp: add bpf_bypass_getsockopt proto callback \| * `08f61a3491` bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE \| * `c62e2ac02e` wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() \| * `3ae910a375` wifi: wilc1000: fix for absent RSN capabilities WFA testcase \| * `795ef55030` spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG \| * `bd3e880dce` samples/bpf: Fix buffer overflow in tcp_basertt \| * `250efb4d3f` wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx \| * `0f3f41b475` wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation \| * `cbd0f41a53` igc: Enable and fix RX hash usage by netstack \| * `a14cb30726` pstore/ram: Add check for kstrdup \| * `628709a057` ima: Fix build warnings \| * `16ec59c03a` evm: Complete description of evm_inode_setattr() \| * `cba85e1cb7` x86/mm: Fix __swp_entry_to_pte() for Xen PV guests \| * `365f546de5` perf/ibs: Fix interface via core pmu events \| * `604d6a5ff7` rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale \| * `d414e24d15` rcu/rcuscale: Move rcu_scale_() after kfree_scale_cleanup() \| `ecc5e6dbc2` rcuscale: Move shutdown from wait_event() to wait_event_idle() \| * `b62c816bdb` rcuscale: Always log error message \| * `8cd9917c13` rcuscale: Console output claims too few grace periods \| * `456f783b83` thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() \| * `bacc49b2d5` cpufreq: intel_pstate: Fix energy_performance_preference for passive \| * `a8bfe52755` ARM: 9303/1: kprobes: avoid missing-declaration warnings \| * `a50b75c13d` powercap: RAPL: Fix CONFIG_IOSF_MBI dependency \| * `23f6efd226` perf/arm-cmn: Fix DTC reset \| * `b69868d50d` PM: domains: fix integer overflow issues in genpd_parse_state() \| * `ebdff09865` clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe \| * `a2f83a4c7c` tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). \| * `f1be1ed32d` posix-timers: Prevent RT livelock in itimer_delete() \| * `b315d57da4` irqchip/jcore-aic: Fix missing allocation of IRQ descriptors \| * `495cee0e14` irqchip/jcore-aic: Kill use of irq_create_strict_mappings() \| * `9d1cccdad0` md/raid10: fix io loss while replacement replace rdev \| * `2990e2ece1` md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request \| * `b1d8f38310` md/raid10: fix wrong setting of max_corr_read_errors \| * `b3a0bc4a01` md/raid10: fix overflow of md/safe_mode_delay \| * `39fa14e824` md/raid10: check slab-out-of-bounds in md_bitmap_get_counter \| * `8563b58a43` blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost \| * `3db97cc79b` x86/resctrl: Only show tasks' pid in current pid namespace \| * `1a82005f3f` fs: pipe: reveal missing function protoypes \| * `f70407e8e0` nubus: Partially revert proc_create_single_data() conversion \| * `0336c8f072` drm/amdgpu: Validate VM ioctl flags. \| * `c484b65f93` scripts/tags.sh: Resolve gtags empty index generation \| * `649104c834` Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" \| * `02a4c4e225` HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. \| * `9598a647ec` HID: wacom: Use ktime_t rather than int when dealing with timestamps \| * `2bf70b88cc` fbdev: imsttfb: Fix use after free bug in imsttfb_probe \| * `5b813734a0` video: imsttfb: check for ioremap() failures \| * `02fbf62df9` can: isotp: isotp_sendmsg(): fix return error fix on TX path \| * `8667f71131` x86/smp: Use dedicated cache-line for mwait_play_dead() \| * `1d0fe3fb5d` media: atomisp: fix "variable dereferenced before check 'asd'" * \| `9710ae86ef` Merge branch 'android12-5.10' into branch 'android12-5.10-lts' * \| `db023c4bb0` Merge 5.10.187 into android12-5.10-lts \|\\| \| * `140d69b4e4` Linux 5.10.187 \| * `93df00f9d4` x86/cpu/amd: Add a Zenbleed fix \| * `191b8f9b0e` x86/cpu/amd: Move the errata checking functionality up \| * `113ce5ed59` x86/microcode/AMD: Load late on both threads too * \| `44da38b39c` ANDROID: GKI: fix up sysctl_vals ABI change. * \| `c9606079a5` Revert "gpio: Allow per-parent interrupt data" * \| `fc3985cbee` Revert "gpiolib: Fix GPIO chip IRQ initialization restriction" * \| `02a1b32243` Merge 5.10.186 into android12-5.10-lts \|/ * `381518b4a9` Linux 5.10.186 * `29917a20be` bpf/btf: Accept function names that contain dots * `8b7454dd98` netfilter: nf_tables: hold mutex on netns pre_exit path * `9e8d927cfa` netfilter: nf_tables: validate registers coming from userspace. * `f19a4818a9` netfilter: nftables: statify nft_parse_register() * `42997367cb` i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle * `5a257f3553` x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys * `d8efc77f23` drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl * `485fe16508` drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl * `0b0fdc43b2` drm/exynos: vidi: fix a wrong error return * `32134e7a0f` ARM: dts: Fix erroneous ADS touchscreen polarities * `79cf5657be` s390/purgatory: disable branch profiling * `a819de62ec` ASoC: nau8824: Add quirk to active-high jack-detect * `fa08753c2d` ASoC: simple-card: Add missing of_node_put() in case of error * `9138ed7e2b` spi: lpspi: disable lpspi module irq in DMA mode * `97b6c4c1d1` s390/cio: unregister device when the only path is gone * `fe949c1662` Input: soc_button_array - add invalid acpi_index DMI quirk handling * `eaf1fa9452` usb: gadget: udc: fix NULL dereference in remove() * `7d1a0733a5` nfcsim.c: Fix error checking for debugfs_create_dir * `dc357c0787` media: cec: core: don't set last_initiator if tx in progress * `c13573032b` arm64: Add missing Set/Way CMO encodings * `49a2b18f49` HID: wacom: Add error check to wacom_parse_and_register() * `2b43198de0` scsi: target: iscsi: Prevent login threads from racing between each other * `75aa3f255c` gpiolib: Fix GPIO chip IRQ initialization restriction * `304802e5b0` gpio: Allow per-parent interrupt data * `bc75968b49` sch_netem: acquire qdisc lock in netem_change() * `caddeadd0d` Revert "net: phy: dp83867: perform soft reset and retain established link" * `5702afa2c3` netfilter: nfnetlink_osf: fix module autoload * `3d5c09c782` netfilter: nf_tables: disallow element updates of bound anonymous sets * `2a90da8e0d` netfilter: nft_set_pipapo: .walk does not deal with generations * `792bfe26a6` be2net: Extend xmit workaround to BE3 chip * `cebb5cee09` net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch * `7a1ae00005` ipvs: align inner_mac_header for encapsulation * `f2547bc716` mmc: usdhi60rol0: fix deferred probing * `4a99e35c5a` mmc: sh_mmcif: fix deferred probing * `c2278de138` mmc: sdhci-acpi: fix deferred probing * `f6e176ef89` mmc: owl: fix deferred probing * `f29d0ab0e6` mmc: omap_hsmmc: fix deferred probing * `65d9318e3d` mmc: omap: fix deferred probing * `9ad3c21fb6` mmc: mvsdio: fix deferred probing * `9b0417fd40` mmc: mtk-sd: fix deferred probing * `ced13bc50e` net: qca_spi: Avoid high load if QCA7000 is not available * `b1b9c81e29` xfrm: Linearize the skb after offloading if needed. * `31cd0d4a44` selftests: net: fcnal-test: check if FIPS mode is enabled * `2af75a36af` selftests: net: vrf-xfrm-tests: change authentication and encryption algos * `07fbbddae5` xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets * `562800447f` bpf: Fix verifier id tracking of scalars on spill * `3b0a96db67` bpf: track immediate values written to stack by BPF_ST instruction * `bff7824db6` xfrm: Ensure policies always checked on XFRM-I input path * `01af67ed83` xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c * `cdaa6e1105` xfrm: Treat already-verified secpath entries as optional * `47be2931c4` ieee802154: hwsim: Fix possible memory leaks * `051d642133` memfd: check for non-NULL file_seals in memfd_create() syscall * `1ac6e9ee84` sysctl: move some boundary constants from sysctl.c to sysctl_vals * `e1aa3fe3e2` mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30% * `ad10dd2113` x86/mm: Avoid using set_pgd() outside of real PGD pages * `4de2093674` nilfs2: prevent general protection fault in nilfs_clear_dirty_page() * `3845c38417` io_uring/net: disable partial retries for recvmsg with cmsg * `826ee9fa36` io_uring/net: clear msg_controllen on partial sendmsg retry * `5fdea4468f` io_uring/net: save msghdr->msg_control for retries * `5a7101d8fa` writeback: fix dereferencing NULL mapping->host on writeback_page_template * `f00cd687c2` regmap: spi-avmm: Fix regmap_bus max_raw_write * `bc35f93e4b` regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK * `5938470f9c` ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN * `2e454015ca` mmc: mmci: stm32: fix max busy timeout calculation * `1be288fd3b` mmc: meson-gx: remove redundant mmc_request_done() call from irq context * `1b97630cd9` mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 * `63608437a8` cgroup: Do not corrupt task iteration when rebinding subsystem * `988d06f5eb` PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic * `8f2d5ebdfe` PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev * `8b74846769` Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" * `79ceb758e3` PCI: hv: Fix a race condition bug in hv_pci_query_relations() * `8b8c9812c0` Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs * `b435298349` nilfs2: fix buffer corruption due to concurrent device reads * `524a2c0bcf` selftests: mptcp: join: skip check if MIB counter not supported * `e508d9cef8` selftests: mptcp: pm nl: remove hardcoded default limits * `4c4ca42418` selftests: mptcp: lib: skip if not below kernel version * `6d20cfbc57` selftests: mptcp: lib: skip if missing symbol * `3cc7935d32` tick/common: Align tick period during sched_timer setup * `db4ab0c97a` tracing: Add tracing_reset_all_online_cpus_unlocked() function * `9ced730490` net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs * `b1b42fff8a` drm/amd/display: fix the system hang while disable PSR Change-Id: I0c8675eb9b259cf7631e968dd66c31d3e16d31e9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Signed-off-by: Todd Kjos <tkjos@google.com>	2023-09-27 19:46:11 +00:00
Jaegeuk Kim	ff86e87c7e	FROMGIT: f2fs: split initial and dynamic conditions for extent_cache Let's allocate the extent_cache tree without dynamic conditions to avoid a missing condition causing a panic as below. # create a file w/ a compressed flag # disable the compression # panic while updating extent_cache F2FS-fs (dm-64): Swapfile: last extent is not aligned to section F2FS-fs (dm-64): Swapfile (3) is not align to section: 1) creat(), 2) ioctl(F2FS_IOC_SET_PIN_FILE), 3) fallocate(2097152 * N) Adding 124996k swap on ./swap-file. Priority:0 extents:2 across:17179494468k ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write out/common/include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_try_cmpxchg_acquire out/common/include/asm-generic/atomic-instrumented.h:705 [inline] BUG: KASAN: null-ptr-deref in queued_write_lock out/common/include/asm-generic/qrwlock.h:92 [inline] BUG: KASAN: null-ptr-deref in __raw_write_lock out/common/include/linux/rwlock_api_smp.h:211 [inline] BUG: KASAN: null-ptr-deref in _raw_write_lock+0x5a/0x110 out/common/kernel/locking/spinlock.c:295 Write of size 4 at addr 0000000000000030 by task syz-executor154/3327 CPU: 0 PID: 3327 Comm: syz-executor154 Tainted: G O 5.10.185 #1 Hardware name: emulation qemu-x86/qemu-x86, BIOS 2023.01-21885-gb3cc1cd24d 01/01/2023 Call Trace: __dump_stack out/common/lib/dump_stack.c:77 [inline] dump_stack_lvl+0x17e/0x1c4 out/common/lib/dump_stack.c:118 __kasan_report+0x16c/0x260 out/common/mm/kasan/report.c:415 kasan_report+0x51/0x70 out/common/mm/kasan/report.c:428 kasan_check_range+0x2f3/0x340 out/common/mm/kasan/generic.c:186 __kasan_check_write+0x14/0x20 out/common/mm/kasan/shadow.c:37 instrument_atomic_read_write out/common/include/linux/instrumented.h:101 [inline] atomic_try_cmpxchg_acquire out/common/include/asm-generic/atomic-instrumented.h:705 [inline] queued_write_lock out/common/include/asm-generic/qrwlock.h:92 [inline] __raw_write_lock out/common/include/linux/rwlock_api_smp.h:211 [inline] _raw_write_lock+0x5a/0x110 out/common/kernel/locking/spinlock.c:295 __drop_extent_tree+0xdf/0x2f0 out/common/fs/f2fs/extent_cache.c:1155 f2fs_drop_extent_tree+0x17/0x30 out/common/fs/f2fs/extent_cache.c:1172 f2fs_insert_range out/common/fs/f2fs/file.c:1600 [inline] f2fs_fallocate+0x19fd/0x1f40 out/common/fs/f2fs/file.c:1764 vfs_fallocate+0x514/0x9b0 out/common/fs/open.c:310 ksys_fallocate out/common/fs/open.c:333 [inline] __do_sys_fallocate out/common/fs/open.c:341 [inline] __se_sys_fallocate out/common/fs/open.c:339 [inline] __x64_sys_fallocate+0xb8/0x100 out/common/fs/open.c:339 do_syscall_64+0x35/0x50 out/common/arch/x86/entry/common.c:46 Bug: 295824459 (cherry picked from commit f803982190f0265fd36cf84670aa6daefc2b0768 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-f2fs-devel/20230907210859.3698691-1-jaegeuk@kernel.org/T/#u Fixes: 72840cccc0a1 ("f2fs: allocate the extent_cache by default") Reported-and-tested-by: syzbot+d342e330a37b48c094b7@syzkaller.appspotmail.com Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Change-Id: Ie814c99098487e76b7abdcfdcda342a7e1c1fcf0	2023-09-20 08:50:12 -07:00
Chao Yu	72a7bbb4a3	UPSTREAM: f2fs: fix to update age extent in f2fs_do_zero_range() We should update age extent in f2fs_do_zero_range() like we did in f2fs_truncate_data_blocks_range(). Bug: 254441685 Fixes: 71644dff4811 ("f2fs: add block_age-based extent cache") Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit a84153f939808102dfa10904aa0f743e734a3e1d) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I775351141745194b08c5f149be36cd275ab84e4c	2023-09-08 12:39:57 +01:00
Chao Yu	1e1986dd44	UPSTREAM: f2fs: fix to update age extent correctly during truncation nr_free may be less than len, we should update age extent cache w/ range [fofs, len] rather than [fofs, nr_free]. Bug: 254441685 Fixes: 71644dff4811 ("f2fs: add block_age-based extent cache") Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit 8c0ed062ce27f6b7f0a568cb241e2b4dd2d9e6a6) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I86dccb39f6e844b180046dc8560e3904700fb4e1	2023-09-08 12:39:57 +01:00
Chao Yu	3e9ba88034	BACKPORT: f2fs: fix to do sanity check on extent cache correctly In do_read_inode(), sanity_check_inode() should be called after f2fs_init_read_extent_tree(), fix it. Fixes: 72840cccc0a1 ("f2fs: allocate the extent_cache by default") Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit d48a7b3a72f121655d95b5157c32c7d555e44c05) [Lee: Removed call to f2fs_handle_error() - not in original hunk] Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I1a8695fc5eda522e010468093ad78ffebd7dada5	2023-09-08 12:39:56 +01:00
Chao Yu	216e24b08c	BACKPORT: f2fs: don't reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:__lock_acquire+0x69/0x2000 kernel/locking/lockdep.c:4942 Call Trace: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5691 __raw_write_lock include/linux/rwlock_api_smp.h:209 [inline] _raw_write_lock+0x2e/0x40 kernel/locking/spinlock.c:300 __drop_extent_tree+0x3ac/0x660 fs/f2fs/extent_cache.c:1100 f2fs_drop_extent_tree+0x17/0x30 fs/f2fs/extent_cache.c:1116 f2fs_insert_range+0x2d5/0x3c0 fs/f2fs/file.c:1664 f2fs_fallocate+0x4e4/0x6d0 fs/f2fs/file.c:1838 vfs_fallocate+0x54b/0x6b0 fs/open.c:324 ksys_fallocate fs/open.c:347 [inline] __do_sys_fallocate fs/open.c:355 [inline] __se_sys_fallocate fs/open.c:353 [inline] __x64_sys_fallocate+0xbd/0x100 fs/open.c:353 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is race condition as below: - since it tries to remount rw filesystem, so that do_remount won't call sb_prepare_remount_readonly to block fallocate, there may be race condition in between remount and fallocate. - in f2fs_remount(), default_options() will reset mount option to default one, and then update it based on result of parse_options(), so there is a hole which race condition can happen. Thread A Thread B - f2fs_fill_super - parse_options - clear_opt(READ_EXTENT_CACHE) - f2fs_remount - default_options - set_opt(READ_EXTENT_CACHE) - f2fs_fallocate - f2fs_insert_range - f2fs_drop_extent_tree - __drop_extent_tree - __may_extent_tree - test_opt(READ_EXTENT_CACHE) return true - write_lock(&et->lock) access NULL pointer - parse_options - clear_opt(READ_EXTENT_CACHE) Bug: 295824459 Cc: <stable@vger.kernel.org> Reported-by: syzbot+d015b6c2fbb5c383bf08@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit 458c15dfbce62c35fefd9ca637b20a051309c9f1) Change-Id: I933beab715c85836b98e8b4cb85223000714176f	2023-09-06 09:56:37 +00:00
Enlin Mu	d26e92d681	FROMGIT: pstore/ram: Check start of empty przs during init After commit `30696378f6` ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that the buffer_size is zero (regardless of the buffer start position). This unchecked start value means it could be outside the bounds of the buffer, leading to future access panics when written to: sysdump_panic_event+0x3b4/0x5b8 atomic_notifier_call_chain+0x54/0x90 panic+0x1c8/0x42c die+0x29c/0x2a8 die_kernel_fault+0x68/0x78 __do_kernel_fault+0x1c4/0x1e0 do_bad_area+0x40/0x100 do_translation_fault+0x68/0x80 do_mem_abort+0x68/0xf8 el1_da+0x1c/0xc0 __raw_writeb+0x38/0x174 __memcpy_toio+0x40/0xac persistent_ram_update+0x44/0x12c persistent_ram_write+0x1a8/0x1b8 ramoops_pstore_write+0x198/0x1e8 pstore_console_write+0x94/0xe0 ... To avoid this, also check if the prz start is 0 during the initialization phase. If not, the next prz sanity check case will discover it (start > size) and zap the buffer back to a sane state. Bug: 293538531 Fixes: `30696378f6` ("pstore/ram: Do not treat empty buffers as valid") Cc: Yunlong Xing <yunlong.xing@unisoc.com> Cc: stable@vger.kernel.org Change-Id: I6ff3a11b8b21f6f5ab37d8432751e5d33a441d8c Signed-off-by: Enlin Mu <enlin.mu@unisoc.com> Link: https://lore.kernel.org/r/20230801060432.1307717-1-yunlong.xing@unisoc.com [kees: update commit log with backtrace and clarifications] (cherry picked from commit fe8c3623ab06603eb760444a032d426542212021 https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/pstore) Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Chunhui Li <chunhui.li@mediatek.com> (cherry picked from commit cd018c99fa2f79262262a2698455f9ee3e5f5076)	2023-08-29 21:43:07 +00:00
Namjae Jeon	966df87a17	UPSTREAM: exfat: check if filename entries exceeds max filename length [ Upstream commit d42334578eba1390859012ebb91e1e556d51db49 ] exfat_extract_uni_name copies characters from a given file name entry into the 'uniname' variable. This variable is actually defined on the stack of the exfat_readdir() function. According to the definition of the 'exfat_uni_name' type, the file name should be limited 255 characters (+ null teminator space), but the exfat_get_uniname_from_ext_entry() function can write more characters because there is no check if filename entries exceeds max filename length. This patch add the check not to copy filename characters when exceeding max filename length. Bug: 296393077 Cc: stable@vger.kernel.org Cc: Yuezhang Mo <Yuezhang.Mo@sony.com> Reported-by: Maxim Suhanov <dfirblog@gmail.com> Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c2fdf827f8fc6a571e1b7cc38a61041f0321adf5) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I57a9ab007a5eac9c3415aa460df324c9044908c0	2023-08-29 16:03:13 +01:00
Andrew Yang	028e0fb3a4	FROMGIT: fs: drop_caches: draining pages before dropping caches We expect a file page access after dropping caches should be a major fault, but sometimes it's still a minor fault. That's because a file page can't be dropped if it's in a per-cpu pagevec. Draining all pages from per-cpu pagevec to lru list before trying to drop caches. Link: https://lkml.kernel.org/r/20230630092203.16080-1-andrew.yang@mediatek.com Change-Id: I9b03c53e39b87134d5ddd0c40ac9b36cf4d190cd Signed-off-by: Andrew Yang <andrew.yang@mediatek.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Matthias Brugger <matthias.bgg@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 285794522 (cherry picked from commit a481c6fdf3e4fdf31bda91098dfbf46098037e76 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable)	2023-08-10 11:28:35 +00:00
Greg Kroah-Hartman	477f5e6b9e	This is the 5.10.188 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmTCEmYACgkQONu9yGCS aT5ETA/+MGhe+GasO74Gvx1MaSVJrPZgPzInUg5UoYIkf+N3BfNqH9KVrY/zFKfU mKNQSQDsli+WG8agHVzoa4lh3ZFHbiUrNx14n+3A8lZ0X5s31fqTLXRvKy9BCu4t 8OQW6nuMv22SVDd40F5ciroNmAbDquDfUQK4KbETNRPU2Yzvd5VEZiCY9aQAGFbc YnqBbx1Qc5EQKmzoBmEiup2j04SWXwMPQERKdFVZ1jrjC3hC8MFmL62YwfbCH4gY faDSZPj++/V5c++bP6oG8QhfrQS+WYGwFmEJpf4GUJ8dxxJC9Ao9CwcXbd2jOjfz Tk0gNQ9YPs+a2gexAnaHsJqKXn+dcRvkIMzmArApZv73PET0LgMv8N7s3OB5E9ei K2ft+nfXs5NCLRjPFCqL9nAeclj8ZX92B4d4mrpbqHZ+fFBiHMb0H/aGxfCAR0MJ BuW1dWQJykR2crhzQ1PJr3OthnL9O4Nl+bBAAuOu6NwqiALFW57uKXQ/2xfhPPbI qi0cTyXNYYY28kRdprERyV1w4K8W8V6L2YUt3N8LWuPNsI9pHSSQQDKru2JIR1T5 rHeC41JSR6iw8rBXtkCj1YhGbH5P8CP3fxlikuKo3Q4PHCjVJo8ZpzYU/Ci8FFCL g/g6DLb9/AHtIhJ8WgcRcxbRNkdyGUc2w9uh6c3rBVS4gwFm/44= =2pvu -----END PGP SIGNATURE----- Merge 5.10.188 into android12-5.10-lts Changes in 5.10.188 media: atomisp: fix "variable dereferenced before check 'asd'" x86/smp: Use dedicated cache-line for mwait_play_dead() can: isotp: isotp_sendmsg(): fix return error fix on TX path video: imsttfb: check for ioremap() failures fbdev: imsttfb: Fix use after free bug in imsttfb_probe HID: wacom: Use ktime_t rather than int when dealing with timestamps HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" scripts/tags.sh: Resolve gtags empty index generation drm/amdgpu: Validate VM ioctl flags. nubus: Partially revert proc_create_single_data() conversion fs: pipe: reveal missing function protoypes x86/resctrl: Only show tasks' pid in current pid namespace blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost md/raid10: check slab-out-of-bounds in md_bitmap_get_counter md/raid10: fix overflow of md/safe_mode_delay md/raid10: fix wrong setting of max_corr_read_errors md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request md/raid10: fix io loss while replacement replace rdev irqchip/jcore-aic: Kill use of irq_create_strict_mappings() irqchip/jcore-aic: Fix missing allocation of IRQ descriptors posix-timers: Prevent RT livelock in itimer_delete() tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe PM: domains: fix integer overflow issues in genpd_parse_state() perf/arm-cmn: Fix DTC reset powercap: RAPL: Fix CONFIG_IOSF_MBI dependency ARM: 9303/1: kprobes: avoid missing-declaration warnings cpufreq: intel_pstate: Fix energy_performance_preference for passive thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() rcuscale: Console output claims too few grace periods rcuscale: Always log error message rcuscale: Move shutdown from wait_event() to wait_event_idle() rcu/rcuscale: Move rcu_scale_() after kfree_scale_cleanup() rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale perf/ibs: Fix interface via core pmu events x86/mm: Fix __swp_entry_to_pte() for Xen PV guests evm: Complete description of evm_inode_setattr() ima: Fix build warnings pstore/ram: Add check for kstrdup igc: Enable and fix RX hash usage by netstack wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx samples/bpf: Fix buffer overflow in tcp_basertt spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG wifi: wilc1000: fix for absent RSN capabilities WFA testcase wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE sctp: add bpf_bypass_getsockopt proto callback libbpf: fix offsetof() and container_of() to work with CO-RE nfc: constify several pointers to u8, char and sk_buff nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() bpftool: JIT limited misreported as negative value on aarch64 regulator: core: Fix more error checking for debugfs_create_dir() regulator: core: Streamline debugfs operations wifi: orinoco: Fix an error handling path in spectrum_cs_probe() wifi: orinoco: Fix an error handling path in orinoco_cs_probe() wifi: atmel: Fix an error handling path in atmel_probe() wl3501_cs: Fix misspelling and provide missing documentation net: create netdev->dev_addr assignment helpers wl3501_cs: use eth_hw_addr_set() wifi: wl3501_cs: Fix an error handling path in wl3501_probe() wifi: ray_cs: Utilize strnlen() in parse_addr() wifi: ray_cs: Drop useless status variable in parse_addr() wifi: ray_cs: Fix an error handling path in ray_probe() wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config watchdog/perf: more properly prevent false positives with turbo modes kexec: fix a memory leak in crash_shrink_memory() memstick r592: make memstick_debug_get_tpc_name() static wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO wifi: iwlwifi: pull from TXQs with softirqs disabled wifi: cfg80211: rewrite merging of inherited elements wifi: ath9k: convert msecs to jiffies where needed igc: Fix race condition in PTP tx code net: stmmac: fix double serdes powerdown netlink: fix potential deadlock in netlink_set_err() netlink: do not hard code device address lenth in fdb dumps selftests: rtnetlink: remove netdevsim device after ipsec offload test gtp: Fix use-after-free in __gtp_encap_destroy(). net: axienet: Move reset before 64-bit DMA detection sfc: fix crash when reading stats while NIC is resetting nfc: llcp: simplify llcp_sock_connect() error paths net: nfc: Fix use-after-free caused by nfc_llcp_find_local lib/ts_bm: reset initial match offset for every block of text netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. ipvlan: Fix return value of ipvlan_queue_xmit() netlink: Add __sock_i_ino() for __netlink_diag_dump(). radeon: avoid double free in ci_dpm_init() drm/amd/display: Explicitly specify update type per plane info change Input: drv260x - sleep between polling GO bit drm/bridge: tc358768: always enable HS video mode drm/bridge: tc358768: fix PLL parameters computation drm/bridge: tc358768: fix PLL target frequency drm/bridge: tc358768: fix TCLK_ZEROCNT computation drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation drm/bridge: tc358768: fix TCLK_TRAILCNT computation drm/bridge: tc358768: fix THS_ZEROCNT computation drm/bridge: tc358768: fix TXTAGOCNT computation drm/bridge: tc358768: fix THS_TRAILCNT computation drm/vram-helper: fix function names in vram helper doc ARM: dts: BCM5301X: Drop "clock-names" from the SPI node ARM: dts: meson8b: correct uart_B and uart_C clock references Input: adxl34x - do not hardcode interrupt trigger type drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` drm/panel: sharp-ls043t1le01: adjust mode settings ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards bus: ti-sysc: Fix dispc quirk masking bool variables arm64: dts: microchip: sparx5: do not use PSCI on reference boards RDMA/bnxt_re: Disable/kill tasklet only if it is enabled RDMA/bnxt_re: Fix to remove unnecessary return labels RDMA/bnxt_re: Use unique names while registering interrupts RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid RDMA/bnxt_re: Fix to remove an unnecessary log ARM: dts: gta04: Move model property out of pinctrl node arm64: dts: qcom: msm8916: correct camss unit address arm64: dts: qcom: msm8994: correct SPMI unit address arm64: dts: qcom: msm8996: correct camss unit address drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H ARM: ep93xx: fix missing-prototype warnings ARM: omap2: fix missing tick_broadcast() prototype arm64: dts: qcom: apq8096: fix fixed regulator name property ARM: dts: stm32: Shorten the AV96 HDMI sound card name memory: brcmstb_dpfe: fix testing array offset after use ASoC: es8316: Increment max value for ALC Capture Target Volume control ASoC: es8316: Do not set rate constraints for unsupported MCLKs ARM: dts: meson8: correct uart_B and uart_C clock references soc/fsl/qe: fix usb.c build errors IB/hfi1: Use bitmap_zalloc() when applicable IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions RDMA/hns: Fix coding style issues RDMA/hns: Use refcount_t APIs for HEM RDMA/hns: Clean the hardware related code for HEM RDMA/hns: Fix hns_roce_table_get return value ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() arm64: dts: ti: k3-j7200: Fix physical address of pin ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx hwmon: (gsc-hwmon) fix fan pwm temperature scaling hwmon: (adm1275) enable adm1272 temperature reporting hwmon: (adm1275) Allow setting sample averaging hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 ARM: dts: BCM5301X: fix duplex-full => full-duplex drm/amdkfd: Fix potential deallocation of previously deallocated memory. drm/radeon: fix possible division-by-zero errors amdgpu: validate offset_in_bo of drm_amdgpu_gem_va RDMA/bnxt_re: wraparound mbox producer index RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() clk: tegra: tegra124-emc: Fix potential memory leak ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer drm/msm/dpu: do not enable color-management if DSPPs are not available drm/msm/dp: Free resources after unregistering them clk: vc5: check memory returned by kasprintf() clk: cdce925: check return value of kasprintf() clk: si5341: Allow different output VDD_SEL values clk: si5341: Add sysfs properties to allow checking/resetting device faults clk: si5341: return error if one synth clock registration fails clk: si5341: check return value of {devm_}kasprintf() clk: si5341: free unused memory on probe failure clk: keystone: sci-clk: check return value of kasprintf() clk: ti: clkctrl: check return value of kasprintf() drivers: meson: secure-pwrc: always enable DMA domain ovl: update of dentry revalidate flags after copy up ASoC: imx-audmix: check return value of devm_kasprintf() PCI: cadence: Fix Gen2 Link Retraining process scsi: qedf: Fix NULL dereference in error handling pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() PCI: pciehp: Cancel bringup sequence if card is not present PCI: ftpci100: Release the clock resources PCI: Add pci_clear_master() stub for non-CONFIG_PCI perf bench: Use unbuffered output when pipe/tee'ing to a file perf bench: Add missing setlocale() call to allow usage of %'d style formatting pinctrl: cherryview: Return correct value if pin in push-pull mode kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures perf script: Fixup 'struct evsel_script' method prefix perf script: Fix allocation of evsel->priv related to per-event dump files perf dwarf-aux: Fix off-by-one in die_get_varname() pinctrl: at91-pio4: check return value of devm_kasprintf() powerpc/powernv/sriov: perform null check on iov before dereferencing iov mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t * powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary hwrng: virtio - add an internal buffer hwrng: virtio - don't wait on cleanup hwrng: virtio - don't waste entropy hwrng: virtio - always add a pending request hwrng: virtio - Fix race on data_avail and actual data crypto: nx - fix build warnings when DEBUG_FS is not enabled modpost: fix section mismatch message for R_ARM_ABS32 modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} crypto: marvell/cesa - Fix type mismatch warning modpost: fix off by one in is_executable_section() ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION dax: Fix dax_mapping_release() use after free dax: Introduce alloc_dev_dax_id() hwrng: st - keep clock enabled while hwrng is registered io_uring: ensure IOPOLL locks around deferred work USB: serial: option: add LARA-R6 01B PIDs usb: dwc3: gadget: Propagate core init errors to UDC during pullup phy: tegra: xusb: Clear the driver reference in usb-phy dev block: fix signed int overflow in Amiga partition support block: change all __u32 annotations to __be32 in affs_hardblocks.h SUNRPC: Fix UAF in svc_tcp_listen_data_ready() w1: w1_therm: fix locking behavior in convert_t w1: fix loop in w1_fini() sh: j2: Use ioremap() to translate device tree address into kernel memory serial: 8250: omap: Fix freeing of resources on failed register clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks media: usb: Check az6007_read() return value media: videodev2.h: Fix struct v4l2_input tuner index comment media: usb: siano: Fix warning due to null work_func_t function pointer clk: qcom: reset: Allow specifying custom reset delay clk: qcom: reset: support resetting multiple bits clk: qcom: ipq6018: fix networking resets usb: dwc3: qcom: Fix potential memory leak usb: gadget: u_serial: Add null pointer check in gserial_suspend extcon: Fix kernel doc of property fields to avoid warnings extcon: Fix kernel doc of property capability fields to avoid warnings usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() usb: hide unused usbfs_notify_suspend/resume functions serial: 8250: lock port for stop_rx() in omap8250_irq() serial: 8250: lock port for UART_IER access in omap8250_irq() kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR coresight: Fix loss of connection info when a module is unloaded mfd: rt5033: Drop rt5033-battery sub-device media: venus: helpers: Fix ALIGN() of non power of two media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() usb: common: usb-conn-gpio: Set last role to unknown before initial detection usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() mfd: intel-lpss: Add missing check for platform_get_resource Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" serial: 8250_omap: Use force_suspend and resume for system suspend test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation mfd: stmfx: Fix error path in stmfx_chip_init mfd: stmfx: Nullify stmfx->vdd in case of error KVM: s390: vsie: fix the length of APCB bitmap mfd: stmpe: Only disable the regulators if they are enabled phy: tegra: xusb: check return value of devm_kzalloc() pwm: imx-tpm: force 'real_period' to be zero in suspend pwm: sysfs: Do not apply state to already disabled PWMs rtc: st-lpc: Release some resources in st_rtc_probe() in case of error media: cec: i2c: ch7322: also select REGMAP sctp: fix potential deadlock on &net->sctp.addr_wq_lock Add MODULE_FIRMWARE() for FIRMWARE_TG357766. net: dsa: vsc73xx: fix MTU configuration spi: bcm-qspi: return error if neither hif_mspi nor mspi is available mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 f2fs: fix error path handling in truncate_dnode() octeontx2-af: Fix mapping for NIX block from CGX connection powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode tcp: annotate data races in __tcp_oow_rate_limited() xsk: Honor SO_BINDTODEVICE on bind net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX pptp: Fix fib lookup calls. net: dsa: tag_sja1105: fix MAC DA patching from meta frames s390/qeth: Fix vipa deletion sh: dma: Fix DMA channel offset calculation apparmor: fix missing error check for rhashtable_insert_fast i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() i2c: xiic: Don't try to handle more interrupt events after error ALSA: jack: Fix mutex call in snd_jack_report() i2c: qup: Add missing unwind goto in qup_i2c_probe() NFSD: add encoding of op_recall flag for write delegation io_uring: wait interruptibly for request completions on exit mmc: core: disable TRIM on Kingston EMMC04G-M627 mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. bcache: fixup btree_cache_wait list damage bcache: Remove unnecessary NULL point check in node allocations bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent um: Use HOST_DIR for mrproper integrity: Fix possible multiple allocation in integrity_inode_get() autofs: use flexible array in ioctl structure shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs jffs2: reduce stack usage in jffs2_build_xattr_subsystem() fs: avoid empty option when generating legacy mount string ext4: Remove ext4 locking of moved directory Revert "f2fs: fix potential corruption when moving a directory" fs: Establish locking order for unrelated directories fs: Lock moved directories btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile btrfs: fix race when deleting quota root from the dirty cow roots list ASoC: mediatek: mt8173: Fix irq error path ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path ARM: orion5x: fix d2net gpio initialization leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename fs: no need to check source fanotify: disallow mount/sb marks on kernel internal pseudo fs tpm, tpm_tis: Claim locality in interrupt handler selftests/bpf: Add verifier test for PTR_TO_MEM spill block: add overflow checks for Amiga partition support sh: pgtable-3level: Fix cast to pointer from integer of different size netfilter: nf_tables: use net_generic infra for transaction data netfilter: nf_tables: add rescheduling points during loop detection walks netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE netfilter: nf_tables: fix chain binding transaction logic netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain netfilter: nf_tables: reject unbound anonymous set before commit phase netfilter: nf_tables: reject unbound chain set before commit phase netfilter: nftables: rename set element data activation/deactivation functions netfilter: nf_tables: drop map element references from preparation phase netfilter: nf_tables: unbind non-anonymous set if rule construction fails netfilter: nf_tables: fix scheduling-while-atomic splat netfilter: conntrack: Avoid nf_ct_helper_hash uses after free netfilter: nf_tables: do not ignore genmask when looking up chain by id netfilter: nf_tables: prevent OOB access in nft_byteorder_eval wireguard: queueing: use saner cpu selection wrapping wireguard: netlink: send staged packets when setting initial private key tty: serial: fsl_lpuart: add earlycon for imx8ulp platform rcu-tasks: Mark ->trc_reader_nesting data races rcu-tasks: Mark ->trc_reader_special.b.need_qs data races rcu-tasks: Simplify trc_read_check_handler() atomic operations block/partition: fix signedness issue for Amiga partitions io_uring: Use io_schedule* in cqring wait io_uring: add reschedule point to handle_tw_list() net: lan743x: Don't sleep in atomic context workqueue: clean up WORK_* constant types, clarify masking drm/panel: simple: Add connector_type for innolux_at043tn24 drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags igc: Remove delay during TX ring configuration net/mlx5e: fix double free in mlx5e_destroy_flow_table net/mlx5e: Check for NOT_READY flag state after locking igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings scsi: qla2xxx: Fix error code in qla2x00_start_sp() net: mvneta: fix txq_map in case of txq_number==1 net/sched: cls_fw: Fix improper refcount update leads to use-after-free gve: Set default duplex configuration to full ionic: remove WARN_ON to prevent panic_on_warn net: bgmac: postpone turning IRQs off to avoid SoC hangs net: prevent skb corruption on frag list segmentation icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). udp6: fix udp6_ehashfn() typo ntb: idt: Fix error handling in idt_pci_driver_init() NTB: amd: Fix error handling in amd_ntb_pci_driver_init() ntb: intel: Fix error handling in intel_ntb_pci_driver_init() NTB: ntb_transport: fix possible memory leak while device_register() fails NTB: ntb_tool: Add check for devm_kcalloc ipv6/addrconf: fix a potential refcount underflow for idev platform/x86: wmi: remove unnecessary argument platform/x86: wmi: use guid_t and guid_equal() platform/x86: wmi: move variables platform/x86: wmi: Break possible infinite loop when parsing GUID igc: Fix launchtime before start of cycle igc: Fix inserting of empty frame for launchtime riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core riscv: bpf: Avoid breaking W^X bpf, riscv: Support riscv jit to provide bpf_line_info riscv, bpf: Fix inconsistent JIT image generation erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF wifi: airo: avoid uninitialized warning in airo_get_rate() net/sched: flower: Ensure both minimum and maximum ports are specified netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() net/sched: make psched_mtu() RTNL-less safe net/sched: sch_qfq: refactor parsing of netlink parameters net/sched: sch_qfq: account for stab overhead in qfq_enqueue nvme-pci: fix DMA direction of unmapping integrity data f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() pinctrl: amd: Fix mistake in handling clearing pins at startup pinctrl: amd: Detect internal GPIO0 debounce handling pinctrl: amd: Only use special debounce behavior for GPIO 0 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation mtd: rawnand: meson: fix unaligned DMA buffers handling net: bcmgenet: Ensure MDIO unregistration has clocks enabled powerpc: Fail build if using recordmcount with binutils v2.37 misc: fastrpc: Create fastrpc scalar with correct buffer count erofs: fix compact 4B support for 16k block size MIPS: Loongson: Fix cpu_probe_loongson() again ext4: Fix reusing stale buffer heads from last failed mounting ext4: fix wrong unit use in ext4_mb_clear_bb ext4: get block from bh in ext4_free_blocks for fast commit replay ext4: fix wrong unit use in ext4_mb_new_blocks ext4: only update i_reserved_data_blocks on successful block allocation jfs: jfs_dmap: Validate db_l2nbperpage while mounting hwrng: imx-rngc - fix the timeout for init and self check PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 PCI: qcom: Disable write access to read only registers for IP v2.3.3 PCI: rockchip: Assert PCI Configuration Enable bit after probe PCI: rockchip: Write PCI Device ID to correct register PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core PCI: rockchip: Use u32 variable to access 32-bit registers PCI: rockchip: Set address alignment for endpoint mode misc: pci_endpoint_test: Free IRQs before removing the device misc: pci_endpoint_test: Re-init completion for every test md/raid0: add discard support for the 'original' layout fs: dlm: return positive pid value for F_GETLK drm/atomic: Allow vblank-enabled + self-refresh "disable" drm/rockchip: vop: Leave vblank enabled in self-refresh drm/amd/display: Correct `DMUB_FW_VERSION` macro serial: atmel: don't enable IRQs prematurely tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() ceph: don't let check_caps skip sending responses for revoke msgs xhci: Fix resume issue of some ZHAOXIN hosts xhci: Fix TRB prefetch issue of ZHAOXIN hosts xhci: Show ZHAOXIN xHCI root hub speed correctly meson saradc: fix clock divider mask length Revert "8250: add support for ASIX devices with a FIFO bug" s390/decompressor: fix misaligned symbol build error tracing/histograms: Add histograms to hist_vars if they have referenced variables samples: ftrace: Save required argument registers in sample trampolines net: ena: fix shift-out-of-bounds in exponential backoff ring-buffer: Fix deadloop issue on reading trace_pipe xtensa: ISS: fix call to split_if_spec tracing: Fix null pointer dereference in tracing_err_log_open() tracing/probes: Fix not to count error code to total length scsi: qla2xxx: Wait for io return on terminate rport scsi: qla2xxx: Array index may go out of bound scsi: qla2xxx: Fix buffer overrun scsi: qla2xxx: Fix potential NULL pointer dereference scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() scsi: qla2xxx: Correct the index of array scsi: qla2xxx: Pointer may be dereferenced scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue net/sched: sch_qfq: reintroduce lmax bound check for MTU RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests drm/atomic: Fix potential use-after-free in nonblocking commits ALSA: hda/realtek - remove 3k pull low procedure ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx keys: Fix linking a duplicate key to a keyring's assoc_array perf probe: Add test for regression introduced by switch to die_get_decl_file() btrfs: fix warning when putting transaction with qgroups enabled after abort fuse: revalidate: don't invalidate if interrupted selftests: tc: set timeout to 15 minutes selftests: tc: add 'ct' action kconfig dep regmap: Drop initial version of maximum transfer length fixes regmap: Account for register length in SMBus I/O limits can: bcm: Fix UAF in bcm_proc_show() drm/client: Fix memory leak in drm_client_target_cloned drm/client: Fix memory leak in drm_client_modeset_probe ASoC: fsl_sai: Disable bit clock with transmitter ext4: correct inline offset when handling xattrs in inode body debugobjects: Recheck debug_objects_enabled before reporting nbd: Add the maximum limit of allocated index in nbd_dev_add md: fix data corruption for raid456 when reshape restart while grow up md/raid10: prevent soft lockup while flush writes posix-timers: Ensure timer ID search-loop limit is valid btrfs: add xxhash to fast checksum implementations ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) arm64: set __exception_irq_entry with __irq_entry as a default arm64: mm: fix VA-range sanity check sched/fair: Don't balance task to its current running CPU wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range bpf: Address KCSAN report on bpf_lru_list devlink: report devlink_port_type_warn source device wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() wifi: iwlwifi: mvm: avoid baid size integer overflow igb: Fix igb_down hung on surprise removal spi: bcm63xx: fix max prepend length fbdev: imxfb: warn about invalid left/right margin pinctrl: amd: Use amd_pinconf_set() for all config options net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() bridge: Add extack warning when enabling STP in netns. iavf: Fix use-after-free in free_netdev iavf: Fix out-of-bounds when setting channels on remove security: keys: Modify mismatched function name octeontx2-pf: Dont allocate BPIDs for LBK interfaces tcp: annotate data-races around tcp_rsk(req)->ts_recent net: ipv4: Use kfree_sensitive instead of kfree net:ipv6: check return value of pskb_trim() Revert "tcp: avoid the lookup process failing to get sk in ehash table" fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe llc: Don't drop packet from non-root netns. netfilter: nf_tables: fix spurious set element insertion failure netfilter: nf_tables: can't schedule in nft_chain_validate netfilter: nft_set_pipapo: fix improper element removal netfilter: nf_tables: skip bound chain in netns release path netfilter: nf_tables: skip bound chain on rule flush tcp: annotate data-races around tp->tcp_tx_delay tcp: annotate data-races around tp->keepalive_time tcp: annotate data-races around tp->keepalive_intvl tcp: annotate data-races around tp->keepalive_probes net: Introduce net.ipv4.tcp_migrate_req. tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries. tcp: annotate data-races around icsk->icsk_syn_retries tcp: annotate data-races around tp->linger2 tcp: annotate data-races around rskq_defer_accept tcp: annotate data-races around tp->notsent_lowat tcp: annotate data-races around icsk->icsk_user_timeout tcp: annotate data-races around fastopenq.max_qlen net: phy: prevent stale pointer dereference in phy_init() tracing/histograms: Return an error if we fail to add histogram to hist_vars list tracing: Fix memory leak of iter->temp when reading trace_pipe ftrace: Store the order of pages allocated in ftrace_page ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() Linux 5.10.188 Change-Id: Ibcc1adc43df5b8f649b12078eedd5d4f57de4578 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-03 11:23:27 +00:00
David Sterba	ae51eb90bc	btrfs: add xxhash to fast checksum implementations [ Upstream commit efcfcbc6a36195c42d98e0ee697baba36da94dc8 ] The implementation of XXHASH is now CPU only but still fast enough to be considered for the synchronous checksumming, like non-generic crc32c. A userspace benchmark comparing it to various implementations (patched hash-speedtest from btrfs-progs): Block size: 4096 Iterations: 1000000 Implementation: builtin Units: CPU cycles NULL-NOP: cycles: 73384294, cycles/i 73 NULL-MEMCPY: cycles: 228033868, cycles/i 228, 61664.320 MiB/s CRC32C-ref: cycles: 24758559416, cycles/i 24758, 567.950 MiB/s CRC32C-NI: cycles: 1194350470, cycles/i 1194, 11773.433 MiB/s CRC32C-ADLERSW: cycles: 6150186216, cycles/i 6150, 2286.372 MiB/s CRC32C-ADLERHW: cycles: 626979180, cycles/i 626, 22427.453 MiB/s CRC32C-PCL: cycles: 466746732, cycles/i 466, 30126.699 MiB/s XXHASH: cycles: 860656400, cycles/i 860, 16338.188 MiB/s Comparing purely software implementation (ref), current outdated accelerated using crc32q instruction (NI), optimized implementations by M. Adler (https://stackoverflow.com/questions/17645167/implementing-sse-4-2s-crc32c-in-software/17646775#17646775) and the best one that was taken from kernel using the PCLMULQDQ instruction (PCL). Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:44:37 +02:00
Eric Whitney	5d5aa5b648	ext4: correct inline offset when handling xattrs in inode body commit 6909cf5c4101214f4305a62d582a5b93c7e1eb9a upstream. When run on a file system where the inline_data feature has been enabled, xfstests generic/269, generic/270, and generic/476 cause ext4 to emit error messages indicating that inline directory entries are corrupted. This occurs because the inline offset used to locate inline directory entries in the inode body is not updated when an xattr in that shared region is deleted and the region is shifted in memory to recover the space it occupied. If the deleted xattr precedes the system.data attribute, which points to the inline directory entries, that attribute will be moved further up in the region. The inline offset continues to point to whatever is located in system.data's former location, with unfortunate effects when used to access directory entries or (presumably) inline data in the inode body. Cc: stable@kernel.org Signed-off-by: Eric Whitney <enwlinux@gmail.com> Link: https://lore.kernel.org/r/20230522181520.1570360-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:36 +02:00
Miklos Szeredi	dad97c205a	fuse: revalidate: don't invalidate if interrupted commit a9d1c4c6df0e568207907c04aed9e7beb1294c42 upstream. If the LOOKUP request triggered from fuse_dentry_revalidate() is interrupted, then the dentry will be invalidated, possibly resulting in submounts being unmounted. Reported-by: Xu Rongbo <xurongbo@baidu.com> Closes: https://lore.kernel.org/all/CAJfpegswN_CJJ6C3RZiaK6rpFmNyWmXfaEpnQUJ42KCwNF5tWw@mail.gmail.com/ Fixes: `9e6268db49` ("[PATCH] FUSE - read-write operations") Cc: <stable@vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:34 +02:00
Filipe Manana	d2c667cc18	btrfs: fix warning when putting transaction with qgroups enabled after abort commit aa84ce8a78a1a5c10cdf9c7a5fb0c999fbc2c8d6 upstream. If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the transaction, like this: [552.6789] ------------[ cut here ]------------ [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs] [552.6817] Modules linked in: btrfs blake2b_generic xor (...) [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs] [552.6821] Code: bd a0 01 00 (...) [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286 [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000 [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010 [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20 [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70 [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028 [552.6821] FS: 0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000 [552.6821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0 [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [552.6822] Call Trace: [552.6822] <TASK> [552.6822] ? __warn+0x80/0x130 [552.6822] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6824] ? report_bug+0x1f4/0x200 [552.6824] ? handle_bug+0x42/0x70 [552.6824] ? exc_invalid_op+0x14/0x70 [552.6824] ? asm_exc_invalid_op+0x16/0x20 [552.6824] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6826] btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs] [552.6828] ? _raw_spin_unlock_irqrestore+0x23/0x40 [552.6828] ? try_to_wake_up+0x94/0x5e0 [552.6828] ? __pfx_process_timeout+0x10/0x10 [552.6828] transaction_kthread+0x103/0x1d0 [btrfs] [552.6830] ? __pfx_transaction_kthread+0x10/0x10 [btrfs] [552.6832] kthread+0xee/0x120 [552.6832] ? __pfx_kthread+0x10/0x10 [552.6832] ret_from_fork+0x29/0x50 [552.6832] </TASK> [552.6832] ---[ end trace 0000000000000000 ]--- This corresponds to this line of code: void btrfs_put_transaction(struct btrfs_transaction *transaction) { (...) WARN_ON(!RB_EMPTY_ROOT( &transaction->delayed_refs.dirty_extent_root)); (...) } The warning happens because btrfs_qgroup_destroy_extent_records(), called in the transaction abort path, we free all entries from the rbtree "dirty_extent_root" with rbtree_postorder_for_each_entry_safe(), but we don't actually empty the rbtree - it's still pointing to nodes that were freed. So set the rbtree's root node to NULL to avoid this warning (assign RB_ROOT). Fixes: `81f7eb00ff` ("btrfs: destroy qgroup extent records on transaction abort") CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Qu Wenruo <wqu@suse.com> Signed-off-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:34 +02:00
Xiubo Li	8e807eadf0	ceph: don't let check_caps skip sending responses for revoke msgs commit 257e6172ab36ebbe295a6c9ee9a9dd0fe54c1dc2 upstream. If a client sends out a cap update dropping caps with the prior 'seq' just before an incoming cap revoke request, then the client may drop the revoke because it believes it's already released the requested capabilities. This causes the MDS to wait indefinitely for the client to respond to the revoke. It's therefore always a good idea to ack the cap revoke request with the bumped up 'seq'. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/61782 Signed-off-by: Xiubo Li <xiubli@redhat.com> Reviewed-by: Milind Changire <mchangir@redhat.com> Reviewed-by: Patrick Donnelly <pdonnell@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:30 +02:00
Alexander Aring	23d5004ee7	fs: dlm: return positive pid value for F_GETLK commit 92655fbda5c05950a411eaabc19e025e86e2a291 upstream. The GETLK pid values have all been negated since commit `9d5b86ac13` ("fs/locks: Remove fl_nspid and use fs-specific l_pid for remote locks"). Revert this for local pids, and leave in place negative pids for remote owners. Cc: stable@vger.kernel.org Fixes: `9d5b86ac13` ("fs/locks: Remove fl_nspid and use fs-specific l_pid for remote locks") Signed-off-by: Alexander Aring <aahringo@redhat.com> Signed-off-by: David Teigland <teigland@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:29 +02:00
Siddh Raman Pant	47b7eaae08	jfs: jfs_dmap: Validate db_l2nbperpage while mounting commit 11509910c599cbd04585ec35a6d5e1a0053d84c1 upstream. In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE Reported-and-tested-by: syzbot+d2cd27dcf8e04b232eb2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=2a70a453331db32ed491f5cbb07e81bf2d225715 Cc: stable@vger.kernel.org Suggested-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Siddh Raman Pant <code@siddh.me> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:27 +02:00
Baokun Li	84293af545	ext4: only update i_reserved_data_blocks on successful block allocation commit de25d6e9610a8b30cce9bbb19b50615d02ebca02 upstream. In our fault injection test, we create an ext4 file, migrate it to non-extent based file, then punch a hole and finally trigger a WARN_ON in the ext4_da_update_reserve_space(): EXT4-fs warning (device sda): ext4_da_update_reserve_space:369: ino 14, used 11 with only 10 reserved data blocks When writing back a non-extent based file, if we enable delalloc, the number of reserved blocks will be subtracted from the number of blocks mapped by ext4_ind_map_blocks(), and the extent status tree will be updated. We update the extent status tree by first removing the old extent_status and then inserting the new extent_status. If the block range we remove happens to be in an extent, then we need to allocate another extent_status with ext4_es_alloc_extent(). use old to remove to add new \|----------\|------------\|------------\| old extent_status The problem is that the allocation of a new extent_status failed due to a fault injection, and __es_shrink() did not get free memory, resulting in a return of -ENOMEM. Then do_writepages() retries after receiving -ENOMEM, we map to the same extent again, and the number of reserved blocks is again subtracted from the number of blocks in that extent. Since the blocks in the same extent are subtracted twice, we end up triggering WARN_ON at ext4_da_update_reserve_space() because used > ei->i_reserved_data_blocks. For non-extent based file, we update the number of reserved blocks after ext4_ind_map_blocks() is executed, which causes a problem that when we call ext4_ind_map_blocks() to create a block, it doesn't always create a block, but we always reduce the number of reserved blocks. So we move the logic for updating reserved blocks to ext4_ind_map_blocks() to ensure that the number of reserved blocks is updated only after we do succeed in allocating some new blocks. Fixes: `5f634d064c` ("ext4: Fix quota accounting error with fallocate") Cc: stable@kernel.org Signed-off-by: Baokun Li <libaokun1@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230424033846.4732-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:27 +02:00
Kemeng Shi	0a5d12e710	ext4: fix wrong unit use in ext4_mb_new_blocks commit 2ec6d0a5ea72689a79e6f725fd8b443a788ae279 upstream. Function ext4_free_blocks_simple needs count in cluster. Function ext4_free_blocks accepts count in block. Convert count to cluster to fix the mismatch. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Link: https://lore.kernel.org/r/20230603150327.3596033-12-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:27 +02:00
Kemeng Shi	514220246a	ext4: get block from bh in ext4_free_blocks for fast commit replay commit 11b6890be0084ad4df0e06d89a9fdcc948472c65 upstream. ext4_free_blocks will retrieve block from bh if block parameter is zero. Retrieve block before ext4_free_blocks_simple to avoid potentially passing wrong block to ext4_free_blocks_simple. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Link: https://lore.kernel.org/r/20230603150327.3596033-9-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:26 +02:00
Kemeng Shi	d054422eb6	ext4: fix wrong unit use in ext4_mb_clear_bb commit 247c3d214c23dfeeeb892e91a82ac1188bdaec9f upstream. Function ext4_issue_discard need count in cluster. Pass count_clusters instead of count to fix the mismatch. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Link: https://lore.kernel.org/r/20230603150327.3596033-11-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:26 +02:00
Zhihao Cheng	be99faf0c4	ext4: Fix reusing stale buffer heads from last failed mounting commit 26fb5290240dc31cae99b8b4dd2af7f46dfcba6b upstream. Following process makes ext4 load stale buffer heads from last failed mounting in a new mounting operation: mount_bdev ext4_fill_super \| ext4_load_and_init_journal \| ext4_load_journal \| jbd2_journal_load \| load_superblock \| journal_get_superblock \| set_buffer_verified(bh) // buffer head is verified \| jbd2_journal_recover // failed caused by EIO \| goto failed_mount3a // skip 'sb->s_root' initialization deactivate_locked_super kill_block_super generic_shutdown_super if (sb->s_root) // false, skip ext4_put_super->invalidate_bdev-> // invalidate_mapping_pages->mapping_evict_folio-> // filemap_release_folio->try_to_free_buffers, which // cannot drop buffer head. blkdev_put blkdev_put_whole if (atomic_dec_and_test(&bdev->bd_openers)) // false, systemd-udev happens to open the device. Then // blkdev_flush_mapping->kill_bdev->truncate_inode_pages-> // truncate_inode_folio->truncate_cleanup_folio-> // folio_invalidate->block_invalidate_folio-> // filemap_release_folio->try_to_free_buffers will be skipped, // dropping buffer head is missed again. Second mount: ext4_fill_super ext4_load_and_init_journal ext4_load_journal ext4_get_journal jbd2_journal_init_inode journal_init_common bh = getblk_unmovable bh = __find_get_block // Found stale bh in last failed mounting journal->j_sb_buffer = bh jbd2_journal_load load_superblock journal_get_superblock if (buffer_verified(bh)) // true, skip journal->j_format_version = 2, value is 0 jbd2_journal_recover do_one_pass next_log_block += count_tags(journal, bh) // According to journal_tag_bytes(), 'tag_bytes' calculating is // affected by jbd2_has_feature_csum3(), jbd2_has_feature_csum3() // returns false because 'j->j_format_version >= 2' is not true, // then we get wrong next_log_block. The do_one_pass may exit // early whenoccuring non JBD2_MAGIC_NUMBER in 'next_log_block'. The filesystem is corrupted here, journal is partially replayed, and new journal sequence number actually is already used by last mounting. The invalidate_bdev() can drop all buffer heads even racing with bare reading block device(eg. systemd-udev), so we can fix it by invalidating bdev in error handling path in __ext4_fill_super(). Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217171 Fixes: `25ed6e8a54` ("jbd2: enable journal clients to enable v2 checksumming") Cc: stable@vger.kernel.org # v3.5 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230315013128.3911115-2-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:26 +02:00
Gao Xiang	8c723eef98	erofs: fix compact 4B support for 16k block size commit 001b8ccd0650727e54ec16ef72bf1b8eeab7168e upstream. In compact 4B, two adjacent lclusters are packed together as a unit to form on-disk indexes for effective random access, as below: (amortized = 4, vcnt = 2) _____________________________________________ \|___@_____ encoded bits __________\|_ blkaddr _\| 0 . amortized * vcnt = 8 . . . . amortized * vcnt - 4 = 4 . . .____________________________. \|_type (2 bits)_\|_clusterofs_\| Therefore, encoded bits for each pack are 32 bits (4 bytes). IOWs, since each lcluster can get 16 bits for its type and clusterofs, the maximum supported lclustersize for compact 4B format is 16k (14 bits). Fix this to enable compact 4B format for 16k lclusters (blocks), which is tested on an arm64 server with 16k page size. Fixes: `152a333a58` ("staging: erofs: add compacted compression indexes support") Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Link: https://lore.kernel.org/r/20230601112341.56960-1-hsiangkao@linux.alibaba.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:26 +02:00
Chao Yu	b39ef5b52f	f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() commit d8189834d4348ae608083e1f1f53792cfcc2a9bc upstream. butt3rflyh4ck reports a bug as below: When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is failed, f2fs kernel thread would invoke callback function to update f2fs io info, it would call f2fs_write_end_io and may trigger null-ptr-deref in NODE_MAPPING. general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline] RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370 <TASK> bio_endio+0x5af/0x6c0 block/bio.c:1608 req_bio_endio block/blk-mq.c:761 [inline] blk_update_request+0x5cc/0x1690 block/blk-mq.c:906 blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023 lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101 __do_softirq+0x1d4/0x8ef kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:939 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:931 smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 kthread+0x33e/0x440 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The root cause is below race case can cause leaving dirty metadata in f2fs after filesystem is remount as ro: Thread A Thread B - f2fs_ioc_resize_fs - f2fs_readonly --- return false - f2fs_resize_fs - f2fs_remount - write_checkpoint - set f2fs as ro - free_segment_range - update meta_inode's data Then, if f2fs_put_super() fails to write_checkpoint due to readonly status, and meta_inode's dirty data will be writebacked after node_inode is put, finally, f2fs_write_end_io will access NULL pointer on sbi->node_inode. Thread A IRQ context - f2fs_put_super - write_checkpoint fails - iput(node_inode) - node_inode = NULL - iput(meta_inode) - write_inode_now - f2fs_write_meta_page - f2fs_write_end_io - NODE_MAPPING(sbi) : access NULL pointer on node_inode Fixes: `b4b10061ef` ("f2fs: refactor resize_fs to avoid meta updates in progress") Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:25 +02:00
Chunhai Guo	4511499138	erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF [ Upstream commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 ] z_erofs_do_read_page() may loop infinitely due to the inappropriate truncation in the below statement. Since the offset is 64 bits and min_t() truncates the result to 32 bits. The solution is to replace unsigned int with a 64-bit type, such as erofs_off_t. cur = end - min_t(unsigned int, offset + end - map->m_la, end); - For example: - offset = 0x400160000 - end = 0x370 - map->m_la = 0x160370 - offset + end - map->m_la = 0x400000000 - offset + end - map->m_la = 0x00000000 (truncated as unsigned int) - Expected result: - cur = 0 - Actual result: - cur = 0x370 Signed-off-by: Chunhai Guo <guochunhai@vivo.com> Fixes: `3883a79abd` ("staging: erofs: introduce VLE decompression support") Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Reviewed-by: Chao Yu <chao@kernel.org> Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:44:23 +02:00
Amir Goldstein	5bf73af8b3	fanotify: disallow mount/sb marks on kernel internal pseudo fs commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c upstream. Hopefully, nobody is trying to abuse mount/sb marks for watching all anonymous pipes/inodes. I cannot think of a good reason to allow this - it looks like an oversight that dated back to the original fanotify API. Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/ Fixes: `0ff21db9fc` ("fanotify: hooks the fanotify_mark syscall to the vfsmount code") Signed-off-by: Amir Goldstein <amir73il@gmail.com> Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20230629042044.25723-1-amir73il@gmail.com> [backport to 5.x.y] Signed-off-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:15 +02:00
Jan Kara	5cb46b80ec	fs: no need to check source commit 66d8fc0539b0d49941f313c9509a8384e4245ac1 upstream. The @source inode must be valid. It is even checked via IS_SWAPFILE() above making it pretty clear. So no need to check it when we unlock. What doesn't need to exist is the @target inode. The lock_two_inodes() helper currently swaps the @inode1 and @inode2 arguments if @inode1 is NULL to have consistent lock class usage. However, we know that at least for vfs_rename() that @inode1 is @source and thus is never NULL as per above. We also know that @source is a different inode than @target as that is checked right at the beginning of vfs_rename(). So we know that @source is valid and locked and that @target is locked. So drop the check whether @source is non-NULL. Fixes: 28eceeda130f ("fs: Lock moved directories") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202307030026.9sE2pk2x-lkp@intel.com Message-Id: <20230703-vfs-rename-source-v1-1-37eebb29b65b@kernel.org> [brauner: use commit message from patch I sent concurrently] Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:14 +02:00
Filipe Manana	6819bb0b85	btrfs: fix race when deleting quota root from the dirty cow roots list commit b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 upstream. When disabling quotas we are deleting the quota root from the list fs_info->dirty_cowonly_roots without taking the lock that protects it, which is struct btrfs_fs_info::trans_lock. This unsynchronized list manipulation may cause chaos if there's another concurrent manipulation of this list, such as when adding a root to it with ctree.c:add_root_to_dirty_list(). This can result in all sorts of weird failures caused by a race, such as the following crash: [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs] [337571.279928] Code: 85 38 06 00 (...) [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206 [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000 [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070 [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600 [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48 [337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000 [337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0 [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [337571.282874] Call Trace: [337571.283101] <TASK> [337571.283327] ? __die_body+0x1b/0x60 [337571.283570] ? die_addr+0x39/0x60 [337571.283796] ? exc_general_protection+0x22e/0x430 [337571.284022] ? asm_exc_general_protection+0x22/0x30 [337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs] [337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs] [337571.284803] ? _raw_spin_unlock+0x15/0x30 [337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs] [337571.285305] reset_balance_state+0x152/0x1b0 [btrfs] [337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs] [337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410 [337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs] [337571.286358] ? mod_objcg_state+0xd2/0x360 [337571.286577] ? refill_obj_stock+0xb0/0x160 [337571.286798] ? seq_release+0x25/0x30 [337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0 [337571.287235] ? percpu_counter_add_batch+0x2e/0xa0 [337571.287455] ? __x64_sys_ioctl+0x88/0xc0 [337571.287675] __x64_sys_ioctl+0x88/0xc0 [337571.287901] do_syscall_64+0x38/0x90 [337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc [337571.288352] RIP: 0033:0x7f478aaffe9b So fix this by locking struct btrfs_fs_info::trans_lock before deleting the quota root from that list. Fixes: `bed92eae26` ("Btrfs: qgroup implementation and prototypes") CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:14 +02:00
Matt Corallo	a3fbd156bd	btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile commit 160fe8f6fdb13da6111677be6263e5d65e875987 upstream. Callers of `btrfs_reduce_alloc_profile` expect it to return exactly one allocation profile flag, and failing to do so may ultimately result in a WARN_ON and remount-ro when allocating new blocks, like the below transaction abort on 6.1. `btrfs_reduce_alloc_profile` has two ways of determining the profile, first it checks if a conversion balance is currently running and uses the profile we're converting to. If no balance is currently running, it returns the max-redundancy profile which at least one block in the selected block group has. This works by simply checking each known allocation profile bit in redundancy order. However, `btrfs_reduce_alloc_profile` has not been updated as new flags have been added - first with the `DUP` profile and later with the RAID1C34 profiles. Because of the way it checks, if we have blocks with different profiles and at least one is known, that profile will be selected. However, if none are known we may return a flag set with multiple allocation profiles set. This is currently only possible when a balance from one of the three unhandled profiles to another of the unhandled profiles is canceled after allocating at least one block using the new profile. In that case, a transaction abort like the below will occur and the filesystem will need to be mounted with -o skip_balance to get it mounted rw again (but the balance cannot be resumed without a similar abort). [770.648] ------------[ cut here ]------------ [770.648] BTRFS: Transaction aborted (error -22) [770.648] WARNING: CPU: 43 PID: 1159593 at fs/btrfs/extent-tree.c:4122 find_free_extent+0x1d94/0x1e00 [btrfs] [770.648] CPU: 43 PID: 1159593 Comm: btrfs Tainted: G W 6.1.0-0.deb11.7-powerpc64le #1 Debian 6.1.20-2~bpo11+1a~test [770.648] Hardware name: T2P9D01 REV 1.00 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV [770.648] NIP: c00800000f6784fc LR: c00800000f6784f8 CTR: c000000000d746c0 [770.648] REGS: c000200089afe9a0 TRAP: 0700 Tainted: G W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test) [770.648] MSR: 9000000002029033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE> CR: 28848282 XER: 20040000 [770.648] CFAR: c000000000135110 IRQMASK: 0 GPR00: c00800000f6784f8 c000200089afec40 c00800000f7ea800 0000000000000026 GPR04: 00000001004820c2 c000200089afea00 c000200089afe9f8 0000000000000027 GPR08: c000200ffbfe7f98 c000000002127f90 ffffffffffffffd8 0000000026d6a6e8 GPR12: 0000000028848282 c000200fff7f3800 5deadbeef0000122 c00000002269d000 GPR16: c0002008c7797c40 c000200089afef17 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000001 c000200008bc5a98 0000000000000001 GPR24: 0000000000000000 c0000003c73088d0 c000200089afef17 c000000016d3a800 GPR28: c0000003c7308800 c00000002269d000 ffffffffffffffea 0000000000000001 [770.648] NIP [c00800000f6784fc] find_free_extent+0x1d94/0x1e00 [btrfs] [770.648] LR [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs] [770.648] Call Trace: [770.648] [c000200089afec40] [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs] (unreliable) [770.648] [c000200089afed30] [c00800000f681398] btrfs_reserve_extent+0x1a0/0x2f0 [btrfs] [770.648] [c000200089afeea0] [c00800000f681bf0] btrfs_alloc_tree_block+0x108/0x670 [btrfs] [770.648] [c000200089afeff0] [c00800000f66bd68] __btrfs_cow_block+0x170/0x850 [btrfs] [770.648] [c000200089aff100] [c00800000f66c58c] btrfs_cow_block+0x144/0x288 [btrfs] [770.648] [c000200089aff1b0] [c00800000f67113c] btrfs_search_slot+0x6b4/0xcb0 [btrfs] [770.648] [c000200089aff2a0] [c00800000f679f60] lookup_inline_extent_backref+0x128/0x7c0 [btrfs] [770.648] [c000200089aff3b0] [c00800000f67b338] lookup_extent_backref+0x70/0x190 [btrfs] [770.648] [c000200089aff470] [c00800000f67b54c] __btrfs_free_extent+0xf4/0x1490 [btrfs] [770.648] [c000200089aff5a0] [c00800000f67d770] __btrfs_run_delayed_refs+0x328/0x1530 [btrfs] [770.648] [c000200089aff740] [c00800000f67ea2c] btrfs_run_delayed_refs+0xb4/0x3e0 [btrfs] [770.648] [c000200089aff800] [c00800000f699aa4] btrfs_commit_transaction+0x8c/0x12b0 [btrfs] [770.648] [c000200089aff8f0] [c00800000f6dc628] reset_balance_state+0x1c0/0x290 [btrfs] [770.648] [c000200089aff9a0] [c00800000f6e2f7c] btrfs_balance+0x1164/0x1500 [btrfs] [770.648] [c000200089affb40] [c00800000f6f8e4c] btrfs_ioctl+0x2b54/0x3100 [btrfs] [770.648] [c000200089affc80] [c00000000053be14] sys_ioctl+0x794/0x1310 [770.648] [c000200089affd70] [c00000000002af98] system_call_exception+0x138/0x250 [770.648] [c000200089affe10] [c00000000000c654] system_call_common+0xf4/0x258 [770.648] --- interrupt: c00 at 0x7fff94126800 [770.648] NIP: 00007fff94126800 LR: 0000000107e0b594 CTR: 0000000000000000 [770.648] REGS: c000200089affe80 TRAP: 0c00 Tainted: G W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test) [770.648] MSR: 900000000000d033 <SF,HV,EE,PR,ME,IR,DR,RI,LE> CR: 24002848 XER: 00000000 [770.648] IRQMASK: 0 GPR00: 0000000000000036 00007fffc9439da0 00007fff94217100 0000000000000003 GPR04: 00000000c4009420 00007fffc9439ee8 0000000000000000 0000000000000000 GPR08: 00000000803c7416 0000000000000000 0000000000000000 0000000000000000 GPR12: 0000000000000000 00007fff9467d120 0000000107e64c9c 0000000107e64d0a GPR16: 0000000107e64d06 0000000107e64cf1 0000000107e64cc4 0000000107e64c73 GPR20: 0000000107e64c31 0000000107e64bf1 0000000107e64be7 0000000000000000 GPR24: 0000000000000000 00007fffc9439ee0 0000000000000003 0000000000000001 GPR28: 00007fffc943f713 0000000000000000 00007fffc9439ee8 0000000000000000 [770.648] NIP [00007fff94126800] 0x7fff94126800 [770.648] LR [0000000107e0b594] 0x107e0b594 [770.648] --- interrupt: c00 [770.648] Instruction dump: [770.648] 3b00ffe4 e8898828 481175f5 60000000 4bfff4fc 3be00000 4bfff570 3d220000 [770.648] 7fc4f378 e8698830 4811cd95 e8410018 <0fe00000> f9c10060 f9e10068 fa010070 [770.648] ---[ end trace 0000000000000000 ]--- [770.648] BTRFS: error (device dm-2: state A) in find_free_extent_update_loop:4122: errno=-22 unknown [770.648] BTRFS info (device dm-2: state EA): forced readonly [770.648] BTRFS: error (device dm-2: state EA) in __btrfs_free_extent:3070: errno=-22 unknown [770.648] BTRFS error (device dm-2: state EA): failed to run delayed ref for logical 17838685708288 num_bytes 24576 type 184 action 2 ref_mod 1: -22 [770.648] BTRFS: error (device dm-2: state EA) in btrfs_run_delayed_refs:2144: errno=-22 unknown [770.648] BTRFS: error (device dm-2: state EA) in reset_balance_state:3599: errno=-22 unknown Fixes: `47e6f7423b` ("btrfs: add support for 3-copy replication (raid1c3)") Fixes: `8d6fac0087` ("btrfs: add support for 4-copy replication (raid1c4)") CC: stable@vger.kernel.org # 5.10+ Signed-off-by: Matt Corallo <blnxfsl@bluematt.me> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:14 +02:00
Jan Kara	59efb86711	fs: Lock moved directories commit 28eceeda130f5058074dd007d9c59d2e8bc5af2e upstream. When a directory is moved to a different directory, some filesystems (udf, ext4, ocfs2, f2fs, and likely gfs2, reiserfs, and others) need to update their pointer to the parent and this must not race with other operations on the directory. Lock the directories when they are moved. Although not all filesystems need this locking, we perform it in vfs_rename() because getting the lock ordering right is really difficult and we don't want to expose these locking details to filesystems. CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20230601105830.13168-5-jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Jan Kara	c5b5e72df1	fs: Establish locking order for unrelated directories commit f23ce757185319886ca80c4864ce5f81ac6cc9e9 upstream. Currently the locking order of inode locks for directories that are not in ancestor relationship is not defined because all operations that needed to lock two directories like this were serialized by sb->s_vfs_rename_mutex. However some filesystems need to lock two subdirectories for RENAME_EXCHANGE operations and for this we need the locking order established even for two tree-unrelated directories. Provide a helper function lock_two_inodes() that establishes lock ordering for any two inodes and use it in lock_two_directories(). CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20230601105830.13168-4-jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Jan Kara	4b03f503b7	Revert "f2fs: fix potential corruption when moving a directory" commit cde3c9d7e2a359e337216855dcb333a19daaa436 upstream. This reverts commit d94772154e524b329a168678836745d2773a6e02. The locking is going to be provided by VFS. CC: Jaegeuk Kim <jaegeuk@kernel.org> CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20230601105830.13168-3-jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Jan Kara	2b563acd2d	ext4: Remove ext4 locking of moved directory commit 3658840cd363f2be094f5dfd2f0b174a9055dd0f upstream. Remove locking of moved directory in ext4_rename2(). We will take care of it in VFS instead. This effectively reverts commit 0813299c586b ("ext4: Fix possible corruption when moving a directory") and followup fixes. CC: Ted Tso <tytso@mit.edu> CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20230601105830.13168-1-jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Thomas Weißschuh	5e7d18a52c	fs: avoid empty option when generating legacy mount string commit 62176420274db5b5127cd7a0083a9aeb461756ee upstream. As each option string fragment is always prepended with a comma it would happen that the whole string always starts with a comma. This could be interpreted by filesystem drivers as an empty option and may produce errors. For example the NTFS driver from ntfs.ko behaves like this and fails when mounted via the new API. Link: https://github.com/util-linux/util-linux/issues/2298 Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Fixes: `3e1aeb00e6` ("vfs: Implement a filesystem superblock creation/configuration context") Cc: stable@vger.kernel.org Message-Id: <20230607-fs-empty-option-v1-1-20c8dbf4671b@weissschuh.net> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Fabian Frederick	988a5d7911	jffs2: reduce stack usage in jffs2_build_xattr_subsystem() commit 1168f095417643f663caa341211e117db552989f upstream. Use kcalloc() for allocation/flush of 128 pointers table to reduce stack usage. Function now returns -ENOMEM or 0 on success. stackusage Before: ./fs/jffs2/xattr.c:775 jffs2_build_xattr_subsystem 1208 dynamic,bounded After: ./fs/jffs2/xattr.c:775 jffs2_build_xattr_subsystem 192 dynamic,bounded Also update definition when CONFIG_JFFS2_FS_XATTR is not enabled Tested with an MTD mount point and some user set/getfattr. Many current target on OpenWRT also suffer from a compilation warning (that become an error with CONFIG_WERROR) with the following output: fs/jffs2/xattr.c: In function 'jffs2_build_xattr_subsystem': fs/jffs2/xattr.c:887:1: error: the frame size of 1088 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] 887 \| } \| ^ Using dynamic allocation fix this compilation warning. Fixes: `c9f700f840` ("[JFFS2][XATTR] using 'delete marker' for xdatum/xref deletion") Reported-by: Tim Gardner <tim.gardner@canonical.com> Reported-by: kernel test robot <lkp@intel.com> Reported-by: Ron Economos <re@w6rz.net> Reported-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Cc: stable@vger.kernel.org Message-Id: <20230506045612.16616-1-ansuelsmth@gmail.com> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Roberto Sassu	5fada37511	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs commit 36ce9d76b0a93bae799e27e4f5ac35478c676592 upstream. As the ramfs-based tmpfs uses ramfs_init_fs_context() for the init_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb() to free it and avoid a memory leak. Link: https://lkml.kernel.org/r/20230607161523.2876433-1-roberto.sassu@huaweicloud.com Fixes: `c3b1b1cbf0` ("ramfs: add support for "mode=" mount option") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: Hugh Dickins <hughd@google.com> Cc: David Howells <dhowells@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:13 +02:00
Dai Ngo	8482ac2e5a	NFSD: add encoding of op_recall flag for write delegation commit 58f5d894006d82ed7335e1c37182fbc5f08c2f51 upstream. Modified nfsd4_encode_open to encode the op_recall flag properly for OPEN result with write delegation granted. Signed-off-by: Dai Ngo <dai.ngo@oracle.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-07-27 08:44:11 +02:00
Chao Yu	5ded9e8aa5	f2fs: fix error path handling in truncate_dnode() [ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ] If truncate_node() fails in truncate_dnode(), it missed to call f2fs_put_page(), fix it. Fixes: `7735730d39` ("f2fs: fix to propagate error from __get_meta_page()") Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:44:09 +02:00
Muchun Song	018eddcb6b	kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR [ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ] The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix it. Fixes: `488dee96bb` ("kernfs: allow creating kernfs objects with arbitrary uid/gid") Signed-off-by: Muchun Song <songmuchun@bytedance.com> Acked-by: Tejun Heo <tj@kernel.org> Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:44:05 +02:00
Olga Kornievskaia	7c9f5a14d9	NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION [ Upstream commit c907e72f58ed979a24a9fdcadfbc447c51d5e509 ] When the client received NFS4ERR_BADSESSION, it schedules recovery and start the state manager thread which in turn freezes the session table and does not allow for any new requests to use the no-longer valid session. However, it is possible that before the state manager thread runs, a new operation would use the released slot that received BADSESSION and was therefore not updated its sequence number. Such re-use of the slot can lead the application errors. Fixes: `5c441544f0` ("NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()") Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:44:00 +02:00
Amir Goldstein	714ba10a6d	ovl: update of dentry revalidate flags after copy up [ Upstream commit b07d5cc93e1b28df47a72c519d09d0a836043613 ] After copy up, we may need to update d_flags if upper dentry is on a remote fs and lower dentries are not. Add helpers to allow incremental update of the revalidate flags. Fixes: `bccece1ead` ("ovl: allow remote upper") Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:43:55 +02:00
Jiasheng Jiang	a14cb30726	pstore/ram: Add check for kstrdup [ Upstream commit d97038d5ec2062733c1e016caf9baaf68cf64ea1 ] Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: `e163fdb3f7` ("pstore/ram: Regularize prz label allocation lifetime") Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230614093733.36048-1-jiasheng@iscas.ac.cn Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:43:36 +02:00
Greg Kroah-Hartman	9710ae86ef	Merge branch 'android12-5.10' into branch 'android12-5.10-lts' Catch up with some commits applied to the android12-5.10 branch that adds new symbols to ensure that the ABI remains stable with LTS merges. This merge contains the following commits: * `383607d234` Merge "Merge tag 'android12-5.10.185_r00' into android12-5.10" into android12-5.10 \|\ \| * `e424229872` Merge tag 'android12-5.10.185_r00' into android12-5.10 * \| `b4b7d22830` ANDROID: wakeupbypass: Add vendor hook for batteryswap * \| `1dc5772322` ANDROID: GKI: Update symbols to symbol list * \| `28f1c8e015` ANDROID: vendor_hook: Add hook to abort reclaim and compaction * \| `adad2dab31` UPSTREAM: Revert "Fix XFRM-I support for nested ESP tunnels" * \| `f48a4c3b29` ANDROID: Incremental fs: Allocate data buffer based on input request size * \| `4def2dd180` ANDROID: ABI: update symbol list for Xclipse GPU * \| `bff06d6020` ANDROID: vendor_hooks: Supplement the missing hook call point. * \| `de4dc1c15c` ANDROID: GKI: Add symbol list for Nothing \|/ * `b52f2d4395` UPSTREAM: usb: dwc3: gadget: Propagate core init errors to UDC during pullup * `505b4a1929` UPSTREAM: usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition * `158d8bfffc` UPSTREAM: media: rkvdec: fix use after free bug in rkvdec_remove * `739f5722f4` UPSTREAM: x86/mm: Avoid using set_pgd() outside of real PGD pages * `5db82d830f` UPSTREAM: relayfs: fix out-of-bounds access in relay_file_read * `be9bc79296` UPSTREAM: io_uring: hold uring mutex around poll removal * `6a975c2771` UPSTREAM: net/sched: flower: fix possible OOB write in fl_set_geneve_opt() * `c811ac11f7` UPSTREAM: ipvlan:Fix out-of-bounds caused by unclear skb->cb * `540586cf5b` ANDROID: GKI: Update symbols to symbol list * `4782c8cb16` ANDROID: vendor_hook: Add hook to tune readaround size * `69a794a283` ANDROID: vendor_hooks: Add hooks to avoid key threads stalled in memory allocations * `69dc2c1a79` UPSTREAM: f2fs: fix to avoid use-after-free for cached IPU bio * `39c3d16903` UPSTREAM: net/sched: cls_u32: Fix reference counter leak leading to overflow * `4991def0fa` UPSTREAM: xfs: verify buffer contents when we skip log replay * `1c98645c8e` UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition * `e6d71f847b` BACKPORT: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() * `b3af11bf90` ANDROID: ABI: Update oplus symbol list * `5f17bf82b4` ANDROID: Export memcg functions to allow module to add new files * `40aea038ea` ANDROID: HID: Only utilise UHID provided exports if UHID is enabled * `5bffeca4fb` UPSTREAM: bluetooth: Perform careful capability checks in hci_sock_ioctl() * `c93516a2d0` ANDROID: HID; Over-ride default maximum buffer size when using UHID * `ab25d94e88` UPSTREAM: usb: gadget: f_fs: Add unbind event before functionfs_unbind * `552009b284` UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize * `c6ae8be4e6` ANDROID: GKI: update symbol list for exynos * `0a52039fcb` UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() * `17bbc533f8` UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() * `708d51e22a` UPSTREAM: 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition * `b82903573e` FROMGIT: pstore: Revert pmsg_lock back to a normal mutex * `403d5d1318` ANDROID: vendor_hook: Avoid clearing protect-flag before waking waiters * `2246168a72` ANDROID: fix a race between speculative page walk and unmap operations * `7cc458acf4` BACKPORT: usb: gadget: udc: Handle gadget_connect failure during bind operation * `fffb0ae9aa` BACKPORT: usb: dwc3: gadget: Bail out in pullup if soft reset timeout happens * `a4420dc21f` BACKPORT: f2fs: skip GC if possible when checkpoint disabling Change-Id: I74d4bd3e7f094e845598f8c29348bea10738d57a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-07-25 09:23:28 +00:00
Treehugger Robot	383607d234	Merge "Merge tag 'android12-5.10.185_r00' into android12-5.10" into android12-5.10	2023-07-24 17:05:05 +00:00
Lee Jones	f48a4c3b29	ANDROID: Incremental fs: Allocate data buffer based on input request size Presently the data buffer used to return the per-UID timeout description is created based on information provided by the user. It is expected that the user populates a variable called 'timeouts_array_size' which is heavily scrutinised to ensure the value provided is appropriate i.e. smaller than the largest possible value but large enough to contain all of the data we wish to pass back. The issue is that the aforementioned scrutiny is imposed on a different variable to the one expected. Contrary to expectation, the data buffer is actually being allocated to the size specified in a variable named 'timeouts_array_size_out'. A variable originally designed to only contain the output information i.e. the size of the data actually copied to the user for consumption. This value is also user provided and is not given the same level of scrutiny as the former. The fix in this case is simple. Ignore 'timeouts_array_size_out' until it is time to populate (over-write) it ourselves and use 'timeouts_array_size' to shape the buffer as intended. Bug: 281547360 Change-Id: I95e12879a33a2355f9e4bc0ce2bfc3f229141aa8 Signed-off-by: Lee Jones <joneslee@google.com> (cherry picked from commit 5a4d20a3eb4e651f88ed2f1f08cee066639ca801)	2023-07-17 14:53:51 +01:00
Greg Kroah-Hartman	e424229872	Merge tag 'android12-5.10.185_r00' into android12-5.10 This is the merge of the upstream LTS release of 5.10.185 into the android12-5.10 branch. It contains the following commits: * `c4f52f22c7` Revert "net: Remove DECnet leftovers from flow.h." * `c6ac900e26` Merge 5.10.185 into android12-5.10-lts \|\ \| * `ef0d5feb32` Linux 5.10.185 \| * `ed2bf5cee6` um: Fix build w/o CONFIG_PM_SLEEP \| * `f73ec12dc7` drm/i915/gen11+: Only load DRAM information from pcode \| * `27458487c8` drm/i915/dg1: Wait for pcode/uncore handshake at startup \| * `2d1c19597d` media: dvb-core: Fix use-after-free due to race at dvb_register_device() \| * `5c61c3945a` media: dvbdev: fix error logic at dvb_register_device() \| * `a1b26dac8b` media: dvbdev: Fix memleak in dvb_register_device \| * `a13dee47fa` nilfs2: reject devices with insufficient block count \| * `c374552b54` mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block \| * `e6dc6a9d0a` mmc: block: ensure error propagation for non-blk \| * `7ce0e8b287` batman-adv: Switch to kstrtox.h for kstrtou64 \| * `e6104284c4` neighbour: delete neigh_lookup_nodev as not used \| * `bf82668eb9` net: Remove DECnet leftovers from flow.h. \| * `7d07fd03f5` net: Remove unused inline function dst_hold_and_use() \| * `53076071fb` neighbour: Remove unused inline function neigh_key_eq16() \| * `7230a9e599` rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period \| * `a261589621` cgroup: always put cset in cgroup_css_set_put_fork \| * `4c10843863` afs: Fix vlserver probe RTT handling \| * `49b6607ded` selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET \| * `08899e8d5a` net: tipc: resize nlattr array to correct size \| * `5fd696b404` net: lapbether: only support ethernet devices \| * `6ee3728ae8` net/sched: cls_api: Fix lockup on flushing explicitly created chain \| * `efed5b50f3` ext4: drop the call to ext4_error() from ext4_get_group_info() \| * `6ab91d1adb` drm/nouveau: add nv_encoder pointer check for NULL \| * `5d43bb9b3e` drm/nouveau/dp: check for NULL nv_connector->native_mode \| * `edb970e03d` drm/nouveau: don't detect DSM for non-NVIDIA device \| * `8c3446ab59` igb: fix nvm.ops.read() error handling \| * `221281d60c` sctp: fix an error code in sctp_sf_eat_auth() \| * `5c47ed7f25` ipvlan: fix bound dev checking for IPv6 l3s mode \| * `3c97f2c9ec` IB/isert: Fix incorrect release of isert connection \| * `da6ae4aab5` IB/isert: Fix possible list corruption in CMA handler \| * `2b6f8817ca` IB/isert: Fix dead lock in ib_isert \| * `2f9d26345c` IB/uverbs: Fix to consider event queue closing also upon non-blocking mode \| * `6cccdbc9f0` RDMA/cma: Always set static rate to 0 for RoCE \| * `f49abbb274` RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions \| * `aa277d5cd4` octeontx2-af: fixed resource availability check \| * `0fb48a2a6a` iavf: remove mask from iavf_irq_enable_queues() \| * `079a9591ee` RDMA/rxe: Fix the use-before-initialization error of resp_pkts \| * `089a0e831f` RDMA/rxe: Removed unused name from rxe_task struct \| * `6205c0d9ff` RDMA/rxe: Remove the unused variable obj \| * `af6eaa5798` net/sched: cls_u32: Fix reference counter leak leading to overflow \| * `5852d17aaa` ping6: Fix send to link-local addresses with VRF. \| * `9e666a77f0` net: enetc: correct the indexes of highest and 2nd highest TCs \| * `1200af82cf` netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM \| * `af42c4fd82` spi: fsl-dspi: avoid SCK glitches with continuous transfers \| * `cb6ec51ddd` RDMA/rtrs: Fix the last iu->buf leak in err path \| * `26293251ab` usb: dwc3: gadget: Reset num TRBs before giving back the request \| * `f4bc416942` serial: lantiq: add missing interrupt ack \| * `0b6e65016c` USB: serial: option: add Quectel EM061KGL series \| * `1c004b379b` Remove DECnet support from kernel \| * `e9d384983f` ALSA: hda/realtek: Add a quirk for Compaq N14JP6 \| * `1148d4ca30` net: usb: qmi_wwan: add support for Compal RXM-G1 \| * `d7acfd5225` RDMA/uverbs: Restrict usage of privileged QKEYs \| * `96e14c91c5` nouveau: fix client work fence deletion race \| * `f1f7117b22` powerpc/purgatory: remove PGO flags \| * `26c80741ce` x86/purgatory: remove PGO flags \| * `f368aed482` kexec: support purgatories with .text.hot sections \| * `7e78b9142f` nilfs2: fix possible out-of-bounds segment allocation in resize ioctl \| * `902fcec052` nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() \| * `d59293f082` nios2: dts: Fix tse_mac "max-frame-size" property \| * `2847d9eed4` ocfs2: check new file size on fallocate call \| * `e73b135f54` ocfs2: fix use-after-free when unmounting read-only filesystem \| * `370f5d98ff` epoll: ep_autoremove_wake_function should use list_del_init_careful \| * `4716c73b18` io_uring: hold uring mutex around poll removal \| * `93a68acc49` irqchip/gic: Correctly validate OF quirk descriptors \| * `2a2641a842` drm:amd:amdgpu: Fix missing buffer object unlock in failure path \| * `7c0b17679b` xen/blkfront: Only check REQ_FUA for writes \| * `8e45fb70f4` ASoC: dwc: move DMA init to snd_soc_dai_driver probe() \| * `d47b5a6d23` mips: Move initrd_start check after initrd address sanitisation. \| * `619672bf2d` MIPS: Alchemy: fix dbdma2 \| * `0ca73b45b7` parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() \| * `3f7625e086` parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() \| * `73102fdb5b` ASoC: soc-pcm: test if a BE can be prepared \| * `3bc883132d` btrfs: handle memory allocation failure in btrfs_csum_one_bio \| * `142fbad314` btrfs: scrub: try harder to mark RAID56 block groups read-only \| * `35d32d8415` power: supply: Fix logic checking if system is running from battery \| * `8b7a2207ee` irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues \| * `dbf6109972` regulator: Fix error checking for debugfs_create_dir \| * `37bcc48e7d` platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 \| * `88d1c1365f` power: supply: Ratelimit no data debug output \| * `6be7a4bef9` tools: gpio: fix debounce_period_us output of lsgpio \| * `39eb9eb9ea` ARM: dts: vexpress: add missing cache properties \| * `b2856c3cd3` power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() \| * `ce2b5f24ca` power: supply: sc27xx: Fix external_power_changed race \| * `9e9e150fa8` power: supply: ab8500: Fix external_power_changed race \| * `539c387f0b` test_firmware: fix a memory leak with reqs buffer \| * `af36f35074` test_firmware: prevent race conditions by a correct implementation of locking \| * `682ca60251` test_firmware: Use kstrtobool() instead of strtobool() \| * `6e2e551e39` kernel.h: split out kstrtox() and simple_strtox() to a separate header \| * `c2def5578b` lib: cleanup kstrto() usage \| `2f2122a869` Revert "neighbour: fix unaligned access to pneigh_entry" * \| `b7321283a9` Merge 5.10.184 into android12-5.10-lts \|\\| \| * `a1f0beb13d` Linux 5.10.184 \| * `7f896130ef` Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" \| * `b60e862e13` btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() \| * `6f371623f3` btrfs: check return value of btrfs_commit_transaction in relocation \| * `ea0d413094` drm/atomic: Don't pollute crtc_state->mode_blob with error pointers \| * `1659268d1a` MIPS: locking/atomic: Fix atomic{_64,}_sub_if_positive \| * `0e98a97f77` xfs: verify buffer contents when we skip log replay \| * `58e8cf94de` tcp: fix tcp_min_tso_segs sysctl \| * `1b4b335096` ext4: only check dquot_initialize_needed() when debugging \| * `fd6cb51719` Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" \| * `cfa91c0573` vhost: support PACKED when setting-getting vring_base \| * `461c88caa8` riscv: fix kprobe __user string arg print fault issue \| * `c6b9050874` eeprom: at24: also select REGMAP \| * `10e376a7c3` i2c: sprd: Delete i2c adapter in .remove's error path \| * `c4aeef5602` ASoC: codecs: wsa881x: do not set can_multi_write flag \| * `b6f309e9d2` staging: vc04_services: fix gcc-13 build warning \| * `0d3c75a693` usb: usbfs: Use consistent mmap functions \| * `143f405721` usb: usbfs: Enforce page requirements for mmap \| * `bcd474d183` pinctrl: meson-axg: add missing GPIOA_18 gpio group \| * `1981d37b1d` rbd: get snapshot context after exclusive lock is ensured to be held \| * `76ae4a7bc9` rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting \| * `841d3b5a84` tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta' \| * `a94024991d` Bluetooth: hci_qca: fix debugfs registration \| * `2270e32bd1` Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk \| * `76b40319a1` s390/dasd: Use correct lock while counting channel queue length \| * `e715c86e92` ceph: fix use-after-free bug for inodes when flushing capsnaps \| * `6714873158` can: j1939: avoid possible use-after-free when j1939_can_rx_register fails \| * `cc834f4d97` can: j1939: change j1939_netdev_lock type to mutex \| * `0268005076` can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket \| * `0038055135` drm/amdgpu: fix xclk freq on CHIP_STONEY \| * `ef95f987be` ALSA: hda/realtek: Add Lenovo P3 Tower platform \| * `95520b3fba` ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 \| * `ca26d00828` Input: psmouse - fix OOB access in Elantech protocol \| * `86efc409f2` Input: xpad - delete a Razer DeathAdder mouse VID/PID entry \| * `9ece26ff08` batman-adv: Broken sync while rescheduling delayed work \| * `3f6dfff5fe` bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks \| * `deead0d872` bnxt_en: Query default VLAN before VNIC setup on a VF \| * `84dbd27ad5` bnxt_en: Don't issue AP reset during ethtool's reset operation \| * `dedd47977a` lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() \| * `27b8d6931f` bpf: Add extra path pointer check to d_path helper \| * `36d07046c2` net: sched: fix possible refcount leak in tc_chain_tmplt_add() \| * `54acac57fe` net: sched: move rtm_tca_policy declaration to include file \| * `dad7417db7` rfs: annotate lockless accesses to RFS sock flow table \| * `c62ca9d037` rfs: annotate lockless accesses to sk->sk_rxhash \| * `86e3981ff1` ipv6: rpl: Fix Route of Death. \| * `b4be099c5f` netfilter: ipset: Add schedule point in call_ad(). \| * `35c89cfcac` netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper \| * `c4ba90ae35` qed/qede: Fix scheduling while atomic \| * `0fee54fa33` Bluetooth: L2CAP: Add missing checks for invalid DCID \| * `0066598012` Bluetooth: Fix l2cap_disconnect_req deadlock \| * `83cfac5851` net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values \| * `8ab2bec9e1` net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT \| * `47ef881f1c` net: dsa: lan9303: allow vid != 0 in port_fdb_{add\|del} methods \| * `9fcc3c3d26` neighbour: fix unaligned access to pneigh_entry \| * `99883d4a0b` wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll \| * `2d3e4c5b3e` afs: Fix setting of mtime when creating a file/dir/symlink \| * `1ed651e234` spi: qup: Request DMA before enabling clocks \| * `e7c61c39d6` staging: vchiq_core: drop vchiq_status from vchiq_initialise \| * `fa30327060` i40e: fix build warning in ice_fltr_add_mac_to_list() \| * `15ca8d584c` i40e: fix build warnings in i40e_alloc.h \| * `f7e208d1c5` i40iw: fix build warning in i40iw_manage_apbvt() \| * `318e2c18da` block/blk-iocost (gcc13): keep large values in a new enum \| * `b6d652f7fb` blk-iocost: avoid 64-bit division in ioc_timer_fn \| * `9214a5484e` f2fs: fix iostat lock protection \| * `d3b74c288d` bonding (gcc13): synchronize bond_{a,t}lb_xmit() types \| * `f122e55174` remove the sx8 block driver \| * `9236470a1d` sfc (gcc13): synchronize ef100_enqueue_skb()'s return type \| * `02ce3cf222` gcc-plugins: Reorganize gimple includes for GCC 13 \| * `4c3ddc06ce` ata: ahci: fix enum constants for gcc-13 * \| `0c0856714e` Revert "tcp: deny tcp_disconnect() when threads are waiting" * \| `848ca335c1` Merge 5.10.183 into android12-5.10-lts \|\\| \| * `7356714b95` Linux 5.10.183 \| * `842156dc0a` ARM: defconfig: drop CONFIG_DRM_RCAR_LVDS \| * `2c0ea7a06d` ext4: enable the lazy init thread when remounting read/write \| * `92450a1eaa` selftests: mptcp: join: skip if MPTCP is not supported \| * `1a6db1f927` selftests: mptcp: simult flows: skip if MPTCP is not supported \| * `4f8356ab74` selftests: mptcp: diag: skip if MPTCP is not supported \| * `81df7153f0` crypto: ccp: Play nice with vmalloc'd memory for SEV command structs \| * `1f988ce6e4` crypto: ccp: Reject SEV commands with mismatching command buffer \| * `d21a20f442` scsi: dpt_i2o: Do not process completions with invalid addresses \| * `a2cd7599b5` scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) \| * `6d6612f7f9` drm/rcar: stop using 'imply' for dependencies \| * `c759c9e4bf` media: ti-vpe: cal: avoid FIELD_GET assertion \| * `d21e955de9` tpm, tpm_tis: Request threaded interrupt handler \| * `608c1f2083` regmap: Account for register length when chunking \| * `cb1cbe430e` KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() \| * `3295dc04af` KVM: x86: Account fastpath-only VM-Exits in vCPU stats \| * `21bb3cd2e1` test_firmware: fix the memory leak of the allocated firmware buffer \| * `510e015b90` serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() \| * `b02ae50c7f` fbcon: Fix null-ptr-deref in soft_cursor \| * `c94228a5ae` ext4: add lockdep annotations for i_data_sem for ea_inode's \| * `ef70012ab5` ext4: disallow ea_inodes with extended attributes \| * `6f4fa43757` ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() \| * `6d67d4966c` ext4: add EA_INODE checking to ext4_iget() \| * `6d0adaa90d` selftests: mptcp: pm nl: skip if MPTCP is not supported \| * `54dea0aa6b` selftests: mptcp: connect: skip if MPTCP is not supported \| * `57eb824b8c` tracing/probe: trace_probe_primary_from_call(): checked list_first_entry \| * `122ba1d40b` selinux: don't use make's grouped targets feature yet \| * `e0b8664c2f` btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds \| * `6c859764f4` tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK \| * `6127e956c3` mmc: vub300: fix invalid response handling \| * `99cb5ed15d` eth: sun: cassini: remove dead code \| * `1d8693376a` gcc-12: disable '-Wdangling-pointer' warning for now \| * `7c602f540b` ath6kl: Use struct_group() to avoid size-mismatched casting \| * `c92ea38a77` ACPI: thermal: drop an always true check \| * `93e28b66c1` x86/boot: Wrap literal addresses in absolute_pointer() \| * `3442be8f30` ata: libata-scsi: Use correct device no in ata_find_dev() \| * `ae0d7613e0` scsi: stex: Fix gcc 13 warnings \| * `86b2d292c2` misc: fastrpc: reject new invocations during device removal \| * `dacb7c103c` misc: fastrpc: return -EPIPE to invocations on device removal \| * `a4f88cb043` usb: gadget: f_fs: Add unbind event before functionfs_unbind \| * `90f581eb74` net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 \| * `e18b0009dd` iio: dac: build ad5758 driver when AD5758 is selected \| * `a869ab6987` iio: adc: ad7192: Change "shorted" channels to differential \| * `143dbb313a` iio: dac: mcp4725: Fix i2c_master_send() return value handling \| * `81c70f4bea` iio: light: vcnl4035: fixed chip ID check \| * `ff864a92d9` iio: imu: inv_icm42600: fix timestamp reset \| * `954bd5a44b` HID: wacom: avoid integer overflow in wacom_intuos_inout() \| * `adac1c22f5` HID: google: add jewel USB id \| * `55c507a34e` iio: adc: mxs-lradc: fix the order of two cleanup operations \| * `5a445c2bf6` mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() \| * `c05ac53bb0` atm: hide unused procfs functions \| * `ab33230458` drm/msm: Be more shouty if per-process pgtables aren't working \| * `93a61212db` ALSA: oss: avoid missing-prototype warnings \| * `4987bf0446` netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT \| * `1c2537291e` wifi: b43: fix incorrect __packed annotation \| * `ea478186ea` scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed \| * `05226a8f22` arm64/mm: mark private VM_FAULT_X defines as vm_fault_t \| * `32f86763c2` ARM: dts: stm32: add pin map for CAN controller on stm32f7 \| * `01c76cb5e5` wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value \| * `0467212806` s390/pkey: zeroize key blobs \| * `76169f7490` media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 \| * `ca2d171fd1` media: dvb-core: Fix kernel WARNING for blocking operation in wait_event() \| `2ea7d26ed8` media: dvb-core: Fix use-after-free due on race condition at dvb_net \| * `415651c8f4` media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table \| * `eb37fef417` media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() \| * `1995e71472` media: dvb_ca_en50221: fix a size write bug \| * `b85233ab53` media: netup_unidvb: fix irq init by register it at the end of probe \| * `74c80d2024` media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address \| * `fcbb72b041` media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() \| * `7945c13c9b` media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer \| * `2d47867a6b` media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() \| * `647da51e4d` media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() \| * `084e43d9a4` media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() \| * `a81280cf33` media: dvb_demux: fix a bug for the continuity counter \| * `204e9082f6` ASoC: ssm2602: Add workaround for playback distortions \| * `beee708ccc` ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs \| * `bd99da6472` xfrm: Check if_id in inbound policy/secpath match \| * `5ee83fef0c` ASoC: dwc: limit the number of overrun messages \| * `32f6f1bf1b` block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE \| * `01c3d30649` nbd: Fix debugfs_create_dir error checking \| * `29f6b42a73` fbdev: stifb: Fix info entry in sti_struct on error path \| * `742dab42d7` fbdev: modedb: Add 1920x1080 at 60 Hz video mode \| * `d03d31d3a2` gfs2: Don't deref jdesc in evict \| * `fe4f6e159b` media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE \| * `16ee4562c7` ARM: 9295/1: unwind:fix unwind abort for uleb128 case \| * `a3393eb6fb` btrfs: abort transaction when sibling keys check fails for leaves \| * `c12c288f1e` mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() \| * `0dcf021af4` ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs. \| * `d5fcccfc50` watchdog: menz069_wdt: fix watchdog initialisation \| * `9823ac6e7a` mtd: rawnand: marvell: don't set the NAND frequency select \| * `e4666d793a` mtd: rawnand: marvell: ensure timing values are written \| * `a437d3d25a` net: dsa: mv88e6xxx: Increase wait after reset deactivation \| * `7c5c67aa29` net/sched: flower: fix possible OOB write in fl_set_geneve_opt() \| * `f5c29a9e91` net/mlx5: Read embedded cpu after init bit cleared \| * `f03bc01360` udp6: Fix race condition in udp6_sendmsg & connect \| * `57e6c54034` net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report \| * `ae7e941f4d` net: sched: fix NULL pointer dereference in mq_attach \| * `a8ad1303b9` net/sched: Prohibit regrafting ingress or clsact Qdiscs \| * `676f203803` net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs \| * `18c76349af` net/sched: sch_clsact: Only create under TC_H_CLSACT \| * `1b0163b2dc` net/sched: sch_ingress: Only create under TC_H_INGRESS \| * `dfb80ebc3b` tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set \| * `cccc620970` tcp: deny tcp_disconnect() when threads are waiting \| * `8f0365a3e2` af_packet: do not use READ_ONCE() in packet_bind() \| * `4de3c2c43c` mtd: rawnand: ingenic: fix empty stub helper definitions \| * `11a1f2561b` amd-xgbe: fix the false linkup in xgbe_phy_status \| * `fa909b1384` af_packet: Fix data-races of pkt_sk(sk)->num. \| * `616da05ff8` netrom: fix info-leak in nr_write_internal() \| * `d1b224cb78` net/mlx5: fw_tracer, Fix event handling \| * `a864a8543c` dmaengine: pl330: rename _start to prevent build error \| * `33d7035dc2` iommu/amd: Don't block updates to GATag if guest mode is on \| * `bd9e61ee3e` iommu/rockchip: Fix unwind goto issue \| * `75c60dacf0` RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx \| * `861868b063` RDMA/bnxt_re: Fix a possible memory leak \| * `ff296fcceb` dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() \| * `6b32ed353f` dmaengine: at_xdmac: Move the free desc to the tail of the desc list \| * `3041b768cc` dmaengine: at_xdmac: Fix race for the tx desc callback \| * `127afc87bb` dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie \| * `958226b3a6` RDMA/efa: Fix unsupported page sizes in device \| * `7d6662e4a4` RDMA/bnxt_re: Fix the page_size used during the MR creation \| * `b51c896285` RDMA/bnxt_re: Code refactor while populating user MRs * \| `04a55bbb7f` Revert "regulator: Add regmap helper for ramp-delay setting" * \| `5e8d66e06a` Revert "regulator: pca9450: Convert to use regulator_set_ramp_delay_regmap" * \| `4d5a15daae` Revert "regulator: pca9450: Fix BUCK2 enable_mask" * \| `06f0c366cb` Merge 5.10.182 into android12-5.10-lts \|\\| \| * `c7992b6c7f` Linux 5.10.182 \| * `468bebc426` netfilter: ctnetlink: Support offloaded conntrack entry deletion \| * `18c14d3028` ipv{4,6}/raw: fix output xfrm lookup wrt protocol \| * `2218752325` binder: fix UAF caused by faulty buffer cleanup \| * `e4d2e6c305` bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() \| * `6a0712d9fe` net: phy: mscc: enable VSC8501/2 RGMII RX clock \| * `b556990235` net/mlx5: Devcom, serialize devcom registration \| * `57dc3c124e` net/mlx5: devcom only supports 2 ports \| * `860ad704e4` regulator: pca9450: Fix BUCK2 enable_mask \| * `b3a9c4081d` regulator: pca9450: Convert to use regulator_set_ramp_delay_regmap \| * `12cb97ed85` regulator: Add regmap helper for ramp-delay setting \| * `b557220d31` power: supply: bq24190: Call power_supply_changed() after updating input current \| * `224f7bbf57` power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier() \| * `277b489ad0` power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize \| * `0949c572d4` power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes \| * `6ed541254f` power: supply: bq27xxx: Move bq27xxx_battery_update() down \| * `ed78797a26` power: supply: bq27xxx: expose battery data when CI=1 \| * `7ff807d68b` power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() \| * `432f98c559` power: supply: bq27xxx: make status more robust \| * `659094e405` power: supply: bq27xxx: fix sign of current_now for newer ICs \| * `14e1a958d9` power: supply: bq27xxx: fix polarity of current_now \| * `18c9cf4633` x86/cpu: Drop spurious underscore from RAPTOR_LAKE #define \| * `4a8980cb2a` x86/cpu: Add Raptor Lake to Intel family * \| `f8e9848656` Revert "tipc: add tipc_bearer_min_mtu to calculate min mtu" * \| `7ae5626406` Revert "tipc: do not update mtu if msg_max is too small in mtu negotiation" * \| `4a7c41b710` Revert "tipc: check the bearer min mtu properly when setting it by netlink" * \| `f015c92c49` Revert "ipv4/tcp: do not use per netns ctl sockets" * \| `8231b54cd2` ANDROID: GKI: preserve CRC generation for some bluetooth symbols * \| `a4be51e26a` Revert "net: Find dst with sk's xfrm policy not ctl_sk" * \| `c86beaeed1` Revert "tcp: fix possible sk_priority leak in tcp_v4_send_reset()" * \| `7c491aaf07` Revert "firmware: arm_sdei: Fix sleep from invalid context BUG" * \| `6d62ca19a7` Merge 5.10.181 into android12-5.10-lts \|\\| \| * `272d4b8a5b` Linux 5.10.181 \| * `cf7ee4b158` net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE \| * `98cedb9910` 3c589_cs: Fix an error handling path in tc589_probe() \| * `6f449e409b` arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay \| * `d4d10a6df1` net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device \| * `8b9c561b9f` net/mlx5: Fix error message when failing to allocate device memory \| * `c21862232f` net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs \| * `058fd18e74` net/mlx5e: do as little as possible in napi poll when budget is 0 \| * `5afd5fb8a9` forcedeth: Fix an error handling path in nv_probe() \| * `80a4b9ad42` ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg \| * `c966b58c85` x86/show_trace_log_lvl: Ensure stack pointer is aligned, again \| * `0de80163de` xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() \| * `b663696c06` coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() \| * `a52d2019ec` fs: fix undefined behavior in bit shift for SB_NOUSER \| * `52967bbb93` power: supply: sbs-charger: Fix INHIBITED bit for Status reg \| * `e85757da90` power: supply: bq27xxx: Fix poll_interval handling and races on remove \| * `1da9a4b55a` power: supply: bq27xxx: Fix I2C IRQ race on remove \| * `ac1ab21394` power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition \| * `2de6eb7c40` power: supply: leds: Fix blink to LED on transition \| * `e5f82688ae` ipv6: Fix out-of-bounds access in ipv6_find_tlv() \| * `a61d5c13c7` bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields \| * `72971f4071` octeontx2-pf: Fix TSOv6 offload \| * `1c8a016822` selftests: fib_tests: mute cleanup error message \| * `a594382ec6` net: fix skb leak in __skb_tstamp_tx() \| * `8a30dce9d7` media: radio-shark: Add endpoint checks \| * `ccef03c511` USB: sisusbvga: Add endpoint checks \| * `4c260bbf35` USB: core: Add routines for endpoint checks in old drivers \| * `5014b64e36` udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). \| * `4bb955c4d2` net: fix stack overflow when LRO is disabled for virtual interfaces \| * `58ecc165ab` fbdev: udlfb: Fix endpoint check \| * `fd67307974` debugobjects: Don't wake up kswapd from fill_pool() \| * `a12ce786be` x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms \| * `518c39fc1e` parisc: Fix flush_dcache_page() for usage from irq context \| * `2d78438c31` selftests/memfd: Fix unknown type name build failure \| * `d4a5e6ae99` x86/mm: Avoid incomplete Global INVLPG flushes \| * `628d7e4941` dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type \| * `139f84c80d` btrfs: use nofs when cleaning up aborted transactions \| * `ea50ee0ef9` gpio: mockup: Fix mode of debugfs files \| * `c570dbf279` parisc: Allow to reboot machine after system halt \| * `de0d7dd5ef` parisc: Handle kgdb breakpoints only in kernel context \| * `89eba5586a` m68k: Move signal frame following exception on 68020/030 \| * `42b78c8cc7` net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize \| * `798c1c62cf` ALSA: hda/realtek: Enable headset onLenovo M70/M90 \| * `1f57a1b979` ALSA: hda: Fix unhandled register update during auto-suspend period \| * `b0d7e62fd1` ALSA: hda/ca0132: add quirk for EVGA X299 DARK \| * `c41324385a` ocfs2: Switch to security_inode_init_security() \| * `60afe299bb` spi: fsl-cpm: Use 16 bit mode for large transfers with even size \| * `e3674788a8` spi: fsl-spi: Re-organise transfer bits_per_word adaptation \| * `5324510378` act_mirred: use the backlog for nested calls to mirred ingress \| * `f5bf8e3ca1` net/sched: act_mirred: better wording on protection against excessive stack growth \| * `bba7ebe10b` net/sched: act_mirred: refactor the handle of xmit \| * `047f618d19` writeback, cgroup: remove extra percpu_ref_exit() \| * `84fbe6ad0f` ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 \| * `dbcc95bb51` watchdog: sp5100_tco: Immediately trigger upon starting. \| * `75258f0838` s390/qdio: fix do_sqbs() inline assembly constraint \| * `3681a0287a` s390/qdio: get rid of register asm \| * `9c9f253fc6` serial: 8250_exar: Add support for USR298x PCI Modems \| * `1ffa0b8ba9` serial: exar: Add support for Sealevel 7xxxC serial cards \| * `fb3c5714f5` serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards \| * `18fbf8cfbb` KVM: arm64: Link position-independent string routines into .hyp.text \| * `e266da1656` HID: wacom: add three styli to wacom_intuos_get_tool_type \| * `dfd419db03` HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs \| * `05b1703797` HID: wacom: Force pen out of prox if no events have been received in a while \| * `6b4205ea97` nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() \| * `710dee5701` powerpc/64s/radix: Fix soft dirty tracking \| * `ae149cdaef` tpm/tpm_tis: Disable interrupts for more Lenovo devices \| * `8c0109d762` ceph: force updating the msg pointer in non-split case \| * `11dddfbb7a` vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF \| * `ea3d5de90b` serial: Add support for Advantech PCI-1611U card \| * `ba061afa06` statfs: enforce statfs[64] structure initialization \| * `845f98af6a` can: kvaser_pciefd: Disable interrupts in probe error path \| * `7a7ec807fe` can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt \| * `65e85232ff` can: kvaser_pciefd: Clear listen-only bit if not explicitly requested \| * `0babb3fabf` can: kvaser_pciefd: Empty SRB buffer in probe \| * `03714e9c04` can: kvaser_pciefd: Call request_irq() before enabling interrupts \| * `3bbeba3ce1` can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() \| * `073a4d750c` can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag \| * `b4b8294a41` can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag \| * `f7f799a6fe` ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 \| * `b4f770e612` ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 \| * `6cebdffba6` ALSA: hda/realtek: Add quirk for Clevo L140AU \| * `3add6b2a4a` ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table \| * `546b1f5f45` ALSA: hda: Fix Oops by 9.1 surround channel names \| * `ff466f77d0` usb: typec: altmodes/displayport: fix pin_assignment_show \| * `35e31e1e92` usb: gadget: u_ether: Fix host MAC address case \| * `e35adb75fd` usb: dwc3: debugfs: Resume dwc3 before accessing registers \| * `66070f5b99` USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value \| * `0caed1faf5` usb-storage: fix deadlock when a scsi command timeouts more than once \| * `6340e432cf` USB: usbtmc: Fix direction for 0-length ioctl control messages \| * `3b3c6f2d2f` ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go \| * `3bd6d11e7e` bridge: always declare tunnel functions \| * `3fa13203b6` netfilter: nft_set_rbtree: fix null deref on element insertion \| * `6cfe6f5185` vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() \| * `562ec162b0` igb: fix bit_shift to be in [1..8] range \| * `dc61f7582c` cassini: Fix a memory leak in the error handling path of cas_init_one() \| * `81139679f4` scsi: storvsc: Don't pass unused PFNs to Hyper-V host \| * `d0d39bed9e` wifi: iwlwifi: mvm: don't trust firmware n_channels \| * `f9337a4177` wifi: mac80211: fix min center freq offset tracing \| * `43f6575004` net: bcmgenet: Restore phy_stop() depending upon suspend/close \| * `e92727ed9e` net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() \| * `2937127d24` tipc: check the bearer min mtu properly when setting it by netlink \| * `2bd4ff4ffb` tipc: do not update mtu if msg_max is too small in mtu negotiation \| * `097ea78d8c` tipc: add tipc_bearer_min_mtu to calculate min mtu \| * `76ea144a35` net/tipc: fix tipc header files for kernel-doc \| * `02b20e0bc0` net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() \| * `01cdda0d27` drm/exynos: fix g2d_open/close helper function definitions \| * `ce97bb60a6` SUNRPC: Fix trace_svc_register() call site \| * `f9982db735` media: netup_unidvb: fix use-after-free at del_timer() \| * `0cefa42152` net: hns3: fix reset delay time to avoid configuration timeout \| * `aba74ad998` net: hns3: fix sending pfc frames after reset issue \| * `e1f800be74` erspan: get the proto with the md version for collect_md \| * `153017561d` serial: arc_uart: fix of_iomap leak in `arc_serial_probe` \| * `e7fd68abbb` tcp: fix possible sk_priority leak in tcp_v4_send_reset() \| * `788791990d` net: Find dst with sk's xfrm policy not ctl_sk \| * `a9ef8b2589` ipv4/tcp: do not use per netns ctl sockets \| * `1716699177` vsock: avoid to close connected socket after the timeout \| * `b1cf6bd883` ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 \| * `13c5fa1248` ALSA: firewire-digi00x: prevent potential use after free \| * `6fb537895d` net: phy: dp83867: add w/a for packet errors seen with short cables \| * `83996d317b` net: fec: Better handle pm_runtime_get() failing in .remove() \| * `8f57715f8e` af_key: Reject optional tunnel/BEET mode templates in outbound policies \| * `f5cb28a90c` cpupower: Make TSC read per CPU for Mperf monitor \| * `dc30fed07d` drm/msm/dpu: Remove duplicate register defines from INTF \| * `eaf9394ed7` drm/msm/dp: unregister audio driver during unbind \| * `c5449195f8` Revert "Fix XFRM-I support for nested ESP tunnels" \| * `295e07a76b` xfrm: don't check the default policy if the policy allows the packet \| * `84fdaaf0d7` btrfs: fix space cache inconsistency after error loading it from disk \| * `a842fb6038` btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid \| * `9c69a9d058` btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c \| * `6a1a72a8cf` mfd: dln2: Fix memory leak in dln2_probe() \| * `7d939e367b` phy: st: miphy28lp: use _poll_timeout functions for waits \| * `3b37bb0d92` Input: xpad - add constants for GIP interface numbers \| * `94ec1a44e8` iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any \| * `cae5f8f4f7` clk: tegra20: fix gcc-7 constant overflow warning \| * `8c472e68be` iommu/arm-smmu-qcom: Limit the SMR groups to 128 \| * `214ae2c1a9` RDMA/core: Fix multiple -Warray-bounds warnings \| * `2d9ca5f62f` recordmcount: Fix memory leaks in the uwrite function \| * `cf3e291601` sched: Fix KCSAN noinstr violation \| * `158502f790` mcb-pci: Reallocate memory region to avoid memory overlapping \| * `2c86a1305c` serial: 8250: Reinit port->pm on port specific driver unbind \| * `7ed30db879` usb: typec: tcpm: fix multiple times discover svids error \| * `60fabcba75` HID: wacom: generic: Set battery quirk only when we see battery data \| * `d234de1a92` spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 \| * `0898a1df72` HID: logitech-hidpp: Reconcile USB and Unifying serials \| * `958534d436` HID: logitech-hidpp: Don't use the USB serial for USB devices \| * `bb1313f37e` staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE \| * `55410a9144` Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp \| * `a2d816f55d` Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set \| * `ba66851aba` ipvs: Update width of source for ip_vs_sync_conn_options \| * `866921dc06` wifi: ath11k: Fix SKB corruption in REO destination ring \| * `91ad1ab3cc` wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace \| * `e732a266b9` null_blk: Always check queue mode setting from configfs \| * `059e426d66` wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf \| * `0fc0d287c1` wifi: iwlwifi: pcie: fix possible NULL pointer dereference \| * `7560ed6592` samples/bpf: Fix fout leak in hbm's run_bpf_prog \| * `ad87bd313f` f2fs: fix to drop all dirty pages during umount() if cp_error is set \| * `fc7237e191` ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() \| * `3ca3005b50` ext4: set goal start correctly in ext4_mb_normalize_request \| * `4c2c8f9599` gfs2: Fix inode height consistency check \| * `697f92f831` scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition \| * `f748e15253` lib: cpu_rmap: Avoid use after free on rmap->obj array entries \| * `4621e24c92` scsi: target: iscsit: Free cmds before session free \| * `2ea171230a` net: Catch invalid index in XPS mapping \| * `8b61e7ad13` net: pasemi: Fix return type of pasemi_mac_start_tx() \| * `e0e7faee3a` scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow \| * `22ab5fed07` ext2: Check block size validity during mount \| * `4e8dc0e5c7` wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex \| * `e8d49d1c59` bpf: Annotate data races in bpf_local_storage \| * `30d041c18d` wifi: ath: Silence memcpy run-time false positive warning \| * `b8e7589f50` drm/amd: Fix an out of bounds error in BIOS parser \| * `978e0d0554` ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects \| * `16359bc02c` ACPICA: Avoid undefined behavior: applying zero offset to null pointer \| * `3f64a0e664` drm/tegra: Avoid potential 32-bit integer overflow \| * `f718f1fd3e` remoteproc: stm32_rproc: Add mutex protection for workqueue \| * `066b90bca7` ACPI: EC: Fix oops when removing custom query handlers \| * `7d8f5ccc82` firmware: arm_sdei: Fix sleep from invalid context BUG \| * `5c23f6da62` memstick: r592: Fix UAF bug in r592_remove due to race condition \| * `ae6769fb93` arm64: dts: qcom: msm8996: Add missing DWC3 quirks \| * `bb1616e105` regmap: cache: Return error in cache sync operations for REGCACHE_NONE \| * `d5138ad7ca` drm/amd/display: Use DC_LOG_DC in the trasform pixel function \| * `c8daee6658` fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() \| * `a7d21b8585` rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access \| * `e4842de4ec` refscale: Move shutdown from wait_event() to wait_event_idle() \| * `100c0ad6c0` ext4: allow ext4_get_group_info() to fail \| * `371d8b8ea0` ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set \| * `8669fff0d0` ext4: add mballoc stats proc file \| * `9b6a0c140e` ext4: drop s_mb_bal_lock and convert protected fields to atomic \| * `0983142c5f` ext4: remove redundant mb_regenerate_buddy() \| * `d48b7eea94` ext4: fix lockdep warning when enabling MMP \| * `5c87115520` ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled \| * `8284c7592d` ext4: reflect error codes from ext4_multi_mount_protect() to its callers \| * `efd18a91c9` ext4: remove an unused variable warning with CONFIG_QUOTA=n \| * `df1be652a4` fbdev: arcfb: Fix error handling in arcfb_probe() \| * `bd6b353671` drm/i915/dp: prevent potential div-by-zero \| * `8307e372e7` af_unix: Fix data races around sk->sk_shutdown. \| * `9b977b0cbb` af_unix: Fix a data race of sk->sk_receive_queue->qlen. \| * `fb6ac4b5bd` net: datagram: fix data-races in datagram_poll() \| * `f4a371d3f5` ipvlan:Fix out-of-bounds caused by unclear skb->cb \| * `963fe9ed86` tcp: add annotations around sk->sk_shutdown accesses \| * `f86568eca4` tcp: factor out __tcp_close() helper \| * `34a5ee69ec` net: add vlan_get_protocol_and_depth() helper \| * `9ccf3edbaf` net: tap: check vlan with eth_type_vlan() method \| * `4493914009` net: deal with most data-races in sk_wait_event() \| * `1b33bdd766` net: annotate sk->sk_err write from do_recvmmsg() \| * `f92557f79a` netlink: annotate accesses to nlk->cb_running \| * `26001e75dc` netfilter: conntrack: fix possible bug_on with enable_hooks=1 \| * `d06f67b2b8` net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). \| * `8eb35b1aca` linux/dim: Do nothing if no time delta between samples \| * `4d3ae448e8` net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() \| * `b882224d73` ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings \| * `139c27648f` drm/mipi-dsi: Set the fwnode for mipi_dsi_device \| * `423908e89d` driver core: add a helper to setup both the of_node and fwnode of a device * \| `6229d57677` Revert "arm64: Stash shadow stack pointer in the task struct on interrupt" * \| `d70c95bd81` Merge 5.10.180 into android12-5.10-lts \|\\| \| * `4c893ff559` Linux 5.10.180 \| * `3ebe5d6d69` drm/amd/display: Fix hang when skipping modeset \| * `a992c387b4` mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock \| * `f2656f437f` drm/exynos: move to use request_irq by IRQF_NO_AUTOEN flag \| * `32232bcd4e` printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h \| * `fcfe05990a` KVM: x86: move guest_pv_has out of user_access section \| * `85cfbaa575` KVM: x86: do not report preemption if the steal time cache is stale \| * `4bffae22be` KVM: x86: revalidate steal time cache if MSR value changes \| * `e10a73f538` KVM: x86: do not set st->preempted when going back to user space \| * `0296620043` KVM: x86: Remove obsolete disabling of page faults in kvm_arch_vcpu_put() \| * `8e39c2f407` KVM: Fix steal time asm constraints \| * `ebd3010d42` KVM: x86: Fix recording of guest steal time / preempted status \| * `4b19cbdb1d` KVM: x86: Ensure PV TLB flush tracepoint reflects KVM behavior \| * `01c0002ec7` drbd: correctly submit flush bio on barrier \| * `ef77d602e3` serial: 8250: Fix serial8250_tx_empty() race with DMA Tx \| * `1a8822343e` ext4: fix invalid free tracking in ext4_xattr_move_to_block() \| * `b0fc279de4` ext4: remove a BUG_ON in ext4_mb_release_group_pa() \| * `d88fe8e611` ext4: bail out of ext4_xattr_ibody_get() fails for any reason \| * `4597554b4f` ext4: add bounds checking in get_max_inline_xattr_value_size() \| * `5f8b55136a` ext4: fix deadlock when converting an inline directory in nojournal mode \| * `37c69da3ad` ext4: improve error recovery code paths in __ext4_remount() \| * `08838aeefa` ext4: check iomap type only if ext4_iomap_begin() does not fail \| * `4aa7f744fa` ext4: fix data races when using cached status extents \| * `0dde3141c5` ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum \| * `5d356d902e` ext4: fix WARNING in mb_find_extent \| * `529f41f0eb` KVM: x86: do not report a vCPU as preempted outside instruction boundaries \| * `0cb6e9e7d3` KVM: x86: hyper-v: Avoid calling kvm_make_vcpus_request_mask() with vcpu_mask==NULL \| * `4502ebbdc0` HID: wacom: insert timestamp to packed Bluetooth (BT) events \| * `77fd800d3f` HID: wacom: Set a default resolution for older tablets \| * `c1420276be` drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend \| * `20ca90ceda` drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras \| * `eed63477ae` drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini() \| * `c85327c1e9` drm/panel: otm8009a: Set backlight parent to panel device \| * `957904f531` f2fs: fix potential corruption when moving a directory \| * `4a638a9582` ARM: dts: s5pv210: correct MIPI CSIS clock name \| * `fed6318e47` ARM: dts: exynos: fix WM8960 clock name in Itop Elite \| * `777952ce11` remoteproc: st: Call of_node_put() on iteration error \| * `30e0834bec` remoteproc: stm32: Call of_node_put() on iteration error \| * `62fe5d74ef` sh: nmi_debug: fix return value of __setup handler \| * `9245f34029` sh: init: use OF_EARLY_FLATTREE for early init \| * `f19bc0d2a6` sh: mcount.S: fix build error when PRINTK is not enabled \| * `bbad64abd6` sh: math-emu: fix macro redefined warning \| * `2d65c97777` inotify: Avoid reporting event with invalid wd \| * `73aef14407` platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i \| * `4b87eec73e` platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet \| * `8c2cdb7326` cifs: fix pcchunk length type in smb2_copychunk_range \| * `829c20fd7a` btrfs: print-tree: parent bytenr must be aligned to sector size \| * `148b16cd30` btrfs: don't free qgroup space unless specified \| * `08fa23adbd` btrfs: fix btrfs_prev_leaf() to not return the same key twice \| * `7a4db11f00` perf symbols: Fix return incorrect build_id size in elf_read_build_id() \| * `87a1fa0ad7` crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs() \| * `be3517ae6b` perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() \| * `604b650fb5` perf pmu: zfree() expects a pointer to a pointer to zero it after freeing its contents \| * `1ebd0dfb27` perf vendor events power9: Remove UTF-8 characters from JSON files \| * `796616f216` net: enetc: check the index of the SFI rather than the handle \| * `b6b15de512` virtio_net: suppress cpu stall when free_unused_bufs \| * `c043714ef2` virtio_net: split free_unused_bufs() \| * `0773270b13` net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621 \| * `0f1ad0ef60` ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` \| * `7f497a9451` drm/amdgpu: add a missing lock for AMDGPU_SCHED \| * `f00ef2618f` af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). \| * `02359ba526` ionic: remove noise from ethtool rxnfc error msg \| * `3605b33184` octeontx2-vf: Detach LF resources on probe cleanup \| * `ea7453f5e5` octeontx2-pf: Disable packet I/O for graceful exit \| * `15152b8a4b` rxrpc: Fix hard call timeout units \| * `9291aba0ff` sfc: Fix module EEPROM reporting for QSFP modules \| * `774da70521` net/sched: act_mirred: Add carrier check \| * `f3fae1b1c7` watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe() \| * `3b7798b42e` writeback: fix call of incorrect macro \| * `f47f0fb5b5` net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu \| * `d6f0687d50` sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() \| * `7311c8be37` net/sched: cls_api: remove block_cb from driver_list before freeing \| * `cc8efc78c3` net/ncsi: clear Tx enable mode when handling a Config required AEN \| * `fa19c533ab` scsi: qedi: Fix use after free bug in qedi_remove() \| * `4285cc0a22` dm verity: fix error handling for check_at_most_once on FEC \| * `fc097cfca0` dm verity: skip redundant verity_handle_err() on I/O errors \| * `26b1b0d0be` mailbox: zynqmp: Fix counts of child nodes \| * `67fb57f247` mailbox: zynq: Switch to flexible array to simplify code \| * `c4e636f025` crypto: ccp - Clear PSP interrupt status register before calling handler \| * `6f60aae72c` ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus \| * `2fcb12b3f4` tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH \| * `6c2ee50c90` tty: clean include/linux/tty.h up \| * `57b510c7d3` tty: move some tty-only functions to drivers/tty/tty.h \| * `1924d47a28` tty: move some internal tty lock enums and functions out of tty.h \| * `f665d81ffa` tty: audit: move some local functions out of tty.h \| * `6a392b806f` tty: create internal tty.h file \| * `e044a24447` netfilter: nf_tables: deactivate anonymous set from preparation phase \| * `a222d2794c` scsi: target: core: Avoid smp_processor_id() in preemptible code \| * `14fc6af67b` arm64: dts: qcom: sdm845: correct dynamic power coefficients \| * `c820c05c5f` sound/oss/dmasound: fix 'dmasound_setup' defined but not used \| * `9079ff34a1` debugobject: Ensure pool refill (again) \| * `3f225f29c6` arm64: Stash shadow stack pointer in the task struct on interrupt * \| `d9baf420d0` Merge `9134b5a464` ("arm64: Always load shadow stack pointer directly from the task struct") into android12-5.10-lts \|\\| \| * `9134b5a464` arm64: Always load shadow stack pointer directly from the task struct * \| `4a2ed7d4bc` Merge `a25a403e4b` ("perf intel-pt: Fix CYC timestamps after standalone CBR") into android12-5.10-lts \|\\| \| * `a25a403e4b` perf intel-pt: Fix CYC timestamps after standalone CBR \| * `905f847675` perf auxtrace: Fix address filter entire kernel size * \| `5cb8a3c82c` Merge `ea827627a9` ("dm ioctl: fix nested locking in table_clear() to remove deadlock concern") into android12-5.10-lts \|\\| \| * `ea827627a9` dm ioctl: fix nested locking in table_clear() to remove deadlock concern * \| `e3f8cee7f9` Merge `a1e3fffe02` ("dm flakey: fix a crash with invalid table line") into android12-5.10-lts \|\\| \| * `a1e3fffe02` dm flakey: fix a crash with invalid table line * \| `eee3af95eb` Merge `44f29e93a5` ("dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path") into android12-5.10-lts \|\\| \| * `44f29e93a5` dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path * \| `7a6cb8c4fa` Merge `717ceb487b` ("dm clone: call kmem_cache_destroy() in dm_clone_init() error path") into android12-5.10-lts \|\\| \| * `717ceb487b` dm clone: call kmem_cache_destroy() in dm_clone_init() error path * \| `c7f1b9f365` Merge `eded3ad80a` ("ia64: fix an addr to taddr in huge_pte_offset()") into android12-5.10-lts \|\\| \| * `eded3ad80a` ia64: fix an addr to taddr in huge_pte_offset() \| * `abb427cb77` s390/dasd: fix hanging blockdevice after request requeue \| * `c96807a4ad` btrfs: scrub: reject unsupported scrub flags \| * `f7fd1eed31` scripts/gdb: fix lx-timerlist for Python3 \| * `9aabb5f9ef` afs: Fix updating of i_size with dv jump from server \| * `3530a795bb` mfd: tqmx86: Correct board names for TQMxE39x \| * `cbe060011b` mfd: tqmx86: Specify IO port register range more precisely \| * `640a1f7e36` mfd: tqmx86: Add support for TQMx110EB and TQMxE40x \| * `4be49b7c24` mfd: tqmx86: Remove incorrect TQMx90UC board ID \| * `6697a3b0ed` mfd: tqmx86: Do not access I2C_DETECT register through io_base \| * `15da2acad5` thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe \| * `08012d9edc` dmaengine: at_xdmac: do not enable all cyclic channels \| * `4f6303fd8f` dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing \| * `b295431945` dmaengine: dw-edma: Fix to change for continuous transfer \| * `da67d60467` phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port \| * `45e4c00940` pwm: mtk-disp: Disable shadow registers before setting backlight values \| * `6d13804388` pwm: mtk-disp: Adjust the clocks to avoid them mismatch \| * `060bd30bf7` pwm: mtk-disp: Don't check the return code of pwmchip_remove() \| * `795cec288e` leds: tca6507: Fix error handling of using fwnode_property_read_string \| * `033f00eb89` dmaengine: mv_xor_v2: Fix an error code. \| * `198fbdd106` leds: TI_LMU_COMMON: select REGMAP instead of depending on it \| * `770b061363` ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline \| * `8f009ae90b` openrisc: Properly store r31 to pt_regs on unhandled exceptions \| * `1fe1580521` clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails \| * `3bc78eddf0` RDMA/mlx5: Use correct device num_ports when modify DC \| * `95468f165d` SUNRPC: remove the maximum number of retries in call_bind_status \| * `50440cdb0b` RDMA/mlx5: Fix flow counter query via DEVX \| * `0d6a5c9489` Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe \| * `09bfd90d04` input: raspberrypi-ts: Release firmware handle when not needed \| * `3aa2503717` firmware: raspberrypi: Introduce devm_rpi_firmware_get() \| * `73a65744c7` NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease \| * `9c4c6512d7` IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests \| * `f84c025978` IB/hfi1: Add additional usdma traces \| * `1af73620a1` IB/hfi1: Add AIP tx traces \| * `823b59fc56` IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order \| * `8ec6acdb9b` RDMA/srpt: Add a check for valid 'mad_agent' pointer \| * `16f596cfe9` RDMA/cm: Trace icm_send_rej event before the cm state is reset \| * `3ef7a4c0d5` RDMA/siw: Remove namespace check from siw_netdev_event() \| * `ac7f79ee11` clk: add missing of_node_put() in "assigned-clocks" property parsing \| * `391fbf0d08` power: supply: generic-adc-battery: fix unit scaling \| * `9e5a7c1106` rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time \| * `9ad3221c86` RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() \| * `889a2070dc` rtc: omap: include header for omap_rtc_power_off_program prototype * \| `b38d756cea` Revert "workqueue: Rename "delayed" (delayed by active management) to "inactive"" * \| `24c41942a4` Revert "workqueue: Fix hung time report of worker pools" * \| `24c3784e97` Merge `647781347a` ("workqueue: Fix hung time report of worker pools") into android12-5.10-lts \|\\| \| * `647781347a` workqueue: Fix hung time report of worker pools \| * `77d9a64cfb` workqueue: Rename "delayed" (delayed by active management) to "inactive" * \| `de3c7c404a` Merge `960167e0e0` ("RDMA/rdmavt: Delete unnecessary NULL check") into android12-5.10-lts \|\\| \| * `960167e0e0` RDMA/rdmavt: Delete unnecessary NULL check \| * `f7790aecb3` RDMA/siw: Fix potential page_array out of range access \| * `ab8646c9a0` clk: at91: clk-sam9x60-pll: fix return value check \| * `8f381b2494` perf/core: Fix hardlockup failure caused by perf throttle \| * `3ea9186a3e` powerpc/rtas: use memmove for potentially overlapping buffer copy \| * `6339b9dcdb` macintosh: via-pmu-led: requires ATA to be set \| * `15f3a811bf` powerpc/sysdev/tsi108: fix resource printk format warnings \| * `4f41f55d82` powerpc/wii: fix resource printk format warnings \| * `701e3e5999` powerpc/mpc512x: fix resource printk format warning \| * `d68265ec0b` macintosh/windfarm_smu_sat: Add missing of_node_put() \| * `c45ab3ab9c` spmi: Add a check for remove callback when removing a SPMI driver \| * `4ca4a3e454` staging: rtl8192e: Fix W_DISABLE# does not work after stop/start \| * `d5d628fea5` serial: 8250: Add missing wakeup event reporting \| * `fde8ffaaac` tty: serial: fsl_lpuart: adjust buffer length to the intended size \| * `5a76bc35cc` firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe \| * `012936502a` usb: mtu3: fix kernel panic at qmu transfer done irq handler \| * `e8f64f3200` usb: chipidea: fix missing goto in `ci_hdrc_probe` \| * `7d667749b3` usb: gadget: tegra-xudc: Fix crash in vbus_draw \| * `95d97e182d` sh: sq: Fix incorrect element size for allocating bitmap buffer * \| `01e0792f60` Revert "uapi/linux/const.h: prefer ISO-friendly __typeof__" * \| `2343b43cca` Merge `a69eb1200e` ("uapi/linux/const.h: prefer ISO-friendly __typeof__") into android12-5.10-lts \|\\| \| * `a69eb1200e` uapi/linux/const.h: prefer ISO-friendly __typeof__ * \| `2dcf843019` Merge `fd7bf900c3` ("i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path") into android12-5.10-lts \|\\| \| * `fd7bf900c3` i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path \| * `b24f1ecc8f` spi: cadence-quadspi: fix suspend-resume implementations \| * `b5a6930fc6` ASoC: fsl_mqs: move of_node_put() to the correct location \| * `5bf2d84074` coresight: etm_pmu: Set the module field \| * `174d7483f1` scripts/gdb: bail early if there are no generic PD \| * `01710564a9` scripts/gdb: bail early if there are no clocks \| * `b4b4409510` ia64: salinfo: placate defined-but-not-used warning \| * `65b5b2c5fd` ia64: mm/contig: fix section mismatch warning/error \| * `fd4e45d8d7` PCI/EDR: Clear Device Status after EDR error recovery \| * `9e5ee4fa0d` of: Fix modalias string generation \| * `85b4aa4eb2` vmci_host: fix a race condition in vmci_host_poll() causing GPF \| * `4bdae667f9` spi: fsl-spi: Fix CPM/QE mode Litte Endian \| * `bc88243bbe` spi: qup: Don't skip cleanup in remove's error path \| * `00c5b5498b` linux/vt_buffer.h: allow either builtin or modular for macros \| * `d4a3c912c8` ASoC: es8316: Handle optional IRQ assignment \| * `67b6e077fb` ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ \| * `eb971efca7` PCI: imx6: Install the fault handler only on compatible match \| * `36c237b202` usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition \| * `aa93a46f99` spi: imx: Don't skip cleanup in remove's error path \| * `c3aba912f4` spi: spi-imx: using pm_runtime_resume_and_get instead of pm_runtime_get_sync \| * `f1f3bc9915` iio: light: max44009: add missing OF device matching \| * `ed1f459af6` fpga: bridge: fix kernel-doc parameter description \| * `98bf98e749` usb: dwc3: gadget: Change condition for processing suspend event \| * `8a859ac86d` usb: host: xhci-rcar: remove leftover quirk handling \| * `c76ba91791` pstore: Revert pmsg_lock back to a normal mutex \| * `7d285c6cfe` ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it \| * `230a5ed7d8` tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. \| * `0abcb0b0d6` net: amd: Fix link leak when verifying config failed \| * `b978d22fa1` netlink: Use copy_to_user() for optval in netlink_getsockopt(). \| * `0837d10f6c` Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" \| * `566785731c` ipv4: Fix potential uninit variable access bug in __ip_make_skb() \| * `4b8a05e380` net/sched: sch_fq: fix integer overflow of "credit" \| * `cb71b24a89` netfilter: nf_tables: don't write table validation state without mutex \| * `f4fc43fde1` bpf: Don't EFAULT for getsockopt with optval=NULL \| * `80090acb58` ixgbe: Enable setting RSS table to default values \| * `7a150a5b54` ixgbe: Allow flow hash to be set via ethtool \| * `89496d6cff` wifi: iwlwifi: fw: fix memory leak in debugfs \| * `f4eb14d261` wifi: iwlwifi: mvm: check firmware response size \| * `4ff7c0fbb3` wifi: iwlwifi: make the loop for card preparation effective \| * `62fde46517` jdb2: Don't refuse invalidation of already invalidated buffers \| * `038cbab550` wifi: iwlwifi: fw: move memset before early return \| * `c0ca382419` wifi: iwlwifi: yoyo: Fix possible division by zero \| * `2a65555f7e` md/raid10: fix memleak of md thread \| * `6361b0592b` md/raid10: fix memleak for 'conf->bio_split' \| * `1697fb124c` md/raid10: fix leak of 'r10bio->remaining' for recovery \| * `fcacaa9d04` bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap \| * `21f2503d37` nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" \| * `e119d19183` nvme: fix async event trace event \| * `a9e3d9bac9` nvme: handle the persistent internal error AER \| * `2f93072222` bpf, sockmap: fix deadlocks in the sockhash and sockmap \| * `2be04fa7ee` net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling \| * `bab8dc38b1` scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() \| * `b2f423fda6` f2fs: fix to avoid use-after-free for cached IPU bio \| * `5877980dc2` xsk: Fix unaligned descriptor validation \| * `2a67bc52cd` crypto: drbg - Only fail when jent is unavailable in FIPS mode \| * `9dbdedd44f` crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors \| * `27942f477d` bpftool: Fix bug for long instructions in program CFG dumps \| * `072d16abf5` selftests/bpf: Wait for receive in cg_storage_multi test \| * `d64a12eeb4` net: qrtr: correct types of trace event parameters \| * `dc55805db2` wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() \| * `c621697505` wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() * \| `be7602cdd6` Merge `adc2d82eee` ("crypto: sa2ul - Select CRYPTO_DES") into android12-5.10-lts \|\\| \| * `adc2d82eee` crypto: sa2ul - Select CRYPTO_DES \| * `de3908e151` crypto: caam - Clear some memory in instantiate_rng \| * `a8226a45b2` f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() \| * `d11a74577c` f2fs: apply zone capacity to all zone type \| * `d420c4a06d` f2fs: enforce single zone capacity \| * `c3a1914b96` f2fs: handle dqget error in f2fs_transfer_project_quota() \| * `202048ec1e` scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS \| * `bfe67e0563` scsi: target: iscsit: Fix TAS handling during conn cleanup \| * `e1f59cd18a` scsi: target: Fix multiple LUN_RESET handling \| * `008b936bbd` scsi: target: Make state_list per CPU \| * `7c8a29f1b2` scsi: target: Rename cmd.bad_sector to cmd.sense_info \| * `621c89a021` scsi: target: Rename struct sense_info to sense_detail \| * `05c6db12ae` net/packet: convert po->auxdata to an atomic flag \| * `5ca1be3658` net/packet: convert po->origdev to an atomic flag \| * `8bb81a925a` net/packet: annotate accesses to po->xmit \| * `ba6d56b20e` vlan: partially enable SIOCSHWTSTAMP in container \| * `118df5df1b` bpf: Remove misleading spec_v1 check on var-offset stack read \| * `10c1051267` scm: fix MSG_CTRUNC setting condition for SO_PASSSEC \| * `10702be8b3` bpf: fix precision propagation verbose logging \| * `6be8ad4cdc` bpf: take into account liveness when propagating precision \| * `243fab8e37` wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() \| * `1980dd8c53` wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() \| * `3ab6ec6c48` tools: bpftool: Remove invalid \' json escape \| * `1300517e37` wifi: ath6kl: reduce WARN to dev_dbg() in callback \| * `6c91b3b57b` wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() \| * `320d760a35` wifi: ath9k: hif_usb: fix memory leak of remain_skbs \| * `129c3fb579` wifi: ath6kl: minor fix for allocation size \| * `c401368926` tick/common: Align tick period with the HZ tick. \| * `107ea1f63b` tick: Get rid of tick_period \| * `fdc4876746` tick/sched: Optimize tick_do_update_jiffies64() further \| * `93c4300836` tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64() \| * `ca721584e9` tick/sched: Use tick_next_period for lockless quick check \| * `780f303233` drm/i915: Make intel_get_crtc_new_encoder() less oopsy \| * `9edf5518db` debugobject: Prevent init race with static objects \| * `f16f065f8c` arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step \| * `55fc2246c4` x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() \| * `dfce9bb351` regulator: stm32-pwr: fix of_iomap leak \| * `a6aeba550c` media: venus: dec: Fix handling of the start cmd \| * `3a227dc12b` media: venus: vdec: Handle DRC after drain \| * `5bac3de7f4` media: venus: preserve DRC state across seeks \| * `4c1239274f` media: venus: vdec: Make decoder return LAST flag for sufficient event \| * `a30297bff8` media: venus: vdec: Fix non reliable setting of LAST flag \| * `025a34716c` media: rc: gpio-ir-recv: Fix support for wake-up \| * `1acb982e36` media: rcar_fdp1: Fix refcount leak in probe and remove function \| * `ccc454881f` media: rcar_fdp1: Fix the correct variable assignments \| * `ee24c9e232` media: rcar_fdp1: Make use of the helper function devm_platform_ioremap_resource() \| * `bf91fb6c1e` media: rcar_fdp1: fix pm_runtime_get_sync() usage count \| * `21de9d0daa` media: rcar_fdp1: simplify error check logic at fdp_open() \| * `7dac96e9cc` media: saa7134: fix use after free bug in saa7134_finidev due to race condition \| * `e9d64e90a0` media: dm1105: Fix use after free bug in dm1105_remove due to race condition \| * `de19d02d73` media: rkvdec: fix use after free bug in rkvdec_remove \| * `4883f0f7ee` x86/apic: Fix atomic update of offset in reserve_eilvt_offset() \| * `06140d6dfe` regulator: core: Avoid lockdep reports when resolving supplies \| * `4c0b98d87c` regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() \| * `e21c93b20a` drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() \| * `0fc1a90bce` ARM: dts: gta04: fix excess dma channel usage \| * `f59421334e` mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data * \| `c83bfc082b` Merge `1487b29030` ("ACPI: processor: Fix evaluating _PDC method when running as Xen dom0") into android12-5.10-lts \|\\| \| * `1487b29030` ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 \| * `ee22417f82` drm: msm: adreno: Disable preemption on Adreno 510 \| * `00f02bb8cb` drm/msm/adreno: drop bogus pm_runtime_set_active() \| * `f9ba5962cc` drm/msm/adreno: Defer enabling runpm until hw_init() \| * `9a3a907cf6` media: max9286: Free control handler \| * `f8d28cecf2` drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 \| * `076cdba34d` firmware: qcom_scm: Clear download bit during reboot \| * `4362444dca` media: bdisp: Add missing check for create_workqueue \| * `a9b9ea0e63` x86/MCE/AMD: Use an u64 for bank_map \| * `a8504f9a13` ARM: dts: qcom: ipq8064: Fix the PCI I/O port range \| * `7d731faebc` ARM: dts: qcom: ipq8064: reduce pci IO size to 64K \| * `870644bf1b` ARM: dts: qcom: ipq4019: Fix the PCI I/O port range \| * `4585591295` arm64: dts: qcom: msm8996: Fix the PCI I/O port range \| * `b6082e8caa` arm64: dts: qcom: ipq8074: Fix the PCI I/O port range \| * `5f6302ab78` arm64: dts: qcom: msm8998: Fix the PCI I/O port range \| * `212352542d` arm64: dts: qcom: sdm845: Fix the PCI I/O port range \| * `eb9c5b383e` arm64: dts: qcom: sdm845: correct dynamic power coefficients \| * `94e6f7e757` arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name \| * `e951bdaa65` EDAC/skx: Fix overflows on the DRAM row address mapping arrays \| * `6e6c27b2fb` drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources \| * `9c4c9010ae` arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table \| * `fbfca9b839` arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table \| * `08310f8109` soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe \| * `a1e6a4161a` soc: ti: pm33xx: Enable basic PM runtime support for genpd \| * `e33f374d65` drm/probe-helper: Cancel previous job before starting new one \| * `67f07215eb` drm/vgem: add missing mutex_destroy \| * `ae784c3ed3` drm/rockchip: Drop unbalanced obj unref \| * `056a1217cf` erofs: fix potential overflow calculating xattr_isize \| * `7a4579cd6e` erofs: stop parsing non-compact HEAD index if clusterofs is invalid \| * `e5ec129158` tpm, tpm_tis: Claim locality when interrupts are reenabled on resume \| * `933bfc5ad2` tpm, tpm: Implement usage counter for locality \| * `140735c46d` tpm, tpm_tis: Claim locality before writing interrupt registers \| * `35ca7f6252` tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed \| * `cbb1dd2705` tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register \| * `c62a2331ab` tpm, tpm_tis: Do not skip reset of original interrupt vector \| * `3ec77043a2` selinux: ensure av_permissions.h is built when needed \| * `fea3144639` selinux: fix Makefile dependencies of flask.h \| * `0c29f14cf4` selftests/resctrl: Check for return value after write_schemata() \| * `4075fbcde4` selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem \| * `d0653cc6e0` rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check \| * `d1ab8b54b2` clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent * \| `6f849f24da` Merge `e0dd13b49d` ("wifi: rtl8xxxu: RTL8192EU always needs full init") into android12-5.10-lts \|\\| \| * `e0dd13b49d` wifi: rtl8xxxu: RTL8192EU always needs full init \| * `0fd9b0f611` mailbox: zynqmp: Fix typo in IPI documentation \| * `63314371eb` mailbox: zynqmp: Fix IPI isr handling \| * `bdbf104b1c` md/raid10: fix null-ptr-deref in raid10_sync_request \| * `8a89d36a07` nilfs2: fix infinite loop in nilfs_mdt_get_block() \| * `7c3e662048` nilfs2: do not write dirty data after degenerating to read-only \| * `e4b5264422` parisc: Fix argument pointer in real64_call_asm() \| * `be649ea153` sound/oss/dmasound: fix build when drivers are mixed =y/=m \| * `b8f444a4fa` ubifs: Free memory for tmpfile name \| * `5b4b6cb724` ubi: Fix return value overwrite issue in try_write_vid_and_data() \| * `66e9f2fb3e` ubifs: Fix memleak when insert_old_idx() failed \| * `a4904c56fc` Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" \| * `87d98984b0` iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE \| * `db8b34ffb2` i2c: omap: Fix standard mode false ACK readings \| * `2b00b2a0e6` writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs \| * `1b0df44753` relayfs: fix out-of-bounds access in relay_file_read \| * `e28df70df0` KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted \| * `680c419d0d` reiserfs: Add security prefix to xattr name in reiserfs_security_write() \| * `eb18bc5a86` rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed \| * `0a89d4a075` crypto: safexcel - Cleanup ring IRQ workqueues on load failure \| * `ff86deaba1` crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON() \| * `1c99f65d6a` ring-buffer: Sync IRQ works before buffer destruction \| * `dda1372c8d` pwm: meson: Fix g12a ao clk81 name \| * `c1cabb10e0` pwm: meson: Fix axg ao mux parents \| * `fcd2da2e6b` kheaders: Use array declaration instead of char \| * `1b633da2fe` ipmi: fix SSIF not responding under certain cond. \| * `6d5993d569` ipmi:ssif: Add send_retries increment * \| `d7203e0307` Merge `47e61cadc7` ("MIPS: fw: Allow firmware to pass a empty env") into android12-5.10-lts \|\\| \| * `47e61cadc7` MIPS: fw: Allow firmware to pass a empty env \| * `2884595932` tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem \| * `29b89908fd` xhci: fix debugfs register accesses while suspended \| * `a863ac03fa` staging: iio: resolver: ads1210: fix config mode \| * `c8714ddf3c` ext4: use ext4_journal_start/stop for fast commit transactions \| * `701a822076` blk-crypto: make blk_crypto_evict_key() more robust \| * `5072008bef` blk-crypto: make blk_crypto_evict_key() return void \| * `874bdf43b4` blk-mq: release crypto keyslot before reporting I/O complete \| * `68494eb75f` perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) \| * `7c5811b95c` posix-cpu-timers: Implement the missing timer_wait_running callback \| * `aed39acf7e` hwmon: (adt7475) Use device_property APIs when configuring polarity \| * `b009006887` hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write \| * `a71cb92ec4` USB: dwc3: fix runtime pm imbalance on unbind \| * `27dc207c38` USB: dwc3: fix runtime pm imbalance on probe errors \| * `b978269dda` PCI: qcom: Fix the incorrect register usage in v2.7.0 config \| * `2f31633da8` PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock \| * `5434c7019d` wireguard: timers: cast enum limits members to int in prints \| * `69fdbb334d` asm-generic/io.h: suppress endianness warnings for readq() and writeq() \| * `925cbb7253` ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 \| * `f5e96af71e` iio: adc: palmas_gpadc: fix NULL dereference on rmmod \| * `8aa079c2fd` driver core: Don't require dynamic_debug for initcall_debug probe timing \| * `f964a00386` USB: serial: option: add UNISOC vendor and TOZED LT70C product \| * `c0e9214223` x86/fpu: Prevent FPU state corruption \| * `98cfbad52f` bluetooth: Perform careful capability checks in hci_sock_ioctl() \| * `dc110b20f4` drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var \| * `549825602e` wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() \| * `1dd95b2109` KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg() \| * `0f29d0e8fc` counter: 104-quad-8: Fix race condition between FLAG and CNTR reads \| * `d4a895e924` seccomp: Move copy_seccomp() to no failure path. * \| `571879dd5f` Revert "sched/fair: Detect capacity inversion" * \| `ce3ecd63bf` Revert "sched/fair: Consider capacity inversion in util_fits_cpu()" * \| `652a7f2c7e` Revert "sched/uclamp: Fix a uninitialized variable warnings" * \| `e1be343429` Revert "sched/fair: Fixes for capacity inversion detection" * \| `4c20c2c837` Merge 5.10.179 into android12-5.10-lts \|\\| \| * `f1b32fda06` Linux 5.10.179 \| * `0367bf3f4a` ASN.1: Fix check for strdup() success \| * `4ab5f8f9d0` ASoC: fsl_asrc_dma: fix potential null-ptr-deref \| * `42604b4ad5` iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() \| * `155b2586de` pwm: hibvt: Explicitly set .polarity in .get_state() \| * `1c3a121137` pwm: iqs620a: Explicitly set .polarity in .get_state() \| * `b28079807d` pwm: meson: Explicitly set .polarity in .get_state() \| * `f69112de70` sctp: Call inet6_destroy_sock() via sk->sk_destruct(). \| * `7da54ddc04` dccp: Call inet6_destroy_sock() via sk->sk_destruct(). \| * `04d393c4bb` inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). \| * `b1f06ab985` tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). \| * `0e7b5e1020` udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). \| * `05cf34a2b6` ext4: fix use-after-free in ext4_xattr_set_entry \| * `c75711396c` ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() \| * `9400206d9d` Revert "ext4: fix use-after-free in ext4_xattr_set_entry" \| * `81775ab858` fuse: fix deadlock between atomic O_TRUNC and page invalidation \| * `03cefde986` fuse: always revalidate rename target dentry \| * `42dfdbd4dc` fuse: fix attr version comparison in fuse_read_update_size() \| * `0078a1667c` fuse: check s_root when destroying sb \| * `6d0d67b05f` virtiofs: split requests that exceed virtqueue size \| * `cf08dc7916` virtiofs: clean up error handling in virtio_fs_get_tree() \| * `e220438d1e` purgatory: fix disabling debug info \| * `37df709706` docs: futex: Fix kernel-doc references after code split-up preparation \| * `77748b0a04` MIPS: Define RUNTIME_DISCARD_EXIT in LD script \| * `4735b6f74f` sched/fair: Fixes for capacity inversion detection \| * `89ad8a672f` sched/uclamp: Fix a uninitialized variable warnings \| * `09129798a6` sched/fair: Consider capacity inversion in util_fits_cpu() \| * `30f04dd56d` sched/fair: Detect capacity inversion \| * `b18cbd359d` sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition \| * `41a880740c` sched/uclamp: Make cpu_overutilized() use util_fits_cpu() \| * `07750955e9` sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() \| * `2fd1c194e6` sched/uclamp: Make select_idle_capacity() use util_fits_cpu() \| * `8ca2bf63d9` sched/uclamp: Fix fits_capacity() check in feec() \| * `5cb1a56ced` sched/uclamp: Make task_fits_capacity() use util_fits_cpu() \| * `2523d9d7bb` mm/khugepaged: check again on anon uffd-wp during isolation \| * `651b0bf43d` mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 \| * `c61928fcca` kernel/sys.c: fix and improve control flow in __sys_setres[ug]id() \| * `e10a6d88ae` memstick: fix memory leak if card device is never registered \| * `2c90ef3715` nilfs2: initialize unused bytes in segment summary blocks \| * `09daff9c3c` iio: light: tsl2772: fix reading proximity-diodes from device tree \| * `77ac8f2ad4` xfs: drop submit side trans alloc for append ioends \| * `a4e800a7bd` powerpc/doc: Fix htmldocs errors \| * `c215c63681` xen/netback: use same error messages for same errors \| * `0c9cbfc951` nvme-tcp: fix a possible UAF when failing to allocate an io queue \| * `8c746b6650` s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling \| * `a36246a748` net: dsa: b53: mmap: add phy ops \| * `b33f28ea45` scsi: core: Improve scsi_vpd_inquiry() checks \| * `24ddcc6a63` scsi: megaraid_sas: Fix fw_crash_buffer_show() \| * `01bd481b1b` selftests: sigaltstack: fix -Wuninitialized \| * `8b44a83a16` Input: i8042 - add quirk for Fujitsu Lifebook A574/H \| * `37882b203a` f2fs: Fix f2fs_truncate_partial_nodes ftrace event \| * `9a8dbfd7f3` e1000e: Disable TSO on i219-LM card to increase speed \| * `b1281d0088` bpf: Fix incorrect verifier pruning due to missing register precision taints \| * `b085b5787b` mlxsw: pci: Fix possible crash during initialization \| * `c972851d38` net: rpl: fix rpl header size calculation \| * `b6b06c5ee3` mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() \| * `880c09bc2f` i40e: fix i40e_setup_misc_vector() error handling \| * `72df55d3dc` i40e: fix accessing vsi->active_filters without holding lock \| * `381110d061` netfilter: nf_tables: fix ifdef to also consider nf_tables=m \| * `6758a51ef3` sfc: Fix use-after-free due to selftest_work \| * `06a72bbf0d` sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP. \| * `b6dd232f63` virtio_net: bugfix overflow inside xdp_linearize_page() \| * `ddcf35deb8` net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg \| * `8e73952957` regulator: fan53555: Explicitly include bits header \| * `3224458030` netfilter: br_netfilter: fix recent physdev match breakage \| * `08b78037c4` arm64: dts: imx8mm-evk: correct pmic clock source \| * `2c06e904c2` arm64: dts: meson-g12-common: specify full DMC range \| * `b33dbd06ac` arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node \| * `e662521ec7` ARM: dts: rockchip: fix a typo error for rk3288 spdif node * \| `b6b9dff07b` Merge branch android12-5.10 into android12-5.10-lts * \| `49df5be923` Revert "ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()" * \| `a406acdee0` ANDROID: preserve CRC for xhci symbols * \| `a4023d8fc3` Revert "ipv4: shrink netns_ipv4 with sysctl conversions" * \| `e2f3aab65b` Revert "tcp: convert elligible sysctls to u8" * \| `036fa20734` Revert "tcp: restrict net.ipv4.tcp_app_win" * \| `2d6a4ad08c` Merge 5.10.178 into android12-5.10-lts \|/ * `791a854ae5` Linux 5.10.178 * `f177b382c3` sysctl: Fix data-races in proc_dou8vec_minmax(). * `56314b90fd` panic, kexec: make __crash_kexec() NMI safe * `d425f34821` kexec: turn all kexec_mutex acquisitions into trylocks * `784b6ba15e` kexec: move locking into do_kexec_load * `0b077b22ea` riscv: Handle zicsr/zifencei issues between clang and binutils * `c36a251011` kbuild: check CONFIG_AS_IS_LLVM instead of LLVM_IAS * `d5f67f6d4e` kbuild: Switch to 'f' variants of integrated assembler flag * `83f55e6f29` kbuild: check the minimum assembler version in Kconfig * `6facabb4d0` coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug * `7b78445bce` watchdog: sbsa_wdog: Make sure the timeout programming is within the limits * `10b7a33c5d` i2c: ocores: generate stop condition after timeout in polling mode * `b4210b10dc` x86/rtc: Remove __init for runtime functions * `ba4a2f6d99` sched/fair: Fix imbalance overflow * `68387ae3b6` sched/fair: Move calculate of avg_load to a better location * `ccbec01cc9` powerpc/papr_scm: Update the NUMA distance table for the target node * `453b3188be` powerpc/pseries: Add support for FORM2 associativity * `498618e0a1` powerpc/pseries: Add a helper for form1 cpu distance * `18ce785eff` powerpc/pseries: Consolidate different NUMA distance update code paths * `f2ae0eb96b` powerpc/pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY * `f6d8a3a2ea` powerpc/pseries: rename min_common_depth to primary_domain_index * `5abf8af8df` ubi: Fix deadlock caused by recursively holding work_sem * `33611d4a81` mtd: ubi: wl: Fix a couple of kernel-doc issues * `0279e82e14` ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size * `37a3cf4abc` cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() * `10bda0ec31` x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot * `176d7345b8` scsi: ses: Handle enclosure with just a primary component gracefully * `cf22c98bcb` net: sfp: initialize sfp->i2c_block_size at sfp allocation * `2a4835b8ed` riscv: add icache flush for nommu sigreturn trampoline * `c76e79e526` asymmetric_keys: log on fatal failures in PE/pkcs7 * `5de2e1f5e2` verify_pefile: relax wrapper length check * `e4b9f0bf91` drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F * `9f0ee9ed54` efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L * `e1f80b4dfa` i2c: imx-lpi2c: clean rx/tx buffers upon new message * `81c30f89b9` wifi: mwifiex: mark OF related data as maybe unused * `ab39582f30` power: supply: cros_usbpd: reclassify "default case!" as debug * `6de0d0699f` libbpf: Fix single-line struct definition output in btf_dump * `1bec9da233` net: macb: fix a memory corruption in extended buffer descriptor mode * `7d8c844b33` udp6: fix potential access to stale information * `d1b9b31916` RDMA/core: Fix GID entry ref leak when create_ah fails * `79b28f4221` sctp: fix a potential overflow in sctp_ifwdtsn_skip * `3814d211ff` net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() * `dad92d8ada` qlcnic: check pci_reset_function result * `4a519731ec` drm/armada: Fix a potential double free in an error handling path * `a069d4d98c` tcp: restrict net.ipv4.tcp_app_win * `cc9f9a49f5` tcp: convert elligible sysctls to u8 * `f662a0786d` ipv4: shrink netns_ipv4 with sysctl conversions * `389dab6142` sysctl: add proc_dou8vec_minmax() * `8a1fdb3545` niu: Fix missing unwind goto in niu_alloc_channels() * `9266e939d7` 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition * `ae11498851` RDMA/cma: Allow UD qp_type to join multicast only * `5e567fd296` IB/mlx5: Add support for 400G_8X lane speed * `a1d2fb5d13` IB/mlx5: Add support for NDR link speed * `8a886f01b8` clk: sprd: set max_register according to mapping range * `6e2845284b` mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min * `9e946e4e8c` mtd: rawnand: stm32_fmc2: remove unsupported EDO mode * `6b0e719192` mtd: rawnand: meson: fix bitmask for length in command word * `441e57ff87` mtdblock: tolerate corrected bit-flips * `0d07ea8d38` fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace * `5635e69406` btrfs: fix fast csum implementation detection * `3576e08f19` btrfs: print checksum type and implementation at mount time * `f7ec5ca433` Bluetooth: Fix race condition in hidp_session_thread * `d9ba36c22a` Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} * `8533fe8645` ALSA: hda/sigmatel: fix S/PDIF out on Intel D45 motherboards * `8f6a20a4f4` ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() * `69108a8a45` ALSA: i2c/cs8427: fix iec958 mixer control deactivation * `e63a515d11` ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard * `df4af0ddf7` ALSA: emu10k1: fix capture interrupt handler unlinking * `14e90335bc` Revert "pinctrl: amd: Disable and mask interrupts on resume" * `59dc9767ce` bpftool: Print newline before '}' for struct with padding only fields * `2765aca637` ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown * `a412ba6b6c` Revert "media: ti: cal: fix possible memory leak in cal_ctx_create()" * `2d96c8dca9` drm/bridge: lt9611: Fix PLL being unable to lock * `a2773afc81` selftests: intel_pstate: ftime() is deprecated * `ea8c42b3b6` mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() * `5a74837809` ring-buffer: Fix race while reader and writer are on the same page * `c1bbe926a1` drm/nouveau/disp: Support more modes by checking with lower bpc * `8250f7f7ae` drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path * `acbbfdba9c` ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() * `6e36373aa5` tracing: Free error logs of tracing instances * `9c5df2f14e` can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events * `70caa596d1` can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access * `f018ef34c4` ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() * `eadcad0a47` ftrace: Mark get_lock_parent_ip() __always_inline * `9470fc63ab` perf/core: Fix the same task check in perf_event_set_output * `499757ad33` scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() * `4bfdead174` iio: adc: ad7791: fix IRQ flags * `14f9ff7857` ALSA: hda/realtek: Add quirk for Clevo X370SNW * `1f3b8c3b04` dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs * `3dbee84bf9` nilfs2: fix sysfs interface lifetime * `f32297dba3` nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() * `a17bed82c0` tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty * `25eff5e7f7` tty: serial: sh-sci: Fix Rx on RZ/G2L SCI * `72a3e4fa88` tty: serial: sh-sci: Fix transmit end interrupt handler * `741d73fc57` iio: light: cm32181: Unregister second I2C client if present * `58bf30479a` iio: dac: cio-dac: Fix max DAC write value check for 12-bit * `f47659f1e9` iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip * `52a003870e` USB: serial: option: add Quectel RM500U-CN modem * `e6655d4837` USB: serial: option: add Telit FE990 compositions * `9d1f2a6b8d` usb: typec: altmodes/displayport: Fix configure initial pin assignment * `4be2b71e9d` USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs * `ec20260950` xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu * `b4b4f17aa4` usb: xhci: tegra: fix sleep in atomic call * `07216da8fb` NFSD: callback request does not use correct credential for AUTH_SYS * `a3c4aa48e5` sunrpc: only free unix grouplist after RCU settles * `890517a4a2` net: stmmac: fix up RX flow hash indirection table when setting channels * `bdbbd3fa58` net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe * `d8c8476c14` gpio: davinci: Add irq chip flag to skip set wake * `605b056d63` ipv6: Fix an uninit variable access bug in __ip6_make_skb() * `ff2565fb8f` net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT * `b4b6dfad41` sctp: check send stream number after wait_for_sndbuf * `efda95cebf` net: don't let netpoll invoke NAPI if in xmit context * `ec81049f09` icmp: guard against too small mtu * `98a9cd82c5` net: qrtr: Fix a refcount bug in qrtr_recvmsg() * `94c53d2949` net: qrtr: combine nameservice into main module * `3fe2051544` wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta * `2951229ee7` KVM: s390: pv: fix external interruption loop not always detected * `b43a8939f1` pwm: sprd: Explicitly set .polarity in .get_state() * `d59b83494d` pwm: cros-ec: Explicitly set .polarity in .get_state() * `176c6b4889` Drivers: vmbus: Check for channel allocation before looking up relids * `c51b336bd9` gpio: GPIO_REGMAP: select REGMAP instead of depending on it Change-Id: I6a8130fdb5232ff7293bdb1bb84c5dc6dd2f4d47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-07-10 16:27:04 +00:00
Greg Kroah-Hartman	44da38b39c	ANDROID: GKI: fix up sysctl_vals ABI change. In commit `1ac6e9ee84` ("sysctl: move some boundary constants from sysctl.c to sysctl_vals"), the sysctl_vals variable got changed, but unfortunatly many Android vendors liked using that array. To preserve the ABI, put the array back the way it was and rename the new change to be `android_gki_sysctl_vals` instead, and move the #defines to use it. This way if any external code is rebuilt, it will use the new symbols, but if not, the old ones will still work just as before, not requiring a rebuild at all. Bug: 161946584 Fixes: `1ac6e9ee84` ("sysctl: move some boundary constants from sysctl.c to sysctl_vals") Change-Id: Ib094ae03682e11fee4f0b06af362541bbcba24d5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-07-10 16:22:13 +00:00
Greg Kroah-Hartman	02a1b32243	Merge 5.10.186 into android12-5.10-lts Changes in 5.10.186 drm/amd/display: fix the system hang while disable PSR net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs tracing: Add tracing_reset_all_online_cpus_unlocked() function tick/common: Align tick period during sched_timer setup selftests: mptcp: lib: skip if missing symbol selftests: mptcp: lib: skip if not below kernel version selftests: mptcp: pm nl: remove hardcoded default limits selftests: mptcp: join: skip check if MIB counter not supported nilfs2: fix buffer corruption due to concurrent device reads Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs PCI: hv: Fix a race condition bug in hv_pci_query_relations() Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic cgroup: Do not corrupt task iteration when rebinding subsystem mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 mmc: meson-gx: remove redundant mmc_request_done() call from irq context mmc: mmci: stm32: fix max busy timeout calculation ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK regmap: spi-avmm: Fix regmap_bus max_raw_write writeback: fix dereferencing NULL mapping->host on writeback_page_template io_uring/net: save msghdr->msg_control for retries io_uring/net: clear msg_controllen on partial sendmsg retry io_uring/net: disable partial retries for recvmsg with cmsg nilfs2: prevent general protection fault in nilfs_clear_dirty_page() x86/mm: Avoid using set_pgd() outside of real PGD pages mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30% sysctl: move some boundary constants from sysctl.c to sysctl_vals memfd: check for non-NULL file_seals in memfd_create() syscall ieee802154: hwsim: Fix possible memory leaks xfrm: Treat already-verified secpath entries as optional xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c xfrm: Ensure policies always checked on XFRM-I input path bpf: track immediate values written to stack by BPF_ST instruction bpf: Fix verifier id tracking of scalars on spill xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets selftests: net: vrf-xfrm-tests: change authentication and encryption algos selftests: net: fcnal-test: check if FIPS mode is enabled xfrm: Linearize the skb after offloading if needed. net: qca_spi: Avoid high load if QCA7000 is not available mmc: mtk-sd: fix deferred probing mmc: mvsdio: fix deferred probing mmc: omap: fix deferred probing mmc: omap_hsmmc: fix deferred probing mmc: owl: fix deferred probing mmc: sdhci-acpi: fix deferred probing mmc: sh_mmcif: fix deferred probing mmc: usdhi60rol0: fix deferred probing ipvs: align inner_mac_header for encapsulation net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch be2net: Extend xmit workaround to BE3 chip netfilter: nft_set_pipapo: .walk does not deal with generations netfilter: nf_tables: disallow element updates of bound anonymous sets netfilter: nfnetlink_osf: fix module autoload Revert "net: phy: dp83867: perform soft reset and retain established link" sch_netem: acquire qdisc lock in netem_change() gpio: Allow per-parent interrupt data gpiolib: Fix GPIO chip IRQ initialization restriction scsi: target: iscsi: Prevent login threads from racing between each other HID: wacom: Add error check to wacom_parse_and_register() arm64: Add missing Set/Way CMO encodings media: cec: core: don't set last_initiator if tx in progress nfcsim.c: Fix error checking for debugfs_create_dir usb: gadget: udc: fix NULL dereference in remove() Input: soc_button_array - add invalid acpi_index DMI quirk handling s390/cio: unregister device when the only path is gone spi: lpspi: disable lpspi module irq in DMA mode ASoC: simple-card: Add missing of_node_put() in case of error ASoC: nau8824: Add quirk to active-high jack-detect s390/purgatory: disable branch profiling ARM: dts: Fix erroneous ADS touchscreen polarities drm/exynos: vidi: fix a wrong error return drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle netfilter: nftables: statify nft_parse_register() netfilter: nf_tables: validate registers coming from userspace. netfilter: nf_tables: hold mutex on netns pre_exit path bpf/btf: Accept function names that contain dots Linux 5.10.186 Change-Id: I2c45f6bd0cb20e43ac316ed751d2708315db80f0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-30 12:27:51 +00:00
Chao Yu	69dc2c1a79	UPSTREAM: f2fs: fix to avoid use-after-free for cached IPU bio [ Upstream commit 5cdb422c839134273866208dad5360835ddb9794 ] xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619! RIP: 0010:folio_end_writeback+0x8a/0x90 Call Trace: end_page_writeback+0x1c/0x60 f2fs_write_end_io+0x199/0x420 bio_endio+0x104/0x180 submit_bio_noacct+0xa5/0x510 submit_bio+0x48/0x80 f2fs_submit_write_bio+0x35/0x300 f2fs_submit_merged_ipu_write+0x2a0/0x2b0 f2fs_write_single_data_page+0x838/0x8b0 f2fs_write_cache_pages+0x379/0xa30 f2fs_write_data_pages+0x30c/0x340 do_writepages+0xd8/0x1b0 __writeback_single_inode+0x44/0x370 writeback_sb_inodes+0x233/0x4d0 __writeback_inodes_wb+0x56/0xf0 wb_writeback+0x1dd/0x2d0 wb_workfn+0x367/0x4a0 process_one_work+0x21d/0x430 worker_thread+0x4e/0x3c0 kthread+0x103/0x130 ret_from_fork+0x2c/0x50 The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write() in f2fs_write_single_data_page() tries to flush IPU bio in cache, however f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter, result in submitting random cached bio which belong to other IO context, then it will cause use-after-free issue, fix it by adding additional validity check. Fixes: `0b20fcec86` ("f2fs: cache global IPU bio") Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Bug: 268109575 Change-Id: Ifbdad0f8e8b51592ed63d025cf13965e623a7956 Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>	2023-06-29 13:13:11 +00:00
Greg Kroah-Hartman	c6ac900e26	Merge 5.10.185 into android12-5.10-lts Changes in 5.10.185 lib: cleanup kstrto*() usage kernel.h: split out kstrtox() and simple_strtox() to a separate header test_firmware: Use kstrtobool() instead of strtobool() test_firmware: prevent race conditions by a correct implementation of locking test_firmware: fix a memory leak with reqs buffer power: supply: ab8500: Fix external_power_changed race power: supply: sc27xx: Fix external_power_changed race power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() ARM: dts: vexpress: add missing cache properties tools: gpio: fix debounce_period_us output of lsgpio power: supply: Ratelimit no data debug output platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 regulator: Fix error checking for debugfs_create_dir irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues power: supply: Fix logic checking if system is running from battery btrfs: scrub: try harder to mark RAID56 block groups read-only btrfs: handle memory allocation failure in btrfs_csum_one_bio ASoC: soc-pcm: test if a BE can be prepared parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() MIPS: Alchemy: fix dbdma2 mips: Move initrd_start check after initrd address sanitisation. ASoC: dwc: move DMA init to snd_soc_dai_driver probe() xen/blkfront: Only check REQ_FUA for writes drm:amd:amdgpu: Fix missing buffer object unlock in failure path irqchip/gic: Correctly validate OF quirk descriptors io_uring: hold uring mutex around poll removal epoll: ep_autoremove_wake_function should use list_del_init_careful ocfs2: fix use-after-free when unmounting read-only filesystem ocfs2: check new file size on fallocate call nios2: dts: Fix tse_mac "max-frame-size" property nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() nilfs2: fix possible out-of-bounds segment allocation in resize ioctl kexec: support purgatories with .text.hot sections x86/purgatory: remove PGO flags powerpc/purgatory: remove PGO flags nouveau: fix client work fence deletion race RDMA/uverbs: Restrict usage of privileged QKEYs net: usb: qmi_wwan: add support for Compal RXM-G1 ALSA: hda/realtek: Add a quirk for Compaq N14JP6 Remove DECnet support from kernel USB: serial: option: add Quectel EM061KGL series serial: lantiq: add missing interrupt ack usb: dwc3: gadget: Reset num TRBs before giving back the request RDMA/rtrs: Fix the last iu->buf leak in err path spi: fsl-dspi: avoid SCK glitches with continuous transfers netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM net: enetc: correct the indexes of highest and 2nd highest TCs ping6: Fix send to link-local addresses with VRF. net/sched: cls_u32: Fix reference counter leak leading to overflow RDMA/rxe: Remove the unused variable obj RDMA/rxe: Removed unused name from rxe_task struct RDMA/rxe: Fix the use-before-initialization error of resp_pkts iavf: remove mask from iavf_irq_enable_queues() octeontx2-af: fixed resource availability check RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions RDMA/cma: Always set static rate to 0 for RoCE IB/uverbs: Fix to consider event queue closing also upon non-blocking mode IB/isert: Fix dead lock in ib_isert IB/isert: Fix possible list corruption in CMA handler IB/isert: Fix incorrect release of isert connection ipvlan: fix bound dev checking for IPv6 l3s mode sctp: fix an error code in sctp_sf_eat_auth() igb: fix nvm.ops.read() error handling drm/nouveau: don't detect DSM for non-NVIDIA device drm/nouveau/dp: check for NULL nv_connector->native_mode drm/nouveau: add nv_encoder pointer check for NULL ext4: drop the call to ext4_error() from ext4_get_group_info() net/sched: cls_api: Fix lockup on flushing explicitly created chain net: lapbether: only support ethernet devices net: tipc: resize nlattr array to correct size selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET afs: Fix vlserver probe RTT handling cgroup: always put cset in cgroup_css_set_put_fork rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period neighbour: Remove unused inline function neigh_key_eq16() net: Remove unused inline function dst_hold_and_use() net: Remove DECnet leftovers from flow.h. neighbour: delete neigh_lookup_nodev as not used batman-adv: Switch to kstrtox.h for kstrtou64 mmc: block: ensure error propagation for non-blk mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block nilfs2: reject devices with insufficient block count media: dvbdev: Fix memleak in dvb_register_device media: dvbdev: fix error logic at dvb_register_device() media: dvb-core: Fix use-after-free due to race at dvb_register_device() drm/i915/dg1: Wait for pcode/uncore handshake at startup drm/i915/gen11+: Only load DRAM information from pcode um: Fix build w/o CONFIG_PM_SLEEP Linux 5.10.185 Change-Id: I05ba9c2e38c013c553c9f89e2a6b71ec9bdb0bd3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-28 10:31:14 +00:00

1 2 3 4 5 ...

70276 Commits