Duoming Zhou 42f8ba8355 media: usb: siano: Fix use after free bugs caused by do_submit_urb ... [ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ] There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below: [ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 [ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 [ 36.408316] [ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 [ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.416157] Workqueue: 0x0 (events) [ 36.417654] Call Trace: [ 36.418546] <TASK> [ 36.419320] dump_stack_lvl+0x96/0xd0 [ 36.420522] print_address_description+0x75/0x350 [ 36.421992] print_report+0x11b/0x250 [ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 [ 36.424806] ? __virt_addr_valid+0xcf/0x170 [ 36.426069] ? worker_thread+0x4a2/0x890 [ 36.427355] kasan_report+0x131/0x160 [ 36.428556] ? worker_thread+0x4a2/0x890 [ 36.430053] worker_thread+0x4a2/0x890 [ 36.431297] ? worker_clr_flags+0x90/0x90 [ 36.432479] kthread+0x166/0x190 [ 36.433493] ? kthread_blkcg+0x50/0x50 [ 36.434669] ret_from_fork+0x22/0x30 [ 36.435923] </TASK> [ 36.436684] [ 36.437215] Allocated by task 24: [ 36.438289] kasan_set_track+0x50/0x80 [ 36.439436] __kasan_kmalloc+0x89/0xa0 [ 36.440566] smsusb_probe+0x374/0xc90 [ 36.441920] usb_probe_interface+0x2d1/0x4c0 [ 36.443253] really_probe+0x1d5/0x580 [ 36.444539] __driver_probe_device+0xe3/0x130 [ 36.446085] driver_probe_device+0x49/0x220 [ 36.447423] __device_attach_driver+0x19e/0x1b0 [ 36.448931] bus_for_each_drv+0xcb/0x110 [ 36.450217] __device_attach+0x132/0x1f0 [ 36.451470] bus_probe_device+0x59/0xf0 [ 36.452563] device_add+0x4ec/0x7b0 [ 36.453830] usb_set_configuration+0xc63/0xe10 [ 36.455230] usb_generic_driver_probe+0x3b/0x80 [ 36.456166] printk: console [ttyGS0] disabled [ 36.456569] usb_probe_device+0x90/0x110 [ 36.459523] really_probe+0x1d5/0x580 [ 36.461027] __driver_probe_device+0xe3/0x130 [ 36.462465] driver_probe_device+0x49/0x220 [ 36.463847] __device_attach_driver+0x19e/0x1b0 [ 36.465229] bus_for_each_drv+0xcb/0x110 [ 36.466466] __device_attach+0x132/0x1f0 [ 36.467799] bus_probe_device+0x59/0xf0 [ 36.469010] device_add+0x4ec/0x7b0 [ 36.470125] usb_new_device+0x863/0xa00 [ 36.471374] hub_event+0x18c7/0x2220 [ 36.472746] process_one_work+0x34c/0x5b0 [ 36.474041] worker_thread+0x4b7/0x890 [ 36.475216] kthread+0x166/0x190 [ 36.476267] ret_from_fork+0x22/0x30 [ 36.477447] [ 36.478160] Freed by task 24: [ 36.479239] kasan_set_track+0x50/0x80 [ 36.480512] kasan_save_free_info+0x2b/0x40 [ 36.481808] ____kasan_slab_free+0x122/0x1a0 [ 36.483173] __kmem_cache_free+0xc4/0x200 [ 36.484563] smsusb_term_device+0xcd/0xf0 [ 36.485896] smsusb_probe+0xc85/0xc90 [ 36.486976] usb_probe_interface+0x2d1/0x4c0 [ 36.488303] really_probe+0x1d5/0x580 [ 36.489498] __driver_probe_device+0xe3/0x130 [ 36.491140] driver_probe_device+0x49/0x220 [ 36.492475] __device_attach_driver+0x19e/0x1b0 [ 36.493988] bus_for_each_drv+0xcb/0x110 [ 36.495171] __device_attach+0x132/0x1f0 [ 36.496617] bus_probe_device+0x59/0xf0 [ 36.497875] device_add+0x4ec/0x7b0 [ 36.498972] usb_set_configuration+0xc63/0xe10 [ 36.500264] usb_generic_driver_probe+0x3b/0x80 [ 36.501740] usb_probe_device+0x90/0x110 [ 36.503084] really_probe+0x1d5/0x580 [ 36.504241] __driver_probe_device+0xe3/0x130 [ 36.505548] driver_probe_device+0x49/0x220 [ 36.506766] __device_attach_driver+0x19e/0x1b0 [ 36.508368] bus_for_each_drv+0xcb/0x110 [ 36.509646] __device_attach+0x132/0x1f0 [ 36.510911] bus_probe_device+0x59/0xf0 [ 36.512103] device_add+0x4ec/0x7b0 [ 36.513215] usb_new_device+0x863/0xa00 [ 36.514736] hub_event+0x18c7/0x2220 [ 36.516130] process_one_work+0x34c/0x5b0 [ 36.517396] worker_thread+0x4b7/0x890 [ 36.518591] kthread+0x166/0x190 [ 36.519599] ret_from_fork+0x22/0x30 [ 36.520851] [ 36.521405] Last potentially related work creation: [ 36.523143] kasan_save_stack+0x3f/0x60 [ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0 [ 36.525831] insert_work+0x25/0x130 [ 36.527039] __queue_work+0x4d4/0x620 [ 36.528236] queue_work_on+0x72/0xb0 [ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0 [ 36.530819] dummy_timer+0x350/0x1a40 [ 36.532149] call_timer_fn+0x2c/0x190 [ 36.533567] expire_timers+0x69/0x1f0 [ 36.534736] __run_timers+0x289/0x2d0 [ 36.535841] run_timer_softirq+0x2d/0x60 [ 36.537110] __do_softirq+0x116/0x380 [ 36.538377] [ 36.538950] Second to last potentially related work creation: [ 36.540855] kasan_save_stack+0x3f/0x60 [ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0 [ 36.543592] insert_work+0x25/0x130 [ 36.544891] __queue_work+0x4d4/0x620 [ 36.546168] queue_work_on+0x72/0xb0 [ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0 [ 36.548805] dummy_timer+0x350/0x1a40 [ 36.550116] call_timer_fn+0x2c/0x190 [ 36.551570] expire_timers+0x69/0x1f0 [ 36.552762] __run_timers+0x289/0x2d0 [ 36.553916] run_timer_softirq+0x2d/0x60 [ 36.555118] __do_softirq+0x116/0x380 [ 36.556239] [ 36.556807] The buggy address belongs to the object at ffff888005960000 [ 36.556807] which belongs to the cache kmalloc-4k of size 4096 [ 36.560652] The buggy address is located 232 bytes inside of [ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000) [ 36.564791] [ 36.565355] The buggy address belongs to the physical page: [ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00 [ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0 [ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000 [ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 36.580175] page dumped because: kasan: bad access detected [ 36.581994] [ 36.582548] Memory state around the buggy address: [ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.591071] ^ [ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.598026] ================================================================== [ 36.600224] Disabling lock debugging due to kernel taint [ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I [ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8 [ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.615026] Workqueue: events do_submit_urb [ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 [ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 [ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 [ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 [ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 [ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f [ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 [ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 [ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 [ 36.643411] Call Trace: [ 36.644215] <TASK> [ 36.644902] smscore_getbuffer+0x3e/0x1e0 [ 36.646147] do_submit_urb+0x4f/0x190 [ 36.647449] process_one_work+0x34c/0x5b0 [ 36.648777] worker_thread+0x4b7/0x890 [ 36.649984] ? worker_clr_flags+0x90/0x90 [ 36.651166] kthread+0x166/0x190 [ 36.652151] ? kthread_blkcg+0x50/0x50 [ 36.653547] ret_from_fork+0x22/0x30 [ 36.655051] </TASK> [ 36.655733] Modules linked in: [ 36.656787] ---[ end trace 0000000000000000 ]--- [ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 [ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 [ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 [ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 [ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 [ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f [ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 [ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 [ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 [ 36.685733] Kernel panic - not syncing: Fatal exception [ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff) [ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]--- When the siano device is plugged in, it may call the following functions to initialize the device. smsusb_probe()-->smsusb_init_device()-->smscore_start_device(). When smscore_start_device() gets failed, the function smsusb_term_device() will be called and smsusb_device_t will be deallocated. Although we use usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests and wait for them to finish, the worker threads that are scheduled by smsusb_onresponse() may be still running. As a result, the UAF bugs could happen. We add cancel_work_sync() in smsusb_stop_streaming() in order that the worker threads could finish before the smsusb_device_t is deallocated. Fixes: dd47fbd40e ("[media] smsusb: don't sleep while atomic") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-11 16:39:47 +01:00
..
accessibility	speakup: fix a segfault caused by switching consoles	2022-11-25 17:45:50 +01:00
acpi	ACPI: battery: Fix missing NUL-termination with large strings	2023-03-11 16:39:22 +01:00
amba
android	file: Rename __close_fd_get_file close_fd_get_file	2023-01-04 11:39:18 +01:00
ata	ata: libata: Fix sata_down_spd_limit() when no link speed is reported	2023-02-15 17:22:13 +01:00
atm	atm: idt77252: fix use-after-free bugs caused by tst_timer	2022-08-25 11:38:02 +02:00
auxdisplay
base	driver core: Fix test_async_probe_init saves device in wrong array	2023-02-01 08:23:15 +01:00
bcma
block	nbd: fix possible overflow on 'first_minor' in nbd_dev_add()	2023-02-25 11:55:04 +01:00
bluetooth	Bluetooth: hci_qca: Fixed issue during suspend	2023-01-24 07:20:01 +01:00
bus	bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()	2023-02-15 17:22:10 +01:00
cdrom
char	ipmi: fix use after free in _ipmi_destroy_user()	2023-01-14 10:16:35 +01:00
clk	clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()	2023-03-11 16:39:44 +01:00
clocksource	clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()	2023-01-14 10:15:20 +01:00
connector
counter	counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update	2023-01-14 10:15:58 +01:00
cpufreq	cpufreq: armada-37xx: stop using 0 as NULL pointer	2023-02-01 08:23:17 +01:00
cpuidle	cpuidle: dt: Return the correct numbers of parsed idle states	2023-01-14 10:15:15 +01:00
crypto	crypto: crypto4xx - Call dma_unmap_page when done	2023-03-11 16:39:28 +01:00
dax	devdax: Fix soft-reservation memory description	2022-09-28 11:10:41 +02:00
dca
devfreq	PM/devfreq: governor: Add a private governor_data for governor	2023-01-14 10:16:31 +01:00
dio	drivers: dio: fix possible memory leak in dio_init()	2023-01-14 10:15:54 +01:00
dma	dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init	2023-02-06 07:56:15 +01:00
dma-buf	dma-buf: fix racing conflict of dma_heap_add()	2022-12-02 17:40:01 +01:00
edac	EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info	2023-02-01 08:23:23 +01:00
eisa
extcon	extcon: Modify extcon device to be created after driver data is set	2022-06-14 18:32:43 +02:00
firewire	firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region	2023-02-15 17:22:09 +01:00
firmware	efi: Accept version 2 of memory attributes table	2023-02-15 17:22:17 +01:00
fpga	fpga: stratix10-soc: Fix return value check in s10_ops_write_init()	2023-02-15 17:22:19 +01:00
fsi	WRITE is "data source", not destination...	2023-02-15 17:22:11 +01:00
gnss
gpio	gpio: vf610: connect GPIO label to dev name	2023-03-11 16:39:35 +01:00
gpu	drm/amdgpu: fix enum odm_combine_mode mismatch	2023-03-11 16:39:37 +01:00
greybus
hid	hid: bigben_probe(): validate report count	2023-03-11 16:39:39 +01:00
hsi	HSI: omap_ssi_core: Fix error handling in ssi_init()	2023-01-14 10:16:03 +01:00
hv	video: hyperv_fb: Avoid taking busy spinlock on panic path	2023-01-14 10:16:13 +01:00
hwmon	hwmon: (mlxreg-fan) Return zero speed for broken fan	2023-03-11 16:39:37 +01:00
hwspinlock	hwspinlock: qcom: correct MMIO max register for newer SoCs	2022-11-16 09:57:07 +01:00
hwtracing	coresight: cti: Fix hang in cti_disable_hw()	2022-11-10 18:14:25 +01:00
i2c	i2c: rk3x: fix a bunch of kernel-doc warnings	2023-02-15 17:22:15 +01:00
i3c
ide
idle	intel_idle: Disable IBRS during long idle	2022-07-25 11:26:43 +02:00
iio	iio:adc:twl6030: Enable measurement of VAC	2023-02-15 17:22:21 +01:00
infiniband	IB/hfi1: Assign npages earlier	2023-03-03 11:44:51 +01:00
input	Input: iqs269a - do not poll during ATI	2023-03-11 16:39:45 +01:00
interconnect	interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate	2022-09-28 11:10:28 +02:00
iommu	iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()	2023-01-18 11:45:00 +01:00
ipack
irqchip	irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts	2023-03-11 16:39:29 +01:00
isdn	mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()	2023-01-14 10:16:10 +01:00
leds	leds: led-core: Fix refcount leak in of_led_get()	2023-03-11 16:39:40 +01:00
lightnvm	lightnvm: disable the subsystem	2022-05-09 09:04:56 +02:00
macintosh	macintosh/macio-adb: check the return value of ioremap()	2023-01-14 10:16:06 +01:00
mailbox	mailbox: zynq-ipi: fix error handling while device_register() fails	2023-01-14 10:16:12 +01:00
mcb	mcb: mcb-parse: fix error handing in chameleon_parse_gdd()	2023-01-14 10:15:59 +01:00
md	dm: remove flush_scheduled_work() during local_exit()	2023-03-11 16:39:38 +01:00
media	media: usb: siano: Fix use after free bugs caused by do_submit_urb	2023-03-11 16:39:47 +01:00
memory	memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()	2023-02-01 08:23:08 +01:00
memstick	memstick/ms_block: Fix a memory leak	2022-08-21 15:15:58 +02:00
message
mfd	mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()	2023-03-11 16:39:41 +01:00
misc	mei: me: add meteor lake point M DID	2023-01-24 07:20:00 +01:00
mmc	mmc: mmc_spi: fix error handling in mmc_spi_probe()	2023-02-22 12:55:55 +01:00
most
mtd	mtd: rawnand: sunxi: Fix the size of the last OOB region	2023-03-11 16:39:41 +01:00
mux
net	net: bcmgenet: fix MoCA LED control	2023-03-11 16:39:29 +01:00
nfc	nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()	2023-01-18 11:44:59 +01:00
ntb	NTB: ntb_tool: uninitialized heap data in tool_fn_write()	2022-08-25 11:38:01 +02:00
nubus
nvdimm	nvdimm: Fix badblocks clear off-by-one error	2022-07-07 17:52:15 +02:00
nvme	nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association	2023-02-22 12:55:53 +01:00
nvmem	nvmem: core: fix return value	2023-02-22 12:56:00 +01:00
of	of/address: Return an error when no valid dma-ranges are found	2023-02-15 17:22:22 +01:00
opp	OPP: fix error checking in opp_migrate_dentry()	2023-03-11 16:39:26 +01:00
oprofile
parisc	parisc: led: Fix potential null-ptr-deref in start_task()	2023-01-14 10:16:36 +01:00
parport	parport_pc: Avoid FIFO port location truncation	2022-11-25 17:45:44 +01:00
pci	PCI/sysfs: Fix double free in error path	2023-01-14 10:16:36 +01:00
pcmcia	pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards	2022-06-14 18:32:30 +02:00
perf	perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()	2023-01-14 10:15:12 +01:00
phy	phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()	2023-02-01 08:23:12 +01:00
pinctrl	linux/kconfig.h: replace IF_ENABLED() with PTR_IF() in <linux/kernel.h>	2023-03-11 16:39:42 +01:00
platform	platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match	2023-02-22 12:55:54 +01:00
pnp	PNP: fix name memory leak in pnp_alloc_dev()	2023-01-14 10:15:17 +01:00
power	power: supply: fix null pointer dereferencing in power_supply_get_battery_info	2023-01-14 10:16:03 +01:00
powercap	powercap: fix possible name leak in powercap_register_zone()	2023-03-11 16:39:23 +01:00
pps
ps3
ptp	ptp: replace snprintf with sysfs_emit	2022-04-13 21:00:55 +02:00
pwm	pwm: tegra: Fix 32 bit build	2023-01-14 10:16:24 +01:00
rapidio	rapidio: devices: fix missing put_device in mport_cdev_open	2023-01-14 10:15:23 +01:00
ras
regulator	regulator: da9211: Use irq handler when ready	2023-01-18 11:44:58 +01:00
remoteproc	remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers	2023-03-11 16:39:45 +01:00
reset	reset: imx7: Fix the iMX8MP PCIe PHY PERST support	2022-10-05 10:38:40 +02:00
rpmsg	rpmsg: qcom: glink: replace strncpy() with strscpy_pad()	2022-10-15 07:55:54 +02:00
rtc	rtc: ds1347: fix value written to century register	2023-01-14 10:16:34 +01:00
s390	s390/dasd: Fix potential memleak in dasd_eckd_init()	2023-03-11 16:39:15 +01:00
sbus
scsi	scsi: aic94xx: Add missing check for dma_map_single()	2023-03-11 16:39:37 +01:00
sfi
sh
siox	siox: fix possible memory leak in siox_device_add()	2022-11-25 17:45:44 +01:00
slimbus	slimbus: stream: correct presence rate frequencies	2022-11-25 17:45:50 +01:00
soc	PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()	2023-02-01 08:23:11 +01:00
soundwire	ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire	2023-01-14 10:16:28 +01:00
spi	spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()	2023-03-11 16:39:38 +01:00
spmi	spmi: pmic-arb: correct duplicate APID to PPID mapping logic	2022-10-26 13:25:39 +02:00
ssb
staging	comedi: adv_pci1760: Fix PWM instruction handling	2023-01-24 07:19:59 +01:00
target	scsi: target: core: Fix warning on RT kernels	2023-02-15 17:22:14 +01:00
tc
tee	tee: optee: fix possible memory leak in optee_register_device()	2022-12-02 17:39:59 +01:00
thermal	thermal/drivers/hisi: Drop second sensor hi3660	2023-03-11 16:39:28 +01:00
thunderbolt	thunderbolt: Use correct function to calculate maximum USB3 link rate	2023-01-24 07:19:59 +01:00
tty	vc_screen: don't clobber return value in vcs_read	2023-03-03 11:44:51 +01:00
uio	uio: uio_dmem_genirq: Fix deadlock between irq config and handling	2023-01-14 10:15:55 +01:00
usb	USB: core: Don't hold device lock while reading the "descriptors" sysfs file	2023-03-03 11:44:52 +01:00
vdpa	vdpa/mlx5: Don't clear mr struct on destroy MR	2023-03-11 16:39:45 +01:00
vfio	vfio: platform: Do not pass return buffer to ACPI _RST method	2023-01-14 10:15:54 +01:00
vhost	vhost/net: Clear the pending messages when the backend is removed	2023-02-15 17:22:11 +01:00
video	fbdev: smscufx: fix error handling code in ufx_usb_probe	2023-02-15 17:22:20 +01:00
virt	vboxguest: Do not use devm for irq	2022-08-25 11:38:14 +02:00
virtio	virtio_mmio: Restore guest page size on resume	2022-07-21 21:20:13 +02:00
visorbus
vlynq
vme	vme: Fix error not catched in fake_init()	2023-01-14 10:16:00 +01:00
w1	w1: fix WARNING after calling w1_process()	2023-02-01 08:23:15 +01:00
watchdog	watchdog: diag288_wdt: fix __diag288() inline assembly	2023-02-15 17:22:17 +01:00
xen	fix "direction" argument of iov_iter_kvec()	2023-02-15 17:22:12 +01:00
zorro
Kconfig
Makefile