moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,067,111 Commits 7 Branches 0 Tags
arpi-5.15
Commit Graph

7273 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
e3d8fe0993 Merge 5.15.91 into android14-5.15 
Changes in 5.15.91
	memory: tegra: Remove clients SID override programming
	memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
	memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
	dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG
	arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property
	ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency'
	ARM: dts: imx7d-pico: Use 'clock-frequency'
	ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
	arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux
	ARM: imx: add missing of_node_put()
	HID: intel_ish-hid: Add check for ishtp_dma_tx_map
	arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity
	soc: imx8m: Fix incorrect check for of_clk_get_by_name()
	reset: uniphier-glue: Use reset_control_bulk API
	reset: uniphier-glue: Fix possible null-ptr-deref
	EDAC/highbank: Fix memory leak in highbank_mc_probe()
	firmware: arm_scmi: Harden shared memory access in fetch_response
	firmware: arm_scmi: Harden shared memory access in fetch_notification
	tomoyo: fix broken dependency on *.conf.default
	RDMA/core: Fix ib block iterator counter overflow
	IB/hfi1: Reject a zero-length user expected buffer
	IB/hfi1: Reserve user expected TIDs
	IB/hfi1: Fix expected receive setup error exit issues
	IB/hfi1: Immediately remove invalid memory from hardware
	IB/hfi1: Remove user expected buffer invalidate race
	affs: initialize fsdata in affs_truncate()
	PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
	arm64: dts: qcom: msm8992: Don't use sfpb mutex
	arm64: dts: qcom: msm8992-libra: Add CPU regulators
	arm64: dts: qcom: msm8992-libra: Fix the memory map
	phy: ti: fix Kconfig warning and operator precedence
	NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
	ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
	amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
	amd-xgbe: Delay AN timeout during KR training
	bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
	phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
	net: nfc: Fix use-after-free in local_cleanup()
	net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
	net: enetc: avoid deadlock in enetc_tx_onestep_tstamp()
	sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb
	gpio: use raw spinlock for gpio chip shadowed data
	gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock
	gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
	wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
	pinctrl/rockchip: Use temporary variable for struct device
	pinctrl/rockchip: add error handling for pull/drive register getters
	pinctrl: rockchip: fix reading pull type on rk3568
	net: stmmac: Fix queue statistics reading
	net/sched: sch_taprio: fix possible use-after-free
	l2tp: Serialize access to sk_user_data with sk_callback_lock
	l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
	l2tp: convert l2tp_tunnel_list to idr
	l2tp: close all race conditions in l2tp_tunnel_register()
	octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
	net: usb: sr9700: Handle negative len
	net: mdio: validate parameter addr in mdiobus_get_phy()
	HID: check empty report_list in hid_validate_values()
	HID: check empty report_list in bigben_probe()
	net: stmmac: fix invalid call to mdiobus_get_phy()
	pinctrl: rockchip: fix mux route data for rk3568
	HID: revert CHERRY_MOUSE_000C quirk
	usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
	usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
	Bluetooth: Fix possible deadlock in rfcomm_sk_state_change
	net: ipa: disable ipa interrupt during suspend
	net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT
	net: mlx5: eliminate anonymous module_init & module_exit
	drm/panfrost: fix GENERIC_ATOMIC64 dependency
	dmaengine: Fix double increment of client_count in dma_chan_get()
	net: macb: fix PTP TX timestamp failure due to packet padding
	virtio-net: correctly enable callback during start_xmit
	l2tp: prevent lockdep issue in l2tp_tunnel_register()
	HID: betop: check shape of output reports
	cifs: fix potential deadlock in cache_refresh_path()
	dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
	phy: phy-can-transceiver: Skip warning if no "max-bitrate"
	drm/amd/display: fix issues with driver unload
	nvme-pci: fix timeout request state check
	tcp: avoid the lookup process failing to get sk in ehash table
	octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
	ptdma: pt_core_execute_cmd() should use spinlock
	device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
	w1: fix deadloop in __w1_remove_master_device()
	w1: fix WARNING after calling w1_process()
	driver core: Fix test_async_probe_init saves device in wrong array
	selftests/net: toeplitz: fix race on tpacket_v3 block close
	net: dsa: microchip: ksz9477: port map correction in ALU table entry register
	thermal/core: Remove duplicate information when an error occurs
	thermal/core: Rename 'trips' to 'num_trips'
	thermal: Validate new state in cur_state_store()
	thermal/core: fix error code in __thermal_cooling_device_register()
	thermal: core: call put_device() only after device_register() fails
	net: stmmac: enable all safety features by default
	tcp: fix rate_app_limited to default to 1
	scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
	cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
	kcsan: test: don't put the expect array on the stack
	cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist
	ASoC: fsl_micfil: Correct the number of steps on SX controls
	net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem
	drm: Add orientation quirk for Lenovo ideapad D330-10IGL
	s390/debug: add _ASM_S390_ prefix to header guard
	s390: expicitly align _edata and _end symbols on page boundary
	perf/x86/msr: Add Emerald Rapids
	perf/x86/intel/uncore: Add Emerald Rapids
	cpufreq: armada-37xx: stop using 0 as NULL pointer
	ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
	ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
	spi: spidev: remove debug messages that access spidev->spi without locking
	KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
	scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
	r8152: add vendor/device ID pair for Microsoft Devkit
	platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
	platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
	lockref: stop doing cpu_relax in the cmpxchg loop
	firmware: coreboot: Check size of table entry and use flex-array
	drm/i915: Allow switching away via vga-switcheroo if uninitialized
	Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
	drm/i915: Remove unused variable
	x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
	fs: reiserfs: remove useless new_opts in reiserfs_remount
	sysctl: add a new register_sysctl_init() interface
	kernel/panic: move panic sysctls to its own file
	panic: unset panic_on_warn inside panic()
	ubsan: no need to unset panic_on_warn in ubsan_epilogue()
	kasan: no need to unset panic_on_warn in end_report()
	exit: Add and use make_task_dead.
	objtool: Add a missing comma to avoid string concatenation
	hexagon: Fix function name in die()
	h8300: Fix build errors from do_exit() to make_task_dead() transition
	csky: Fix function name in csky_alignment() and die()
	ia64: make IA64_MCA_RECOVERY bool instead of tristate
	panic: Separate sysctl logic from CONFIG_SMP
	exit: Put an upper limit on how often we can oops
	exit: Expose "oops_count" to sysfs
	exit: Allow oops_limit to be disabled
	panic: Consolidate open-coded panic_on_warn checks
	panic: Introduce warn_limit
	panic: Expose "warn_count" to sysfs
	docs: Fix path paste-o for /sys/kernel/warn_count
	exit: Use READ_ONCE() for all oops/warn limit reads
	Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
	drm/amdgpu: complete gfxoff allow signal during suspend without delay
	scsi: hpsa: Fix allocation size for scsi_host_alloc()
	KVM: SVM: fix tsc scaling cache logic
	module: Don't wait for GOING modules
	tracing: Make sure trace_printk() can output as soon as it can be used
	trace_events_hist: add check for return value of 'create_hist_field'
	ftrace/scripts: Update the instructions for ftrace-bisect.sh
	cifs: Fix oops due to uncleared server->smbd_conn in reconnect
	i2c: mv64xxx: Remove shutdown method from driver
	i2c: mv64xxx: Add atomic_xfer method to driver
	ksmbd: add smbd max io size parameter
	ksmbd: add max connections parameter
	ksmbd: do not sign response to session request for guest login
	ksmbd: downgrade ndr version error message to debug
	ksmbd: limit pdu length size according to connection status
	ovl: fail on invalid uid/gid mapping at copy up
	KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
	KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation
	thermal: intel: int340x: Protect trip temperature from concurrent updates
	ipv6: fix reachability confirmation with proxy_ndp
	ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
	EDAC/device: Respect any driver-supplied workqueue polling value
	EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
	net: mana: Fix IRQ name - add PCI and queue number
	scsi: ufs: core: Fix devfreq deadlocks
	i2c: designware: use casting of u64 in clock multiplication to avoid overflow
	netlink: prevent potential spectre v1 gadgets
	net: fix UaF in netns ops registration error path
	drm/i915/selftest: fix intel_selftest_modify_policy argument types
	netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
	netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
	netlink: annotate data races around nlk->portid
	netlink: annotate data races around dst_portid and dst_group
	netlink: annotate data races around sk_state
	ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
	ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
	netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
	netrom: Fix use-after-free of a listening socket.
	net/sched: sch_taprio: do not schedule in taprio_reset()
	sctp: fail if no bound addresses can be used for a given scope
	riscv/kprobe: Fix instruction simulation of JALR
	nvme: fix passthrough csi check
	gpio: mxc: Unlock on error path in mxc_flip_edge()
	ravb: Rename "no_ptp_cfg_active" and "ptp_cfg_active" variables
	net: ravb: Fix lack of register setting after system resumed for Gen3
	net: ravb: Fix possible hang if RIS2_QFF1 happen
	net: mctp: mark socks as dead on unhash, prevent re-add
	thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
	net/tg3: resolve deadlock in tg3_reset_task() during EEH
	net: mdio-mux-meson-g12a: force internal PHY off on mux switch
	treewide: fix up files incorrectly marked executable
	tools: gpio: fix -c option of gpio-event-mon
	Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
	cpufreq: Move to_gov_attr_set() to cpufreq.h
	cpufreq: governor: Use kobject release() method to free dbs_data
	kbuild: Allow kernel installation packaging to override pkg-config
	block: fix and cleanup bio_check_ro
	x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
	netfilter: conntrack: unify established states for SCTP paths
	perf/x86/amd: fix potential integer overflow on shift of a int
	Linux 5.15.91

Change-Id: I3349d802533097ac86e5c680fbd40c00c9719ec7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-02-01 09:38:19 +00:00
Eric Dumazet
41b74e95f2 netlink: prevent potential spectre v1 gadgets 
[ Upstream commit f0950402e8c76e7dcb08563f1b4e8000fbc62455 ]

Most netlink attributes are parsed and validated from
__nla_validate_parse() or validate_nla()

    u16 type = nla_type(nla);

    if (type == 0 || type > maxtype) {
        /* error or continue */
    }

@type is then used as an array index and can be used
as a Spectre v1 gadget.

array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.

This should take care of vast majority of netlink uses,
but an audit is needed to take care of others where
validation is not yet centralized in core netlink functions.

Fixes: bfa83a9e03 ("[NETLINK]: Type-safe netlink messages/attributes interface")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230119110150.2678537-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-02-01 08:27:26 +01:00
Kees Cook
7b98914a6c panic: Consolidate open-coded panic_on_warn checks 
commit 79cc1ba7badf9e7a12af99695a557e9ce27ee967 upstream.

Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll
their own warnings, and each check "panic_on_warn". Consolidate this
into a single function so that future instrumentation can be added in
a single location.

Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ben Segall <bsegall@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Gow <davidgow@google.com>
Cc: tangmeng <tangmeng@uniontech.com>
Cc: Jann Horn <jannh@google.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: kasan-dev@googlegroups.com
Cc: linux-mm@kvack.org
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://lore.kernel.org/r/20221117234328.594699-4-keescook@chromium.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-02-01 08:27:22 +01:00
Tiezhu Yang
b5c967dc68 ubsan: no need to unset panic_on_warn in ubsan_epilogue() 
commit d83ce027a54068fabb70d2c252e1ce2da86784a4 upstream.

panic_on_warn is unset inside panic(), so no need to unset it before
calling panic() in ubsan_epilogue().

Link: https://lkml.kernel.org/r/1644324666-15947-5-git-send-email-yangtiezhu@loongson.cn
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Xuefeng Li <lixuefeng@loongson.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-02-01 08:27:20 +01:00
Mateusz Guzik
a4e70bcf2e lockref: stop doing cpu_relax in the cmpxchg loop 
[ Upstream commit f5fe24ef17b5fbe6db49534163e77499fb10ae8c ]

On the x86-64 architecture even a failing cmpxchg grants exclusive
access to the cacheline, making it preferable to retry the failed op
immediately instead of stalling with the pause instruction.

To illustrate the impact, below are benchmark results obtained by
running various will-it-scale tests on top of the 6.2-rc3 kernel and
Cascade Lake (2 sockets * 24 cores * 2 threads) CPU.

All results in ops/s.  Note there is some variance in re-runs, but the
code is consistently faster when contention is present.

  open3 ("Same file open/close"):
  proc          stock       no-pause
     1         805603         814942       (+%1)
     2        1054980        1054781       (-0%)
     8        1544802        1822858      (+18%)
    24        1191064        2199665      (+84%)
    48         851582        1469860      (+72%)
    96         609481        1427170     (+134%)

  fstat2 ("Same file fstat"):
  proc          stock       no-pause
     1        3013872        3047636       (+1%)
     2        4284687        4400421       (+2%)
     8        3257721        5530156      (+69%)
    24        2239819        5466127     (+144%)
    48        1701072        5256609     (+209%)
    96        1269157        6649326     (+423%)

Additionally, a kernel with a private patch to help access() scalability:
access2 ("Same file access"):

  proc          stock        patched      patched
                                         +nopause
    24        2378041        2005501      5370335  (-15% / +125%)

That is, fixing the problems in access itself *reduces* scalability
after the cacheline ping-pong only happens in lockref with the pause
instruction.

Note that fstat and access benchmarks are not currently integrated into
will-it-scale, but interested parties can find them in pull requests to
said project.

Code at hand has a rather tortured history.  First modification showed
up in commit d472d9d98b ("lockref: Relax in cmpxchg loop"), written
with Itanium in mind.  Later it got patched up to use an arch-dependent
macro to stop doing it on s390 where it caused a significant regression.
Said macro had undergone revisions and was ultimately eliminated later,
going back to cpu_relax.

While I intended to only remove cpu_relax for x86-64, I got the
following comment from Linus:

    I would actually prefer just removing it entirely and see if
    somebody else hollers. You have the numbers to prove it hurts on
    real hardware, and I don't think we have any numbers to the
    contrary.

    So I think it's better to trust the numbers and remove it as a
    failure, than say "let's just remove it on x86-64 and leave
    everybody else with the potentially broken code"

Additionally, Will Deacon (maintainer of the arm64 port, one of the
architectures previously benchmarked):

    So, from the arm64 side of the fence, I'm perfectly happy just
    removing the cpu_relax() calls from lockref.

As such, come back full circle in history and whack it altogether.

Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://lore.kernel.org/all/CAGudoHHx0Nqg6DE70zAVA75eV-HXfWyhVMWZ-aSeOofkA_=WdA@mail.gmail.com/
Acked-by: Tony Luck <tony.luck@intel.com> # ia64
Acked-by: Nicholas Piggin <npiggin@gmail.com> # powerpc
Acked-by: Will Deacon <will@kernel.org> # arm64
Acked-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-02-01 08:27:19 +01:00
Greg Kroah-Hartman
962d1816e1 Merge 5.15.86 into android14-5.15 
Changes in 5.15.86
	drm/amd/display: Manually adjust strobe for DCN303
	usb: musb: remove extra check in musb_gadget_vbus_draw
	arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
	arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable
	arm64: dts: qcom: msm8996: Add MSM8996 Pro support
	arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables
	arm64: dts: qcom: msm8996: fix GPU OPP table
	ARM: dts: qcom: apq8064: fix coresight compatible
	arm64: dts: qcom: sdm630: fix UART1 pin bias
	arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
	arm64: dts: qcom: msm8916: Drop MSS fallback compatible
	objtool, kcsan: Add volatile read/write instrumentation to whitelist
	ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
	ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
	drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
	arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name
	arm64: dts: qcom: sm8250: correct LPASS pin pull down
	soc: qcom: llcc: make irq truly optional
	arm64: dts: qcom: Correct QMP PHY child node name
	arm64: dts: qcom: sm8150: fix UFS PHY registers
	arm64: dts: qcom: sm8250: fix UFS PHY registers
	arm64: dts: qcom: sm8350: fix UFS PHY registers
	arm64: dts: qcom: sm8250: drop bogus DP PHY clock
	soc: qcom: apr: make code more reuseable
	soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
	arm64: dts: qcom: sm6125: fix SDHCI CQE reg names
	arm: dts: spear600: Fix clcd interrupt
	soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
	soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
	soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
	arm64: Treat ESR_ELx as a 64-bit register
	arm64: mm: kfence: only handle translation faults
	perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
	perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()
	perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
	arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
	arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
	ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes
	arm64: dts: mt6779: Fix devicetree build warnings
	arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
	arm64: dts: mt2712e: Fix unit address for pinctrl node
	arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
	arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
	arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
	arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
	ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: turris-omnia: Add ethernet aliases
	ARM: dts: turris-omnia: Add switch port 6 node
	arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
	seccomp: Move copy_seccomp() to no failure path.
	pstore/ram: Fix error return code in ramoops_probe()
	ARM: mmp: fix timer_read delay
	pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
	tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
	tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
	ovl: store lower path in ovl_inode
	ovl: use ovl_copy_{real,upper}attr() wrappers
	ovl: remove privs in ovl_copyfile()
	ovl: remove privs in ovl_fallocate()
	sched/fair: Cleanup task_util and capacity type
	sched/uclamp: Fix relationship between uclamp and migration margin
	sched/uclamp: Make task_fits_capacity() use util_fits_cpu()
	sched/uclamp: Make select_idle_capacity() use util_fits_cpu()
	sched/fair: Removed useless update of p->recent_used_cpu
	sched/core: Introduce sched_asym_cpucap_active()
	sched/uclamp: Make asym_fits_capacity() use util_fits_cpu()
	cpuidle: dt: Return the correct numbers of parsed idle states
	alpha: fix TIF_NOTIFY_SIGNAL handling
	alpha: fix syscall entry in !AUDUT_SYSCALL case
	x86/sgx: Reduce delay and interference of enclave release
	PM: hibernate: Fix mistake in kerneldoc comment
	fs: don't audit the capability check in simple_xattr_list()
	cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
	selftests/ftrace: event_triggers: wait longer for test_event_enable
	perf: Fix possible memleak in pmu_dev_alloc()
	lib/debugobjects: fix stat count and optimize debug_objects_mem_init
	platform/x86: huawei-wmi: fix return value calculation
	timerqueue: Use rb_entry_safe() in timerqueue_getnext()
	proc: fixup uptime selftest
	lib/fonts: fix undefined behavior in bit shift for get_default_font
	ocfs2: fix memory leak in ocfs2_stack_glue_init()
	MIPS: vpe-mt: fix possible memory leak while module exiting
	MIPS: vpe-cmp: fix possible memory leak while module exiting
	selftests/efivarfs: Add checking of the test return value
	PNP: fix name memory leak in pnp_alloc_dev()
	perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology()
	perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
	perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
	perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
	platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
	thermal: core: fix some possible name leaks in error paths
	irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
	irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init()
	EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
	SUNRPC: Return true/false (not 1/0) from bool functions
	NFSD: Finish converting the NFSv2 GETACL result encoder
	nfsd: don't call nfsd_file_put from client states seqfile display
	genirq/irqdesc: Don't try to remove non-existing sysfs files
	cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
	lib/notifier-error-inject: fix error when writing -errno to debugfs file
	debugfs: fix error when writing negative value to atomic_t debugfs file
	rapidio: fix possible name leaks when rio_add_device() fails
	rapidio: rio: fix possible name leak in rio_register_mport()
	clocksource/drivers/sh_cmt: Access registers according to spec
	mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem
	mips: ralink: mt7621: soc queries and tests as functions
	mips: ralink: mt7621: do not use kzalloc too early
	futex: Move to kernel/futex/
	futex: Resend potentially swallowed owner death notification
	cpu/hotplug: Make target_store() a nop when target == state
	cpu/hotplug: Do not bail-out in DYING/STARTING sections
	clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
	ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
	uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
	x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
	x86/xen: Fix memory leak in xen_init_lock_cpu()
	xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
	PM: runtime: Do not call __rpm_callback() from rpm_idle()
	platform/chrome: cros_ec_typec: Cleanup switch handle return paths
	platform/chrome: cros_ec_typec: zero out stale pointers
	platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
	platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
	MIPS: BCM63xx: Add check for NULL for clk in clk_enable
	MIPS: OCTEON: warn only once if deprecated link status is being used
	lockd: set other missing fields when unlocking files
	fs: sysv: Fix sysv_nblocks() returns wrong value
	rapidio: fix possible UAF when kfifo_alloc() fails
	eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
	relay: fix type mismatch when allocating memory in relay_create_buf()
	hfs: Fix OOB Write in hfs_asc2mac
	rapidio: devices: fix missing put_device in mport_cdev_open
	platform/mellanox: mlxbf-pmc: Fix event typo
	wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
	wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
	wifi: rtl8xxxu: Fix reading the vendor of combo chips
	drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
	libbpf: Fix use-after-free in btf_dump_name_dups
	libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
	ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros
	ata: add/use ata_taskfile::{error|status} fields
	ata: libata: fix NCQ autosense logic
	ipmi: kcs: Poll OBF briefly to reduce OBE latency
	drm/amdgpu/powerplay/psm: Fix memory leak in power state init
	media: v4l2-ctrls: Fix off-by-one error in integer menu control check
	media: coda: jpeg: Add check for kmalloc
	media: adv748x: afe: Select input port when initializing AFE
	media: i2c: ad5820: Fix error path
	venus: pm_helpers: Fix error check in vcodec_domains_get()
	soreuseport: Fix socket selection for SO_INCOMING_CPU.
	media: exynos4-is: don't rely on the v4l2_async_subdev internals
	libbpf: Btf dedup identical struct test needs check for nested structs/arrays
	can: kvaser_usb: do not increase tx statistics when sending error message frames
	can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
	can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
	can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
	can: kvaser_usb_leaf: Set Warning state even without bus errors
	can: kvaser_usb: make use of units.h in assignment of frequency
	can: kvaser_usb_leaf: Fix improved state not being reported
	can: kvaser_usb_leaf: Fix wrong CAN state after stopping
	can: kvaser_usb_leaf: Fix bogus restart events
	can: kvaser_usb: Add struct kvaser_usb_busparams
	can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
	drm/rockchip: lvds: fix PM usage counter unbalance in poweron
	clk: renesas: r9a06g032: Repair grave increment error
	spi: Update reference to struct spi_controller
	drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
	ima: Handle -ESTALE returned by ima_filter_rule_match()
	drm/msm/hdmi: drop unused GPIO support
	drm/msm/hdmi: use devres helper for runtime PM management
	bpf: Fix slot type check in check_stack_write_var_off
	media: vivid: fix compose size exceed boundary
	media: platform: exynos4-is: fix return value check in fimc_md_probe()
	bpf: propagate precision in ALU/ALU64 operations
	bpf: Check the other end of slot_type for STACK_SPILL
	bpf: propagate precision across all frames, not just the last one
	clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
	mtd: Fix device name leak when register device failed in add_mtd_device()
	Input: joystick - fix Kconfig warning for JOYSTICK_ADC
	wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
	media: camss: Clean up received buffers on failed start of streaming
	net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
	rxrpc: Fix ack.bufferSize to be 0 when generating an ack
	bfq: fix waker_bfqq inconsistency crash
	drm/radeon: Add the missed acpi_put_table() to fix memory leak
	drm/mediatek: Modify dpi power on/off sequence.
	ASoC: pxa: fix null-pointer dereference in filter()
	libbpf: Fix uninitialized warning in btf_dump_dump_type_data
	nvmet: only allocate a single slab for bvecs
	regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
	amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
	nvme: return err on nvme_init_non_mdts_limits fail
	regulator: qcom-rpmh: Fix PMR735a S3 regulator spec
	drm/fourcc: Add packed 10bit YUV 4:2:0 format
	drm/fourcc: Fix vsub/hsub for Q410 and Q401
	integrity: Fix memory leakage in keyring allocation error path
	ima: Fix misuse of dereference of pointer in template_desc_init_fields()
	block: clear ->slave_dir when dropping the main slave_dir reference
	wifi: ath10k: Fix return value in ath10k_pci_init()
	drm/msm/a6xx: Fix speed-bin detection vs probe-defer
	mtd: lpddr2_nvm: Fix possible null-ptr-deref
	Input: elants_i2c - properly handle the reset GPIO when power is off
	media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
	media: solo6x10: fix possible memory leak in solo_sysfs_init()
	media: platform: exynos4-is: Fix error handling in fimc_md_init()
	media: videobuf-dma-contig: use dma_mmap_coherent
	inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
	mtd: spi-nor: hide jedec_id sysfs attribute if not present
	mtd: spi-nor: Fix the number of bytes for the dummy cycles
	bpf: Move skb->len == 0 checks into __bpf_redirect
	HID: hid-sensor-custom: set fixed size for custom attributes
	pinctrl: k210: call of_node_put()
	ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
	ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
	regulator: core: use kfree_const() to free space conditionally
	clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
	drm/amdgpu: fix pci device refcount leak
	bonding: fix link recovery in mode 2 when updelay is nonzero
	mtd: maps: pxa2xx-flash: fix memory leak in probe
	drbd: remove call to memset before free device/resource/connection
	drbd: destroy workqueue when drbd device was freed
	ASoC: qcom: Add checks for devm_kcalloc
	media: vimc: Fix wrong function called when vimc_init() fails
	media: imon: fix a race condition in send_packet()
	clk: imx8mn: rename vpu_pll to m7_alt_pll
	clk: imx: replace osc_hdmi with dummy
	clk: imx8mn: fix imx8mn_sai2_sels clocks list
	clk: imx8mn: fix imx8mn_enet_phy_sels clocks list
	pinctrl: pinconf-generic: add missing of_node_put()
	media: dvb-core: Fix ignored return value in dvb_register_frontend()
	media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
	media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
	drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
	ASoC: dt-bindings: wcd9335: fix reset line polarity in example
	ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
	NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
	NFSv4.2: Fix a memory stomp in decode_attr_security_label
	NFSv4.2: Fix initialisation of struct nfs4_label
	NFSv4: Fix a credential leak in _nfs4_discover_trunking()
	NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
	NFS: Fix an Oops in nfs_d_automount()
	ALSA: asihpi: fix missing pci_disable_device()
	wifi: iwlwifi: mvm: fix double free on tx path.
	ASoC: mediatek: mt8173: Fix debugfs registration for components
	ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
	drm/amd/pm/smu11: BACO is supported when it's in BACO state
	drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
	drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
	drm/amdkfd: Fix memory leakage
	ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
	netfilter: conntrack: set icmpv6 redirects as RELATED
	Input: wistron_btns - disable on UML
	bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
	bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes
	bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
	bonding: uninitialized variable in bond_miimon_inspect()
	spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
	wifi: mac80211: fix memory leak in ieee80211_if_add()
	wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
	mt76: stop the radar detector after leaving dfs channel
	wifi: mt76: mt7921: fix reporting of TX AGGR histogram
	wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
	regulator: core: fix module refcount leak in set_supply()
	clk: qcom: lpass-sc7180: Fix pm_runtime usage
	clk: qcom: clk-krait: fix wrong div2 functions
	hsr: Add a rcu-read lock to hsr_forward_skb().
	hsr: Avoid double remove of a node.
	hsr: Disable netpoll.
	hsr: Synchronize sending frames to have always incremented outgoing seq nr.
	hsr: Synchronize sequence number updates.
	configfs: fix possible memory leak in configfs_create_dir()
	regulator: core: fix resource leak in regulator_register()
	hwmon: (jc42) Convert register access and caching to regmap/regcache
	hwmon: (jc42) Restore the min/max/critical temperatures on resume
	bpf, sockmap: fix race in sock_map_free()
	ALSA: pcm: Set missing stop_operating flag at undoing trigger start
	media: saa7164: fix missing pci_disable_device()
	ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
	xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
	SUNRPC: Fix missing release socket in rpc_sockname()
	NFSv4.x: Fail client initialisation if state manager thread can't run
	riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC
	mmc: alcor: fix return value check of mmc_add_host()
	mmc: moxart: fix return value check of mmc_add_host()
	mmc: mxcmmc: fix return value check of mmc_add_host()
	mmc: pxamci: fix return value check of mmc_add_host()
	mmc: rtsx_pci: fix return value check of mmc_add_host()
	mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
	mmc: toshsd: fix return value check of mmc_add_host()
	mmc: vub300: fix return value check of mmc_add_host()
	mmc: wmt-sdmmc: fix return value check of mmc_add_host()
	mmc: atmel-mci: fix return value check of mmc_add_host()
	mmc: omap_hsmmc: fix return value check of mmc_add_host()
	mmc: meson-gx: fix return value check of mmc_add_host()
	mmc: via-sdmmc: fix return value check of mmc_add_host()
	mmc: wbsd: fix return value check of mmc_add_host()
	mmc: mmci: fix return value check of mmc_add_host()
	mmc: renesas_sdhi: alway populate SCC pointer
	memstick: ms_block: Add error handling support for add_disk()
	memstick/ms_block: Add check for alloc_ordered_workqueue
	mmc: core: Normalize the error handling branch in sd_read_ext_regs()
	regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe()
	media: c8sectpfe: Add of_node_put() when breaking out of loop
	media: coda: Add check for dcoda_iram_alloc
	media: coda: Add check for kmalloc
	clk: samsung: Fix memory leak in _samsung_clk_register_pll()
	spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
	wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
	wifi: rtl8xxxu: Fix the channel width reporting
	wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
	blktrace: Fix output non-blktrace event when blk_classic option enabled
	bpf: Do not zero-extend kfunc return values
	clk: socfpga: Fix memory leak in socfpga_gate_init()
	net: vmw_vsock: vmci: Check memcpy_from_msg()
	net: defxx: Fix missing err handling in dfx_init()
	net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
	net: stmmac: fix possible memory leak in stmmac_dvr_probe()
	drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
	of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
	ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: farsync: Fix kmemleak when rmmods farsync
	net/tunnel: wait until all sk_user_data reader finish before releasing the sock
	net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
	hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
	af_unix: call proto_unregister() in the error path in af_unix_init()
	net: amd-xgbe: Fix logic around active and passive cables
	net: amd-xgbe: Check only the minimum speed for active/passive cables
	can: tcan4x5x: Remove invalid write in clear_interrupts
	can: m_can: Call the RAM init directly from m_can_chip_config
	can: tcan4x5x: Fix use of register error status mask
	net: lan9303: Fix read error execution path
	ntb_netdev: Use dev_kfree_skb_any() in interrupt context
	sctp: sysctl: make extra pointers netns aware
	Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS
	Bluetooth: btintel: Fix missing free skb in btintel_setup_combined()
	Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
	stmmac: fix potential division by 0
	i40e: Fix the inability to attach XDP program on downed interface
	net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path
	apparmor: fix a memleak in multi_transaction_new()
	apparmor: fix lockdep warning when removing a namespace
	apparmor: Fix abi check to include v8 abi
	crypto: hisilicon/qm - fix missing destroy qp_idr
	crypto: sun8i-ss - use dma_addr instead u32
	crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
	scsi: core: Fix a race between scsi_done() and scsi_timeout()
	apparmor: Use pointer to struct aa_label for lbs_cred
	PCI: dwc: Fix n_fts[] array overrun
	RDMA/core: Fix order of nldev_exit call
	PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
	f2fs: Fix the race condition of resize flag between resizefs
	crypto: rockchip - do not do custom power management
	crypto: rockchip - do not store mode globally
	crypto: rockchip - add fallback for cipher
	crypto: rockchip - add fallback for ahash
	crypto: rockchip - better handle cipher key
	crypto: rockchip - remove non-aligned handling
	crypto: rockchip - rework by using crypto_engine
	apparmor: Fix memleak in alloc_ns()
	f2fs: fix to invalidate dcc->f2fs_issue_discard in error path
	f2fs: fix normal discard process
	f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super()
	RDMA/irdma: Report the correct link speed
	scsi: qla2xxx: Fix set-but-not-used variable warnings
	RDMA/siw: Fix immediate work request flush to completion queue
	IB/mad: Don't call to function that might sleep while in atomic context
	PCI: vmd: Disable MSI remapping after suspend
	RDMA/restrack: Release MR restrack when delete
	RDMA/core: Make sure "ib_port" is valid when access sysfs node
	RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
	RDMA/siw: Set defined status for work completion with undefined status
	scsi: scsi_debug: Fix a warning in resp_write_scat()
	crypto: ccree - Remove debugfs when platform_driver_register failed
	crypto: cryptd - Use request context instead of stack for sub-request
	crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
	RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
	RDMA/hns: Fix ext_sge num error when post send
	PCI: Check for alloc failure in pci_request_irq()
	RDMA/hfi: Decrease PCI device reference count in error path
	crypto: ccree - Make cc_debugfs_global_fini() available for module init function
	RDMA/hns: fix memory leak in hns_roce_alloc_mr()
	RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
	dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq
	dt-bindings: visconti-pcie: Fix interrupts array max constraints
	scsi: hpsa: Fix possible memory leak in hpsa_init_one()
	crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
	padata: Always leave BHs disabled when running ->parallel()
	padata: Fix list iterator in padata_do_serial()
	scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
	scsi: hpsa: Fix error handling in hpsa_add_sas_host()
	scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
	scsi: efct: Fix possible memleak in efct_device_init()
	scsi: scsi_debug: Fix a warning in resp_verify()
	scsi: scsi_debug: Fix a warning in resp_report_zones()
	scsi: fcoe: Fix possible name leak when device_register() fails
	scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
	scsi: ipr: Fix WARNING in ipr_init()
	scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
	scsi: snic: Fix possible UAF in snic_tgt_create()
	RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
	f2fs: avoid victim selection from previous victim section
	RDMA/nldev: Fix failure to send large messages
	crypto: amlogic - Remove kcalloc without check
	crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
	riscv/mm: add arch hook arch_clear_hugepage_flags
	RDMA/hfi1: Fix error return code in parse_platform_config()
	RDMA/srp: Fix error return code in srp_parse_options()
	PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_
	PCI: mt7621: Add sentinel to quirks table
	orangefs: Fix sysfs not cleanup when dev init failed
	RDMA/hns: Fix AH attr queried by query_qp
	RDMA/hns: Fix PBL page MTR find
	RDMA/hns: Fix page size cap from firmware
	RDMA/hns: Fix error code of CMD
	crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
	hwrng: amd - Fix PCI device refcount leak
	hwrng: geode - Fix PCI device refcount leak
	IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
	RISC-V: Align the shadow stack
	drivers: dio: fix possible memory leak in dio_init()
	serial: tegra: Read DMA status before terminating
	serial: 8250_bcm7271: Fix error handling in brcmuart_init()
	class: fix possible memory leak in __class_register()
	vfio: platform: Do not pass return buffer to ACPI _RST method
	uio: uio_dmem_genirq: Fix missing unlock in irq configuration
	uio: uio_dmem_genirq: Fix deadlock between irq config and handling
	usb: fotg210-udc: Fix ages old endianness issues
	staging: vme_user: Fix possible UAF in tsi148_dma_list_add
	usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
	usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
	usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails
	usb: typec: tipd: Fix spurious fwnode_handle_put in error path
	extcon: usbc-tusb320: Add support for mode setting and reset
	extcon: usbc-tusb320: Add support for TUSB320L
	usb: typec: Factor out non-PD fwnode properties
	extcon: usbc-tusb320: Factor out extcon into dedicated functions
	extcon: usbc-tusb320: Add USB TYPE-C support
	extcon: usbc-tusb320: Update state on probe even if no IRQ pending
	serial: amba-pl011: avoid SBSA UART accessing DMACR register
	serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
	serial: stm32: move dma_request_chan() before clk_prepare_enable()
	serial: pch: Fix PCI device refcount leak in pch_request_dma()
	tty: serial: clean up stop-tx part in altera_uart_tx_chars()
	tty: serial: altera_uart_{r,t}x_chars() need only uart_port
	serial: altera_uart: fix locking in polling mode
	serial: sunsab: Fix error handling in sunsab_init()
	test_firmware: fix memory leak in test_firmware_init()
	misc: ocxl: fix possible name leak in ocxl_file_register_afu()
	ocxl: fix pci device refcount leak when calling get_function_0()
	misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
	misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
	firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
	cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
	cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
	iio: temperature: ltc2983: make bulk write buffer DMA-safe
	iio: adis: handle devices that cannot unmask the drdy pin
	iio: adis: stylistic changes
	iio:imu:adis: Move exports into IIO_ADISLIB namespace
	iio: adis: add '__adis_enable_irq()' implementation
	counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
	coresight: trbe: remove cpuhp instance node before remove cpuhp state
	usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
	usb: gadget: f_hid: fix f_hidg lifetime vs cdev
	usb: gadget: f_hid: fix refcount leak on error path
	drivers: mcb: fix resource leak in mcb_probe()
	mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
	chardev: fix error handling in cdev_device_add()
	i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
	staging: rtl8192u: Fix use after free in ieee80211_rx()
	staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
	vme: Fix error not catched in fake_init()
	gpiolib: Get rid of redundant 'else'
	gpiolib: cdev: fix NULL-pointer dereferences
	gpiolib: make struct comments into real kernel docs
	gpiolib: protect the GPIO device against being dropped while in use by user-space
	i2c: mux: reg: check return value after calling platform_get_resource()
	i2c: ismt: Fix an out-of-bounds bug in ismt_access()
	usb: storage: Add check for kcalloc
	tracing/hist: Fix issue of losting command info in error_log
	ksmbd: Fix resource leak in ksmbd_session_rpc_open()
	samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
	thermal/drivers/imx8mm_thermal: Validate temperature range
	thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2
	thermal/drivers/qcom/lmh: Fix irq handler return value
	fbdev: ssd1307fb: Drop optional dependency
	fbdev: pm2fb: fix missing pci_disable_device()
	fbdev: via: Fix error in via_core_init()
	fbdev: vermilion: decrease reference count in error path
	fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe()
	fbdev: geode: don't build on UML
	fbdev: uvesafb: don't build on UML
	fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
	HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
	HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
	power: supply: fix residue sysfs file in error handle route of __power_supply_register()
	perf trace: Return error if a system call doesn't exist
	perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
	perf trace: Handle failure when trace point folder is missed
	perf symbol: correction while adjusting symbol
	power: supply: z2_battery: Fix possible memleak in z2_batt_probe()
	HSI: omap_ssi_core: Fix error handling in ssi_init()
	power: supply: ab8500: Fix error handling in ab8500_charger_init()
	power: supply: fix null pointer dereferencing in power_supply_get_battery_info
	perf stat: Refactor __run_perf_stat() common code
	perf stat: Do not delay the workload with --delay
	RDMA/siw: Fix pointer cast warning
	fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst()
	overflow: Implement size_t saturating arithmetic helpers
	fs/ntfs3: Harden against integer overflows
	iommu/sun50i: Fix reset release
	iommu/sun50i: Consider all fault sources for reset
	iommu/sun50i: Fix R/W permission check
	iommu/sun50i: Fix flush size
	iommu/rockchip: fix permission bits in page table entries v2
	phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
	include/uapi/linux/swab: Fix potentially missing __always_inline
	pwm: tegra: Improve required rate calculation
	fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs
	dmaengine: idxd: Fix crc_val field for completion record
	rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
	rtc: cmos: Fix event handler registration ordering issue
	rtc: cmos: Fix wake alarm breakage
	rtc: cmos: fix build on non-ACPI platforms
	rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
	rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
	rtc: cmos: Eliminate forward declarations of some functions
	rtc: cmos: Rename ACPI-related functions
	rtc: cmos: Disable ACPI RTC event on removal
	rtc: snvs: Allow a time difference on clock register read
	rtc: pcf85063: Fix reading alarm
	iommu/amd: Fix pci device refcount leak in ppr_notifier()
	iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
	macintosh: fix possible memory leak in macio_add_one_device()
	macintosh/macio-adb: check the return value of ioremap()
	powerpc/52xx: Fix a resource leak in an error handling path
	cxl: Fix refcount leak in cxl_calc_capp_routing
	powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
	powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
	powerpc/perf: callchain validate kernel stack pointer bounds
	powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
	powerpc/hv-gpci: Fix hv_gpci event list
	selftests/powerpc: Fix resource leaks
	iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
	pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
	pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm
	pwm: mediatek: always use bus clock for PWM on MT7622
	remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
	remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()
	remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
	remoteproc: qcom_q6v5_pas: detach power domains on remove
	remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
	remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on()
	powerpc/eeh: Drop redundant spinlock initialization
	powerpc/pseries/eeh: use correct API for error log size
	mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ
	mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe()
	mfd: pm8008: Remove driver data structure pm8008_data
	mfd: pm8008: Fix return value check in pm8008_probe()
	netfilter: flowtable: really fix NAT IPv6 offload
	rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
	rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
	rtc: pcf85063: fix pcf85063_clkout_control
	nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
	net: macsec: fix net device access prior to holding a lock
	mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	block, bfq: fix possible uaf for 'bfqq->bic'
	selftests/bpf: Add test for unstable CT lookup API
	net: enetc: avoid buffer leaks on xdp_do_redirect() failure
	nfc: pn533: Clear nfc_target before being used
	unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg()
	r6040: Fix kmemleak in probe and remove
	igc: Enhance Qbv scheduling by using first flag bit
	igc: Use strict cycles for Qbv scheduling
	igc: Add checking for basetime less than zero
	igc: allow BaseTime 0 enrollment for Qbv
	igc: recalculate Qbv end_time by considering cycle time
	igc: Lift TAPRIO schedule restriction
	igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
	rtc: mxc_v2: Add missing clk_disable_unprepare()
	selftests: devlink: fix the fd redirect in dummy_reporter_test
	openvswitch: Fix flow lookup to use unmasked key
	soc: mediatek: pm-domains: Fix the power glitch issue
	arm64: dts: mt8183: Fix Mali GPU clock
	skbuff: Account for tail adjustment during pull operations
	mailbox: mpfs: read the system controller's status
	mailbox: arm_mhuv2: Fix return value check in mhuv2_probe()
	mailbox: zynq-ipi: fix error handling while device_register() fails
	net_sched: reject TCF_EM_SIMPLE case for complex ematch module
	rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
	myri10ge: Fix an error handling path in myri10ge_probe()
	net: stream: purge sk_error_queue in sk_stream_kill_queues()
	HID: amd_sfh: Add missing check for dma_alloc_coherent
	rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
	arm64: make is_ttbrX_addr() noinstr-safe
	video: hyperv_fb: Avoid taking busy spinlock on panic path
	x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
	binfmt_misc: fix shift-out-of-bounds in check_special_flags
	fs: jfs: fix shift-out-of-bounds in dbAllocAG
	udf: Avoid double brelse() in udf_rename()
	jfs: Fix fortify moan in symlink
	fs: jfs: fix shift-out-of-bounds in dbDiscardAG
	ACPICA: Fix error code path in acpi_ds_call_control_method()
	nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
	nilfs2: fix shift-out-of-bounds due to too large exponent of block size
	acct: fix potential integer overflow in encode_comp_t()
	hfs: fix OOB Read in __hfs_brec_find
	drm/etnaviv: add missing quirks for GC300
	media: imx-jpeg: Disable useless interrupt to avoid kernel panic
	brcmfmac: return error when getting invalid max_flowrings from dongle
	wifi: ath9k: verify the expected usb_endpoints are present
	wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
	ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
	ipmi: fix memleak when unload ipmi driver
	drm/amd/display: prevent memory leak
	Revert "drm/amd/display: Limit max DSC target bpp for specific monitors"
	qed (gcc13): use u16 for fid to be big enough
	bpf: make sure skb->len != 0 when redirecting to a tunneling device
	net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
	hamradio: baycom_epp: Fix return type of baycom_send_packet()
	wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
	igb: Do not free q_vector unless new one was allocated
	drm/amdgpu: Fix type of second parameter in trans_msg() callback
	drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
	s390/ctcm: Fix return type of ctc{mp,}m_tx()
	s390/netiucv: Fix return type of netiucv_tx()
	s390/lcs: Fix return type of lcs_start_xmit()
	drm/msm: Use drm_mode_copy()
	drm/rockchip: Use drm_mode_copy()
	drm/sti: Use drm_mode_copy()
	drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid()
	drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
	md/raid1: stop mdx_raid1 thread when raid1 array run failed
	drm/amd/display: fix array index out of bound error in bios parser
	net: add atomic_long_t to net_device_stats fields
	ipv6/sit: use DEV_STATS_INC() to avoid data-races
	mrp: introduce active flags to prevent UAF when applicant uninit
	ppp: associate skb with a device at tx
	bpf: Prevent decl_tag from being referenced in func_proto arg
	ethtool: avoiding integer overflow in ethtool_phys_id()
	media: dvb-frontends: fix leak of memory fw
	media: dvbdev: adopts refcnt to avoid UAF
	media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
	blk-mq: fix possible memleak when register 'hctx' failed
	drm/amd/display: Use the largest vready_offset in pipe group
	libbpf: Avoid enum forward-declarations in public API in C++ mode
	regulator: core: fix use_count leakage when handling boot-on
	wifi: mt76: do not run mt76u_status_worker if the device is not running
	mmc: f-sdh30: Add quirks for broken timeout clock capability
	mmc: renesas_sdhi: better reset from HS400 mode
	media: si470x: Fix use-after-free in si470x_int_in_callback()
	clk: st: Fix memory leak in st_of_quadfs_setup()
	crypto: hisilicon/hpre - fix resource leak in remove process
	scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs
	scsi: ufs: Reduce the START STOP UNIT timeout
	scsi: elx: libefc: Fix second parameter type in state callbacks
	hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
	drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
	drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
	orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
	orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
	tools/include: Add _RET_IP_ and math definitions to kernel.h
	KVM: selftests: Fix build regression by using accessor function
	hwmon: (jc42) Fix missing unlock on error in jc42_write()
	ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
	ALSA: hda: add snd_hdac_stop_streams() helper
	ASoC: Intel: Skylake: Fix driver hang during shutdown
	ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
	ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
	ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
	ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe()
	ASoC: wm8994: Fix potential deadlock
	ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
	ASoC: rt5670: Remove unbalanced pm_runtime_put()
	drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern
	LoadPin: Ignore the "contents" argument of the LSM hooks
	pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
	perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
	afs: Fix lost servers_outstanding count
	pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
	ima: Simplify ima_lsm_copy_rule
	ALSA: usb-audio: add the quirk for KT0206 device
	ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
	ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
	usb: cdnsp: fix lack of ZLP for ep0
	usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq
	arm64: dts: qcom: sm8250: fix USB-DP PHY registers
	usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
	usb: dwc3: core: defer probe on ulpi_read_id timeout
	xhci: Prevent infinite loop in transaction errors recovery for streams
	HID: wacom: Ensure bootloader PID is usable in hidraw mode
	HID: mcp2221: don't connect hidraw
	loop: Fix the max_loop commandline argument treatment when it is set to 0
	9p: set req refcount to zero to avoid uninitialized usage
	security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6
	reiserfs: Add missing calls to reiserfs_security_free()
	iio: fix memory leak in iio_device_register_eventset()
	iio: adc: ad_sigma_delta: do not use internal iio_dev lock
	iio: adc128s052: add proper .data members in adc128_of_match table
	regulator: core: fix deadlock on regulator enable
	floppy: Fix memory leak in do_floppy_init()
	gcov: add support for checksum field
	fbdev: fbcon: release buffer when fbcon_do_set_font() failed
	ovl: fix use inode directly in rcu-walk mode
	btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range
	scsi: qla2xxx: Fix crash when I/O abort times out
	net: stmmac: fix errno when create_singlethread_workqueue() fails
	media: dvbdev: fix build warning due to comments
	media: dvbdev: fix refcnt bug
	extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered
	mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code
	pwm: tegra: Fix 32 bit build
	Linux 5.15.86

Change-Id: Ic157edd6a65abf4a3167b5d227edeb0564f1be4e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-01-18 12:52:16 +00:00
Eric Biggers
d4966a8203 ANDROID: fips140: remove CONFIG_CRYPTO_FIPS140 option 
There is no good reason for the CRYPTO_FIPS140 kconfig option to exist
separately from CRYPTO_FIPS140_MOD.  It existed mainly to guard some
code in the module loader that was needed only for loading the fips140
module.  However, that code has been removed, since an alternate
solution that doesn't require changes to the module loader was found.

The remaining references to CRYPTO_FIPS140 are in:

- scripts/module.lds.S.  But the guarded code only affects building the
  fips140 module, so CRYPTO_FIPS140_MOD should be used here instead.

- lib/crypto/, for guarding the Android vendor hooks required by the
  fips140 module.  However, Android vendor hooks are already guarded by
  ANDROID_VENDOR_HOOKS.  The extra guard by CRYPTO_FIPS140 isn't useful,
  especially since CRYPTO_FIPS140 was effectively hardcoded to y anyway.
  It did have the side effect of making the hooks be guarded by arm64,
  which excluded them from builds of arch/x86/purgatory/.  However, a
  cleaner way to accomplish that is to check for __DISABLE_EXPORTS,
  which handles both arch/x86/purgatory/ and fips140.ko itself.

Bug: 188620248
Change-Id: Ic6141cd2a553540c2bf95774e71de7310926e3ce
Signed-off-by: Eric Biggers <ebiggers@google.com>
 2023-01-09 21:19:29 +00:00
Kees Cook
30f20ceb87 overflow: Implement size_t saturating arithmetic helpers 
[ Upstream commit e1be43d9b5d0d1310dbd90185a8e5c7145dde40f ]

In order to perform more open-coded replacements of common allocation
size arithmetic, the kernel needs saturating (SIZE_MAX) helpers for
multiplication, addition, and subtraction. For example, it is common in
allocators, especially on realloc, to add to an existing size:

    p = krealloc(map->patch,
                 sizeof(struct reg_sequence) * (map->patch_regs + num_regs),
                 GFP_KERNEL);

There is no existing saturating replacement for this calculation, and
just leaving the addition open coded inside array_size() could
potentially overflow as well. For example, an overflow in an expression
for a size_t argument might wrap to zero:

    array_size(anything, something_at_size_max + 1) == 0

Introduce size_mul(), size_add(), and size_sub() helpers that
implicitly promote arguments to size_t and saturated calculations for
use in allocations. With these helpers it is also possible to redefine
array_size(), array3_size(), flex_array_size(), and struct_size() in
terms of the new helpers.

As with the check_*_overflow() helpers, the new helpers use __must_check,
though what is really desired is a way to make sure that assignment is
only to a size_t lvalue. Without this, it's still possible to introduce
overflow/underflow via type conversion (i.e. from size_t to int).
Enforcing this will currently need to be left to static analysis or
future use of -Wconversion.

Additionally update the overflow unit tests to force runtime evaluation
for the pathological cases.

Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Len Baker <len.baker@gmx.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Stable-dep-of: e001e6086939 ("fs/ntfs3: Harden against integer overflows")
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-31 13:14:33 +01:00
Zhengchao Shao
357379d504 test_firmware: fix memory leak in test_firmware_init() 
[ Upstream commit 7610615e8cdb3f6f5bbd9d8e7a5d8a63e3cabf2e ]

When misc_register() failed in test_firmware_init(), the memory pointed
by test_fw_config->name is not released. The memory leak information is
as follows:
unreferenced object 0xffff88810a34cb00 (size 32):
  comm "insmod", pid 7952, jiffies 4294948236 (age 49.060s)
  hex dump (first 32 bytes):
    74 65 73 74 2d 66 69 72 6d 77 61 72 65 2e 62 69  test-firmware.bi
    6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  n...............
  backtrace:
    [<ffffffff81b21fcb>] __kmalloc_node_track_caller+0x4b/0xc0
    [<ffffffff81affb96>] kstrndup+0x46/0xc0
    [<ffffffffa0403a49>] __test_firmware_config_init+0x29/0x380 [test_firmware]
    [<ffffffffa040f068>] 0xffffffffa040f068
    [<ffffffff81002c41>] do_one_initcall+0x141/0x780
    [<ffffffff816a72c3>] do_init_module+0x1c3/0x630
    [<ffffffff816adb9e>] load_module+0x623e/0x76a0
    [<ffffffff816af471>] __do_sys_finit_module+0x181/0x240
    [<ffffffff89978f99>] do_syscall_64+0x39/0xb0
    [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: c92316bf8e ("test_firmware: add batched firmware tests")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20221119035721.18268-1-shaozhengchao@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-31 13:14:29 +01:00
Akinobu Mita
7e8e8cc136 lib/notifier-error-inject: fix error when writing -errno to debugfs file 
[ Upstream commit f883c3edd2c432a2931ec8773c70a570115a50fe ]

The simple attribute files do not accept a negative value since the commit
488dac0c92 ("libfs: fix error cast of negative value in
simple_attr_write()").

This restores the previous behaviour by using newly introduced
DEFINE_SIMPLE_ATTRIBUTE_SIGNED instead of DEFINE_SIMPLE_ATTRIBUTE.

Link: https://lkml.kernel.org/r/20220919172418.45257-3-akinobu.mita@gmail.com
Fixes: 488dac0c92 ("libfs: fix error cast of negative value in simple_attr_write()")
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Reported-by: Zhao Gongyi <zhaogongyi@huawei.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yongjun <weiyongjun1@huawei.com>
Cc: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-31 13:14:03 +01:00
Gaosheng Cui
e83b47580a lib/fonts: fix undefined behavior in bit shift for get_default_font 
[ Upstream commit 6fe888c4d2fb174408e4540bb2d5602b9f507f90 ]

Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned.  The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20
left shift of 1 by 31 places cannot be represented in type 'int'
 <TASK>
 dump_stack_lvl+0x7d/0xa5
 dump_stack+0x15/0x1b
 ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
 get_default_font+0x1c7/0x1f0
 fbcon_startup+0x347/0x3a0
 do_take_over_console+0xce/0x270
 do_fbcon_takeover+0xa1/0x170
 do_fb_registered+0x2a8/0x340
 fbcon_fb_registered+0x47/0xe0
 register_framebuffer+0x294/0x4a0
 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]
 drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper]
 drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper]
 drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper]
 bochs_pci_probe+0x6ca/0x772 [bochs]
 local_pci_probe+0x4d/0xb0
 pci_device_probe+0x119/0x320
 really_probe+0x181/0x550
 __driver_probe_device+0xc6/0x220
 driver_probe_device+0x32/0x100
 __driver_attach+0x195/0x200
 bus_for_each_dev+0xbb/0x120
 driver_attach+0x27/0x30
 bus_add_driver+0x22e/0x2f0
 driver_register+0xa9/0x190
 __pci_register_driver+0x90/0xa0
 bochs_pci_driver_init+0x52/0x1000 [bochs]
 do_one_initcall+0x76/0x430
 do_init_module+0x61/0x28a
 load_module+0x1f82/0x2e50
 __do_sys_finit_module+0xf8/0x190
 __x64_sys_finit_module+0x23/0x30
 do_syscall_64+0x58/0x80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 </TASK>

Link: https://lkml.kernel.org/r/20221031113829.4183153-1-cuigaosheng1@huawei.com
Fixes: c81f717cb9 ("fbcon: Fix typo and bogus logic in get_default_font")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-31 13:14:02 +01:00
wuchi
4b46932283 lib/debugobjects: fix stat count and optimize debug_objects_mem_init 
[ Upstream commit eabb7f1ace53e127309407b2b5e74e8199e85270 ]

1. Var debug_objects_allocated tracks valid kmem_cache_alloc calls, so
   track it in debug_objects_replace_static_objects.  Do similar things in
   object_cpu_offline.

2. In debug_objects_mem_init, there is no need to call function
   cpuhp_setup_state_nocalls when debug_objects_enabled = 0 (out of
   memory).

Link: https://lkml.kernel.org/r/20220611130634.99741-1-wuchi.zero@gmail.com
Fixes: 634d61f45d ("debugobjects: Percpu pool lookahead freeing/allocation")
Fixes: c4b73aabd0 ("debugobjects: Track number of kmem_cache_alloc/kmem_cache_free done")
Signed-off-by: wuchi <wuchi.zero@gmail.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-31 13:14:01 +01:00
Andrey Konovalov
5839854929 UPSTREAM: kasan: move tests to mm/kasan/ 
Move KASAN tests to mm/kasan/ to keep the test code alongside the
implementation.

Link: https://lkml.kernel.org/r/676398f0aeecd47d2f8e3369ea0e95563f641a36.1662416260.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 254721825
(cherry picked from commit f7e01ab828fd4bf6d25b1f143a3994241e8572bf)
Change-Id: I5f140a9b4decb076ca2a3be3587f9d187d05c435
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
 2022-12-20 23:11:43 +00:00
Andrey Konovalov
99f245a12c UPSTREAM: kasan: add another use-after-free test 
Add a new use-after-free test that checks that KASAN detects
use-after-free when another object was allocated in the same slot.

This test is mainly relevant for the tag-based modes, which do not use
quarantine.

Once [1] is resolved, this test can be extended to check that the stack
traces in the report point to the proper kmalloc/kfree calls.

[1] https://bugzilla.kernel.org/show_bug.cgi?id=212203

Link: https://lkml.kernel.org/r/0659cfa15809dd38faa02bc0a59d0b5dbbd81211.1662411800.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 254721825
(cherry picked from commit 34b592ce5cc2dbd7d94812bff12ec32d3ec6f65c)
Change-Id: I30ea708890166efde2782ff41b42ae0909dcea50
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
 2022-12-20 23:11:43 +00:00
Andrey Konovalov
4c6a34f440 BACKPORT: kasan: drop CONFIG_KASAN_TAGS_IDENTIFY 
(Backport: minor conflicts due folio pathset not backported.)

Drop CONFIG_KASAN_TAGS_IDENTIFY and related code to simplify making
changes to the reporting code.

The dropped functionality will be restored in the following patches in
this series.

Link: https://lkml.kernel.org/r/4c66ba98eb237e9ed9312c19d423bbcf4ecf88f8.1662411799.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 254721825
(cherry picked from commit 687c85afa67a635dae683cf0ab6012e76333065b)
Change-Id: If4df8435ee4447e772b2bef24b58aa7737359bda
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
 2022-12-20 23:11:41 +00:00
Andrey Konovalov
25f6112738 UPSTREAM: kasan: clean-up kconfig options descriptions 
Various readability clean-ups of KASAN Kconfig options.

No functional changes.

Link: https://lkml.kernel.org/r/c160840dd9e4b1ad5529ecfdb0bba35d9a14d826.1652203271.git.andreyknvl@google.com
Link: https://lkml.kernel.org/r/47afaecec29221347bee49f58c258ac1ced3b429.1652123204.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 254721825
(cherry picked from commit fe30ddca9f18fb56bf1dd161ffd9d8a04bba5713)
Change-Id: Ie7813a0711bc8e6e8d47f030cbf226d2a6da3e4a
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
 2022-12-20 21:21:26 +00:00
Peter Collingbourne
d7045d5644 UPSTREAM: kasan: update function name in comments 
The function kasan_global_oob was renamed to kasan_global_oob_right, but
the comments referring to it were not updated.  Do so.

Link: https://linux-review.googlesource.com/id/I20faa90126937bbee77d9d44709556c3dd4b40be
Link: https://lkml.kernel.org/r/20220219012433.890941-1-pcc@google.com
Signed-off-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug: 254721825
(cherry picked from commit 2dfd1bd992322f7ab8db82d7862cb758c3be63fa)
Change-Id: I024557d0b724abb8473e18319ea8267fa038fe7f
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
 2022-12-20 21:21:26 +00:00
Imran Khan
e9aa144c45 UPSTREAM: lib, stackdepot: add helper to print stack entries 
To print a stack entries, users of stackdepot, first use stack_depot_fetch
to get a list of stack entries and then use stack_trace_print to print
this list.  Provide a helper in stackdepot to print stack entries based on
stackdepot handle.  Also change above mentioned users to use this helper.

Link: https://lkml.kernel.org/r/20210915014806.3206938-3-imran.f.khan@oracle.com
Signed-off-by: Imran Khan <imran.f.khan@oracle.com>
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: David Airlie <airlied@linux.ie>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug: 254721825
(cherry picked from commit 505be48165fa2f2cb795659b4fc61f35563d105e)
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Change-Id: I70e12b6381a908b8c8fd1cffde9d908b6f7691eb
 2022-12-20 21:21:26 +00:00
Imran Khan
42937de44c UPSTREAM: lib, stackdepot: check stackdepot handle before accessing slabs 
Patch series "lib, stackdepot: check stackdepot handle before accessing slabs", v2.

PATCH-1: Checks validity of a stackdepot handle before proceeding to
access stackdepot slab/objects.

PATCH-2: Adds a helper in stackdepot, to allow users to print stack
entries just by specifying the stackdepot handle.  It also changes such
users to use this new interface.

PATCH-3: Adds a helper in stackdepot, to allow users to print stack
entries into buffers just by specifying the stackdepot handle and
destination buffer.  It also changes such users to use this new interface.

This patch (of 3):

stack_depot_save allocates slabs that will be used for storing objects in
future.If this slab allocation fails we may get to a situation where space
allocation for a new stack_record fails, causing stack_depot_save to
return 0 as handle.  If user of this handle ends up invoking
stack_depot_fetch with this handle value, current implementation of
stack_depot_fetch will end up using slab from wrong index.  To avoid this
check handle value at the beginning.

Link: https://lkml.kernel.org/r/20210915175321.3472770-1-imran.f.khan@oracle.com
Link: https://lkml.kernel.org/r/20210915014806.3206938-1-imran.f.khan@oracle.com
Link: https://lkml.kernel.org/r/20210915014806.3206938-2-imran.f.khan@oracle.com
Signed-off-by: Imran Khan <imran.f.khan@oracle.com>
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug: 254721825
(cherry picked from commit 4d4712c1a4ac331574fb4542e4adcfd24fdb07d0)
Change-Id: Ic17c8b4a6f98aa0eee65ba750573baf63d398fe8
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
 2022-12-20 21:21:26 +00:00
Andrey Konovalov
68f55096aa UPSTREAM: kasan: test: prevent cache merging in kmem_cache_double_destroy 
With HW_TAGS KASAN and kasan.stacktrace=off, the cache created in the
kmem_cache_double_destroy() test might get merged with an existing one.
Thus, the first kmem_cache_destroy() call won't actually destroy it but
will only decrease the refcount.  This causes the test to fail.

Provide an empty constructor for the created cache to prevent the cache
from getting merged.

Bug: 254441685
Link: https://lkml.kernel.org/r/b597bd434c49591d8af00ee3993a42c609dc9a59.1644346040.git.andreyknvl@google.com
Fixes: f98f966cd750 ("kasan: test: add test case for double-kmem_cache_destroy()")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 70effdc3756c924f4a2b6af1ec4e2e92e18e1b45)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iadceef74f2239975ec6abd934776ecd5a6d39943
 2022-12-19 16:21:56 +00:00
Greg Kroah-Hartman
b3d82fd3de Merge 5.15.82 into android14-5.15 
Changes in 5.15.82
	arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored
	drm/i915: Create a dummy object for gen6 ppgtt
	drm/i915/gt: Use i915_vm_put on ppgtt_create error paths
	erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
	btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino
	btrfs: free btrfs_path before copying inodes to userspace
	spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
	btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
	btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
	drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
	drm/amdgpu: update drm_display_info correctly when the edid is read
	drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
	iio: health: afe4403: Fix oob read in afe4403_read_raw
	iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
	iio: light: rpr0521: add missing Kconfig dependencies
	bpf, perf: Use subprog name when reporting subprog ksymbol
	scripts/faddr2line: Fix regression in name resolution on ppc64le
	ARM: at91: rm9200: fix usb device clock id
	libbpf: Handle size overflow for ringbuf mmap
	hwmon: (ltc2947) fix temperature scaling
	hwmon: (ina3221) Fix shunt sum critical calculation
	hwmon: (i5500_temp) fix missing pci_disable_device()
	hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
	bpf: Do not copy spin lock field from user in bpf_selem_alloc
	nvmem: rmem: Fix return value check in rmem_read()
	of: property: decrement node refcount in of_fwnode_get_reference_args()
	ixgbevf: Fix resource leak in ixgbevf_init_module()
	i40e: Fix error handling in i40e_init_module()
	fm10k: Fix error handling in fm10k_init_module()
	iavf: remove redundant ret variable
	iavf: Fix error handling in iavf_init_module()
	e100: Fix possible use after free in e100_xmit_prepare
	net/mlx5: DR, Rename list field in matcher struct to list_node
	net/mlx5: DR, Fix uninitialized var warning
	net/mlx5: Fix uninitialized variable bug in outlen_write()
	net/mlx5e: Fix use-after-free when reverting termination table
	can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
	can: cc770: cc770_isa_probe(): add missing free_cc770dev()
	can: etas_es58x: es58x_init_netdev(): free netdev when register_candev()
	can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods
	can: m_can: Add check for devm_clk_get
	qlcnic: fix sleep-in-atomic-context bugs caused by msleep
	aquantia: Do not purge addresses when setting the number of rings
	wifi: cfg80211: fix buffer overflow in elem comparison
	wifi: cfg80211: don't allow multi-BSSID in S1G
	wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
	net: phy: fix null-ptr-deref while probe() failed
	net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()
	net: net_netdev: Fix error handling in ntb_netdev_init_module()
	net/9p: Fix a potential socket leak in p9_socket_open
	net: ethernet: nixge: fix NULL dereference
	net: wwan: iosm: fix kernel test robot reported error
	net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type
	dsa: lan9303: Correct stat name
	tipc: re-fetch skb cb after tipc_msg_validate
	net: hsr: Fix potential use-after-free
	net: mdiobus: fix unbalanced node reference count
	afs: Fix fileserver probe RTT handling
	net: tun: Fix use-after-free in tun_detach()
	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
	sctp: fix memory leak in sctp_stream_outq_migrate()
	net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
	hwmon: (coretemp) Check for null before removing sysfs attrs
	hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
	riscv: vdso: fix section overlapping under some conditions
	riscv: mm: Proper page permissions after initmem free
	ALSA: dice: fix regression for Lexicon I-ONIX FW810S
	error-injection: Add prompt for function error injection
	tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
	nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
	x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
	pinctrl: intel: Save and restore pins in "direct IRQ" mode
	v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
	net: stmmac: Set MAC's flow control register to reflect current settings
	mmc: mmc_test: Fix removal of debugfs file
	mmc: core: Fix ambiguous TRIM and DISCARD arg
	mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
	mmc: sdhci-sprd: Fix no reset data and command after voltage switch
	mmc: sdhci: Fix voltage switch delay
	drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
	drm/amdgpu: enable Vangogh VCN indirect sram mode
	drm/i915: Fix negative value passed as remaining time
	drm/i915: Never return 0 if not all requests retired
	tracing/osnoise: Fix duration type
	tracing: Fix race where histograms can be called before the event
	tracing: Free buffers when a used dynamic event is removed
	io_uring: update res mask in io_poll_check_events
	io_uring: fix tw losing poll events
	io_uring: cmpxchg for poll arm refs release
	io_uring: make poll refs more robust
	io_uring/poll: fix poll_refs race with cancelation
	KVM: x86/mmu: Fix race condition in direct_page_fault
	ASoC: ops: Fix bounds check for _sx controls
	pinctrl: single: Fix potential division by zero
	riscv: Sync efi page table's kernel mappings before switching
	riscv: fix race when vmap stack overflow
	riscv: kexec: Fixup irq controller broken in kexec crash path
	nvme: fix SRCU protection of nvme_ns_head list
	iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
	iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
	mm: __isolate_lru_page_prepare() in isolate_migratepages_block()
	mm: migrate: fix THP's mapcount on isolation
	parisc: Increase FRAME_WARN to 2048 bytes on parisc
	Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
	selftests: net: add delete nexthop route warning test
	selftests: net: fix nexthop warning cleanup double ip typo
	ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
	ipv4: Fix route deletion when nexthop info is not specified
	serial: stm32: Factor out GPIO RTS toggling into separate function
	serial: stm32: Use TC interrupt to deassert GPIO RTS in RS485 mode
	serial: stm32: Deassert Transmit Enable on ->rs485_config()
	i2c: npcm7xx: Fix error handling in npcm_i2c_init()
	i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
	ACPI: HMAT: remove unnecessary variable initialization
	ACPI: HMAT: Fix initiator registration for single-initiator systems
	Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
	char: tpm: Protect tpm_pm_suspend with locks
	Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
	ipc/sem: Fix dangling sem_array access in semtimedop race
	proc: avoid integer type confusion in get_proc_long
	proc: proc_skip_spaces() shouldn't think it is working on C strings
	Linux 5.15.82

Change-Id: I1631261fcfd321674c546c41628bb3283e02f1a5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-12-08 16:43:35 +00:00
Lee Jones
e078355881 Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled 
[ Upstream commit 152fe65f300e1819d59b80477d3e0999b4d5d7d2 ]

When enabled, KASAN enlarges function's stack-frames.  Pushing quite a few
over the current threshold.  This can mainly be seen on 32-bit
architectures where the present limit (when !GCC) is a lowly 1024-Bytes.

Link: https://lkml.kernel.org/r/20221125120750.3537134-3-lee@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: David Airlie <airlied@gmail.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Leo Li <sunpeng.li@amd.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: "Pan, Xinhui" <Xinhui.Pan@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Tom Rix <trix@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-08 11:28:44 +01:00
Helge Deller
723fa02e0e parisc: Increase FRAME_WARN to 2048 bytes on parisc 
[ Upstream commit 8d192bec534bd5b778135769a12e5f04580771f7 ]

PA-RISC uses a much bigger frame size for functions than other
architectures. So increase it to 2048 for 32- and 64-bit kernels.
This fixes e.g. a warning in lib/xxhash.c.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Stable-dep-of: 152fe65f300e ("Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled")
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-08 11:28:44 +01:00
Steven Rostedt (Google)
b60a8ad771 error-injection: Add prompt for function error injection 
commit a4412fdd49dc011bcc2c0d81ac4cab7457092650 upstream.

The config to be able to inject error codes into any function annotated
with ALLOW_ERROR_INJECTION() is enabled when FUNCTION_ERROR_INJECTION is
enabled.  But unfortunately, this is always enabled on x86 when KPROBES
is enabled, and there's no way to turn it off.

As kprobes is useful for observability of the kernel, it is useful to
have it enabled in production environments.  But error injection should
be avoided.  Add a prompt to the config to allow it to be disabled even
when kprobes is enabled, and get rid of the "def_bool y".

This is a kernel debug feature (it's in Kconfig.debug), and should have
never been something enabled by default.

Cc: stable@vger.kernel.org
Fixes: 540adea380 ("error-injection: Separate error-injection from kprobe")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-12-08 11:28:42 +01:00
Greg Kroah-Hartman
880a2689a3 Merge 5.15.81 into android14-5.15 
Changes in 5.15.81
	ASoC: fsl_sai: use local device pointer
	ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N
	serial: Add rs485_supported to uart_port
	serial: fsl_lpuart: Fill in rs485_supported
	tty: serial: fsl_lpuart: don't break the on-going transfer when global reset
	sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent
	sctp: clear out_curr if all frag chunks of current msg are pruned
	cifs: introduce new helper for cifs_reconnect()
	cifs: split out dfs code from cifs_reconnect()
	cifs: support nested dfs links over reconnect
	cifs: Fix connections leak when tlink setup failed
	ata: libata-scsi: simplify __ata_scsi_queuecmd()
	ata: libata-core: do not issue non-internal commands once EH is pending
	drm/display: Don't assume dual mode adaptors support i2c sub-addressing
	nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH
	nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro
	nvme-pci: disable namespace identifiers for the MAXIO MAP1001
	nvme-pci: disable write zeroes on various Kingston SSD
	nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000
	iio: ms5611: Simplify IO callback parameters
	iio: pressure: ms5611: fixed value compensation bug
	ceph: do not update snapshot context when there is no new snapshot
	ceph: avoid putting the realm twice when decoding snaps fails
	x86/sgx: Create utility to validate user provided offset and length
	x86/sgx: Add overflow check in sgx_validate_offset_length()
	binder: validate alloc->mm in ->mmap() handler
	ceph: Use kcalloc for allocating multiple elements
	ceph: fix NULL pointer dereference for req->r_session
	wifi: mac80211: fix memory free error when registering wiphy fail
	wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
	riscv: dts: sifive unleashed: Add PWM controlled LEDs
	audit: fix undefined behavior in bit shift for AUDIT_BIT
	wifi: airo: do not assign -1 to unsigned char
	wifi: mac80211: Fix ack frame idr leak when mesh has no route
	wifi: ath11k: Fix QCN9074 firmware boot on x86
	spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
	selftests/bpf: Add verifier test for release_reference()
	Revert "net: macsec: report real_dev features when HW offloading is enabled"
	platform/x86: ideapad-laptop: Disable touchpad_switch
	platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1
	platform/x86/intel/pmt: Sapphire Rapids PMT errata fix
	platform/x86/intel/hid: Add some ACPI device IDs
	scsi: ibmvfc: Avoid path failures during live migration
	scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
	drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
	block, bfq: fix null pointer dereference in bfq_bio_bfqg()
	arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
	nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
	Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""
	ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue
	RISC-V: vdso: Do not add missing symbols to version section in linker script
	MIPS: pic32: treat port as signed integer
	xfrm: fix "disable_policy" on ipv4 early demux
	xfrm: replay: Fix ESN wrap around for GSO
	af_key: Fix send_acquire race with pfkey_register
	ARM: dts: am335x-pcm-953: Define fixed regulators in root node
	ASoC: hdac_hda: fix hda pcm buffer overflow issue
	ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
	ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
	x86/hyperv: Restore VP assist page after cpu offlining/onlining
	scsi: storvsc: Fix handling of srb_status and capacity change events
	ASoC: max98373: Add checks for devm_kcalloc
	regulator: core: fix kobject release warning and memory leak in regulator_register()
	spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld()
	regulator: core: fix UAF in destroy_regulator()
	bus: sunxi-rsb: Remove the shutdown callback
	bus: sunxi-rsb: Support atomic transfers
	tee: optee: fix possible memory leak in optee_register_device()
	ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
	selftests: mptcp: more stable simult_flows tests
	selftests: mptcp: fix mibit vs mbit mix up
	net: liquidio: simplify if expression
	rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc
	rxrpc: Use refcount_t rather than atomic_t
	rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
	net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus
	nfc/nci: fix race with opening and closing
	net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
	9p/fd: fix issue of list_del corruption in p9_fd_cancel()
	netfilter: conntrack: Fix data-races around ct mark
	netfilter: nf_tables: do not set up extensions for end interval
	iavf: Fix a crash during reset task
	iavf: Do not restart Tx queues after reset task failure
	iavf: Fix race condition between iavf_shutdown and iavf_remove
	ARM: mxs: fix memory leak in mxs_machine_init()
	ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
	net: ethernet: mtk_eth_soc: fix error handling in mtk_open()
	net/mlx4: Check retval of mlx4_bitmap_init
	net: mvpp2: fix possible invalid pointer dereference
	net/qla3xxx: fix potential memleak in ql3xxx_send()
	octeontx2-af: debugsfs: fix pci device refcount leak
	net: pch_gbe: fix pci device refcount leak while module exiting
	nfp: fill splittable of devlink_port_attrs correctly
	nfp: add port from netdev validation for EEPROM access
	macsec: Fix invalid error code set
	Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
	Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
	netfilter: ipset: regression in ip_set_hash_ip.c
	net/mlx5: Do not query pci info while pci disabled
	net/mlx5: Fix FW tracer timestamp calculation
	net/mlx5: Fix handling of entry refcount when command is not issued to FW
	tipc: set con sock in tipc_conn_alloc
	tipc: add an extra conn_get in tipc_conn_alloc
	tipc: check skb_linearize() return value in tipc_disc_rcv()
	xfrm: Fix oops in __xfrm_state_delete()
	xfrm: Fix ignored return value in xfrm6_init()
	net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg()
	sfc: fix potential memleak in __ef100_hard_start_xmit()
	net: sparx5: fix error handling in sparx5_port_open()
	net: sched: allow act_ct to be built without NF_NAT
	NFC: nci: fix memory leak in nci_rx_data_packet()
	regulator: twl6030: re-add TWL6032_SUBCLASS
	bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
	dma-buf: fix racing conflict of dma_heap_add()
	netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
	netfilter: flowtable_offload: add missing locking
	fs: do not update freeing inode i_io_list
	dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
	ipv4: Fix error return code in fib_table_insert()
	arcnet: fix potential memory leak in com20020_probe()
	s390/dasd: fix no record found for raw_track_access
	nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
	nfc: st-nci: fix memory leaks in EVT_TRANSACTION
	nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION
	net: enetc: manage ENETC_F_QBV in priv->active_offloads only when enabled
	net: enetc: cache accesses to &priv->si->hw
	net: enetc: preserve TX ring priority across reconfiguration
	octeontx2-pf: Add check for devm_kcalloc
	octeontx2-af: Fix reference count issue in rvu_sdp_init()
	net: thunderx: Fix the ACPI memory leak
	s390/crashdump: fix TOD programmable field size
	lib/vdso: use "grep -E" instead of "egrep"
	init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
	nios2: add FORCE for vmlinuz.gz
	mmc: sdhci-brcmstb: Re-organize flags
	mmc: sdhci-brcmstb: Enable Clock Gating to save power
	mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI
	KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from EL1
	usb: dwc3: exynos: Fix remove() function
	usb: cdnsp: Fix issue with Clear Feature Halt Endpoint
	usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1
	ext4: fix use-after-free in ext4_ext_shift_extents
	arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
	iio: light: apds9960: fix wrong register for gesture gain
	iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
	bus: ixp4xx: Don't touch bit 7 on IXP42x
	usb: dwc3: gadget: conditionally remove requests
	usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
	usb: dwc3: gadget: Clear ep descriptor last
	nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
	gcov: clang: fix the buffer overflow issue
	mm: vmscan: fix extreme overreclaim and swap floods
	KVM: x86: nSVM: leave nested mode on vCPU free
	KVM: x86: forcibly leave nested mode on vCPU reset
	KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use
	KVM: x86: add kvm_leave_nested
	KVM: x86: remove exit_int_info warning in svm_handle_exit
	x86/tsx: Add a feature bit for TSX control MSR support
	x86/pm: Add enumeration check before spec MSRs save/restore setup
	x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
	Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
	ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
	tools: iio: iio_generic_buffer: Fix read size
	serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
	Input: goodix - try resetting the controller when no config is set
	Input: soc_button_array - add use_low_level_irq module parameter
	Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[]
	Input: i8042 - apply probe defer to more ASUS ZenBook models
	ASoC: stm32: dfsdm: manage cb buffers cleanup
	xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
	xen/platform-pci: add missing free_irq() in error path
	platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
	platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
	drm/amdgpu: disable BACO support on more cards
	zonefs: fix zone report size in __zonefs_io_error()
	platform/x86: hp-wmi: Ignore Smart Experience App event
	platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some Yoga laptops
	tcp: configurable source port perturb table size
	net: usb: qmi_wwan: add Telit 0x103a composition
	scsi: iscsi: Fix possible memory leak when device_register() failed
	gpu: host1x: Avoid trying to use GART on Tegra20
	dm integrity: flush the journal on suspend
	dm integrity: clear the journal on suspend
	fuse: lock inode unconditionally in fuse_fallocate()
	wifi: wilc1000: validate pairwise and authentication suite offsets
	wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
	wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
	wifi: wilc1000: validate number of channels
	genirq/msi: Shutdown managed interrupts with unsatifiable affinities
	genirq: Always limit the affinity to online CPUs
	irqchip/gic-v3: Always trust the managed affinity provided by the core code
	genirq: Take the proposed affinity at face value if force==true
	btrfs: free btrfs_path before copying root refs to userspace
	btrfs: free btrfs_path before copying fspath to userspace
	btrfs: free btrfs_path before copying subvol info to userspace
	btrfs: zoned: fix missing endianness conversion in sb_write_pointer
	btrfs: use kvcalloc in btrfs_get_dev_zone_info
	btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
	drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
	drm/amd/display: No display after resume from WB/CB
	drm/amdgpu: Enable Aldebaran devices to report CU Occupancy
	drm/amdgpu: always register an MMU notifier for userptr
	drm/i915: fix TLB invalidation for Gen12 video and compute engines
	cifs: fix missed refcounting of ipc tcon
	Linux 5.15.81

Change-Id: I9fe677a5bc83d3484f86aebbe20dd129c7ca3a42
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-12-04 12:02:10 +00:00
Greg Kroah-Hartman
c4a9046c27 lib/vdso: use "grep -E" instead of "egrep" 
commit 8ac3b5cd3e0521d92f9755e90d140382fc292510 upstream.

The latest version of grep claims the egrep is now obsolete so the build
now contains warnings that look like:
	egrep: warning: egrep is obsolescent; using grep -E
fix this up by moving the vdso Makefile to use "grep -E" instead.

Cc: Andy Lutomirski <luto@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Link: https://lore.kernel.org/r/20220920170633.3133829-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-12-02 17:41:08 +01:00
Greg Kroah-Hartman
335a32d033 Merge 5.15.75 into android14-5.15 
Changes in 5.15.75
	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
	ALSA: oss: Fix potential deadlock at unregistration
	ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
	ALSA: usb-audio: Fix potential memory leaks
	ALSA: usb-audio: Fix NULL dererence at error path
	ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
	ALSA: hda/realtek: Correct pin configs for ASUS G533Z
	ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
	ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
	mtd: rawnand: atmel: Unmap streaming DMA mappings
	io_uring/net: don't update msg_name if not provided
	hv_netvsc: Fix race between VF offering and VF association message from host
	cifs: destage dirty pages before re-reading them for cache=none
	cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
	iio: dac: ad5593r: Fix i2c read protocol requirements
	iio: ltc2497: Fix reading conversion results
	iio: adc: ad7923: fix channel readings for some variants
	iio: pressure: dps310: Refactor startup procedure
	iio: pressure: dps310: Reset chip after timeout
	xhci: dbc: Fix memory leak in xhci_alloc_dbc()
	usb: add quirks for Lenovo OneLink+ Dock
	can: kvaser_usb: Fix use of uninitialized completion
	can: kvaser_usb_leaf: Fix overread with an invalid command
	can: kvaser_usb_leaf: Fix TX queue out of sync after restart
	can: kvaser_usb_leaf: Fix CAN state after restart
	mmc: sdhci-sprd: Fix minimum clock limit
	i2c: designware: Fix handling of real but unexpected device interrupts
	fs: dlm: fix race between test_bit() and queue_work()
	fs: dlm: handle -EBUSY first in lock arg validation
	HID: multitouch: Add memory barriers
	quota: Check next/prev free block number after reading from quota file
	platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
	ASoC: wcd9335: fix order of Slimbus unprepare/disable
	ASoC: wcd934x: fix order of Slimbus unprepare/disable
	hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
	net: thunderbolt: Enable DMA paths only after rings are enabled
	regulator: qcom_rpm: Fix circular deferral regression
	arm64: topology: move store_cpu_topology() to shared code
	riscv: topology: fix default topology reporting
	RISC-V: Make port I/O string accessors actually work
	parisc: fbdev/stifb: Align graphics memory size to 4MB
	riscv: Allow PROT_WRITE-only mmap()
	riscv: Make VM_WRITE imply VM_READ
	riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb
	riscv: Pass -mno-relax only on lld < 15.0.0
	UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	nvmem: core: Fix memleak in nvmem_register()
	nvme-multipath: fix possible hang in live ns resize with ANA access
	nvme-pci: set min_align_mask before calculating max_hw_sectors
	Revert "drm/amdgpu: use dirty framebuffer helper"
	dmaengine: mxs: use platform_driver_register
	drm/virtio: Check whether transferred 2D BO is shmem
	drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error
	drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
	drm/udl: Restore display mode on resume
	arm64: errata: Add Cortex-A55 to the repeat tlbi list
	mm/damon: validate if the pmd entry is present before accessing
	mm/mmap: undo ->mmap() when arch_validate_flags() fails
	xen/gntdev: Prevent leaking grants
	xen/gntdev: Accommodate VMA splitting
	PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
	serial: 8250: Let drivers request full 16550A feature probing
	serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices
	NFSD: Protect against send buffer overflow in NFSv3 READDIR
	NFSD: Protect against send buffer overflow in NFSv2 READ
	NFSD: Protect against send buffer overflow in NFSv3 READ
	powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
	powerpc/boot: Explicitly disable usage of SPE instructions
	slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure
	slimbus: qcom-ngd: cleanup in probe error path
	scsi: qedf: Populate sysfs attributes for vport
	gpio: rockchip: request GPIO mux to pinctrl when setting direction
	pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
	fbdev: smscufx: Fix use-after-free in ufx_ops_open()
	ksmbd: fix endless loop when encryption for response fails
	ksmbd: Fix wrong return value and message length check in smb2_ioctl()
	ksmbd: Fix user namespace mapping
	fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
	btrfs: fix race between quota enable and quota rescan ioctl
	btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
	f2fs: complete checkpoints during remount
	f2fs: flush pending checkpoints when freezing super
	f2fs: increase the limit for reserve_root
	f2fs: fix to do sanity check on destination blkaddr during recovery
	f2fs: fix to do sanity check on summary info
	hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
	hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
	jbd2: wake up journal waiters in FIFO order, not LIFO
	jbd2: fix potential buffer head reference count leak
	jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
	jbd2: add miss release buffer head in fc_do_one_pass()
	ext4: avoid crash when inline data creation follows DIO write
	ext4: fix null-ptr-deref in ext4_write_info
	ext4: make ext4_lazyinit_thread freezable
	ext4: fix check for block being out of directory size
	ext4: don't increase iversion counter for ea_inodes
	ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
	ext4: place buffer head allocation before handle start
	ext4: fix dir corruption when ext4_dx_add_entry() fails
	ext4: fix miss release buffer head in ext4_fc_write_inode
	ext4: fix potential memory leak in ext4_fc_record_modified_inode()
	ext4: fix potential memory leak in ext4_fc_record_regions()
	ext4: update 'state->fc_regions_size' after successful memory allocation
	livepatch: fix race between fork and KLP transition
	ftrace: Properly unset FTRACE_HASH_FL_MOD
	ring-buffer: Allow splice to read previous partially read pages
	ring-buffer: Have the shortest_full queue be the shortest not longest
	ring-buffer: Check pending waiters when doing wake ups as well
	ring-buffer: Add ring_buffer_wake_waiters()
	ring-buffer: Fix race between reset page and reading page
	tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
	tracing: Wake up ring buffer waiters on closing of the file
	tracing: Wake up waiters when tracing is disabled
	tracing: Add ioctl() to force ring buffer waiters to wake up
	tracing: Move duplicate code of trace_kprobe/eprobe.c into header
	tracing: Add "(fault)" name injection to kernel probes
	tracing: Fix reading strings from synthetic events
	thunderbolt: Explicitly enable lane adapter hotplug events at startup
	efi: libstub: drop pointless get_memory_map() call
	media: cedrus: Set the platform driver data earlier
	media: cedrus: Fix endless loop in cedrus_h265_skip_bits()
	blk-wbt: call rq_qos_add() after wb_normal is initialized
	KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
	KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
	KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02
	KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
	staging: greybus: audio_helper: remove unused and wrong debugfs usage
	drm/nouveau/kms/nv140-: Disable interlacing
	drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
	drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
	drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
	drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier
	drm/amd/display: Fix vblank refcount in vrr transition
	smb3: must initialize two ACL struct fields to zero
	selinux: use "grep -E" instead of "egrep"
	ima: fix blocking of security.ima xattrs of unsupported algorithms
	userfaultfd: open userfaultfds with O_RDONLY
	ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers
	thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register()
	sh: machvec: Use char[] for section boundaries
	MIPS: SGI-IP27: Free some unused memory
	MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
	ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
	ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
	objtool: Preserve special st_shndx indexes in elf_update_symbol
	nfsd: Fix a memory leak in an error handling path
	SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
	SUNRPC: Fix svcxdr_init_encode's buflen calculation
	NFSD: Protect against send buffer overflow in NFSv2 READDIR
	NFSD: Fix handling of oversized NFSv4 COMPOUND requests
	wifi: rtlwifi: 8192de: correct checking of IQK reload
	wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
	leds: lm3601x: Don't use mutex after it was destroyed
	bpf: Fix reference state management for synchronous callbacks
	wifi: mac80211: allow bw change during channel switch in mesh
	bpftool: Fix a wrong type cast in btf_dumper_int
	spi: mt7621: Fix an error message in mt7621_spi_probe()
	x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
	xsk: Fix backpressure mechanism on Tx
	bpf: Disable preemption when increasing per-cpu map_locked
	bpf: Propagate error from htab_lock_bucket() to userspace
	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy
	Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
	wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
	wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init()
	selftests/xsk: Avoid use-after-free on ctx
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
	wifi: rtl8xxxu: Fix skb misuse in TX queue selection
	spi: meson-spicc: do not rely on busy flag in pow2 clk ops
	bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
	wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
	wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
	wifi: mt76: sdio: fix transmitting packet hangs
	wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload
	wifi: mt76: mt7915: do not check state before configuring implicit beamform
	Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release
	net: fs_enet: Fix wrong check in do_pd_setup
	bpf: Ensure correct locking around vulnerable function find_vpid()
	Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
	netfilter: conntrack: fix the gc rescheduling delay
	netfilter: conntrack: revisit the gc initial rescheduling bias
	wifi: ath11k: fix number of VHT beamformee spatial streams
	x86/microcode/AMD: Track patch allocation size explicitly
	x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
	spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
	spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
	skmsg: Schedule psock work if the cached skb exists on the psock
	i2c: mlxbf: support lock mechanism
	Bluetooth: hci_core: Fix not handling link timeouts propertly
	xfrm: Reinject transport-mode packets through workqueue
	netfilter: nft_fib: Fix for rpath check with VRF devices
	spi: s3c64xx: Fix large transfers with DMA
	wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
	vhost/vsock: Use kvmalloc/kvfree for larger packets.
	eth: alx: take rtnl_lock on resume
	mISDN: fix use-after-free bugs in l1oip timer handlers
	sctp: handle the error returned from sctp_auth_asoc_init_active_key
	tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
	spi: Ensure that sg_table won't be used after being freed
	hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller
	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
	bnx2x: fix potential memory leak in bnx2x_tpa_stop()
	net: wwan: iosm: Call mutex_init before locking it
	net/ieee802154: reject zero-sized raw_sendmsg()
	once: add DO_ONCE_SLOW() for sleepable contexts
	net: mvpp2: fix mvpp2 debugfs leak
	drm: bridge: adv7511: fix CEC power down control register offset
	drm: bridge: adv7511: unregister cec i2c device after cec adapter
	drm/bridge: Avoid uninitialized variable warning
	drm/mipi-dsi: Detach devices when removing the host
	drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
	drm/bridge: parade-ps8640: Fix regulator supply order
	drm/dp_mst: fix drm_dp_dpcd_read return value checks
	drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
	ASoC: mt6359: fix tests for platform_get_irq() failure
	platform/chrome: fix double-free in chromeos_laptop_prepare()
	platform/chrome: fix memory corruption in ioctl
	ASoC: tas2764: Allow mono streams
	ASoC: tas2764: Drop conflicting set_bias_level power setting
	ASoC: tas2764: Fix mute/unmute
	platform/x86: msi-laptop: Fix old-ec check for backlight registering
	platform/x86: msi-laptop: Fix resource cleanup
	platform/chrome: cros_ec_typec: Correct alt mode index
	drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume()
	drm/bridge: megachips: Fix a null pointer dereference bug
	ASoC: rsnd: Add check for rsnd_mod_power_on
	ALSA: hda: beep: Simplify keep-power-at-enable behavior
	drm/bochs: fix blanking
	drm/omap: dss: Fix refcount leak bugs
	drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
	mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
	ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
	drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
	drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
	drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
	ASoC: codecs: tx-macro: fix kcontrol put
	ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
	ALSA: dmaengine: increment buffer pointer atomically
	mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
	ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
	ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
	ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
	ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
	ALSA: hda/hdmi: Don't skip notification handling during PM operation
	memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
	memory: of: Fix refcount leak bug in of_get_ddr_timings()
	memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
	locks: fix TOCTOU race when granting write lease
	soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
	soc: qcom: smem_state: Add refcounting for the 'state->of_node'
	ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus
	ARM: dts: turris-omnia: Fix mpp26 pin name and comment
	ARM: dts: kirkwood: lsxl: fix serial line
	ARM: dts: kirkwood: lsxl: remove first ethernet port
	ia64: export memory_add_physaddr_to_nid to fix cxl build error
	soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
	arm64: dts: ti: k3-j7200: fix main pinmux range
	ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
	ARM: Drop CMDLINE_* dependency on ATAGS
	ext4: don't run ext4lazyinit for read-only filesystems
	arm64: ftrace: fix module PLTs with mcount
	ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
	iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
	iio: adc: at91-sama5d2_adc: check return status for pressure and touch
	iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
	iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
	iio: inkern: only release the device node when done with it
	iio: inkern: fix return value in devm_of_iio_channel_get_by_name()
	iio: ABI: Fix wrong format of differential capacitance channel ABI.
	iio: magnetometer: yas530: Change data type of hard_offsets to signed
	RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey
	usb: common: debug: Check non-standard control requests
	clk: meson: Hold reference returned by of_get_parent()
	clk: oxnas: Hold reference returned by of_get_parent()
	clk: qoriq: Hold reference returned by of_get_parent()
	clk: berlin: Add of_node_put() for of_get_parent()
	clk: sprd: Hold reference returned by of_get_parent()
	clk: tegra: Fix refcount leak in tegra210_clock_init
	clk: tegra: Fix refcount leak in tegra114_clock_init
	clk: tegra20: Fix refcount leak in tegra20_clock_init
	HSI: omap_ssi: Fix refcount leak in ssi_probe
	HSI: omap_ssi_port: Fix dma_map_sg error check
	media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
	tty: xilinx_uartps: Fix the ignore_status
	media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
	media: uvcvideo: Fix memory leak in uvc_gpio_parse
	media: uvcvideo: Use entity get_cur in uvc_ctrl_set
	media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
	RDMA/rxe: Fix "kernel NULL pointer dereference" error
	RDMA/rxe: Fix the error caused by qp->sk
	misc: ocxl: fix possible refcount leak in afu_ioctl()
	fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
	dmaengine: hisilicon: Disable channels when unregister hisi_dma
	dmaengine: hisilicon: Fix CQ head update
	dmaengine: hisilicon: Add multi-thread support for a DMA channel
	dyndbg: fix static_branch manipulation
	dyndbg: fix module.dyndbg handling
	dyndbg: let query-modname override actual module name
	dyndbg: drop EXPORTed dynamic_debug_exec_queries
	clk: qcom: sm6115: Select QCOM_GDSC
	mtd: devices: docg3: check the return value of devm_ioremap() in the probe
	phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent()
	phy: phy-mtk-tphy: fix the phy type setting issue
	mtd: rawnand: intel: Read the chip-select line from the correct OF node
	mtd: rawnand: intel: Remove undocumented compatible string
	mtd: rawnand: fsl_elbc: Fix none ECC mode
	RDMA/irdma: Align AE id codes to correct flush code and event
	RDMA/srp: Fix srp_abort()
	RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
	RDMA/siw: Fix QP destroy to wait for all references dropped.
	ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
	ata: fix ata_id_has_devslp()
	ata: fix ata_id_has_ncq_autosense()
	ata: fix ata_id_has_dipm()
	mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
	md: Replace snprintf with scnprintf
	md/raid5: Ensure stripe_fill happens on non-read IO with journal
	md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
	RDMA/cm: Use SLID in the work completion as the DLID in responder side
	IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
	xhci: Don't show warning for reinit on known broken suspend
	usb: gadget: function: fix dangling pnp_string in f_printer.c
	drivers: serial: jsm: fix some leaks in probe
	serial: 8250: Toggle IER bits on only after irq has been set up
	tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
	phy: qualcomm: call clk_disable_unprepare in the error handling
	staging: vt6655: fix some erroneous memory clean-up loops
	slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON
	firmware: google: Test spinlock on panic path to avoid lockups
	serial: 8250: Fix restoring termios speed after suspend
	scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
	scsi: iscsi: Rename iscsi_conn_queue_work()
	scsi: iscsi: Add recv workqueue helpers
	scsi: iscsi: Run recv path from workqueue
	scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
	clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
	clk: qcom: gcc-sm6115: Override default Alpha PLL regs
	RDMA/rxe: Fix resize_finish() in rxe_queue.c
	fsi: core: Check error number after calling ida_simple_get
	mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
	mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
	mfd: lp8788: Fix an error handling path in lp8788_probe()
	mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
	mfd: fsl-imx25: Fix check for platform_get_irq() errors
	mfd: sm501: Add check for platform_driver_register()
	clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
	dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
	usb: mtu3: fix failed runtime suspend in host only mode
	spmi: pmic-arb: correct duplicate APID to PPID mapping logic
	clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
	clk: baikal-t1: Fix invalid xGMAC PTP clock divider
	clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
	clk: baikal-t1: Add SATA internal ref clock buffer
	clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
	clk: imx: scu: fix memleak on platform_device_add() fails
	clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
	clk: ast2600: BCLK comes from EPLL
	mailbox: mpfs: fix handling of the reg property
	mailbox: mpfs: account for mbox offsets while sending
	mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
	powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig
	powerpc/math_emu/efp: Include module.h
	powerpc/sysdev/fsl_msi: Add missing of_node_put()
	powerpc/pci_dn: Add missing of_node_put()
	powerpc/powernv: add missing of_node_put() in opal_export_attrs()
	powerpc: Fix fallocate and fadvise64_64 compat parameter combination
	x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
	powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
	powerpc: Fix SPE Power ISA properties for e500v1 platforms
	powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
	powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL
	crypto: sahara - don't sleep when in softirq
	crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
	hwrng: arm-smccc-trng - fix NO_ENTROPY handling
	cgroup: Honor caller's cgroup NS when resolving path
	hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
	crypto: qat - fix default value of WDT timer
	crypto: hisilicon/qm - fix missing put dfx access
	cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
	iommu/omap: Fix buffer overflow in debugfs
	crypto: akcipher - default implementation for setting a private key
	crypto: ccp - Release dma channels before dmaengine unrgister
	crypto: inside-secure - Change swab to swab32
	crypto: qat - fix DMA transfer direction
	cifs: return correct error in ->calc_signature()
	iommu/iova: Fix module config properly
	tracing: kprobe: Fix kprobe event gen test module on exit
	tracing: kprobe: Make gen test module work in arm and riscv
	tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads
	kbuild: remove the target in signal traps when interrupted
	kbuild: rpm-pkg: fix breakage when V=1 is used
	crypto: marvell/octeontx - prevent integer overflows
	crypto: cavium - prevent integer overflow loading firmware
	thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
	ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
	f2fs: fix race condition on setting FI_NO_EXTENT flag
	f2fs: fix to account FS_CP_DATA_IO correctly
	selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
	fs: dlm: fix race in lowcomms
	rcu: Avoid triggering strict-GP irq-work when RCU is idle
	rcu: Back off upon fill_page_cache_func() allocation failure
	rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
	ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
	ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address
	cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode
	MIPS: BCM47XX: Cast memcmp() of function to (void *)
	powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
	thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
	ARM: decompressor: Include .data.rel.ro.local
	ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
	x86/entry: Work around Clang __bdos() bug
	NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
	NFSD: fix use-after-free on source server when doing inter-server copy
	wifi: brcmfmac: fix invalid address access when enabling SCAN log level
	bpftool: Clear errno after libcap's checks
	ice: set tx_tstamps when creating new Tx rings via ethtool
	net: ethernet: ti: davinci_mdio: Add workaround for errata i2329
	openvswitch: Fix double reporting of drops in dropwatch
	openvswitch: Fix overreporting of drops in dropwatch
	tcp: annotate data-race around tcp_md5sig_pool_populated
	x86/mce: Retrieve poison range from hardware
	wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
	thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround
	xfrm: Update ipcomp_scratches with NULL when freed
	iavf: Fix race between iavf_close and iavf_reset_task
	wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
	Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk
	regulator: core: Prevent integer underflow
	wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value
	Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
	Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
	can: bcm: check the result of can_send() in bcm_can_tx()
	wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
	wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
	wifi: rt2x00: set VGC gain for both chains of MT7620
	wifi: rt2x00: set SoC wmac clock register
	wifi: rt2x00: correctly set BBP register 86 for MT7620
	hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms
	net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
	Bluetooth: L2CAP: Fix user-after-free
	r8152: Rate limit overflow messages
	drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
	drm: Use size_t type for len variable in drm_copy_field()
	drm: Prevent drm_copy_field() to attempt copying a NULL pointer
	drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
	gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
	drm/amd/display: fix overflow on MIN_I64 definition
	udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
	drm: bridge: dw_hdmi: only trigger hotplug event on link change
	ALSA: usb-audio: Register card at the last interface
	drm/vc4: vec: Fix timings for VEC modes
	drm: panel-orientation-quirks: Add quirk for Anbernic Win600
	platform/chrome: cros_ec: Notify the PM of wake events during resume
	platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
	ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
	drm/amdgpu: fix initial connector audio value
	drm/meson: reorder driver deinit sequence to fix use-after-free bug
	drm/meson: explicitly remove aggregate driver at module unload time
	mmc: sdhci-msm: add compatible string check for sdm670
	drm/dp: Don't rewrite link config when setting phy test pattern
	drm/amd/display: Remove interface for periodic interrupt 1
	ARM: dts: imx7d-sdb: config the max pressure for tsc2046
	ARM: dts: imx6q: add missing properties for sram
	ARM: dts: imx6dl: add missing properties for sram
	ARM: dts: imx6qp: add missing properties for sram
	ARM: dts: imx6sl: add missing properties for sram
	ARM: dts: imx6sll: add missing properties for sram
	ARM: dts: imx6sx: add missing properties for sram
	kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
	arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
	btrfs: dump extra info if one free space cache has more bitmaps than it should
	btrfs: scrub: try to fix super block errors
	btrfs: don't print information about space cache or tree every remount
	ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
	clk: zynqmp: Fix stack-out-of-bounds in strncpy`
	media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
	media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc
	clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
	usb: host: xhci-plat: suspend and resume clocks
	usb: host: xhci-plat: suspend/resume clks for brcm
	dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow
	scsi: 3w-9xxx: Avoid disabling device if failing to enable it
	nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
	iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity
	power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
	staging: vt6655: fix potential memory leak
	blk-throttle: prevent overflow while calculating wait time
	ata: libahci_platform: Sanity check the DT child nodes number
	bcache: fix set_at_max_writeback_rate() for multiple attached devices
	soundwire: cadence: Don't overwrite msg->buf during write commands
	soundwire: intel: fix error handling on dai registration issues
	HID: roccat: Fix use-after-free in roccat_read()
	eventfd: guard wake_up in eventfd fs calls as well
	md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
	usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
	usb: musb: Fix musb_gadget.c rxstate overflow bug
	arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes
	usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
	Revert "usb: storage: Add quirk for Samsung Fit flash"
	staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
	staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
	scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled
	ext2: Use kvmalloc() for group descriptor array
	nvme: copy firmware_rev on each init
	nvmet-tcp: add bounds check on Transfer Tag
	usb: idmouse: fix an uninit-value in idmouse_open
	clk: bcm2835: Make peripheral PLLC critical
	clk: bcm2835: Round UART input clock up
	perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
	io_uring/af_unix: defer registered files gc to io_uring release
	io_uring: correct pinned_vm accounting
	io_uring/rw: fix short rw error handling
	io_uring/rw: fix error'ed retry return values
	io_uring/rw: fix unexpected link breakage
	mm: hugetlb: fix UAF in hugetlb_handle_userfault
	net: ieee802154: return -EINVAL for unknown addr type
	ALSA: usb-audio: Fix last interface check for registration
	blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
	net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses
	Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
	net/ieee802154: don't warn zero-sized raw_sendmsg()
	drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n
	Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5
	Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
	lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5
	ext4: continue to expand file system when the target size doesn't reach
	thermal: intel_powerclamp: Use first online CPU as control_cpu
	gcov: support GCC 12.1 and newer compilers
	io-wq: Fix memory leak in worker creation
	Linux 5.15.75

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id3dfe8285e830d01df7adb33729e78a75c1cac1a
 2022-11-02 08:51:19 +01:00
Nathan Chancellor
0e63de6d7e lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5 
commit 0a6de78cff600cb991f2a1b7ed376935871796a0 upstream.

When building with a RISC-V kernel with DWARF5 debug info using clang
and the GNU assembler, several instances of the following error appear:

  /tmp/vgettimeofday-48aa35.s:2963: Error: non-constant .uleb128 is not supported

Dumping the .s file reveals these .uleb128 directives come from
.debug_loc and .debug_ranges:

  .Ldebug_loc0:
          .byte   4                               # DW_LLE_offset_pair
          .uleb128 .Lfunc_begin0-.Lfunc_begin0    #   starting offset
          .uleb128 .Ltmp1-.Lfunc_begin0           #   ending offset
          .byte   1                               # Loc expr size
          .byte   90                              # DW_OP_reg10
          .byte   0                               # DW_LLE_end_of_list

  .Ldebug_ranges0:
          .byte   4                               # DW_RLE_offset_pair
          .uleb128 .Ltmp6-.Lfunc_begin0           #   starting offset
          .uleb128 .Ltmp27-.Lfunc_begin0          #   ending offset
          .byte   4                               # DW_RLE_offset_pair
          .uleb128 .Ltmp28-.Lfunc_begin0          #   starting offset
          .uleb128 .Ltmp30-.Lfunc_begin0          #   ending offset
          .byte   0                               # DW_RLE_end_of_list

There is an outstanding binutils issue to support a non-constant operand
to .sleb128 and .uleb128 in GAS for RISC-V but there does not appear to
be any movement on it, due to concerns over how it would work with
linker relaxation.

To avoid these build errors, prevent DWARF5 from being selected when
using clang and an assembler that does not have support for these symbol
deltas, which can be easily checked in Kconfig with as-instr plus the
small test program from the dwz test suite from the binutils issue.

Link: https://sourceware.org/bugzilla/show_bug.cgi?id=27215
Link: https://github.com/ClangBuiltLinux/linux/issues/1719
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nathan: Fix conflicts due to lack of f9b3cd24578401e]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-10-26 12:35:55 +02:00
Masahiro Yamada
84cd0b20fa Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT 
commit bb1435f3f575b5213eaf27434efa3971f51c01de upstream.

CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT does not give explicit
-gdwarf-* flag. The actual DWARF version is up to the toolchain.

The combination of GCC and GAS works fine, and Clang with the integrated
assembler is good too.

The combination of Clang and GAS is tricky, but at least, the -g flag
works for Clang <=13, which defaults to DWARF v4.

Clang 14 switched its default to DWARF v5.

Now, CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT has the same issue as
addressed by commit 98cd6f521f ("Kconfig: allow explicit opt in to
DWARF v5").

CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y for Clang >= 14 and
GAS < 2.35 produces a ton of errors like follows:

  /tmp/main-c2741c.s: Assembler messages:
  /tmp/main-c2741c.s:109: Error: junk at end of line, first unrecognized character is `"'
  /tmp/main-c2741c.s:109: Error: file number less than one

Add 'depends on' to check toolchains.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
[nathan: Fix conflict due to lack of f9b3cd24578401e]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-10-26 12:35:55 +02:00
Masahiro Yamada
371aaf6b48 Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5 
commit 4f001a21080ff2e2f0e1c3692f5e119aedbb3bc1 upstream.

Commit c0a5c81ca9 ("Kconfig.debug: drop GCC 5+ version check for
DWARF5") could have cleaned up the code a bit more.

"CC_IS_CLANG &&" is unneeded. No functional change is intended.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
[nathan: Only apply to DWARF5, as 5.15 does not have 32ef9e5054ec032]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-10-26 12:35:55 +02:00
Jim Cromie
aecb632674 dyndbg: drop EXPORTed dynamic_debug_exec_queries 
[ Upstream commit e26ef3af964acfea311403126acee8c56c89e26b ]

This exported fn is unused, and will not be needed. Lets dump it.

The export was added to let drm control pr_debugs, as part of using
them to avoid drm_debug_enabled overheads.  But its better to just
implement the drm.debug bitmap interface, then its available for
everyone.

Fixes: a2d375eda7 ("dyndbg: refine export, rename to dynamic_debug_exec_queries()")
Fixes: 4c0d77828d ("dyndbg: export ddebug_exec_queries")
Acked-by: Jason Baron <jbaron@akamai.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20220904214134.408619-10-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-10-26 12:35:08 +02:00
Jim Cromie
0d4421f2cb dyndbg: let query-modname override actual module name 
[ Upstream commit e75ef56f74965f426dd819a41336b640ffdd8fbc ]

dyndbg's control-parser: ddebug_parse_query(), requires that search
terms: module, func, file, lineno, are used only once in a query; a
thing cannot be named both foo and bar.

The cited commit added an overriding module modname, taken from the
module loader, which is authoritative.  So it set query.module 1st,
which disallowed its use in the query-string.

But now, its useful to allow a module-load to enable classes across a
whole (or part of) a subsystem at once.

  # enable (dynamic-debug in) drm only
  modprobe drm dyndbg="class DRM_UT_CORE +p"

  # get drm_helper too
  modprobe drm dyndbg="class DRM_UT_CORE module drm* +p"

  # get everything that knows DRM_UT_CORE
  modprobe drm dyndbg="class DRM_UT_CORE module * +p"

  # also for boot-args:
  drm.dyndbg="class DRM_UT_CORE module * +p"

So convert the override into a default, by filling it only when/after
the query-string omitted the module.

NB: the query class FOO handling is forthcoming.

Fixes: 8e59b5cfb9 dynamic_debug: add modname arg to exec_query callchain
Acked-by: Jason Baron <jbaron@akamai.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20220904214134.408619-8-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-10-26 12:35:08 +02:00
Jim Cromie
49d85932f7 dyndbg: fix static_branch manipulation 
[ Upstream commit ee879be38bc87f8cedc79ae2742958db6533ca59 ]

In https://lore.kernel.org/lkml/20211209150910.GA23668@axis.com/

Vincent's patch commented on, and worked around, a bug toggling
static_branch's, when a 2nd PRINTK-ish flag was added.  The bug
results in a premature static_branch_disable when the 1st of 2 flags
was disabled.

The cited commit computed newflags, but then in the JUMP_LABEL block,
failed to use that result, instead using just one of the terms in it.
Using newflags instead made the code work properly.

This is Vincents test-case, reduced.  It needs the 2nd flag to
demonstrate the bug, but it's explanatory here.

pt_test() {
    echo 5 > /sys/module/dynamic_debug/verbose

    site="module tcp" # just one callsite
    echo " $site =_ " > /proc/dynamic_debug/control # clear it

    # A B ~A ~B
    for flg in +T +p "-T #broke here" -p; do
	echo " $site $flg " > /proc/dynamic_debug/control
    done;

    # A B ~B ~A
    for flg in +T +p "-p #broke here" -T; do
	echo " $site $flg " > /proc/dynamic_debug/control
    done
}
pt_test

Fixes: 84da83a6ff dyndbg: combine flags & mask into a struct, simplify with it
CC: vincent.whitchurch@axis.com
Acked-by: Jason Baron <jbaron@akamai.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20220904214134.408619-2-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-10-26 12:35:08 +02:00
Eric Dumazet
7aef5082c5 once: add DO_ONCE_SLOW() for sleepable contexts 
[ Upstream commit 62c07983bef9d3e78e71189441e1a470f0d1e653 ]

Christophe Leroy reported a ~80ms latency spike
happening at first TCP connect() time.

This is because __inet_hash_connect() uses get_random_once()
to populate a perturbation table which became quite big
after commit 4c2c8f03a5ab ("tcp: increase source port perturb table to 2^16")

get_random_once() uses DO_ONCE(), which block hard irqs for the duration
of the operation.

This patch adds DO_ONCE_SLOW() which uses a mutex instead of a spinlock
for operations where we prefer to stay in process context.

Then __inet_hash_connect() can use get_random_slow_once()
to populate its perturbation table.

Fixes: 4c2c8f03a5ab ("tcp: increase source port perturb table to 2^16")
Fixes: 190cc82489 ("tcp: change source port randomizarion at connect() time")
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Link: https://lore.kernel.org/netdev/CANn89iLAEYBaoYajy0Y9UmGFff5GPxDUoG-ErVB2jDdRNQ5Tug@mail.gmail.com/T/#t
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Tested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-10-26 12:34:49 +02:00
Kees Cook
435e7684c4 UPSTREAM: overflow: Implement size_t saturating arithmetic helpers 
In order to perform more open-coded replacements of common allocation
size arithmetic, the kernel needs saturating (SIZE_MAX) helpers for
multiplication, addition, and subtraction. For example, it is common in
allocators, especially on realloc, to add to an existing size:

    p = krealloc(map->patch,
                 sizeof(struct reg_sequence) * (map->patch_regs + num_regs),
                 GFP_KERNEL);

There is no existing saturating replacement for this calculation, and
just leaving the addition open coded inside array_size() could
potentially overflow as well. For example, an overflow in an expression
for a size_t argument might wrap to zero:

    array_size(anything, something_at_size_max + 1) == 0

Introduce size_mul(), size_add(), and size_sub() helpers that
implicitly promote arguments to size_t and saturated calculations for
use in allocations. With these helpers it is also possible to redefine
array_size(), array3_size(), flex_array_size(), and struct_size() in
terms of the new helpers.

As with the check_*_overflow() helpers, the new helpers use __must_check,
though what is really desired is a way to make sure that assignment is
only to a size_t lvalue. Without this, it's still possible to introduce
overflow/underflow via type conversion (i.e. from size_t to int).
Enforcing this will currently need to be left to static analysis or
future use of -Wconversion.

Additionally update the overflow unit tests to force runtime evaluation
for the pathological cases.

Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Len Baker <len.baker@gmx.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit e1be43d9b5d0d1310dbd90185a8e5c7145dde40f)
Signed-off-by: Will Deacon <willdeacon@google.com>
Bug: 233587962
Change-Id: I7743104617dd2ed530002cc06574203daf6d13d9
 2022-10-21 09:24:58 +00:00
Greg Kroah-Hartman
923f8ffad3 Merge 5.15.65 into android14-5.15 
Changes in 5.15.65
	mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
	drm/bridge: Add stubs for devm_drm_of_get_bridge when OF is disabled
	ACPI: thermal: drop an always true check
	drm/vc4: hdmi: Rework power up
	drm/vc4: hdmi: Depends on CONFIG_PM
	firmware: tegra: bpmp: Do only aligned access to IPC memory area
	crypto: lib - remove unneeded selection of XOR_BLOCKS
	Drivers: hv: balloon: Support status report for larger page sizes
	mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte
	arm64: errata: Add Cortex-A510 to the repeat tlbi list
	io_uring: correct fill events helpers types
	io_uring: clean cqe filling functions
	io_uring: refactor poll update
	io_uring: move common poll bits
	io_uring: kill poll linking optimisation
	io_uring: inline io_poll_complete
	io_uring: poll rework
	io_uring: Remove unused function req_ref_put
	io_uring: remove poll entry from list when canceling all
	io_uring: bump poll refs to full 31-bits
	io_uring: fail links when poll fails
	io_uring: fix wrong arm_poll error handling
	io_uring: fix UAF due to missing POLLFREE handling
	kbuild: Fix include path in scripts/Makefile.modpost
	Bluetooth: L2CAP: Fix build errors in some archs
	Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()"
	HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
	udmabuf: Set the DMA mask for the udmabuf device (v2)
	media: pvrusb2: fix memory leak in pvr_probe
	HID: hidraw: fix memory leak in hidraw_release()
	net: fix refcount bug in sk_psock_get (2)
	fbdev: fb_pm2fb: Avoid potential divide by zero error
	ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
	bpf: Don't redirect packets with invalid pkt_len
	mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
	ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5
	HID: add Lenovo Yoga C630 battery quirk
	HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
	HID: asus: ROG NKey: Ignore portion of 0x5a report
	HID: thrustmaster: Add sparco wheel and fix array length
	drm/i915/gt: Skip TLB invalidations once wedged
	mmc: mtk-sd: Clear interrupts when cqe off/disable
	mmc: sdhci-of-dwcmshc: add reset call back for rockchip Socs
	mmc: sdhci-of-dwcmshc: rename rk3568 to rk35xx
	mmc: sdhci-of-dwcmshc: Re-enable support for the BlueField-3 SoC
	btrfs: remove root argument from btrfs_unlink_inode()
	btrfs: remove no longer needed logic for replaying directory deletes
	btrfs: add and use helper for unlinking inode during log replay
	btrfs: fix warning during log replay when bumping inode link count
	fs/ntfs3: Fix work with fragmented xattr
	ASoC: sh: rz-ssi: Improve error handling in rz_ssi_probe() error path
	drm/amd/display: Avoid MPC infinite loop
	drm/amd/display: Fix HDMI VSIF V3 incorrect issue
	drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
	drm/amd/display: clear optc underflow before turn off odm clock
	ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not configured
	neigh: fix possible DoS due to net iface start/stop loop
	s390/hypfs: avoid error message under KVM
	ksmbd: don't remove dos attribute xattr on O_TRUNC open
	drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
	drm/amd/display: Fix pixel clock programming
	drm/amdgpu: Increase tlb flush timeout for sriov
	drm/amd/display: avoid doing vm_init multiple time
	netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
	testing: selftests: nft_flowtable.sh: use random netns names
	btrfs: move lockdep class helpers to locking.c
	btrfs: fix lockdep splat with reloc root extent buffers
	btrfs: tree-checker: check for overlapping extent items
	kprobes: don't call disarm_kprobe() for disabled kprobes
	btrfs: fix space cache corruption and potential double allocations
	android: binder: fix lockdep check on clearing vma
	net/af_packet: check len when min_header_len equals to 0
	net: neigh: don't call kfree_skb() under spin_lock_irqsave()
	Linux 5.15.65

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5d29db64b8de0e14dbe991c50430c20bb36ecf59
 2022-09-24 10:02:50 +02:00
Greg Kroah-Hartman
d32ea5d2c0 Merge 5.15.64 into android14-5.15 
Changes in 5.15.64
	wifi: rtlwifi: remove always-true condition pointed out by GCC 12
	eth: sun: cassini: remove dead code
	audit: fix potential double free on error path from fsnotify_add_inode_mark
	cgroup: Fix race condition at rebind_subsystems()
	parisc: Make CONFIG_64BIT available for ARCH=parisc64 only
	parisc: Fix exception handler for fldw and fstw instructions
	kernel/sys_ni: add compat entry for fadvise64_64
	x86/entry: Move CLD to the start of the idtentry macro
	block: add a bdev_max_zone_append_sectors helper
	block: add bdev_max_segments() helper
	btrfs: zoned: revive max_zone_append_bytes
	btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size
	btrfs: convert count_max_extents() to use fs_info->max_extent_size
	Input: i8042 - move __initconst to fix code styling warning
	Input: i8042 - merge quirk tables
	Input: i8042 - add TUXEDO devices to i8042 quirk tables
	Input: i8042 - add additional TUXEDO devices to i8042 quirk tables
	drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist
	scsi: qla2xxx: Fix response queue handler reading stale packets
	scsi: qla2xxx: edif: Fix dropped IKE message
	btrfs: put initial index value of a directory in a constant
	btrfs: pass the dentry to btrfs_log_new_name() instead of the inode
	btrfs: remove unnecessary parameter delalloc_start for writepage_delalloc()
	riscv: lib: uaccess: fold fixups into body
	riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit
	xfrm: fix refcount leak in __xfrm_policy_check()
	xfrm: clone missing x->lastused in xfrm_do_migrate
	af_key: Do not call xfrm_probe_algs in parallel
	xfrm: policy: fix metadata dst->dev xmit null pointer dereference
	fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
	net: use eth_hw_addr_set() instead of ether_addr_copy()
	Revert "net: macsec: update SCI upon MAC address change."
	NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open()
	NFSv4.2 fix problems with __nfs42_ssc_open
	SUNRPC: RPC level errors should set task->tk_rpc_status
	mm/smaps: don't access young/dirty bit if pte unpresent
	ntfs: fix acl handling
	rose: check NULL rose_loopback_neigh->loopback
	r8152: fix the units of some registers for RTL8156A
	r8152: fix the RX FIFO settings when suspending
	nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
	ice: xsk: Force rings to be sized to power of 2
	ice: xsk: prohibit usage of non-balanced queue id
	net/mlx5e: Properly disable vlan strip on non-UL reps
	net/mlx5: Avoid false positive lockdep warning by adding lock_class_key
	net/mlx5e: Fix wrong application of the LRO state
	net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off
	net: ipa: don't assume SMEM is page-aligned
	net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume()
	net: moxa: get rid of asymmetry in DMA mapping/unmapping
	bonding: 802.3ad: fix no transmission of LACPDUs
	net: ipvtap - add __init/__exit annotations to module init/exit funcs
	netfilter: ebtables: reject blobs that don't provide all entry points
	bnxt_en: fix NQ resource accounting during vf creation on 57500 chips
	netfilter: nf_tables: disallow updates of implicit chain
	netfilter: nf_tables: make table handle allocation per-netns friendly
	netfilter: nft_payload: report ERANGE for too long offset and length
	netfilter: nft_payload: do not truncate csum_offset and csum_type
	netfilter: nf_tables: do not leave chain stats enabled on error
	netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
	netfilter: nft_tunnel: restrict it to netdev family
	netfilter: nf_tables: consolidate rule verdict trace call
	netfilter: nft_cmp: optimize comparison for 16-bytes
	netfilter: bitwise: improve error goto labels
	netfilter: nf_tables: upfront validation of data via nft_data_init()
	netfilter: nf_tables: disallow jump to implicit chain from set element
	netfilter: nf_tables: disallow binding to already bound chain
	netfilter: flowtable: add function to invoke garbage collection immediately
	netfilter: flowtable: fix stuck flows on cleanup due to pending work
	net: Fix data-races around sysctl_[rw]mem_(max|default).
	net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
	net: Fix data-races around netdev_max_backlog.
	net: Fix data-races around netdev_tstamp_prequeue.
	ratelimit: Fix data-races in ___ratelimit().
	net: Fix data-races around sysctl_optmem_max.
	net: Fix a data-race around sysctl_tstamp_allow_data.
	net: Fix a data-race around sysctl_net_busy_poll.
	net: Fix a data-race around sysctl_net_busy_read.
	net: Fix a data-race around netdev_budget.
	tcp: expose the tcp_mark_push() and tcp_skb_entail() helpers
	mptcp: stop relying on tcp_tx_skb_cache
	net: Fix data-races around sysctl_max_skb_frags.
	net: Fix a data-race around netdev_budget_usecs.
	net: Fix data-races around sysctl_fb_tunnels_only_for_init_net.
	net: Fix data-races around sysctl_devconf_inherit_init_net.
	net: Fix a data-race around sysctl_somaxconn.
	ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
	i40e: Fix incorrect address type for IPv6 flow rules
	rxrpc: Fix locking in rxrpc's sendmsg
	ionic: widen queue_lock use around lif init and deinit
	ionic: clear broken state on generation change
	ionic: fix up issues with handling EAGAIN on FW cmds
	ionic: VF initial random MAC address if no assigned mac
	net: stmmac: work around sporadic tx issue on link-up
	btrfs: fix silent failure when deleting root reference
	btrfs: replace: drop assert for suspended replace
	btrfs: add info when mount fails due to stale replace target
	btrfs: check if root is readonly while setting security xattr
	btrfs: fix possible memory leak in btrfs_get_dev_args_from_path()
	perf/x86/lbr: Enable the branch type for the Arch LBR by default
	x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
	x86/bugs: Add "unknown" reporting for MMIO Stale Data
	x86/nospec: Unwreck the RSB stuffing
	loop: Check for overflow while configuring loop
	writeback: avoid use-after-free after removing device
	asm-generic: sections: refactor memory_intersects
	mm/damon/dbgfs: avoid duplicate context directory creation
	s390/mm: do not trigger write fault when vma does not allow VM_WRITE
	bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem
	s390: fix double free of GS and RI CBs on fork() failure
	fbdev: fbcon: Properly revert changes when vc_resize() failed
	Revert "memcg: cleanup racy sum avoidance code"
	ACPI: processor: Remove freq Qos request for all CPUs
	nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
	smb3: missing inode locks in punch hole
	xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
	riscv: traps: add missing prototype
	io_uring: fix issue with io_write() not always undoing sb_start_write()
	Revert "usbnet: smsc95xx: Fix deadlock on runtime resume"
	Revert "usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling"
	mm/hugetlb: fix hugetlb not supporting softdirty tracking
	Revert "md-raid: destroy the bitmap after destroying the thread"
	md: call __md_stop_writes in md_stop
	mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb
	arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76
	binder_alloc: add missing mmap_lock calls when using the VMA
	x86/nospec: Fix i386 RSB stuffing
	Documentation/ABI: Mention retbleed vulnerability info file for sysfs
	blk-mq: fix io hung due to missing commit_rqs
	perf python: Fix build when PYTHON_CONFIG is user supplied
	perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU
	perf/x86/intel/ds: Fix precise store latency handling
	perf stat: Clear evsel->reset_group for each stat run
	scsi: ufs: core: Enable link lost interrupt
	scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
	bpf: Don't use tnum_range on array range checking for poke descriptors
	Linux 5.15.64

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8e4d8a8ed90e22487e249b9635b210935febda6e
 2022-09-24 10:01:28 +02:00
Greg Kroah-Hartman
239044beef Merge 5.15.63 into android14-5.15 
Changes in 5.15.63
	ALSA: info: Fix llseek return value when using callback
	ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
	KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
	x86/mm: Use proper mask when setting PUD mapping
	rds: add missing barrier to release_refill
	locking/atomic: Make test_and_*_bit() ordered on failure
	drm/nouveau: recognise GA103
	drm/ttm: Fix dummy res NULL ptr deref bug
	drm/amd/display: Check correct bounds for stream encoder instances for DCN303
	ata: libata-eh: Add missing command name
	mmc: pxamci: Fix another error handling path in pxamci_probe()
	mmc: pxamci: Fix an error handling path in pxamci_probe()
	mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
	btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
	btrfs: reset RO counter on block group if we fail to relocate
	btrfs: fix lost error handling when looking up extended ref on log replay
	cifs: Fix memory leak on the deferred close
	x86/kprobes: Fix JNG/JNLE emulation
	tracing/perf: Fix double put of trace event when init fails
	tracing/eprobes: Do not allow eprobes to use $stack, or % for regs
	tracing/eprobes: Do not hardcode $comm as a string
	tracing/eprobes: Have event probes be consistent with kprobes and uprobes
	tracing/probes: Have kprobes and uprobes use $COMM too
	tracing: Have filter accept "common_cpu" to be consistent
	ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II
	dt-bindings: usb: mtk-xhci: Allow wakeup interrupt-names to be optional
	can: ems_usb: fix clang's -Wunaligned-access warning
	apparmor: fix quiet_denied for file rules
	apparmor: fix absroot causing audited secids to begin with =
	apparmor: Fix failed mount permission check error message
	apparmor: fix aa_label_asxprint return check
	apparmor: fix setting unconfined mode on a loaded profile
	apparmor: fix overlapping attachment computation
	apparmor: fix reference count leak in aa_pivotroot()
	apparmor: Fix memleak in aa_simple_write_to_buffer()
	Documentation: ACPI: EINJ: Fix obsolete example
	NFSv4.1: Don't decrease the value of seq_nr_highest_sent
	NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly
	NFSv4: Fix races in the legacy idmapper upcall
	NFSv4.1: RECLAIM_COMPLETE must handle EACCES
	NFSv4/pnfs: Fix a use-after-free bug in open
	BPF: Fix potential bad pointer dereference in bpf_sys_bpf()
	bpf: Don't reinit map value in prealloc_lru_pop
	bpf: Acquire map uref in .init_seq_private for array map iterator
	bpf: Acquire map uref in .init_seq_private for hash map iterator
	bpf: Acquire map uref in .init_seq_private for sock local storage map iterator
	bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator
	bpf: Check the validity of max_rdwr_access for sock local storage map iterator
	can: mcp251x: Fix race condition on receive interrupt
	can: j1939: j1939_session_destroy(): fix memory leak of skbs
	net: atlantic: fix aq_vec index out of range error
	m68k: coldfire/device.c: protect FLEXCAN blocks
	sunrpc: fix expiry of auth creds
	SUNRPC: Fix xdr_encode_bool()
	SUNRPC: Reinitialise the backchannel request buffers before reuse
	virtio_net: fix memory leak inside XPD_TX with mergeable
	devlink: Fix use-after-free after a failed reload
	net: phy: Warn about incorrect mdio_bus_phy_resume() state
	net: bcmgenet: Indicate MAC is in charge of PHY PM
	net: bgmac: Fix a BUG triggered by wrong bytes_compl
	selftests: forwarding: Fix failing tests with old libnet
	dt-bindings: arm: qcom: fix Alcatel OneTouch Idol 3 compatibles
	pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
	pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
	pinctrl: amd: Don't save/restore interrupt status and wake status bits
	pinctrl: sunxi: Add I/O bias setting for H6 R-PIO
	pinctrl: qcom: sm8250: Fix PDC map
	Input: exc3000 - fix return value check of wait_for_completion_timeout
	octeontx2-pf: Fix NIX_AF_TL3_TL2X_LINKX_CFG register configuration
	octeontx2-af: Apply tx nibble fixup always
	octeontx2-af: suppress external profile loading warning
	octeontx2-af: Fix mcam entry resource leak
	octeontx2-af: Fix key checking for source mac
	ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
	geneve: do not use RT_TOS for IPv6 flowlabel
	mlx5: do not use RT_TOS for IPv6 flowlabel
	ipv6: do not use RT_TOS for IPv6 flowlabel
	plip: avoid rcu debug splat
	vsock: Fix memory leak in vsock_connect()
	vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
	dt-bindings: gpio: zynq: Add missing compatible strings
	dt-bindings: arm: qcom: fix Longcheer L8150 compatibles
	dt-bindings: arm: qcom: fix MSM8916 MTP compatibles
	dt-bindings: arm: qcom: fix MSM8994 boards compatibles
	dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources
	spi: dt-bindings: cadence: add missing 'required'
	spi: dt-bindings: zynqmp-qspi: add missing 'required'
	ceph: use correct index when encoding client supported features
	tools/vm/slabinfo: use alphabetic order when two values are equal
	ceph: don't leak snap_rwsem in handle_cap_grant
	kbuild: dummy-tools: avoid tmpdir leak in dummy gcc
	tools build: Switch to new openssl API for test-libcrypto
	NTB: ntb_tool: uninitialized heap data in tool_fn_write()
	nfp: ethtool: fix the display error of `ethtool -m DEVNAME`
	xen/xenbus: fix return type in xenbus_file_read()
	atm: idt77252: fix use-after-free bugs caused by tst_timer
	geneve: fix TOS inheriting for ipv4
	perf probe: Fix an error handling path in 'parse_perf_probe_command()'
	perf parse-events: Fix segfault when event parser gets an error
	perf tests: Fix Track with sched_switch test for hybrid case
	dpaa2-eth: trace the allocated address instead of page struct
	fs/ntfs3: Fix using uninitialized value n when calling indx_read
	fs/ntfs3: Fix NULL deref in ntfs_update_mftmirr
	fs/ntfs3: Don't clear upper bits accidentally in log_replay()
	fs/ntfs3: Fix double free on remount
	fs/ntfs3: Do not change mode if ntfs_set_ea failed
	fs/ntfs3: Fix missing i_op in ntfs_read_mft
	nios2: page fault et.al. are *not* restartable syscalls...
	nios2: don't leave NULLs in sys_call_table[]
	nios2: traced syscall does need to check the syscall number
	nios2: fix syscall restart checks
	nios2: restarts apply only to the first sigframe we build...
	nios2: add force_successful_syscall_return()
	iavf: Fix adminq error handling
	iavf: Fix reset error handling
	ASoC: SOF: debug: Fix potential buffer overflow by snprintf()
	ASoC: tas2770: Set correct FSYNC polarity
	ASoC: tas2770: Allow mono streams
	ASoC: tas2770: Drop conflicting set_bias_level power setting
	ASoC: tas2770: Fix handling of mute/unmute
	ASoC: codec: tlv320aic32x4: fix mono playback via I2S
	netfilter: nf_tables: use READ_ONCE and WRITE_ONCE for shared generation id access
	fs/ntfs3: uninitialized variable in ntfs_set_acl_ex()
	netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag
	netfilter: nf_tables: possible module reference underflow in error path
	netfilter: nf_tables: really skip inactive sets when allocating name
	netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag
	netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags
	netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END
	netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified
	powerpc/pci: Fix get_phb_number() locking
	spi: meson-spicc: add local pow2 clock ops to preserve rate between messages
	net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change()
	net: dsa: mv88e6060: prevent crash on an unused port
	mlxsw: spectrum: Clear PTP configuration after unregistering the netdevice
	net: moxa: pass pdev instead of ndev to DMA functions
	net: fix potential refcount leak in ndisc_router_discovery()
	net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry
	net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters
	net: genl: fix error path memory leak in policy dumping
	net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it
	net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
	ice: Ignore EEXIST when setting promisc mode
	i2c: imx: Make sure to unregister adapter on remove()
	regulator: pca9450: Remove restrictions for regulator-name
	i40e: Fix to stop tx_timeout recovery if GLOBR fails
	fec: Fix timer capture timing in `fec_ptp_enable_pps()`
	stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
	igb: Add lock to avoid data race
	kbuild: fix the modules order between drivers and libs
	gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
	tracing/eprobes: Fix reading of string fields
	drm/imx/dcss: get rid of HPD warning message
	ASoC: SOF: Intel: hda: Define rom_status_reg in sof_intel_dsp_desc
	ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()
	drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
	drm/sun4i: dsi: Prevent underflow when computing packet sizes
	net: qrtr: start MHI channel after endpoit creation
	KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems
	KVM: arm64: Reject 32bit user PSTATE on asymmetric systems
	HID: multitouch: new device class fix Lenovo X12 trackpad sticky
	PCI: Add ACS quirk for Broadcom BCM5750x NICs
	platform/chrome: cros_ec_proto: don't show MKBP version if unsupported
	usb: cdns3 fix use-after-free at workaround 2
	usb: cdns3: fix random warning message when driver load
	usb: gadget: uvc: calculate the number of request depending on framesize
	usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info
	PCI: aardvark: Fix reporting Slot capabilities on emulated bridge
	irqchip/tegra: Fix overflow implicit truncation warnings
	drm/meson: Fix overflow implicit truncation warnings
	clk: ti: Stop using legacy clkctrl names for omap4 and 5
	scsi: ufs: ufs-mediatek: Fix the timing of configuring device regulators
	usb: host: ohci-ppc-of: Fix refcount leak bug
	usb: renesas: Fix refcount leak bug
	usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch
	vboxguest: Do not use devm for irq
	clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
	uacce: Handle parent device removal or parent driver module rmmod
	zram: do not lookup algorithm in backends table
	clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
	scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
	scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
	gadgetfs: ep_io - wait until IRQ finishes
	coresight: etm4x: avoid build failure with unrolled loops
	habanalabs/gaudi: fix shift out of bounds
	habanalabs/gaudi: mask constant value before cast
	mmc: tmio: avoid glitches when resetting
	pinctrl: intel: Check against matching data instead of ACPI companion
	cxl: Fix a memory leak in an error handling path
	PCI/ACPI: Guard ARM64-specific mcfg_quirks
	um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
	dmaengine: dw-axi-dmac: do not print NULL LLI during error
	dmaengine: dw-axi-dmac: ignore interrupt if no descriptor
	RDMA/rxe: Limit the number of calls to each tasklet
	csky/kprobe: reclaim insn_slot on kprobe unregistration
	selftests/kprobe: Do not test for GRP/ without event failures
	dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed
	openrisc: io: Define iounmap argument as volatile
	phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks
	md: Notify sysfs sync_completed in md_reap_sync_thread()
	nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown
	drivers:md:fix a potential use-after-free bug
	ext4: avoid remove directory when directory is corrupted
	ext4: avoid resizing to a partial cluster size
	lib/list_debug.c: Detect uninitialized lists
	tty: serial: Fix refcount leak bug in ucc_uart.c
	KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings
	vfio: Clear the caps->buf to NULL after free
	mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
	iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit
	modules: Ensure natural alignment for .altinstructions and __bug_table sections
	ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl()
	riscv: dts: sifive: Add fu740 topology information
	riscv: dts: canaan: Add k210 topology information
	riscv: mmap with PROT_WRITE but no PROT_READ is invalid
	RISC-V: Add fast call path of crash_kexec()
	watchdog: export lockup_detector_reconfigure
	powerpc/32: Set an IBAT covering up to _einittext during init
	powerpc/32: Don't always pass -mcpu=powerpc to the compiler
	ovl: warn if trusted xattr creation fails
	powerpc/ioda/iommu/debugfs: Generate unique debugfs entries
	ALSA: core: Add async signal helpers
	ALSA: timer: Use deferred fasync helper
	ALSA: control: Use deferred fasync helper
	f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
	f2fs: fix to do sanity check on segment type in build_sit_entries()
	smb3: check xattr value length earlier
	powerpc/64: Init jump labels before parse_early_param()
	venus: pm_helpers: Fix warning in OPP during probe
	video: fbdev: i740fb: Check the argument of i740_calc_vclk()
	MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
	can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once()
	scsi: ufs: ufs-mediatek: Fix build error and type mismatch
	xfs: flush inodegc workqueue tasks before cancel
	xfs: reserve quota for dir expansion when linking/unlinking files
	xfs: reserve quota for target dir expansion when renaming files
	xfs: remove infinite loop when reserving free block pool
	xfs: always succeed at setting the reserve pool size
	xfs: fix overfilling of reserve pool
	xfs: fix soft lockup via spinning in filestream ag selection loop
	xfs: revert "xfs: actually bump warning counts when we send warnings"
	xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
	Linux 5.15.63

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I85d0cf74054be9e400907eac7d8f2d4d85914f6f
 2022-09-24 10:01:09 +02:00
Greg Kroah-Hartman
47c7e57022 Merge 5.15.61 into android14-5.15 
Changes in 5.15.61
        Makefile: link with -z noexecstack --no-warn-rwx-segments
        x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
        Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"
        scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
        pNFS/flexfiles: Report RDMA connection errors to the server
        NFSD: Clean up the show_nf_flags() macro
        nfsd: eliminate the NFSD_FILE_BREAK_* flags
        ALSA: usb-audio: Add quirk for Behringer UMC202HD
        ALSA: bcd2000: Fix a UAF bug on the error path of probing
        ALSA: hda/realtek: Add quirk for Clevo NV45PZ
        ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
        wifi: mac80211_hwsim: fix race condition in pending packet
        wifi: mac80211_hwsim: add back erroneously removed cast
        wifi: mac80211_hwsim: use 32-bit skb cookie
        add barriers to buffer_uptodate and set_buffer_uptodate
        lockd: detect and reject lock arguments that overflow
        HID: hid-input: add Surface Go battery quirk
        HID: wacom: Only report rotation for art pen
        HID: wacom: Don't register pad_input for touch switch
        KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
        KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case
        KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
        KVM: s390: pv: don't present the ecall interrupt twice
        KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits
        KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value
        KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks
        KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4
        KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
        KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
        KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1
        KVM: x86: Tag kvm_mmu_x86_module_init() with __init
        KVM: x86: do not report preemption if the steal time cache is stale
        KVM: x86: revalidate steal time cache if MSR value changes
        riscv: set default pm_power_off to NULL
        ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
        ALSA: hda/cirrus - support for iMac 12,1 model
        ALSA: hda/realtek: Add quirk for another Asus K42JZ model
        ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED
        tty: vt: initialize unicode screen buffer
        vfs: Check the truncate maximum size in inode_newsize_ok()
        fs: Add missing umask strip in vfs_tmpfile
        thermal: sysfs: Fix cooling_device_stats_setup() error code path
        fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
        fbcon: Fix accelerated fbdev scrolling while logo is still shown
        usbnet: Fix linkwatch use-after-free on disconnect
        fix short copy handling in copy_mc_pipe_to_iter()
        crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
        ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
        parisc: Fix device names in /proc/iomem
        parisc: Drop pa_swapper_pg_lock spinlock
        parisc: Check the return value of ioremap() in lba_driver_probe()
        parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode
        riscv:uprobe fix SR_SPIE set/clear handling
        dt-bindings: riscv: fix SiFive l2-cache's cache-sets
        RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context
        RISC-V: Fixup get incorrect user mode PC for kernel mode regs
        RISC-V: Fixup schedule out issue in machine_crash_shutdown()
        RISC-V: Add modules to virtual kernel memory layout dump
        rtc: rx8025: fix 12/24 hour mode detection on RX-8035
        drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error
        drm/shmem-helper: Add missing vunmap on error
        drm/vc4: hdmi: Disable audio if dmas property is present but empty
        drm/hyperv-drm: Include framebuffer and EDID headers
        drm/nouveau: fix another off-by-one in nvbios_addr
        drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend()
        drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime
        drm/nouveau/kms: Fix failure path for creating DP connectors
        drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
        drm/amdgpu: fix check in fbdev init
        bpf: Fix KASAN use-after-free Read in compute_effective_progs
        btrfs: reject log replay if there is unsupported RO compat flag
        mtd: rawnand: arasan: Fix clock rate in NV-DDR
        mtd: rawnand: arasan: Update NAND bus clock instead of system clock
        um: Remove straying parenthesis
        um: seed rng using host OS rng
        iio: fix iio_format_avail_range() printing for none IIO_VAL_INT
        iio: light: isl29028: Fix the warning in isl29028_remove()
        scsi: sg: Allow waiting for commands to complete on removed device
        scsi: qla2xxx: Fix incorrect display of max frame size
        scsi: qla2xxx: Zero undefined mailbox IN registers
        soundwire: qcom: Check device status before reading devid
        ksmbd: fix memory leak in smb2_handle_negotiate
        ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT
        ksmbd: fix use-after-free bug in smb2_tree_disconect
        fuse: limit nsec
        fuse: ioctl: translate ENOSYS
        serial: mvebu-uart: uart2 error bits clearing
        md-raid: destroy the bitmap after destroying the thread
        md-raid10: fix KASAN warning
        mbcache: don't reclaim used entries
        mbcache: add functions to delete entry if unused
        media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator
        ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
        PCI: Add defines for normal and subtractive PCI bridges
        powerpc/fsl-pci: Fix Class Code of PCIe Root Port
        powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
        powerpc/powernv: Avoid crashing if rng is NULL
        MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
        coresight: Clear the connection field properly
        usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
        USB: HCD: Fix URB giveback issue in tasklet function
        ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
        arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
        usb: dwc3: gadget: refactor dwc3_repare_one_trb
        usb: dwc3: gadget: fix high speed multiplier setting
        netfilter: nf_tables: do not allow SET_ID to refer to another table
        netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
        netfilter: nf_tables: do not allow RULE_ID to refer to another chain
        netfilter: nf_tables: fix null deref due to zeroed list head
        epoll: autoremove wakers even more aggressively
        x86: Handle idle=nomwait cmdline properly for x86_idle
        arch: make TRACE_IRQFLAGS_NMI_SUPPORT generic
        arm64: Do not forget syscall when starting a new thread.
        arm64: fix oops in concurrently setting insn_emulation sysctls
        arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"
        ext2: Add more validity checks for inode counts
        sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg
        genirq: Don't return error on missing optional irq_request_resources()
        irqchip/mips-gic: Only register IPI domain when SMP is enabled
        genirq: GENERIC_IRQ_IPI depends on SMP
        sched/core: Always flush pending blk_plug
        irqchip/mips-gic: Check the return value of ioremap() in gic_of_init()
        wait: Fix __wait_event_hrtimeout for RT/DL tasks
        ARM: dts: imx6ul: add missing properties for sram
        ARM: dts: imx6ul: change operating-points to uint32-matrix
        ARM: dts: imx6ul: fix keypad compatible
        ARM: dts: imx6ul: fix csi node compatible
        ARM: dts: imx6ul: fix lcdif node compatible
        ARM: dts: imx6ul: fix qspi node compatible
        ARM: dts: BCM5301X: Add DT for Meraki MR26
        ARM: dts: ux500: Fix Codina accelerometer mounting matrix
        ARM: dts: ux500: Fix Gavini accelerometer mounting matrix
        spi: synquacer: Add missing clk_disable_unprepare()
        ARM: OMAP2+: display: Fix refcount leak bug
        ARM: OMAP2+: pdata-quirks: Fix refcount leak bug
        ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks
        ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk
        ACPI: PM: save NVS memory for Lenovo G40-45
        ACPI: LPSS: Fix missing check in register_device_clock()
        ARM: dts: qcom: sdx55: Fix the IRQ trigger type for UART
        arm64: dts: qcom: ipq8074: fix NAND node name
        arm64: dts: allwinner: a64: orangepi-win: Fix LED node name
        ARM: shmobile: rcar-gen2: Increase refcount for new reference
        firmware: tegra: Fix error check return value of debugfs_create_file()
        hwmon: (dell-smm) Add Dell XPS 13 7390 to fan control whitelist
        hwmon: (sht15) Fix wrong assumptions in device remove callback
        PM: hibernate: defer device probing when resuming from hibernation
        selinux: fix memleak in security_read_state_kernel()
        selinux: Add boundary check in put_entry()
        kasan: test: Silence GCC 12 warnings
        drm/amdgpu: Remove one duplicated ef removal
        powerpc/64s: Disable stack variable initialisation for prom_init
        spi: spi-rspi: Fix PIO fallback on RZ platforms
        ARM: findbit: fix overflowing offset
        meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
        arm64: dts: renesas: beacon: Fix regulator node names
        spi: spi-altera-dfl: Fix an error handling path
        ARM: bcm: Fix refcount leak in bcm_kona_smc_init
        ACPI: processor/idle: Annotate more functions to live in cpuidle section
        ARM: dts: imx7d-colibri-emmc: add cpu1 supply
        soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values
        scsi: hisi_sas: Use managed PCI functions
        dt-bindings: iio: accel: Add DT binding doc for ADXL355
        soc: amlogic: Fix refcount leak in meson-secure-pwrc.c
        arm64: dts: renesas: Fix thermal-sensors on single-zone sensors
        x86/pmem: Fix platform-device leak in error path
        ARM: dts: ast2500-evb: fix board compatible
        ARM: dts: ast2600-evb: fix board compatible
        ARM: dts: ast2600-evb-a1: fix board compatible
        arm64: dts: mt8192: Fix idle-states nodes naming scheme
        arm64: dts: mt8192: Fix idle-states entry-method
        arm64: select TRACE_IRQFLAGS_NMI_SUPPORT
        arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1
        locking/lockdep: Fix lockdep_init_map_*() confusion
        arm64: dts: qcom: sc7180: Remove ipa_fw_mem node on trogdor
        soc: fsl: guts: machine variable might be unset
        block: fix infinite loop for invalid zone append
        ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg
        ARM: OMAP2+: Fix refcount leak in omapdss_init_of
        ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
        arm64: dts: qcom: sdm630: disable GPU by default
        arm64: dts: qcom: sdm630: fix the qusb2phy ref clock
        arm64: dts: qcom: sdm630: fix gpu's interconnect path
        arm64: dts: qcom: sdm636-sony-xperia-ganges-mermaid: correct sdc2 pinconf
        cpufreq: zynq: Fix refcount leak in zynq_get_revision
        regulator: qcom_smd: Fix pm8916_pldo range
        ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
        ARM: dts: qcom-msm8974: fix irq type on blsp2_uart1
        soc: qcom: ocmem: Fix refcount leak in of_get_ocmem
        soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register
        ARM: dts: qcom: pm8841: add required thermal-sensor-cells
        bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
        stack: Declare {randomize_,}kstack_offset to fix Sparse warnings
        arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
        ACPI: APEI: explicit init of HEST and GHES in apci_init()
        drivers/iio: Remove all strcpy() uses
        ACPI: VIOT: Fix ACS setup
        arm64: dts: qcom: sm6125: Move sdc2 pinctrl from seine-pdx201 to sm6125
        arm64: dts: qcom: sm6125: Append -state suffix to pinctrl nodes
        arm64: dts: qcom: sm8250: add missing PCIe PHY clock-cells
        arm64: dts: mt7622: fix BPI-R64 WPS button
        arm64: tegra: Fixup SYSRAM references
        arm64: tegra: Update Tegra234 BPMP channel addresses
        arm64: tegra: Mark BPMP channels as no-memory-wc
        arm64: tegra: Fix SDMMC1 CD on P2888
        erofs: avoid consecutive detection for Highmem memory
        blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
        spi: Fix simplification of devm_spi_register_controller
        spi: tegra20-slink: fix UAF in tegra_slink_remove()
        hwmon: (drivetemp) Add module alias
        blktrace: Trace remapped requests correctly
        PM: domains: Ensure genpd_debugfs_dir exists before remove
        dm writecache: return void from functions
        dm writecache: count number of blocks read, not number of read bios
        dm writecache: count number of blocks written, not number of write bios
        dm writecache: count number of blocks discarded, not number of discard bios
        regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
        soc: qcom: Make QCOM_RPMPD depend on PM
        arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment
        irqdomain: Report irq number for NOMAP domains
        drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX
        nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
        x86/extable: Fix ex_handler_msr() print condition
        selftests/seccomp: Fix compile warning when CC=clang
        thermal/tools/tmon: Include pthread and time headers in tmon.h
        dm: return early from dm_pr_call() if DM device is suspended
        pwm: sifive: Simplify offset calculation for PWMCMP registers
        pwm: sifive: Ensure the clk is enabled exactly once per running PWM
        pwm: sifive: Shut down hardware only after pwmchip_remove() completed
        pwm: lpc18xx-sct: Reduce number of devm memory allocations
        pwm: lpc18xx-sct: Simplify driver by not using pwm_[gs]et_chip_data()
        pwm: lpc18xx: Fix period handling
        drm/dp: Export symbol / kerneldoc fixes for DP AUX bus
        drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function
        ath10k: do not enforce interrupt trigger type
        drm/st7735r: Fix module autoloading for Okaya RH128128T
        drm/panel: Fix build error when CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20=y && CONFIG_DRM_DISPLAY_HELPER=m
        wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
        ath11k: fix netdev open race
        drm/mipi-dbi: align max_chunk to 2 in spi_transfer
        ath11k: Fix incorrect debug_mask mappings
        drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
        drm/mediatek: Modify dsi funcs to atomic operations
        drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs
        drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
        drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR
        drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init
        drm/bridge: lt9611uxc: Cancel only driver's work
        i2c: npcm: Remove own slave addresses 2:10
        i2c: npcm: Correct slave role behavior
        i2c: mxs: Silence a clang warning
        virtio-gpu: fix a missing check to avoid NULL dereference
        drm/shmem-helper: Unexport drm_gem_shmem_create_with_handle()
        drm/shmem-helper: Export dedicated wrappers for GEM object functions
        drm/shmem-helper: Pass GEM shmem object in public interfaces
        drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
        drm: adv7511: override i2c address of cec before accessing it
        crypto: sun8i-ss - do not allocate memory when handling hash requests
        crypto: sun8i-ss - fix error codes in allocate_flows()
        net: fix sk_wmem_schedule() and sk_rmem_schedule() errors
        can: netlink: allow configuring of fixed bit rates without need for do_set_bittiming callback
        can: netlink: allow configuring of fixed data bit rates without need for do_set_data_bittiming callback
        i2c: Fix a potential use after free
        crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs()
        media: atmel: atmel-sama7g5-isc: fix warning in configs without OF
        media: tw686x: Register the irq at the end of probe
        media: imx-jpeg: Correct some definition according specification
        media: imx-jpeg: Leave a blank space before the configuration data
        media: imx-jpeg: Add pm-runtime support for imx-jpeg
        media: imx-jpeg: use NV12M to represent non contiguous NV12
        media: imx-jpeg: Set V4L2_BUF_FLAG_LAST at eos
        media: imx-jpeg: Refactor function mxc_jpeg_parse
        media: imx-jpeg: Identify and handle precision correctly
        media: imx-jpeg: Handle source change in a function
        media: imx-jpeg: Support dynamic resolution change
        media: imx-jpeg: Align upwards buffer size
        media: imx-jpeg: Implement drain using v4l2-mem2mem helpers
        ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
        wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
        drm/radeon: fix incorrrect SPDX-License-Identifiers
        rcutorture: Warn on individual rcu_torture_init() error conditions
        rcutorture: Don't cpuhp_remove_state() if cpuhp_setup_state() failed
        rcutorture: Fix ksoftirqd boosting timing and iteration
        test_bpf: fix incorrect netdev features
        crypto: ccp - During shutdown, check SEV data pointer before using
        drm: bridge: adv7511: Add check for mipi_dsi_driver_register
        media: imx-jpeg: Disable slot interrupt when frame done
        drm/mcde: Fix refcount leak in mcde_dsi_bind
        media: hdpvr: fix error value returns in hdpvr_read
        media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set
        media: driver/nxp/imx-jpeg: fix a unexpected return value problem
        media: tw686x: Fix memory leak in tw686x_video_init
        drm/vc4: plane: Remove subpixel positioning check
        drm/vc4: plane: Fix margin calculations for the right/bottom edges
        drm/bridge: Add a function to abstract away panels
        drm/vc4: dsi: Switch to devm_drm_of_get_bridge
        drm/vc4: Use of_device_get_match_data()
        drm/vc4: dsi: Release workaround buffer and DMA
        drm/vc4: dsi: Correct DSI divider calculations
        drm/vc4: dsi: Correct pixel order for DSI0
        drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type
        drm/vc4: dsi: Fix dsi0 interrupt support
        drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration
        drm/vc4: hdmi: Fix HPD GPIO detection
        drm/vc4: hdmi: Avoid full hdmi audio fifo writes
        drm/vc4: hdmi: Reset HDMI MISC_CONTROL register
        drm/vc4: hdmi: Fix timings for interlaced modes
        drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes
        crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE
        selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0
        drm/rockchip: vop: Don't crash for invalid duplicate_state()
        drm/rockchip: Fix an error handling path rockchip_dp_probe()
        drm/mediatek: dpi: Remove output format of YUV
        drm/mediatek: dpi: Only enable dpi after the bridge is enabled
        drm: bridge: sii8620: fix possible off-by-one
        hinic: Use the bitmap API when applicable
        net: hinic: fix bug that ethtool get wrong stats
        net: hinic: avoid kernel hung in hinic_get_stats64()
        drm/msm/mdp5: Fix global state lock backoff
        crypto: hisilicon/sec - don't sleep when in softirq
        crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq
        media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
        drm/msm: Avoid dirtyfb stalls on video mode displays (v2)
        drm/msm/dpu: Fix for non-visible planes
        mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
        mt76: mt7615: do not update pm stats in case of error
        ieee80211: add EHT 1K aggregation definitions
        mt76: mt7921: fix aggregation subframes setting to HE max
        mt76: mt7921: enlarge maximum VHT MPDU length to 11454
        mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
        mediatek: mt76: eeprom: fix missing of_node_put() in mt76_find_power_limits_node()
        skmsg: Fix invalid last sg check in sk_msg_recvmsg()
        drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed.
        tcp: make retransmitted SKB fit into the send window
        libbpf: Fix the name of a reused map
        selftests: timers: valid-adjtimex: build fix for newer toolchains
        selftests: timers: clocksource-switch: fix passing errors from child
        bpf: Fix subprog names in stack traces.
        fs: check FMODE_LSEEK to control internal pipe splicing
        media: cedrus: h265: Fix flag name
        media: hantro: postproc: Fix motion vector space size
        media: hantro: Simplify postprocessor
        media: hevc: Embedded indexes in RPS
        media: staging: media: hantro: Fix typos
        wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
        wifi: p54: Fix an error handling path in p54spi_probe()
        wifi: p54: add missing parentheses in p54_flush()
        selftests/bpf: fix a test for snprintf() overflow
        libbpf: fix an snprintf() overflow check
        can: pch_can: do not report txerr and rxerr during bus-off
        can: rcar_can: do not report txerr and rxerr during bus-off
        can: sja1000: do not report txerr and rxerr during bus-off
        can: hi311x: do not report txerr and rxerr during bus-off
        can: sun4i_can: do not report txerr and rxerr during bus-off
        can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off
        can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off
        can: usb_8dev: do not report txerr and rxerr during bus-off
        can: error: specify the values of data[5..7] of CAN error frames
        can: pch_can: pch_can_error(): initialize errc before using it
        Bluetooth: hci_intel: Add check for platform_driver_register
        i2c: cadence: Support PEC for SMBus block read
        i2c: mux-gpmux: Add of_node_put() when breaking out of loop
        wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
        wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
        wifi: libertas: Fix possible refcount leak in if_usb_probe()
        media: cedrus: hevc: Add check for invalid timestamp
        net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version
        net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS
        net/mlx5: Adjust log_max_qp to be 18 at most
        crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq
        crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
        crypto: hisilicon/sec - fix auth key size error
        inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH()
        ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH()
        net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
        netdevsim: fib: Fix reference count leak on route deletion failure
        wifi: rtw88: check the return value of alloc_workqueue()
        iavf: Fix max_rate limiting
        iavf: Fix 'tc qdisc show' listing too many queues
        netdevsim: Avoid allocation warnings triggered from user space
        net: rose: fix netdev reference changes
        net: ionic: fix error check for vlan flags in ionic_set_nic_features()
        dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
        net: usb: make USB_RTL8153_ECM non user configurable
        wireguard: ratelimiter: use hrtimer in selftest
        wireguard: allowedips: don't corrupt stack when detecting overflow
        HID: amd_sfh: Don't show client init failed as error when discovery fails
        clk: renesas: r9a06g032: Fix UART clkgrp bitsel
        mtd: maps: Fix refcount leak in of_flash_probe_versatile
        mtd: maps: Fix refcount leak in ap_flash_init
        mtd: rawnand: meson: Fix a potential double free issue
        of: check previous kernel's ima-kexec-buffer against memory bounds
        scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing
        scsi: qla2xxx: edif: Fix potential stuck session in sa update
        scsi: qla2xxx: edif: Reduce connection thrash
        scsi: qla2xxx: edif: Fix inconsistent check of db_flags
        scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application
        scsi: qla2xxx: edif: Add retry for ELS passthrough
        scsi: qla2xxx: edif: Fix n2n discovery issue with secure target
        scsi: qla2xxx: edif: Fix n2n login retry for secure device
        KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails"
        KVM: SVM: Stuff next_rip on emulated INT3 injection if NRIPS is supported
        phy: samsung: exynosautov9-ufs: correct TSRV register configurations
        PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains()
        PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
        HID: cp2112: prevent a buffer overflow in cp2112_xfer()
        mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
        mtd: partitions: Fix refcount leak in parse_redboot_of
        mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset
        mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
        PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains()
        fpga: altera-pr-ip: fix unsigned comparison with less than zero
        usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
        usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
        usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()
        usb: xhci: tegra: Fix error check
        netfilter: xtables: Bring SPDX identifier back
        scsi: qla2xxx: edif: Send LOGO for unexpected IKE message
        scsi: qla2xxx: edif: Reduce disruption due to multiple app start
        scsi: qla2xxx: edif: Fix no login after app start
        scsi: qla2xxx: edif: Tear down session if keys have been removed
        scsi: qla2xxx: edif: Fix session thrash
        scsi: qla2xxx: edif: Fix no logout on delete for N2N
        iio: accel: bma400: Fix the scale min and max macro values
        platform/chrome: cros_ec: Always expose last resume result
        iio: accel: bma400: Reordering of header files
        clk: mediatek: reset: Fix written reset bit offset
        lib/test_hmm: avoid accessing uninitialized pages
        memremap: remove support for external pgmap refcounts
        mm/memremap: fix memunmap_pages() race with get_dev_pagemap()
        KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
        mwifiex: Ignore BTCOEX events from the 88W8897 firmware
        mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
        scsi: iscsi: Allow iscsi_if_stop_conn() to be called from kernel
        scsi: iscsi: Add helper to remove a session from the kernel
        scsi: iscsi: Fix session removal on shutdown
        dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics
        mtd: dataflash: Add SPI ID table
        clk: qcom: camcc-sm8250: Fix halt on boot by reducing driver's init level
        misc: rtsx: Fix an error handling path in rtsx_pci_probe()
        driver core: fix potential deadlock in __driver_attach
        clk: qcom: clk-krait: unlock spin after mux completion
        clk: qcom: gcc-msm8939: Add missing SYSTEM_MM_NOC_BFDCD_CLK_SRC
        clk: qcom: gcc-msm8939: Fix bimc_ddr_clk_src rcgr base address
        clk: qcom: gcc-msm8939: Add missing system_mm_noc_bfdcd_clk_src
        clk: qcom: gcc-msm8939: Point MM peripherals to system_mm_noc clock
        usb: host: xhci: use snprintf() in xhci_decode_trb()
        RDMA/rxe: Fix deadlock in rxe_do_local_ops()
        clk: qcom: ipq8074: fix NSS core PLL-s
        clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
        clk: qcom: ipq8074: fix NSS port frequency tables
        clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
        clk: qcom: camcc-sdm845: Fix topology around titan_top power domain
        clk: qcom: camcc-sm8250: Fix topology around titan_top power domain
        clk: qcom: clk-rcg2: Fail Duty-Cycle configuration if MND divider is not enabled.
        clk: qcom: clk-rcg2: Make sure to not write d=0 to the NMD register
        mm/mempolicy: fix get_nodes out of bound access
        PCI: dwc: Stop link on host_init errors and de-initialization
        PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
        PCI: dwc: Disable outbound windows only for controllers using iATU
        PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address
        PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
        PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists
        soundwire: bus_type: fix remove and shutdown support
        soundwire: revisit driver bind/unbind and callbacks
        KVM: arm64: Don't return from void function
        dmaengine: sf-pdma: Add multithread support for a DMA channel
        PCI: endpoint: Don't stop controller when unbinding endpoint function
        scsi: qla2xxx: Check correct variable in qla24xx_async_gffid()
        intel_th: Fix a resource leak in an error handling path
        intel_th: msu-sink: Potential dereference of null pointer
        intel_th: msu: Fix vmalloced buffers
        binder: fix redefinition of seq_file attributes
        staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback
        mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
        mmc: mxcmmc: Silence a clang warning
        mmc: renesas_sdhi: Get the reset handle early in the probe
        memstick/ms_block: Fix some incorrect memory allocation
        memstick/ms_block: Fix a memory leak
        mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
        of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer
        mmc: block: Add single read for 4k sector cards
        KVM: s390: pv: leak the topmost page table when destroy fails
        PCI/portdrv: Don't disable AER reporting in get_port_device_capability()
        PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
        scsi: smartpqi: Fix DMA direction for RAID requests
        xtensa: iss/network: provide release() callback
        xtensa: iss: fix handling error cases in iss_net_configure()
        usb: gadget: udc: amd5536 depends on HAS_DMA
        usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
        usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
        usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
        usb: dwc3: qcom: fix missing optional irq warnings
        eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
        phy: stm32: fix error return in stm32_usbphyc_phy_init
        interconnect: imx: fix max_node_id
        um: random: Don't initialise hwrng struct with zero
        RDMA/irdma: Fix a window for use-after-free
        RDMA/irdma: Fix VLAN connection with wildcard address
        RDMA/irdma: Fix setting of QP context err_rq_idx_valid field
        RDMA/rtrs-srv: Fix modinfo output for stringify
        RDMA/rtrs: Fix warning when use poll mode on client side.
        RDMA/rtrs: Replace duplicate check with is_pollqueue helper
        RDMA/rtrs: Introduce destroy_cq helper
        RDMA/rtrs: Do not allow sessname to contain special symbols / and .
        RDMA/rtrs: Rename rtrs_sess to rtrs_path
        RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path
        RDMA/rtrs-clt: Rename rtrs_clt_sess to rtrs_clt_path
        RDMA/rtrs-clt: Replace list_next_or_null_rr_rcu with an inline function
        RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
        RDMA/hns: Fix incorrect clearing of interrupt status register
        RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
        iio: cros: Register FIFO callback after sensor is registered
        clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk
        RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
        gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
        HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
        HID: amd_sfh: Add NULL check for hid device
        dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t)
        scripts/gdb: lx-dmesg: read records individually
        scripts/gdb: fix 'lx-dmesg' on 32 bits arch
        RDMA/rxe: Fix mw bind to allow any consumer key portion
        mmc: cavium-octeon: Add of_node_put() when breaking out of loop
        mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
        HID: alps: Declare U1_UNICORN_LEGACY support
        RDMA/rxe: For invalidate compare according to set keys in mr
        PCI: tegra194: Fix Root Port interrupt handling
        PCI: tegra194: Fix link up retry sequence
        HID: amd_sfh: Handle condition of "no sensors"
        USB: serial: fix tty-port initialized comments
        usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
        mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}()
        KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP
        platform/olpc: Fix uninitialized data in debugfs write
        RDMA/srpt: Duplicate port name members
        RDMA/srpt: Introduce a reference count in struct srpt_device
        RDMA/srpt: Fix a use-after-free
        android: binder: stop saving a pointer to the VMA
        mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
        selftests: kvm: set rax before vmcall
        of/fdt: declared return type does not match actual return type
        RDMA/mlx5: Add missing check for return value in get namespace flow
        RDMA/rxe: Add memory barriers to kernel queues
        RDMA/rxe: Remove the is_user members of struct rxe_sq/rxe_rq/rxe_srq
        RDMA/rxe: Fix error unwind in rxe_create_qp()
        block/rnbd-srv: Set keep_id to true after mutex_trylock
        null_blk: fix ida error handling in null_add_dev()
        nvme: use command_id instead of req->tag in trace_nvme_complete_rq()
        nvme: define compat_ioctl again to unbreak 32-bit userspace.
        nvme: disable namespace access for unsupported metadata
        nvme: don't return an error from nvme_configure_metadata
        nvme: catch -ENODEV from nvme_revalidate_zones again
        block/bio: remove duplicate append pages code
        block: ensure iov_iter advances for added pages
        jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction()
        ext4: recover csum seed of tmp_inode after migrating to extents
        jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
        usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable()
        opp: Fix error check in dev_pm_opp_attach_genpd()
        ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe
        ASoC: samsung: Fix error handling in aries_audio_probe
        ASoC: imx-audmux: Silence a clang warning
        ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
        ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe
        ASoC: codecs: da7210: add check for i2c_add_driver
        ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
        serial: 8250: Export ICR access helpers for internal use
        serial: 8250: dma: Allow driver operations before starting DMA transfers
        serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
        ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV
        ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
        rpmsg: char: Add mutex protection for rpmsg_eptdev_open()
        rpmsg: mtk_rpmsg: Fix circular locking dependency
        remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
        selftests/livepatch: better synchronize test_klp_callbacks_busy
        profiling: fix shift too large makes kernel panic
        remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init
        ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header
        powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable
        ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables
        tty: n_gsm: Delete gsmtty open SABM frame when config requester
        tty: n_gsm: fix user open not possible at responder until initiator open
        tty: n_gsm: fix tty registration before control channel open
        tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()
        tty: n_gsm: fix missing timer to handle stalled links
        tty: n_gsm: fix non flow control frames during mux flow off
        tty: n_gsm: fix packet re-transmission without open control channel
        tty: n_gsm: fix race condition in gsmld_write()
        tty: n_gsm: fix resource allocation order in gsm_activate_mux()
        ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe()
        ASoC: imx-card: Fix DSD/PDM mclk frequency
        remoteproc: qcom: wcnss: Fix handling of IRQs
        vfio/ccw: Do not change FSM state in subchannel event
        serial: 8250_fsl: Don't report FE, PE and OE twice
        tty: n_gsm: fix wrong T1 retry count handling
        tty: n_gsm: fix DM command
        tty: n_gsm: fix missing corner cases in gsmld_poll()
        MIPS: vdso: Utilize __pa() for gic_pfn
        swiotlb: fail map correctly with failed io_tlb_default_mem
        ASoC: mt6359: Fix refcount leak bug
        serial: 8250_bcm7271: Save/restore RTS in suspend/resume
        iommu/exynos: Handle failed IOMMU device registration properly
        9p: fix a bunch of checkpatch warnings
        9p: Drop kref usage
        9p: Add client parameter to p9_req_put()
        net: 9p: fix refcount leak in p9_read_work() error handling
        MIPS: Fixed __debug_virt_addr_valid()
        rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
        kfifo: fix kfifo_to_user() return type
        lib/smp_processor_id: fix imbalanced instrumentation_end() call
        proc: fix a dentry lock race between release_task and lookup
        remoteproc: qcom: pas: Check if coredump is enabled
        remoteproc: sysmon: Wait for SSCTL service to come up
        mfd: t7l66xb: Drop platform disable callback
        mfd: max77620: Fix refcount leak in max77620_initialise_fps
        iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
        perf tools: Fix dso_id inode generation comparison
        s390/dump: fix old lowcore virtual vs physical address confusion
        s390/maccess: fix semantics of memcpy_real() and its callers
        s390/crash: fix incorrect number of bytes to copy to user space
        s390/zcore: fix race when reading from hardware system area
        ASoC: fsl_asrc: force cast the asrc_format type
        ASoC: fsl-asoc-card: force cast the asrc_format type
        ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format
        ASoC: imx-card: use snd_pcm_format_t type for asrc_format
        ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
        fuse: Remove the control interface for virtio-fs
        ASoC: audio-graph-card: Add of_node_put() in fail path
        watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource
        watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
        video: fbdev: amba-clcd: Fix refcount leak bugs
        video: fbdev: sis: fix typos in SiS_GetModeID()
        ASoC: mchp-spdifrx: disable end of block interrupt on failures
        powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping.
        powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32
        powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case
        powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
        tty: serial: fsl_lpuart: correct the count of break characters
        s390/dump: fix os_info virtual vs physical address confusion
        s390/smp: cleanup target CPU callback starting
        s390/smp: cleanup control register update routines
        s390/maccess: rework absolute lowcore accessors
        s390/smp: enforce lowcore protection on CPU restart
        f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
        powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
        powerpc/xive: Fix refcount leak in xive_get_max_prio
        powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
        perf symbol: Fail to read phdr workaround
        kprobes: Forbid probing on trampoline and BPF code areas
        x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero
        powerpc/pci: Fix PHB numbering when using opal-phbid
        genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
        scripts/faddr2line: Fix vmlinux detection on arm64
        sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy()
        sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
        x86/numa: Use cpumask_available instead of hardcoded NULL check
        video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
        tools/thermal: Fix possible path truncations
        sched: Fix the check of nr_running at queue wakelist
        sched: Remove the limitation of WF_ON_CPU on wakelist if wakee cpu is idle
        sched/core: Do not requeue task on CPU excluded from cpus_mask
        x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y
        f2fs: allow compression for mmap files in compress_mode=user
        f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED
        video: fbdev: vt8623fb: Check the size of screen before memset_io()
        video: fbdev: arkfb: Check the size of screen before memset_io()
        video: fbdev: s3fb: Check the size of screen before memset_io()
        scsi: ufs: core: Correct ufshcd_shutdown() flow
        scsi: zfcp: Fix missing auto port scan and thus missing target ports
        scsi: qla2xxx: Fix imbalance vha->vref_count
        scsi: qla2xxx: Fix discovery issues in FC-AL topology
        scsi: qla2xxx: Turn off multi-queue for 8G adapters
        scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
        scsi: qla2xxx: Fix excessive I/O error messages by default
        scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection
        scsi: qla2xxx: Wind down adapter after PCIe error
        scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os
        scsi: qla2xxx: Fix losing target when it reappears during delete
        scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests
        x86/bugs: Enable STIBP for IBPB mitigated RETBleed
        ftrace/x86: Add back ftrace_expected assignment
        x86/kprobes: Update kcb status flag after singlestepping
        x86/olpc: fix 'logical not is only applied to the left hand side'
        SMB3: fix lease break timeout when multiple deferred close handles for the same file.
        posix-cpu-timers: Cleanup CPU timers before freeing them during exec
        Input: gscps2 - check return value of ioremap() in gscps2_probe()
        __follow_mount_rcu(): verify that mount_lock remains unchanged
        spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
        drm/mediatek: Allow commands to be sent during video mode
        drm/mediatek: Keep dsi as LP00 before dcs cmds transfer
        crypto: blake2s - remove shash module
        drm/dp/mst: Read the extended DPCD capabilities during system resume
        drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component
        usbnet: smsc95xx: Don't clear read-only PHY interrupt
        usbnet: smsc95xx: Avoid link settings race on interrupt reception
        usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling
        usbnet: smsc95xx: Fix deadlock on runtime resume
        firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
        scsi: lpfc: Fix EEH support for NVMe I/O
        scsi: lpfc: SLI path split: Refactor lpfc_iocbq
        scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4
        scsi: lpfc: SLI path split: Refactor SCSI paths
        scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID
        intel_th: pci: Add Meteor Lake-P support
        intel_th: pci: Add Raptor Lake-S PCH support
        intel_th: pci: Add Raptor Lake-S CPU support
        KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors
        KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS)
        iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
        PCI/AER: Iterate over error counters instead of error strings
        PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
        serial: 8250_pci: Refactor the loop in pci_ite887x_init()
        serial: 8250_pci: Replace dev_*() by pci_*() macros
        serial: 8250: Fold EndRun device support into OxSemi Tornado code
        serial: 8250: Add proper clock handling for OxSemi PCIe devices
        tty: 8250: Add support for Brainboxes PX cards.
        dm writecache: set a default MAX_WRITEBACK_JOBS
        kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
        dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
        net/9p: Initialize the iounit field during fid creation
        ARM: remove some dead code
        timekeeping: contribute wall clock to rng on time change
        locking/csd_lock: Change csdlock_debug from early_param to __setup
        block: remove the struct blk_queue_ctx forward declaration
        block: don't allow the same type rq_qos add more than once
        btrfs: ensure pages are unlocked on cow_file_range() failure
        btrfs: reset block group chunk force if we have to wait
        btrfs: properly flag filesystem with BTRFS_FEATURE_INCOMPAT_BIG_METADATA
        ACPI: CPPC: Do not prevent CPPC from working in the future
        powerpc/powernv/kvm: Use darn for H_RANDOM on Power9
        KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter
        KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU
        KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl
        KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL
        KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists
        dm raid: fix address sanitizer warning in raid_status
        dm raid: fix address sanitizer warning in raid_resume
        tracing: Add '__rel_loc' using trace event macros
        tracing: Avoid -Warray-bounds warning for __rel_loc macro
        ext4: update s_overhead_clusters in the superblock during an on-line resize
        ext4: fix extent status tree race in writeback error recovery path
        ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
        ext4: fix use-after-free in ext4_xattr_set_entry
        ext4: correct max_inline_xattr_value_size computing
        ext4: correct the misjudgment in ext4_iget_extra_inode
        ext4: fix warning in ext4_iomap_begin as race between bmap and write
        ext4: check if directory block is within i_size
        ext4: make sure ext4_append() always allocates new block
        ext4: remove EA inode entry from mbcache on inode eviction
        ext4: use kmemdup() to replace kmalloc + memcpy
        ext4: unindent codeblock in ext4_xattr_block_set()
        ext4: fix race when reusing xattr blocks
        KEYS: asymmetric: enforce SM2 signature use pkey algo
        tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH
        xen-blkback: fix persistent grants negotiation
        xen-blkback: Apply 'feature_persistent' parameter when connect
        xen-blkfront: Apply 'feature_persistent' parameter when connect
        powerpc: Fix eh field when calling lwarx on PPC32
        tracing: Use a struct alignof to determine trace event field alignment
        net_sched: cls_route: remove from list when handle is 0
        mac80211: fix a memory leak where sta_info is not freed
        tcp: fix over estimation in sk_forced_mem_schedule()
        crypto: lib/blake2s - reduce stack frame usage in self test
        Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
        Revert "s390/smp: enforce lowcore protection on CPU restart"
        drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function
        net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode
        drm/vc4: change vc4_dma_range_matches from a global to static
        tracing/perf: Avoid -Warray-bounds warning for __rel_loc macro
        drm/msm: Fix dirtyfb refcounting
        drm/meson: Fix refcount leak in meson_encoder_hdmi_init
        io_uring: mem-account pbuf buckets
        Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
        Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
        drm/bridge: Move devm_drm_of_get_bridge to bridge/panel.c
        scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup()
        scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4()
        scsi: lpfc: Resolve some cleanup issues following SLI path refactoring
        Linux 5.15.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iec359ed301bcbcd6e19b67ee8534418fab26850b
 2022-09-21 17:30:12 +02:00
Eric Biggers
2edbdfc89d crypto: lib - remove unneeded selection of XOR_BLOCKS 
commit 874b301985ef2f89b8b592ad255e03fb6fbfe605 upstream.

CRYPTO_LIB_CHACHA_GENERIC doesn't need to select XOR_BLOCKS.  It perhaps
was thought that it's needed for __crypto_xor, but that's not the case.

Enabling XOR_BLOCKS is problematic because the XOR_BLOCKS code runs a
benchmark when it is initialized.  That causes a boot time regression on
systems that didn't have it enabled before.

Therefore, remove this unnecessary and problematic selection.

Fixes: e56e18985596 ("lib/crypto: add prompts back to crypto libraries")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-09-05 10:30:03 +02:00
Kuniyuki Iwashima
0db9ce822f ratelimit: Fix data-races in ___ratelimit(). 
[ Upstream commit 6bae8ceb90ba76cdba39496db936164fa672b9be ]

While reading rs->interval and rs->burst, they can be changed
concurrently via sysctl (e.g. net_ratelimit_state).  Thus, we
need to add READ_ONCE() to their readers.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-31 17:16:43 +02:00
Guenter Roeck
ce0432aa89 lib/list_debug.c: Detect uninitialized lists 
[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ]

In some circumstances, attempts are made to add entries to or to remove
entries from an uninitialized list.  A prime example is
amdgpu_bo_vm_destroy(): It is indirectly called from
ttm_bo_init_reserved() if that function fails, and tries to remove an
entry from a list.  However, that list is only initialized in
amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned
success.  This results in crashes such as

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5
 Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020
 RIP: 0010:__list_del_entry_valid+0x26/0x7d
 ...
 Call Trace:
  amdgpu_bo_vm_destroy+0x48/0x8b
  ttm_bo_init_reserved+0x1d7/0x1e0
  amdgpu_bo_create+0x212/0x476
  ? amdgpu_bo_user_destroy+0x23/0x23
  ? kmem_cache_alloc+0x60/0x271
  amdgpu_bo_create_vm+0x40/0x7d
  amdgpu_vm_pt_create+0xe8/0x24b
 ...

Check if the list's prev and next pointers are NULL to catch such problems.

Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-25 11:40:40 +02:00
Jason A. Donenfeld
621b596b29 crypto: lib/blake2s - reduce stack frame usage in self test 
commit d6c14da474bf260d73953fbf7992c98d9112aec7 upstream.

Using 3 blocks here doesn't give us much more than using 2, and it
causes a stack frame size warning on certain compiler/config/arch
combinations:

   lib/crypto/blake2s-selftest.c: In function 'blake2s_selftest':
>> lib/crypto/blake2s-selftest.c:632:1: warning: the frame size of 1088 bytes is larger than 1024 bytes [-Wframe-larger-than=]
     632 | }
         | ^

So this patch just reduces the block from 3 to 2, which makes the
warning go away.

Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/linux-crypto/202206200851.gE3MHCgd-lkp@intel.com
Fixes: 2d16803c562e ("crypto: blake2s - remove shash module")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-08-17 14:24:29 +02:00
Jason A. Donenfeld
3dd33a09f5 crypto: blake2s - remove shash module 
[ Upstream commit 2d16803c562ecc644803d42ba98a8e0aef9c014e ]

BLAKE2s has no currently known use as an shash. Just remove all of this
unnecessary plumbing. Removing this shash was something we talked about
back when we were making BLAKE2s a built-in, but I simply never got
around to doing it. So this completes that project.

Importantly, this fixs a bug in which the lib code depends on
crypto_simd_disabled_for_test, causing linker errors.

Also add more alignment tests to the selftests and compare SIMD and
non-SIMD compression functions, to make up for what we lose from
testmgr.c.

Reported-by: gaochao <gaochao49@huawei.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 6048fdcc5f26 ("lib/crypto: blake2s: include as built-in")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-17 14:24:19 +02:00
Tetsuo Handa
f28e4d2148 lib/smp_processor_id: fix imbalanced instrumentation_end() call 
[ Upstream commit bd27acaac24e4b252ee28dddcabaee80456d0faf ]

Currently instrumentation_end() won't be called if printk_ratelimit()
returned false.

Link: https://lkml.kernel.org/r/a636d8e0-ad32-5888-acac-671f7f553bb3@I-love.SAKURA.ne.jp
Fixes: 126f21f0e8 ("lib/smp_processor_id: Move it into noinstr section")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Alexandre Chartre <alexandre.chartre@oracle.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-17 14:24:08 +02:00
Joe Lawrence
49929f3ee8 selftests/livepatch: better synchronize test_klp_callbacks_busy 
[ Upstream commit 55eb9a6c8bf3e2099863118ef53e02d9f44f85a8 ]

The test_klp_callbacks_busy module conditionally blocks a future
livepatch transition by busy waiting inside its workqueue function,
busymod_work_func().  After scheduling this work, a test livepatch is
loaded, introducing the transition under test.

Both events are marked in the kernel log for later verification, but
there is no synchronization to ensure that busymod_work_func() logs its
function entry message before subsequent selftest commands log their own
messages.  This can lead to a rare test failure due to unexpected
ordering like:

#  --- expected
#  +++ result
#  @@ -1,7 +1,7 @@
#   % modprobe test_klp_callbacks_busy block_transition=Y
#   test_klp_callbacks_busy: test_klp_callbacks_busy_init
#  -test_klp_callbacks_busy: busymod_work_func enter
#   % modprobe test_klp_callbacks_demo
#  +test_klp_callbacks_busy: busymod_work_func enter
#   livepatch: enabling patch 'test_klp_callbacks_demo'
#   livepatch: 'test_klp_callbacks_demo': initializing patching transition
#   test_klp_callbacks_demo: pre_patch_callback: vmlinux

Force the module init function to wait until busymod_work_func() has
started (and logged its message), before exiting to the next selftest
steps.

Fixes: 547840bd5a ("selftests/livepatch: simplify test-klp-callbacks busy target tests")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20220602203233.979681-1-joe.lawrence@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-17 14:24:03 +02:00
Miaohe Lin
d1e0ceeec0 lib/test_hmm: avoid accessing uninitialized pages 
[ Upstream commit ed913b055a74b723976f8e885a3395162a0371e6 ]

If make_device_exclusive_range() fails or returns pages marked for
exclusive access less than required, remaining fields of pages will left
uninitialized.  So dmirror_atomic_map() will access those yet
uninitialized fields of pages.  To fix it, do dmirror_atomic_map() iff all
pages are marked for exclusive access (we will break if mapped is less
than required anyway) so we won't access those uninitialized fields of
pages.

Link: https://lkml.kernel.org/r/20220609130835.35110-1-linmiaohe@huawei.com
Fixes: b659baea75 ("mm: selftests for exclusive device memory")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-17 14:23:43 +02:00
Jian Shen
8f458e34a8 test_bpf: fix incorrect netdev features 
[ Upstream commit 9676feccacdb0571791c88b23e3b7ac4e7c9c457 ]

The prototype of .features is netdev_features_t, it should use
NETIF_F_LLTX and NETIF_F_HW_VLAN_STAG_TX, not NETIF_F_LLTX_BIT
and NETIF_F_HW_VLAN_STAG_TX_BIT.

Fixes: cf204a7183 ("bpf, testing: Introduce 'gso_linear_no_head_frag' skb_segment test")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20220622135002.8263-1-shenjian15@huawei.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-17 14:23:23 +02:00
Kees Cook
abd3622f65 kasan: test: Silence GCC 12 warnings 
[ Upstream commit aaf50b1969d7933a51ea421b11432a7fb90974e3 ]

GCC 12 continues to get smarter about array accesses. The KASAN tests
are expecting to explicitly test out-of-bounds conditions at run-time,
so hide the variable from GCC, to avoid warnings like:

../lib/test_kasan.c: In function 'ksize_uaf':
../lib/test_kasan.c:790:61: warning: array subscript 120 is outside array bounds of 'void[120]' [-Warray-bounds]
  790 |         KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
      |                                       ~~~~~~~~~~~~~~~~~~~~~~^~~~~~
../lib/test_kasan.c:97:9: note: in definition of macro 'KUNIT_EXPECT_KASAN_FAIL'
   97 |         expression; \
      |         ^~~~~~~~~~

Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: kasan-dev@googlegroups.com
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220608214024.1068451-1-keescook@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-08-17 14:23:05 +02:00
Al Viro
4228c037f8 fix short copy handling in copy_mc_pipe_to_iter() 
commit c3497fd009ef2c59eea60d21c3ac22de3585ed7d upstream.

Unlike other copying operations on ITER_PIPE, copy_mc_to_iter() can
result in a short copy.  In that case we need to trim the unused
buffers, as well as the length of partially filled one - it's not
enough to set ->head, ->iov_offset and ->count to reflect how
much had we copied.  Not hard to fix, fortunately...

I'd put a helper (pipe_discard_from(pipe, head)) into pipe_fs_i.h,
rather than iov_iter.c - it has nothing to do with iov_iter and
having it will allow us to avoid an ugly kludge in fs/splice.c.
We could put it into lib/iov_iter.c for now and move it later,
but I don't see the point going that way...

Cc: stable@kernel.org # 4.19+
Fixes: ca146f6f09 "lib/iov_iter: Fix pipe handling in _copy_to_iter_mcsafe()"
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-08-17 14:22:51 +02:00