Merge tag 'android12-5.10.110_r01' into android12-5.10

This is the merge of the upstream LTS release of 5.4.110 into the
android12-5.10 branch.

It contains the following commits:

e08dd85cc9 ANDROID: fix up abi issue with struct snd_pcm_runtime, again
8f4bd2a63f Revert "coredump: Snapshot the vmas in do_coredump"
b7dbb1ee1f Revert "coredump: Remove the WARN_ON in dump_vma_snapshot"
5f24894332 Revert "coredump: Use the vma snapshot in fill_files_note"
c4eb663fca Revert "pstore: Don't use semaphores in always-atomic-context code"
562c3bd65c Revert "PCI: Reduce warnings on possible RW1C corruption"
0038e1f40c ANDROID: GKI: fix crc issue with commit ce1927b8cf ("block: don't merge across cgroup boundaries if blkcg is enabled")
62fa3399b4 ANDROID: remove CONFIG_HW_RANDOM_CAVIUM from arm64 gki_defconfig
95f4203fc9 Merge 5.10.110 into android12-5.10-lts
3238bffaf9 Linux 5.10.110
cf342cbfb3 PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup"
a25864c5bc arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones
558564db44 coredump: Use the vma snapshot in fill_files_note
b7933f145a coredump/elf: Pass coredump_params into fill_note_info
b043ae637a coredump: Remove the WARN_ON in dump_vma_snapshot
936c8be4d1 coredump: Snapshot the vmas in do_coredump
5318cdf4fd can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
869016a293 can: m_can: m_can_tx_handler(): fix use after free of skb
e90518d10c KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
e36c45263a openvswitch: Fixed nd target mask field in the flow dump.
415edc68b6 docs: sysctl/kernel: add missing bit to panic_print
272c74323d um: Fix uml_mconsole stop/go
c0a6a54738 ARM: dts: spear13xx: Update SPI dma properties
ea3912af8b ARM: dts: spear1340: Update serial node properties
74f7971985 ASoC: topology: Allow TLV control to be either read or write
3ca47556d9 ubi: fastmap: Return error code if memory allocation fails in add_aeb()
7704f243cb dt-bindings: spi: mxic: The interrupt property is not mandatory
648ab1dcc1 dt-bindings: mtd: nand-controller: Fix a comment in the examples
71917e45e1 dt-bindings: mtd: nand-controller: Fix the reg property description
73f2f37417 bpf: Fix comment for helper bpf_current_task_under_cgroup()
90805175a2 bpf: Adjust BPF stack helper functions to accommodate skip > 0
86489492e8 mm/usercopy: return 1 from hardened_usercopy __setup() handler
81a04b9a32 mm/memcontrol: return 1 from cgroup.memory __setup() handler
f321621f5c ARM: 9187/1: JIVE: fix return value of __setup handler
d57feed3b1 mm/mmap: return 1 from stack_guard_gap __setup() handler
73f7cbb151 batman-adv: Check ptr for NULL before reducing its refcnt
f6da750bfa ASoC: soc-compress: Change the check for codec_dai
d3f786b7cf staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet
12e380bb6f proc: bootconfig: Add null pointer check
90ec1b1538 can: isotp: restore accidentally removed MSG_PEEK feature
16960ac92b platform/chrome: cros_ec_typec: Check for EC device
e5b681822c ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
785a53373c riscv module: remove (NOLOAD)
b27de7011c io_uring: fix memory leak of uid in files registration
20499ed3c0 ARM: iop32x: offset IRQ numbers by 1
432b057f8e ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
f28a857a61 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
ecfc3f8a63 pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE()
503868a7c0 pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR()
d9afc5146b watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function
402b53dc7c pinctrl: pinconf-generic: Print arguments for bias-pull-*
7169f60110 watch_queue: Free the page array when watch_queue is dismantled
e64dc94990 crypto: arm/aes-neonbs-cbc - Select generic cbc and aes
a16f5ae8ad mailbox: imx: fix wakeup failure from freeze mode
051360e513 rxrpc: Fix call timer start racing with call destruction
a94d98e06e net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware
c73af4bc8a gfs2: Make sure FITRIM minlen is rounded up to fs block size
33c204266c rtc: check if __rtc_read_time was successful
381636f33f XArray: Update the LRU list in xas_split()
3b9fabe8f6 can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value
ef0acc5141 can: mcba_usb: properly check endpoint type
0801a51d79 can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
1ac49c8fd4 XArray: Fix xas_create_range() when multi-order entry present
49f77ab50a wireguard: socket: ignore v6 endpoints when ipv6 is disabled
096f9d35ca wireguard: socket: free skb in send6 when ipv6 is disabled
cd032f218c wireguard: queueing: use CFI-safe ptr_ring cleanup function
8a0c70c238 ubifs: rename_whiteout: correct old_dir size computing
c34ae24a25 ubifs: Fix to add refcount once page is set private
07a209fade ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
d07a242169 ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
13b2a8151e ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
83e42a7842 ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
a90e2dbe66 ubifs: rename_whiteout: Fix double free for whiteout_ui->data
0c307349fe ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
0fb470eb48 KVM: SVM: fix panic on out-of-bounds guest IRQ
cd8c2d7c7c KVM: x86: fix sending PV IPI
eccfee4494 KVM: Prevent module exit until all VMs are freed
09c771c45c KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
aea4ffdcf3 platform: chrome: Split trace include file
d3a913ba1f scsi: qla2xxx: Use correct feature type field during RFF_ID processing
633450063c scsi: qla2xxx: Reduce false trigger to login
dd48727cab scsi: qla2xxx: Fix N2N inconsistent PLOGI
0910a791a6 scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests
f296e888e9 scsi: qla2xxx: Fix hang due to session stuck
edea037716 scsi: qla2xxx: Fix incorrect reporting of task management failure
9dc104edd7 scsi: qla2xxx: Fix disk failure to rediscover
f97316dd39 scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
0e4a89efc2 scsi: qla2xxx: Check for firmware dump already collected
ef10a7530c scsi: qla2xxx: Add devids and conditionals for 28xx
bad77c9a47 scsi: qla2xxx: Fix device reconnect in loop topology
8b52e20c22 scsi: qla2xxx: Fix warning for missing error code
7c9745421d scsi: qla2xxx: Fix wrong FDMI data for 64G adapter
7fef50214d scsi: qla2xxx: Fix scheduling while atomic
c45147018d scsi: qla2xxx: Fix stuck session in gpdb
031547f4c6 powerpc: Fix build errors with newer binutils
68fa67e939 powerpc/lib/sstep: Fix build errors with newer binutils
ad806b4022 powerpc/lib/sstep: Fix 'sthcx' instruction
f39a330939 powerpc/kasan: Fix early region not updated correctly
89e5a42687 KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU
a3ad453008 ALSA: hda/realtek: Add alc256-samsung-headphone fixup
aa2ad067cd media: atomisp: fix bad usage at error handling logic
2412a5d294 mmc: host: Return an error when ->enable_sdio_irq() ops is missing
808990afd8 media: hdpvr: initialize dev->worker at hdpvr_register_videodev
32582f82df media: Revert "media: em28xx: add missing em28xx_close_extension"
b1c2857752 video: fbdev: sm712fb: Fix crash in smtcfb_write()
e7bb29df2a ARM: mmp: Fix failure to remove sram device
add823a9a5 ARM: tegra: tamonten: Fix I2C3 pad setting
08ec8450f3 lib/test_lockup: fix kernel pointer check for separate address spaces
40a5c93a74 uaccess: fix type mismatch warnings from access_ok()
a49b687a75 media: cx88-mpeg: clear interrupt status register before streaming video
4606350268 ASoC: soc-core: skip zero num_dai component in searching dai name
a840fc067e ARM: dts: bcm2711: Add the missing L1/L2 cache information
681a317034 video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
a7c624abf6 video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
543dae0a46 video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
910715c4b4 arm64: defconfig: build imx-sdma as a module
14df2556a1 ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
c241cfd0a5 ARM: ftrace: avoid redundant loads or clobbering IP
41082d6432 media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
b554196e6d media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards
370b50492e ASoC: madera: Add dependencies on MFD
0020667edc ARM: dts: bcm2837: Add the missing L1/L2 cache information
f040c08102 ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
da210b1b55 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
8c7e2141fb video: fbdev: cirrusfb: check pixclock to avoid divide by zero
1e33f19746 video: fbdev: w100fb: Reset global state
08dff48201 video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
99e3f83539 media: ir_toy: free before error exiting
d658178b5a media: staging: media: zoran: fix various V4L2 compliance errors
bafec1a6ba media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com
bd01629315 media: staging: media: zoran: move videodev alloc
b230f2d944 ntfs: add sanity check on allocation size
f7e8aff062 f2fs: compress: fix to print raw data size in error path of lz4 decompression
d91d1e681c NFSD: Fix nfsd_breaker_owns_lease() return values
498b7088db f2fs: fix to do sanity check on curseg->alloc_type
330d0e44fc ext4: don't BUG if someone dirty pages without asking ext4 first
cd6d719534 ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
69d2421b55 ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb
ecd384c436 locking/lockdep: Iterate lock_classes directly when reading lockdep files
3ad817f1bd spi: tegra20: Use of_device_get_match_data()
1c200c8bce nvme-tcp: lockdep: annotate in-kernel sockets
7e4967e913 parisc: Fix handling off probe non-access faults
ede1ef1a7d PM: core: keep irq flags in device_pm_check_callbacks()
227718c8bb ACPI/APEI: Limit printable size of BERT table data
cc051f497e Revert "Revert "block, bfq: honor already-setup queue merges""
1b69302bfa lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
1b87ce6a77 ACPICA: Avoid walking the ACPI Namespace if it is not there
df6e00b1a5 bfq: fix use-after-free in bfq_dispatch_request
dd85ed4af8 fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
9fc899ce5a irqchip/nvic: Release nvic_base upon failure
4bbd910de1 irqchip/qcom-pdc: Fix broken locking
f038185b6a Fix incorrect type in assignment of ipv6 port for audit
012c572007 loop: use sysfs_emit() in the sysfs xxx show()
448857f580 selinux: allow FIOCLEX and FIONCLEX with policy capability
4b9b60b5bf selinux: use correct type for context length
7507ead1e9 block, bfq: don't move oom_bfqq
79b16d00de pinctrl: npcm: Fix broken references to chip->parent_device
9d1d8e5e42 gcc-plugins/stackleak: Exactly match strings instead of prefixes
b0f2f89d74 regulator: rpi-panel: Handle I2C errors/timing to the Atmel
2784604c8c LSM: general protection fault in legacy_parse_param
e600b5973e fs: fix fd table size alignment properly
327f07e370 lib/test: use after free in register_test_dev_kmod()
00d2b9fe5e fs: fd tables have to be multiples of BITS_PER_LONG
1752fcd404 net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
edb91a475d NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
5c94b6205e net/x25: Fix null-ptr-deref caused by x25_disconnect
4896c308a5 qlcnic: dcb: default to returning -EOPNOTSUPP
2165d0ebfb selftests: test_vxlan_under_vrf: Fix broken test case
f98dc124a4 net: phy: broadcom: Fix brcm_fet_config_init()
3e7a483af3 net: hns3: fix bug when PF set the duplicate MAC address for VFs
3eb92660e6 net: enetc: report software timestamping via SO_TIMESTAMPING
e9445a7a59 xen: fix is_xen_pmu()
af0c3ced24 clk: Initialize orphan req_rate
845e734f97 clk: qcom: gcc-msm8994: Fix gpll4 width
e2a2625392 kdb: Fix the putarea helper function
a9fa7d48a1 NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
8cd30d28da netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
fbd56a61ce jfs: fix divide error in dbNextAG
acb96e62e6 driver core: dd: fix return value of __setup handler
89748be18f firmware: google: Properly state IOMEM dependency
3d934d7b90 kgdbts: fix return value of __setup handler
f65ba8b988 serial: 8250: fix XOFF/XON sending when DMA is used
45e95a7bf8 kgdboc: fix return value of __setup handler
96038b1cf4 tty: hvc: fix return value of __setup handler
566e30289d pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
669b05ff43 pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
9d095fe2fb pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs
861946289d pinctrl: mediatek: paris: Fix pingroup pin config state readback
7675fb2aaf pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get()
901e192ac9 pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
72ea0fefea pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
fddbfe43bf staging: mt7621-dts: fix GB-PC2 devicetree
00e0739ca1 staging: mt7621-dts: fix pinctrl properties for ethernet
47c31fe8ca staging: mt7621-dts: fix formatting
59ec187d7c staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
942f68bf29 NFS: remove unneeded check in decode_devicenotify_args()
e025c66387 clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver
54c8128297 clk: clps711x: Terminate clk_div_table with sentinel element
9ff533033d clk: loongson1: Terminate clk_div_table with sentinel element
bb680cabf2 clk: actions: Terminate clk_div_table with sentinel element
431f8a9cec nvdimm/region: Fix default alignment for small regions
f7210ca29a remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
7a494580a8 remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
5c1d484d96 remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
f95fd61dd8 dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma
d047d68ff0 clk: qcom: clk-rcg2: Update the frac table for pixel clock
334720f418 clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
639744b242 clk: at91: sama7g5: fix parents of PDMCs' GCLK
0553ecbce9 clk: imx7d: Remove audio_mclk_root_clk
867258d3f3 dma-debug: fix return value of __setup handlers
2f3885514e NFS: Return valid errors from nfs2/3_decode_dirent()
7b59afe84a habanalabs: Add check for pci_enable_device
afcbc63752 iio: adc: Add check for devm_request_threaded_irq
df2dc4cf71 serial: 8250: Fix race condition in RTS-after-send handling
469ce5119f NFS: Use of mapping_set_error() results in spurious errors
659fe4d653 serial: 8250_lpss: Balance reference count for PCI DMA device
0aebb3944a serial: 8250_mid: Balance reference count for PCI DMA device
c92bd51313 phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
80805f555e clk: qcom: ipq8074: Use floor ops for SDCC1 clock
fd2601e366 pinctrl: renesas: checker: Fix miscalculation of number of states
c5cf977515 pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
b5db33a81e staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
f5b01abf5f iio: mma8452: Fix probe failing when an i2c_device_id is used
8b89c9e68a clk: qcom: ipq8074: fix PCI-E clock oops
a70d5dbe2e soundwire: intel: fix wrong register name in intel_shim_wake
091704a9a7 cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse
f90ad94322 misc: alcor_pci: Fix an error handling path
553541c453 fsi: Aspeed: Fix a potential double free
cb212c3f0d fsi: aspeed: convert to devm_platform_ioremap_resource
c0b3c06414 pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
2cd05c38a2 mxser: fix xmit_buf leak in activate when LSR == 0xff
8513c93ead mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
084be6309f tipc: fix the timer expires after interval 100ms
5d8162371c openvswitch: always update flow key after nat
4593c76a65 tcp: ensure PMTU updates are processed during fastopen
b26091a020 net: bcmgenet: Use stronger register read/writes to assure ordering
9088614323 PCI: Avoid broken MSI on SB600 USB devices
75a4a97b74 selftests/bpf/test_lirc_mode2.sh: Exit with proper code
0d3ad6142a i2c: mux: demux-pinctrl: do not deactivate a master that is not active
c483f8002d i2c: meson: Fix wrong speed use from probe
b089836218 af_netlink: Fix shift out of bounds in group mask calculation
40f3b8dada ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
70a6cf749d Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
b441fcdff2 Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed
876cfe1380 selftests/bpf: Fix error reporting from sock_fields programs
ac1ec6f319 bareudp: use ipv6_mod_enabled to check if IPv6 enabled
c037e13539 can: isotp: support MSG_TRUNC flag when reading from socket
f402c49865 can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
8a9d996d4e USB: storage: ums-realtek: fix error code in rts51x_read_mem()
f9a6661009 samples/bpf, xdpsock: Fix race when running for fix duration of time
cd84ea3920 bpf, sockmap: Fix double uncharge the mem of sk_msg
7b812a369e bpf, sockmap: Fix more uncharged while msg has more_data
bec34a91eb bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
c98d903ff9 RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
a3587259ae mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
fa3d444245 MIPS: pgalloc: fix memory leak caused by pgd_free()
8c4808ff9e MIPS: RB532: fix return value of __setup handler
ef1728e3cb mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
315772133a ath10k: Fix error handling in ath10k_setup_msa_resources
71f311b123 vxcan: enable local echo for sent CAN frames
3c2a397849 powerpc: 8xx: fix a return value error in mpc8xx_pic_init
956fab99ad platform/x86: huawei-wmi: check the return value of device_create_file()
1ba28cb692 selftests/bpf: Make test_lwt_ip_encap more stable and faster
08ab406781 libbpf: Unmap rings when umem deleted
6fa8edfc90 mfd: mc13xxx: Add check for mc13xxx_irq_request
bcf93175ed powerpc/sysdev: fix incorrect use to determine if list is empty
ab0a335b54 mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
bbd91cdb62 net: axienet: fix RX ring refill allocation failure handling
9ec698984d PCI: Reduce warnings on possible RW1C corruption
a84cb039d2 IB/hfi1: Allow larger MTU without AIP
48d23ef901 power: supply: wm8350-power: Add missing free in free_charger_irq
9d3dab40af power: supply: wm8350-power: Handle error for wm8350_register_irq
5cf1371628 i2c: xiic: Make bus names unique
f01e08083c hv_balloon: rate-limit "Unhandled message" warning
ba2c6e353b KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor()
fa9089949d KVM: x86: Fix emulation in writing cr8
3e7e73ae2b powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
05abd49972 powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties()
3e04a837db libbpf: Skip forward declaration when counting duplicated type names
6bb107332d gpu: host1x: Fix a memory leak in 'host1x_remove()'
d1c7759304 bpf, arm64: Feed byte-offset into bpf line info
694398af5f bpf, arm64: Call build_prologue() first in first JIT pass
06a0001366 drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
a3d53f0005 scsi: hisi_sas: Change permission of parameter prot_mask
705c70399e power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return
1e06710c43 drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
9ffa07c699 ext2: correct max file size computing
60605acf5b TOMOYO: fix __setup handlers return values
adb7c8d1de drm/amd/display: Remove vupdate_int_entry definition
e462b0f518 RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
279f318bd7 scsi: pm8001: Fix abort all task initialization
780c668a2d scsi: pm8001: Fix NCQ NON DATA command completion handling
f7a3f9e4e8 scsi: pm8001: Fix NCQ NON DATA command task initialization
f76bbee39e scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
6bc86bca35 scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
27ccdcaa01 scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
6c0e850c22 scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config()
edde1ede76 scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
257a55622c scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
f55a7bc38f scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
5349cde1df dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
d4862bea08 drm/msm/dpu: fix dp audio condition
7b52fb813c drm/msm/dpu: add DSPP blocks teardown
413c62697b drm/msm/dp: populate connector of struct dp_panel
441a83ff27 iwlwifi: mvm: Fix an error code in iwl_mvm_up()
c12692c3e9 iwlwifi: Fix -EIO error code that is never returned
ec376f5c11 dax: make sure inodes are flushed before destroy cache
5e6b030ac3 IB/cma: Allow XRC INI QPs to set their local ACK timeout
9c384e1afa drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug
80b96ac9d2 drm/amd/pm: enable pm sysfs write for one VF mode
06e778d184 iommu/ipmmu-vmsa: Check for error num after setting mask
ab63b24ae6 HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
879356a6a0 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
f03ef518c1 drm/bridge: dw-hdmi: use safe format when first in bridge chain
e0e25e131d PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
b1af8b9ec0 livepatch: Fix build failure on 32 bits processors
6f095441f8 scripts/dtc: Call pkg-config POSIXly correct
080822563b net: dsa: mv88e6xxx: Enable port policy support on 6097
2ac4f049db mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
2430af1241 mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
232c1cc986 mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv
253cc4aafc mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode
b5d363ff17 powerpc/perf: Don't use perf_hw_context for trace IMC PMU
c18b538617 KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
8b64c158a0 powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch
be703360ed ray_cs: Check ioremap return value
43f2fe2a69 power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
da71a1483b i40e: respect metadata on XSK Rx to skb
b2e48cd141 i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
e8fe653fa7 KVM: PPC: Fix vmx/vsx mixup in mmio emulation
11cb9eba06 RDMA/core: Set MR type in ib_reg_user_mr
11f11ac281 ath9k_htc: fix uninit value bugs
6e669baa33 drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function
19a7eba284 drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
9abee51534 drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
47402eaf88 ionic: fix type complaint in ionic_dev_cmd_clean()
1ba10e5c39 drm/edid: Don't clear formats if using deep color
d99e7feaed mtd: rawnand: gpmi: fix controller timings setting
364b2eee62 mtd: onenand: Check for error irq
96ea88eb9b Bluetooth: hci_serdev: call init_rwsem() before p->open()
b267a8118c udmabuf: validate ubuf->pagecount
56722aa77b libbpf: Fix possible NULL pointer dereference when destroying skeleton
4a9c268a40 drm/panfrost: Check for error num after setting mask
5d1114ede5 ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
fb2be762a4 drm: bridge: adv7511: Fix ADV7535 HPD enablement
d9d61beb21 drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe
064e7f7532 drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
d8db734df6 drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
ec3924eab5 drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops
a1c665f5b7 ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS
1f24716e38 ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data
abefbf602c ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe
90ac679aa6 ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe
ec26e3ce3c ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card()
541251b903 mmc: davinci_mmc: Handle error for clk_enable
19eb5c7957 ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe
42042c7a3d ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
fe4db4ea21 ASoC: fsl_spdif: Disable TX clock when stop
86b6cf9894 ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
c8c981cfc0 ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
f452cff025 ASoC: SOF: Add missing of_node_put() in imx8m_probe
0d82401d46 ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe
7e8b0fd0eb ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource()
b5664a584e ivtv: fix incorrect device_caps for ivtvfb
ebd4f1501e media: saa7134: fix incorrect use to determine if list is empty
dd67315994 media: saa7134: convert list_for_each to entry variant
066d9b48f9 video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
20da8404e4 ASoC: fsi: Add check for clk_enable
db1c00a025 ASoC: wm8350: Handle error for wm8350_register_irq
662ee5ac6b ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
663e7a7287 media: vidtv: Check for null return of vzalloc
4d68603cc4 media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
b02752d753 m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined
9ca3635a0a arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly
7e6f578662 ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
64eee4127c memory: emif: check the pointer temp in get_device_details()
330a9b0d38 memory: emif: Add check for setup_interrupts
4639c1d97f ASoC: soc-compress: prevent the potentially use of null pointer
a6ee60d4a9 ASoC: dwc-i2s: Handle errors for clk_enable
39bee81e30 ASoC: atmel_ssc_dai: Handle errors for clk_enable
dc947d175c ASoC: mxs-saif: Handle errors for clk_enable
a754ea0de3 printk: fix return value of printk.devkmsg __setup handler
87a265e292 arm64: dts: broadcom: Fix sata nodename
f63122803d arm64: dts: ns2: Fix spi-cpol and spi-cpha property
5d6a0dc6ba ALSA: spi: Add check for clk_enable()
039fae34f8 ASoC: ti: davinci-i2s: Add check for clk_enable()
94cb9fe5d8 ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
7ce3e6e103 uaccess: fix nios2 and microblaze get_user_8()
19894751f6 ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put
f126dcbe70 media: cedrus: h264: Fix neighbour info buffer size
c011ae1665 media: cedrus: H265: Fix neighbour info buffer size
44973633b0 media: usb: go7007: s2250-board: fix leak in probe()
ec8a37b2d9 media: em28xx: initialize refcount before kref_get
1b46f57d51 media: video/hdmi: handle short reads of hdmi info frame.
170ad3942b ARM: dts: imx: Add missing LVDS decoder on M53Menlo
2a0eb50d9a ARM: dts: sun8i: v3s: Move the csi1 block to follow address order
77406ac6ef soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
18b2ec361a firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined
8395a17ef6 arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
d19248e23f arm64: dts: qcom: sdm845: fix microphone bias properties and values
2042c6fbfb soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
5a990a65d4 soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem
b5d6eba719 soc: qcom: rpmpd: Check for null return of devm_kcalloc
0c11cb8db4 ARM: dts: qcom: ipq4019: fix sleep clock
22474dfd0c firmware: qcom: scm: Remove reassignment to desc following initializer
bf4bad1114 video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
6de6a64f23 video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
64ec3e678d video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
0dff86aeb1 video: fbdev: controlfb: Fix COMPILE_TEST build
ec1c20b02a video: fbdev: controlfb: Fix set but not used warnings
f8bf19f7f3 video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen
3187a1d4d5 media: aspeed: Correct value for h-total-pixels
245561612b media: hantro: Fix overfill bottom register field name
032b141a91 media: meson: vdec: potential dereference of null pointer
d3e5106c67 media: coda: Fix missing put_device() call in coda_get_vdoa_data
c9f4586d99 ASoC: generic: simple-card-utils: remove useless assignment
2c357e0277 ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting
712dd2ac26 media: bttv: fix WARNING regression on tunerless devices
bc2573abc6 media: mtk-vcodec: potential dereference of null pointer
8a83731a09 media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
c76188715d media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size
f622bd0758 kunit: make kunit_test_timeout compatible with comment
9e63bcb71d selftests, x86: fix how check_cc.sh is being invoked
d2c53e77b0 f2fs: fix compressed file start atomic write may cause data corruption
1c4d94e4f0 f2fs: compress: remove unneeded read when rewrite whole cluster
2c4741d1b0 btrfs: fix unexpected error path when reflinking an inline extent
3ef3bc75cd f2fs: fix to avoid potential deadlock
85cc399b65 nfsd: more robust allocation failure handling in nfsd_file_cache_init
1a11a87374 f2fs: fix missing free nid in f2fs_handle_failed_inode
c0cffc1fb3 perf/x86/intel/pt: Fix address filter config for 32-bit kernel
13c8e37e1f perf/core: Fix address filter parser for multiple filters
a9faa5beda rseq: Remove broken uapi field layout on 32-bit little endian
f0250e05e5 rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs()
ecc17de4b9 sched/core: Export pelt_thermal_tp
40732cab51 sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
2b5d41bcf2 f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
9d92be1a09 watch_queue: Actually free the watch
5ae75b4ed3 watch_queue: Fix NULL dereference in error cleanup
509565faed io_uring: terminate manual loop iterator loop correctly for non-vecs
44a77e52bd clocksource: acpi_pm: fix return value of __setup handler
d678f002f0 hwmon: (pmbus) Add Vin unit off handling
7ca525b4cc hwrng: nomadik - Change clk_disable to clk_disable_unprepare
e4c777fd8c amba: Make the remove callback return void
1c6ac39763 vfio: platform: simplify device removal
c93017c8d5 crypto: ccree - Fix use after free in cc_cipher_exit()
78622926fe crypto: ccp - ccp_dmaengine_unregister release dma channels
9eeee6f684 ACPI: APEI: fix return value of __setup handlers
0b45bf1659 clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init()
b33c753cff clocksource/drivers/timer-microchip-pit64b: Use notrace
db9d00461b clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts
d4e13c4a6f clocksource/drivers/exynos_mct: Refactor resources allocation
42d331a279 clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix
aedff03da4 crypto: vmx - add missing dependencies
51939008ca crypto: amlogic - call finalize with bh disabled
24857d87cc crypto: sun8i-ce - call finalize with bh disabled
bf4814d58b crypto: sun8i-ss - call finalize with bh disabled
a4067ccb97 hwrng: atmel - disable trng on failure path
b7940bef6f spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
3928a04bc6 PM: suspend: fix return value of __setup handler
052a218db0 PM: hibernate: fix __setup handler error handling
0b5924a14d block: don't delete queue kobject before its children
40b288a861 nvme: cleanup __nvme_check_ids
32c4db2a52 hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
ec8536f701 hwmon: (pmbus) Add mutex to regulator ops
18a18594ae spi: pxa2xx-pci: Balance reference count for PCI DMA device
55259cb374 crypto: ccree - don't attempt 0 len DMA mappings
d788ad472f EVM: fix the evm= __setup handler return value
a137f93ae5 audit: log AUDIT_TIME_* records only from rules
5e9501e60b crypto: rockchip - ECB does not need IV
8265bea7d8 selftests/x86: Add validity check and allow field splitting
f7d9249af3 arm64/mm: avoid fixmap race condition when create pud mapping
99a8dfce7c spi: tegra114: Add missing IRQ check in tegra_spi_probe
71dba67138 thermal: int340x: Check for NULL after calling kmemdup()
8e57117142 crypto: mxs-dcp - Fix scatterlist processing
ec1d372974 crypto: authenc - Fix sleep in atomic context in decrypt_tail
fdfaafeb4b crypto: sun8i-ss - really disable hash on A80
19693838c8 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
bc20294cc8 hwrng: cavium - Check health status while reading random data
962d1f59d5 selinux: check return value of sel_make_avc_files
1ae9b020dd regulator: qcom_smd: fix for_each_child.cocci warnings
c20975954e PCI: xgene: Revert "PCI: xgene: Fix IB window setup"
0f56f24015 PCI: pciehp: Clear cmd_busy bit in polling mode
89ddcc8191 drm/i915/gem: add missing boundary check in vm_access
b84857c06e drm/i915/opregion: check port number bounds for SWSCI display power state
88975951d4 brcmfmac: pcie: Fix crashes due to early IRQs
1cbcf93a93 brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
f3820ddaf4 brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
daa07f2902 brcmfmac: firmware: Allocate space for default boardrev in nvram
1dd031eb99 xtensa: fix xtensa_wsr always writing 0
dac518bbce xtensa: fix stop_machine_cpuslocked call in patch_text
20f974dce5 media: davinci: vpif: fix unbalanced runtime PM enable
7c9b915b94 media: davinci: vpif: fix unbalanced runtime PM get
cde90e8291 media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC
785ffce44a DEC: Limit PMAX memory probing to R3k systems
8dde2296ec bcache: fixup multiple threads crash
37d2b4fa5c crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
b89fb8b882 crypto: rsa-pkcs1pad - restore signature length check
f38c318068 crypto: rsa-pkcs1pad - correctly get hash from source scatterlist
c1db3f44f2 crypto: rsa-pkcs1pad - only allow with rsa
27a6f495b6 exec: Force single empty string when argv is empty
b02d33171d lib/raid6/test: fix multiple definition linking error
bf057eac9a thermal: int340x: Increase bitmap size
86a926c3f0 pstore: Don't use semaphores in always-atomic-context code
b26f400e4f carl9170: fix missing bit-wise or operator for tx_params
3aef4df6e1 mgag200 fix memmapsl configuration in GCTL6 register
ef1df91685 ARM: dts: exynos: add missing HDMI supplies on SMDK5420
3cde68a1eb ARM: dts: exynos: add missing HDMI supplies on SMDK5250
5ac205c414 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
7187c9beb7 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
2ca2a5552a video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
72af881092 video: fbdev: sm712fb: Fix crash in smtcfb_read()
ba09b04173 drm/edid: check basic audio support on CEA extension block
ce1927b8cf block: don't merge across cgroup boundaries if blkcg is enabled
6e0d24598c block: limit request dispatch loop duration
958e9b56de mailbox: tegra-hsp: Flush whole channel
f67a140078 drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
b35eb48471 ext4: fix fs corruption when tring to remove a non-empty directory with IO error
a1e6884b2d ext4: fix ext4_fc_stats trace point
c119fb65f6 coredump: Also dump first pages of non-executable ELF libraries
7ad5ccc3da ACPI: properties: Consistently return -ENOENT if there are no more references
ef3a87e0c4 arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs
18864e8b83 arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs
e85fa9f4e9 arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs
7ce550a01b arm64: signal: nofpsimd: Do not allocate fp/simd context when not available
210e7b43d4 udp: call udp_encap_enable for v6 sockets when enabling encap
e1a58498ef powerpc/kvm: Fix kvm_use_magic_page
d72866a7f5 can: isotp: sanitize CAN ID checks in isotp_bind()
fde8c5cad0 drbd: fix potential silent data corruption
b101e74f9a dm integrity: set journal entry unused when shrinking device
d5d5804acc mm/kmemleak: reset tag when compare object pointer
bc2f58b8e4 mm,hwpoison: unmap poisoned page before invalidation
608c501d70 Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"
8b354e3032 mm: madvise: return correct bytes advised with process_madvise
928c06c114 mm: madvise: skip unmapped vma holes passed to process_madvise
51f7557c3c ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
9017201e8d ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
7b7a03d8b5 ALSA: hda: Avoid unsol event during RPM suspending
a55e2d7423 ALSA: cs4236: fix an incorrect NULL check on list iterator
edefc4b2a8 cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
9963ccea60 cifs: prevent bad output lengths in smb2_ioctl_query_info()
b75198edda Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
34bc1f69bf riscv: Increase stack size under KASAN
24b9b8e95c riscv: Fix fill_callchain return value
0f8c0bd0a4 qed: validate and restrict untrusted VFs vlan promisc mode
a3af3d4319 qed: display VF trust config
aa28075f06 scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
4bcefc78c8 mempolicy: mbind_range() set_policy() after vma_merge()
fa37c17143 mm: invalidate hwpoison page cache page in fault path
7188e7c96f mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
51dbb5e36d jffs2: fix memory leak in jffs2_scan_medium
607d3aab73 jffs2: fix memory leak in jffs2_do_mount_fs
7bb7428dd7 jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
b417f9c505 can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
3a21ee89bc mtd: rawnand: protect access to rawnand devices while in suspend
145a63201d spi: mxic: Fix the transmit path
be22ebe79e pinctrl: samsung: drop pin banks references on error paths
b97b305656 remoteproc: Fix count check in rproc_coredump_write()
784630df17 f2fs: fix to do sanity check on .cp_pack_total_block_count
e58ee6bd93 f2fs: quota: fix loop condition at f2fs_quota_sync()
ec67040703 f2fs: fix to unlock page correctly in error path of is_alive()
7af164fa2f NFSD: prevent integer overflow on 32 bit systems
65e21cc042 NFSD: prevent underflow in nfssvc_decode_writeargs()
b7b430104a SUNRPC: avoid race between mod_timer() and del_timer_sync()
f51ab2f60a HID: intel-ish-hid: Use dma_alloc_coherent for firmware update
a1df8e60f2 firmware: stratix10-svc: add missing callback parameter on RSU
e94f5fbe7a Documentation: update stable tree link
f4bab992ee Documentation: add link to stable release candidate tree
10ee5662d5 KEYS: fix length validation in keyctl_pkey_params_get_2()
5a41a3033a ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
2775d8e364 clk: uniphier: Fix fixed-rate initialization
25cd5872d9 greybus: svc: fix an error handling bug in gb_svc_hello()
9f0cd81174 iio: inkern: make a best effort on offset calculation
19e533452f iio: inkern: apply consumer scale when no channel scale is available
e10dbe7f6a iio: inkern: apply consumer scale on IIO_VAL_INT cases
9f4fffc2ab iio: afe: rescale: use s64 for temporary scale calculations
9cd1b02655 coresight: Fix TRCCONFIGR.QE sysfs interface
7b478cb67b mei: avoid iterator usage outside of list_for_each_entry
ec8975417d mei: me: add Alder Lake N device id.
0a0c61dd07 xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
811f403519 xhci: make xhci_handshake timeout for xhci_reset() adjustable
3a820d1ca1 xhci: fix runtime PM imbalance in USB2 resume
c41387f96a xhci: fix garbage USBSTS being logged in some cases
1e0f089f70 USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
39a70732eb virtio-blk: Use blk_validate_block_size() to validate block size
290e05f346 tpm: fix reference counting for struct tpm_chip
fcd3c31dd1 iommu/iova: Improve 32-bit free space estimate
68c80088f5 locking/lockdep: Avoid potential access of invalid memory in lock_class
f19d8dfad6 net: dsa: microchip: add spi_device_id tables
8d3f4ad430 af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
ef1a6ab36d Input: zinitix - do not report shadow fingers
21680aabc4 spi: Fix erroneous sgs value with min_t()
8fb7af1b5a Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"
18a4417a19 net:mcf8390: Use platform_get_irq() to get the interrupt
102d7f6c2e spi: Fix invalid sgs value
a4f4ce3dee gpio: Revert regression in sysfs-gpio (gpiolib.c)
fc9a35627c ethernet: sun: Free the coherent when failing in probing
3c84471925 tools/virtio: fix virtio_test execution
6d98dc2369 vdpa/mlx5: should verify CTRL_VQ feature exists for MQ
c97ffb4184 virtio_console: break out of buf poll on remove
0c00d38337 ARM: mstar: Select HAVE_ARM_ARCH_TIMER
a7e75e5ed4 xfrm: fix tunnel model fragmentation behavior
e05ae08ea8 HID: logitech-dj: add new lightspeed receiver id
ff919a7ad9 netdevice: add the case if dev is NULL
c4dc584a2d hv: utils: add PTP_1588_CLOCK to Kconfig to fix build
d136a2574a USB: serial: simple: add Nokia phone driver
38e3d48ffe USB: serial: pl2303: add IBM device IDs
d4d975e792 swiotlb: fix info leak with DMA_FROM_DEVICE
414e6c8e94 ANDROID: fix up abi issue with struct snd_pcm_runtime
51790ed529 Merge 5.10.109 into android12-5.10-lts
d9c5818a0b Linux 5.10.109
163960a7de llc: only change llc->dev when bind() succeeds
2b5a6d7714 nds32: fix access_ok() checks in get/put_user
c064268eb8 wcn36xx: Differentiate wcn3660 from wcn3620
95193d12f1 tpm: use try_get_ops() in tpm-space.c
5d3ff9542a mac80211: fix potential double free on mesh join
fcc9797d0d rcu: Don't deboost before reporting expedited quiescent state
87f7ed7c36 Revert "ath: add support for special 0x0 regulatory domain"
c971e6a1c8 crypto: qat - disable registration of algorithms
9f4e64611e ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
0b2ffba2de ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
2724b72b22 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
2c74374c2e netfilter: nf_tables: initialize registers in nft_do_chain()
eb1ba8d1c3 drivers: net: xgene: Fix regression in CRC stripping
a2368d10b7 ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
6936d2ecf8 ALSA: cmipci: Restore aux vol on suspend/resume
cbd27127af ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
0ae81ef3ea ALSA: pcm: Add stream lock during PCM reset ioctl operations
b560d670c8 ALSA: pcm: Fix races among concurrent prealloc proc writes
a38440f006 ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
8527c8f052 ALSA: pcm: Fix races among concurrent read/write and buffer changes
0f6947f5f5 ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
014c81dfb3 ALSA: hda/realtek: Add quirk for ASUS GA402
05256f3fd6 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
ca8247b4df ALSA: hda/realtek: Add quirk for Clevo NP50PNJ
26fe8f3103 ALSA: hda/realtek: Add quirk for Clevo NP70PNJ
80eab86a86 ALSA: usb-audio: add mapping for new Corsair Virtuoso SE
5ce74ff705 ALSA: oss: Fix PCM OSS buffer allocation overflow
db03abd0da ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call
571df3393f llc: fix netdevice reference leaks in llc_ui_bind()
56dc187b35 staging: fbtft: fb_st7789v: reset display before initialization
351493858e tpm: Fix error handling in async work
ea21245cdc cgroup-v1: Correct privileges check in release_agent writes
824a950c3f cgroup: Use open-time cgroup namespace for process migration perm checks
f28364fe38 cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
9eeaa2d7d5 exfat: avoid incorrectly releasing for root inode
ae8ec5eabb net: ipv6: fix skb_over_panic in __ip6_append_data
25c23fe40e nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
ab2d1d40a1 Revert "vsock: each transport cycles only on its own sockets"
644c989f41 Merge 5.10.108 into android12-5.10-lts
9940314ebf Linux 5.10.108
37119edab8 Revert "selftests/bpf: Add test for bpf_timer overwriting crash"
9248694dac esp: Fix possible buffer overflow in ESP transformation
96340cdd55 smsc95xx: Ignore -ENODEV errors when device is unplugged
e27b51af54 net: usb: Correct reset handling of smsc95xx
b54daeafc1 net: usb: Correct PHY handling of smsc95xx
204d38dc6a perf symbols: Fix symbol size calculation condition
f0d43d22d2 Input: aiptek - properly check endpoint type
98e7a654a5 scsi: mpt3sas: Page fault in reply q processing
10a805334a usb: usbtmc: Fix bug in pipe direction for control transfers
00bdd9bf1a usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
28bc026739 usb: gadget: rndis: prevent integer overflow in rndis_set_response()
2c010c61e6 arm64: fix clang warning about TRAMP_VALIAS
277b7f6394 net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload
2550afba2a net: bcmgenet: skip invalid partial checksums
bf5b7aae86 bnx2x: fix built-in kernel driver load failure
c07fdba12f net: phy: mscc: Add MODULE_FIRMWARE macros
ba50073cf4 net: dsa: Add missing of_node_put() in dsa_port_parse_of
a630ad5e8b net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
336b6be6ad drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings
9d45aec02f drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check()
9b763ceda6 hv_netvsc: Add check for kvmalloc_array
09a7264fb0 atm: eni: Add check for dma_map_single
70b7b3c055 net/packet: fix slab-out-of-bounds access in packet_recvmsg()
169add82d2 net: phy: marvell: Fix invalid comparison in the resume and suspend functions
01fac1ca8a esp6: fix check on ipv6_skip_exthdr's return value
d9fe590970 vsock: each transport cycles only on its own sockets
ac7dd60946 efi: fix return value of __setup handlers
fa3aa103e7 mm: swap: get rid of livelock in swapin readahead
df3301dc60 ocfs2: fix crash when initialize filecheck kobj fails
0f9b7b8df1 crypto: qcom-rng - ensure buffer for generate is completely filled
9a559b8868 Merge branch 'android12-5.10' into `android12-5.10-lts`
8646e92696 Merge 5.10.107 into android12-5.10-lts
4c8814277b Linux 5.10.107
7a0d13ef67 arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable
dc1163203a io_uring: return back safer resurrect
8fdaab341b kselftest/vm: fix tests build with old libc
2490695ffd sfc: extend the locking on mcdi->seqno
2fad5b6948 tcp: make tcp_read_sock() more robust
3f9a8f8a95 nl80211: Update bss channel on channel switch for P2P_CLIENT
0ba557d330 drm/vrr: Set VRR capable prop only if it is attached to connector
9a8e4a5c5b iwlwifi: don't advertise TWT support
c5ea0221c8 atm: firestream: check the return value of ioremap() in fs_init()
efdd92c18e can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready
ebe106eac6 ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE
e8ad9ecc40 MIPS: smp: fill in sibling and core maps earlier
8c70b9b470 mac80211: refuse aggregations sessions before authorized
d687d7559e ARM: dts: rockchip: fix a typo on rk3288 crypto-controller
6f0a94931c ARM: dts: rockchip: reorder rk322x hmdi clocks
6493c6aa8b arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg"
c5c8c649fe arm64: dts: rockchip: reorder rk3399 hdmi clocks
f7f062919f arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity
ca142038a5 xfrm: Fix xfrm migrate issues when address family changes
d8889a445b xfrm: Check if_id in xfrm_migrate
6056abc99b sctp: fix the processing for INIT chunk
bdf0316982 Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
5287773dba Merge 5.10.106 into android12-5.10-lts
9e8aa4cec7 Merge 5.10.105 into android12-5.10-lts
55d57b8929 Merge b65b87e718 ("arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting") into android12-5.10-lts
9fddd6c893 UPSTREAM: arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting
531b5ce9dd UPSTREAM: arm64: Use the clearbhb instruction in mitigations
d05b159f71 UPSTREAM: KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
11bed3edbd UPSTREAM: arm64: Mitigate spectre style branch history side channels
9bc6a2543d UPSTREAM: arm64: Do not include __READ_ONCE() block in assembly files
2434153e7e UPSTREAM: KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
cfa82070a7 UPSTREAM: arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
5195a80d07 UPSTREAM: arm64: Add percpu vectors for EL1
9e96a3d6ae Merge 56cf5326bd ("arm64: entry: Add macro for reading symbol addresses from the trampoline") into android12-5.10-lts
327f1e7d81 Linux 5.10.106
648895da69 watch_queue: Fix filter limit check
8bb5b72dbd ARM: fix Thumb2 regression with Spectre BHB
6b1249db9e ext4: add check to prevent attempting to resize an fs with sparse_super2
b297cf764d x86/traps: Mark do_int3() NOKPROBE_SYMBOL
29f6f35001 x86/boot: Add setup_indirect support in early_memremap_is_setup_data()
b3444e5b64 x86/boot: Fix memremap of setup_indirect structures
24d268130e watch_queue: Make comment about setting ->defunct more accurate
ec03510e0a watch_queue: Fix lack of barrier/sync/lock between post and read
06ab844439 watch_queue: Free the alloc bitmap when the watch_queue is torn down
880acbb718 watch_queue: Fix the alloc bitmap size to reflect notes allocated
e2b52ca498 watch_queue: Fix to always request a pow-of-2 pipe ring size
2039900aad watch_queue: Fix to release page in ->release()
d729d4e99f watch_queue, pipe: Free watchqueue state after clearing pipe ring
573a3228ca virtio: acknowledge all features before access
bf52b627cf virtio: unexport virtio_finalize_features
8bfb959ea2 arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0
1ef5fe3dba riscv: Fix auipc+jalr relocation range checks
a69aa422b4 mmc: meson: Fix usage of meson_mmc_post_req()
0c6eeaf8c1 net: macb: Fix lost RX packet wakeup race in NAPI receive
6d9700b445 staging: gdm724x: fix use after free in gdm_lte_rx()
8c1bc04c8c staging: rtl8723bs: Fix access-point mode deadlock
ab5595b45f fuse: fix pipe buffer lifetime for direct_io
f2c52a4baf ARM: Spectre-BHB: provide empty stub for non-config
f1f5d089fc selftests/memfd: clean up mapping in mfd_fail_write
71013d071b selftest/vm: fix map_fixed_noreplace test failure
8d276f10e8 tracing: Ensure trace buffer is at least 4096 bytes large
ae7597b47d ipv6: prevent a possible race condition with lifetimes
8c0c50e9fc Revert "xen-netback: Check for hotplug-status existence before watching"
625c04b523 Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
a0e2768fb9 gpio: Return EPROBE_DEFER if gc->to_irq is NULL
65d4e9d130 hwmon: (pmbus) Clear pmbus fault/warning bits after read
d15c9f6e33 net-sysfs: add check for netdevice being present to speed_show
8c023c3039 spi: rockchip: terminate dma transmission when slave abort
889254f98e spi: rockchip: Fix error in getting num-cs property
4fb9be675b selftests/bpf: Add test for bpf_timer overwriting crash
dc1c2b47b5 net: bcmgenet: Don't claim WOL when its not available
b7e4d9ba2d sctp: fix kernel-infoleak for SCTP sockets
3cf533f120 net: phy: DP83822: clear MISR2 register to disable interrupts
21044e679e gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
3a4cd1c51e gpio: ts4900: Do not set DAT and OE together
7702e7e9e3 selftests: pmtu.sh: Kill tcpdump processes launched by subshell.
2b1c85f565 NFC: port100: fix use-after-free in port100_send_complete
1fdabf2cf4 net/mlx5e: Lag, Only handle events from highest priority multipath entry
f3331bc174 net/mlx5: Fix a race on command flush flow
5f1340963b net/mlx5: Fix size field in bufferx_reg struct
e2201ef32f ax25: Fix NULL pointer dereference in ax25_kill_by_device
cc7679079c net: ethernet: lpc_eth: Handle error for clk_enable
b3e4fcb539 net: ethernet: ti: cpts: Handle error for clk_enable
5e42f90d72 tipc: fix incorrect order of state message data sanity check
979b418b96 ethernet: Fix error handling in xemaclite_of_probe
506d61bc1b ice: Fix curr_link_speed advertised speed
852a9e97d3 ice: Rename a couple of variables
b21ffd5469 ice: Remove unnecessary checker loop
875967aff5 ice: Align macro names to the specification
8c613f7cd3 ice: stop disabling VFs due to PF error responses
d9ee2cbff2 i40e: stop disabling VFs due to PF error responses
965070a2b7 ARM: dts: aspeed: Fix AST2600 quad spi group
96b01b8541 net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate()
ed5bb00d86 drm/sun4i: mixer: Fix P010 and P210 format numbers
93223495bc qed: return status of qed_iov_get_link
5bee2ed050 esp: Fix BEET mode inter address family tunneling on GSO
16386479ef net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
33c74f8085 isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
cca9d5035b virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
a3d5fcc6cf mISDN: Fix memory leak in dsp_pipeline_build()
f97ad179d1 mISDN: Remove obsolete PIPELINE_DEBUG debugging information
2de76d37d4 tipc: fix kernel panic when enabling bearer
ea3a5e6df5 arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias
2c6a75ea32 HID: vivaldi: fix sysfs attributes leak
2a18a38cbc clk: qcom: gdsc: Add support to update GDSC transition delay
0d6882dd15 ARM: boot: dts: bcm2711: Fix HVS register range
5c5685cc64 Merge 7ae8127e41 ("arm64: Add HWCAP for self-synchronising virtual counter") into android12-5.10-lts
19787ca417 Merge b19eaa004f ("arm64: Add Cortex-A510 CPU part definition") into android12-5.10-lts
199789221d Merge fc8070a9c5 ("arm64: Add Neoverse-N2, Cortex-A710 CPU part definition") into android-mainline
f14cf58208 UPSTREAM: ARM: fix Thumb2 regression with Spectre BHB
74562af594 UPSTREAM: ARM: Spectre-BHB: provide empty stub for non-config
b0ff4e14b1 UPSTREAM: ARM: fix build warning in proc-v7-bugs.c
f3ec5e6124 UPSTREAM: ARM: Do not use NOCROSSREFS directive with ld.lld
5c1f913cd2 UPSTREAM: ARM: fix co-processor register typo
4c5218ead0 UPSTREAM: ARM: fix build error when BPF_SYSCALL is disabled
7ab81873bd Merge 302754d023 ("ARM: include unprivileged BPF status in Spectre V2 reporting") into android12-5.10-lts
d221da1d6f Merge d04937ae94 ("x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT") into android12-5.10-lts
0773736e48 Merge 5.10.104 into android12-5.10-lts
56d625a4ce ANDROID: fix up rndis ABI breakage
67c781d938 Linux 5.10.105
561e91e5fe Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE"
206c8e271b xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
39c00d0928 xen/gnttab: fix gnttab_end_foreign_access() without page specified
c4b16486d6 xen/pvcalls: use alloc/free_pages_exact()
8357d75bfd xen/9p: use alloc/free_pages_exact()
17f01b7206 xen: remove gnttab_query_foreign_access()
5f36ae75b8 xen/gntalloc: don't use gnttab_query_foreign_access()
3047255182 xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
f6690dd944 xen/netfront: don't use gnttab_query_foreign_access() for mapped status
96219af4e5 xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
3d81e85f30 xen/grant-table: add gnttab_try_end_foreign_access()
5c600371b8 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
b65b87e718 arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting
90f59cc2f2 ARM: fix build warning in proc-v7-bugs.c
551717cf3b arm64: Use the clearbhb instruction in mitigations
8c4192d126 ARM: Do not use NOCROSSREFS directive with ld.lld
38c26bdb3c KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
1749b553d7 ARM: fix co-processor register typo
e192c8baa6 arm64: Mitigate spectre style branch history side channels
a330601c63 ARM: fix build error when BPF_SYSCALL is disabled
192023e6ba KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
13a807a0a0 arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
56cf5326bd arm64: entry: Add macro for reading symbol addresses from the trampoline
1f63326a52 arm64: Add percpu vectors for EL1
3f21b7e355 arm64: entry: Add vectors that have the bhb mitigation sequences
4937955296 arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
26211252c1 arm64: entry: Allow the trampoline text to occupy multiple pages
73ee716a1f arm64: entry: Make the kpti trampoline's kpti sequence optional
8c691e5308 arm64: entry: Move trampoline macros out of ifdef'd section
e550250632 arm64: entry: Don't assume tramp_vectors is the start of the vectors
5275fb5ea5 arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
bda8960281 arm64: entry: Move the trampoline data page before the text page
d93b25a665 arm64: entry: Free up another register on kpti's tramp_exit path
7ae8127e41 arm64: Add HWCAP for self-synchronising virtual counter
b19eaa004f arm64: Add Cortex-A510 CPU part definition
fc8070a9c5 arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
5242d6971e arm64: entry: Make the trampoline cleanup optional
8617156931 arm64: Add Cortex-X2 CPU part definition
7048a21086 arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit
dc5b630c0d arm64: entry.S: Add ventry overflow sanity checks
97d8bdf331 arm64: cpufeature: add HWCAP for FEAT_RPRES
162aa002ec arm64: cpufeature: add HWCAP for FEAT_AFP
dbcfa98539 arm64: add ID_AA64ISAR2_EL1 sys register
302754d023 ARM: include unprivileged BPF status in Spectre V2 reporting
d04937ae94 x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
f3c12fc53e arm64: cputype: Add CPU implementor & types for the Apple M1 cores
3f9c958e35 ARM: Spectre-BHB workaround
cc9e3e55bd x86/speculation: Warn about Spectre v2 LFENCE mitigation
29d9b56df1 ARM: use LOADADDR() to get load address of sections
e335384560 x86/speculation: Update link to AMD speculation whitepaper
46deb22468 ARM: early traps initialisation
2fdf67a1d2 x86/speculation: Use generic retpoline by default on AMD
b7f1e73c4d ARM: report Spectre v2 status through sysfs
afc2d635b5 x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
071e8b69d7 Documentation/hw-vuln: Update spectre doc
a6a119d647 x86/speculation: Add eIBRS + Retpoline options
f38774bb6e x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
206cfe2dac x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
97581b56b5 Linux 5.10.104
dbbe09d953 hamradio: fix macro redefine warning
dcd03efd7e Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"
292e1c88b8 btrfs: add missing run of delayed items after unlink during log replay
41712c5fa5 btrfs: qgroup: fix deadlock between rescan worker and remove qgroup
6e0319e770 btrfs: fix lost prealloc extents beyond eof after full fsync
827172ffa9 tracing: Fix return value of __setup handlers
78059b1cfc tracing/histogram: Fix sorting on old "cpu" value
0e188fde82 HID: add mapping for KEY_ALL_APPLICATIONS
f276ea5035 HID: add mapping for KEY_DICTATE
3b8f2a7aed Input: samsung-keypad - properly state IOMEM dependency
a621ae6394 Input: elan_i2c - fix regulator enable count imbalance after suspend/resume
1397bbcd81 Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power()
988f4f29cc net: dcb: disable softirqs in dcbnl_flush_dev()
6828da5dea drm/amdgpu: fix suspend/resume hang regression
f5e496ef73 nl80211: Handle nla_memdup failures in handle_nan_filter
64e4305a03 iavf: Refactor iavf state machine tracking
e6bc597fbc net: chelsio: cxgb3: check the return value of pci_find_capability()
320980b249 ibmvnic: complete init_done on transport events
86027004bb ARM: tegra: Move panels to AUX bus
fbb810825a soc: fsl: qe: Check of ioremap return value
2824f6939e soc: fsl: guts: Add a missing memory allocation failure check
3afe488d5c soc: fsl: guts: Revert commit 3c0d64e867
4470913079 ARM: dts: Use 32KiHz oscillator on devkit8000
298f6fae54 ARM: dts: switch timer config to common devkit8000 devicetree
8b20c1999d s390/extable: fix exception table sorting
49aa9c9c7f memfd: fix F_SEAL_WRITE after shmem huge page allocated
6acbc88752 ibmvnic: free reset-work-item when flushing
9d8a11d74d igc: igc_write_phy_reg_gpy: drop premature return
223744f521 pinctrl: sunxi: Use unique lockdep classes for IRQs
2851b76e5f selftests: mlxsw: tc_police_scale: Make test more robust
85bf489c5c ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions
6b63410490 ARM: Fix kgdb breakpoint for Thumb2
fefe4cb4a6 igc: igc_read_phy_reg_gpy: drop premature return
0632854fb1 arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output
43eaf1b178 can: gs_usb: change active_channels's type from atomic_t to u8
daaed6ced8 ASoC: cs4265: Fix the duplicated control name
8b8ac465bf firmware: arm_scmi: Remove space in MODULE_ALIAS name
667df6fe3e efivars: Respect "block" flag in efivar_entry_set_safe()
283c37e542 ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc()
5f394102ee net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
92b791771a ibmvnic: register netdev after init of adapter
6e0f986032 net: sxgbe: fix return value of __setup handler
e1a82db1eb iavf: Fix missing check for running netdev
c9a066fe45 mac80211: treat some SAE auth steps as final
e6d7f57f91 net: stmmac: fix return value of __setup handler
fa65989a48 mac80211: fix forwarded mesh frames AC & queue selection
dcc3423c1d ia64: ensure proper NUMA distance and possible map initialization
1312ef5ad0 sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa()
d753aecb3d sched/topology: Make sched_init_numa() use a set for the deduplicating sort
05ae1f0fe9 ice: fix concurrent reset and removal of VFs
41edeeaae5 ice: Fix race conditions between virtchnl handling and VF ndo ops
0c145262ac rcu/nocb: Fix missed nocb_timer requeue
9bb7237cc7 net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server
d7eb662625 net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client
2e8d465b83 net/smc: fix connection leak
6a8a4dc2a2 net: dcb: flush lingering app table entries for unregistered devices
f4c63b24de net: ipv6: ensure we call ipv6_mc_down() at most once
a9c4a74ad5 batman-adv: Don't expect inter-netns unique iflink indices
3dae11d21f batman-adv: Request iflink once in batadv_get_real_netdevice
dcf10d78ff batman-adv: Request iflink once in batadv-on-batadv check
81f817f3e5 netfilter: nf_queue: handle socket prefetch
4d05239203 netfilter: nf_queue: fix possible use-after-free
3b9ba964f7 netfilter: nf_queue: don't assume sk is full socket
4e178ed14b net: fix up skbs delta_truesize in UDP GRO frag_list
eb5e444fe3 e1000e: Correct NVM checksum verification flow
b53d4bfd1a xfrm: enforce validity of offload input flags
2f0e6d80e8 xfrm: fix the if_id check in changelink
24efaae03b bpf, sockmap: Do not ignore orig_len parameter
8b0142c414 netfilter: fix use-after-free in __nf_register_net_hook()
4952faa77d xfrm: fix MTU regression
e93f2be33d mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls
912186db09 ntb: intel: fix port config status offset for SPR
1c0b51e62a thermal: core: Fix TZ_GET_TRIP NULL pointer dereference
a1753d5c29 xen/netfront: destroy queues before real_num_tx_queues is zeroed
ce41d80391 drm/i915: s/JSP2/ICP2/ PCH
61a895da48 iommu/amd: Recover from event log overflow
6951a58881 ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
dd9dd24fd7 riscv: Fix config KASAN && DEBUG_VIRTUAL
7211aab288 riscv: Fix config KASAN && SPARSEMEM && !SPARSE_VMEMMAP
00fb385f0a riscv/efi_stub: Fix get_boot_hartid_from_fdt() return value
336872601c ALSA: intel_hdmi: Fix reference to PCM buffer address
e57dfaf66f tracing: Add ustring operation to filtering string pointers
4a9d2390f3 drm/amdgpu: check vm ready by amdgpu_vm->evicting flag
67e25eb1b4 ata: pata_hpt37x: fix PCI clock detection
335f11ff74 serial: stm32: prevent TDR register overwrite when sending x_char
c999c5927e tracing: Add test for user space strings when filtering on string pointers
db36a94ed6 exfat: fix i_blocks for files truncated over 4 GiB
1b810d5cb6 exfat: reuse exfat_inode_info variable instead of calling EXFAT_I()
fdd64084e4 usb: gadget: clear related members when goto fail
c13159a588 usb: gadget: don't release an existing dev->buf
00d5ac05af net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990
16f903afba i2c: qup: allow COMPILE_TEST
57c333ad8c i2c: cadence: allow COMPILE_TEST
9d6285e632 dmaengine: shdma: Fix runtime PM imbalance on error
37b06d5ebf selftests/seccomp: Fix seccomp failure by adding missing headers
df9db1a2af cifs: fix double free race when mount fails in cifs_get_root()
e3850e211d tipc: fix a bit overflow in tipc_crypto_key_rcv()
6d4985b8a0 KVM: arm64: vgic: Read HW interrupt pending state from the HW
5d4b00e053 Input: clear BTN_RIGHT/MIDDLE on buttonpads
6e7015d982 regulator: core: fix false positive in regulator_late_cleanup()
467d664e5f ASoC: rt5682: do not block workqueue if card is unbound
0b050b7a0d ASoC: rt5668: do not block workqueue if card is unbound
11956c6eeb i2c: bcm2835: Avoid clock stretching timeouts
13f0ea8d11 mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work
46f6d66219 mac80211_hwsim: report NOACK frames in tx_status
d172937367 Merge 5.10.103 into android12-5.10-lts
915a747ac7 Linux 5.10.103
78706b051a memblock: use kfree() to release kmalloced memblock regions
4185b788d3 gpio: tegra186: Fix chip_data type confusion
bb2e0a7723 tty: n_gsm: fix deadlock in gsmtty_open()
e4c8cb95d0 tty: n_gsm: fix wrong tty control line for flow control
1f0641dd0b tty: n_gsm: fix NULL pointer access due to DLCI release
1e35cb9e12 tty: n_gsm: fix proper link termination after failed open
90b47e617f tty: n_gsm: fix encoding of control signal octet bit DV
9e2dbc31e3 riscv: fix oops caused by irqsoff latency tracer
e098933866 thermal: int340x: fix memory leak in int3400_notify()
5b1cef5798 RDMA/cma: Do not change route.addr.src_addr outside state checks
8fe4da5524 driver core: Free DMA range map when device is released
2148247643 xhci: Prevent futile URB re-submissions due to incorrect return value.
0b0a229da1 xhci: re-initialize the HC during resume if HCE was set
328faee6d4 usb: dwc3: gadget: Let the interrupt handler disable bottom halves.
e57bdee866 usb: dwc3: pci: Fix Bay Trail phy GPIO mappings
99b2425d91 usb: dwc2: drd: fix soft connect when gadget is unconfigured
c786688037 USB: serial: option: add Telit LE910R1 compositions
220ba174f1 USB: serial: option: add support for DW5829e
3a1dd56e56 tracefs: Set the group ownership in apply_options() not parse_options()
bfa8ffbaaa USB: gadget: validate endpoint index for xilinx udc
4ce247af3f usb: gadget: rndis: add spinlock for rndis response list
ddc254fc88 Revert "USB: serial: ch341: add new Product ID for CH341A"
d3fce1b6bd ata: pata_hpt37x: disable primary channel on HPT371
18701d8afa sc16is7xx: Fix for incorrect data being transmitted
d5ddd7343a iio: Fix error handling for PM
eabcc609cb iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot
b8d411a962 iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits
1aa12ecfdc iio: adc: men_z188_adc: Fix a resource leak in an error handling path
afbeee13be tracing: Have traceon and traceoff trigger honor the instance
99eb8d6941 RDMA/ib_srp: Fix a deadlock
a7ab53d3c2 configfs: fix a race in configfs_{,un}register_subsystem()
0ecd3e35d7 RDMA/rtrs-clt: Move free_permit from free_clt to rtrs_clt_close
b0ecf9e594 RDMA/rtrs-clt: Kill wait_for_inflight_permits
8260f1800f RDMA/rtrs-clt: Fix possible double free in error case
dc64aa4c7d regmap-irq: Update interrupt clear register for proper reset
2efece1368 spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()
67819b983e net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets
be55d3e76c net/mlx5: Fix wrong limitation of metadata match on ecpf
8d617110d7 net/mlx5: Fix possible deadlock on rule deletion
1c59128955 udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()
a184f4dd9b surface: surface3_power: Fix battery readings on batteries without a serial number
91f56a8527 net/smc: Use a mutex for locking "struct smc_pnettable"
7e9880e81d netfilter: nf_tables: fix memory leak during stateful obj update
af4bc921d3 nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()
58a6d5f24f net: Force inlining of checksum functions in net/checksum.h
550d98ab30 net: ll_temac: check the return value of devm_kmalloc()
0fc1847359 net/sched: act_ct: Fix flow table lookup after ct clear or switching zones
bc8f768af3 net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
fd020eaaa2 drm/edid: Always set RGB444
1df9d552fe openvswitch: Fix setting ipv6 fields causing hw csum failure
dac2490d9e gso: do not skip outer ip header in case of ipip and net_failover
b692d5dc6f tipc: Fix end of loop tests for list_for_each_entry()
c5722243d0 net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
4a93c65946 io_uring: add a schedule point in io_add_buffers()
7ef94bfb08 bpf: Add schedule points in batch ops
4f5d47e6b4 selftests: bpf: Check bpf_msg_push_data return value
d0caa7218d bpf: Do not try bpf_msg_push_data with len 0
962b2a3188 hwmon: Handle failure to register sensor with thermal zone correctly
d8b78314c5 bnxt_en: Fix active FEC reporting to ethtool
7e1eae5d1a bnx2x: fix driver load from initrd
51e96061c6 perf data: Fix double free in perf_session__delete()
5419b5be88 ping: remove pr_err from ping_lookup
5da17865c7 optee: use driver internal tee_context for some rpc
eb35461384 tee: export teedev_open() and teedev_close_context()
bae7fc6f0d x86/fpu: Correct pkru/xstate inconsistency
68f19845f5 netfilter: nf_tables_offload: incorrect flow offload action array size
69560efa00 CDC-NCM: avoid overflow in sanity checking
2aeba1ea7c USB: zaurus: support another broken Zaurus
4f5f5411f0 sr9700: sanity check for packet length
55eec5c630 drm/i915: Correctly populate use_sagv_wm for all pipes
ff9134882d drm/amdgpu: disable MMHUB PG for Picasso
72fdfc75d4 KVM: x86/mmu: make apf token non-zero to fix bug
646b532f32 parisc/unaligned: Fix ldw() and stw() unalignment handlers
397b5433f7 parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel
698dc7d13c vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
84e303b4d5 clk: jz4725b: fix mmc0 clock gating
72a5b01875 btrfs: tree-checker: check item_size for dev_item
5c967dd073 btrfs: tree-checker: check item_size for inode_item
fcec42dd28 cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
e1b86e7f5c Merge branch 'android12-5.10' into `android12-5.10-lts`
cbfab5c59c Revert "ipv6: per-netns exclusive flowlabel checks"
79553fad5c Merge 5.10.102 into android12-5.10-lts
47667effb7 Linux 5.10.102
6062d1267f lockdep: Correct lock_classes index mapping
f333c1916f i2c: brcmstb: fix support for DSL and CM variants
9fee985f9a copy_process(): Move fd_install() out of sighand->siglock critical section
e3fdbc40b7 i2c: qcom-cci: don't put a device tree node before i2c_add_adapter()
b5b2a92117 i2c: qcom-cci: don't delete an unregistered adapter
3b6d25d1b6 dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
2c35c95d36 dmaengine: stm32-dmamux: Fix PM disable depth imbalance in stm32_dmamux_probe
4f907b6eb7 dmaengine: sh: rcar-dmac: Check for error num after setting mask
797b380f07 net: sched: limit TC_ACT_REPEAT loops
595c259f75 EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
f6ce4e3289 scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop
3680b2b810 kconfig: fix failing to generate auto.conf
b6787e284d net: macb: Align the dma and coherent dma masks
439171a291 net: usb: qmi_wwan: Add support for Dell DW5829e
15616ba17d tracing: Fix tp_printk option related with tp_printk_stop_on_boot
5a253a23d9 drm/rockchip: dw_hdmi: Do not leave clock enabled in error case
1e7433fb95 xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
a21f472fb5 soc: aspeed: lpc-ctrl: Block error printing on probe defer cases
fecb05b1ce ata: libata-core: Disable TRIM on M88V29
b19ec7afa9 lib/iov_iter: initialize "flags" in new pipe_buffer
3045532278 kconfig: let 'shell' return enough output for deep path names
e05dde47f5 selftests: fixup build warnings in pidfd / clone3 tests
531a56c2e0 pidfd: fix test failure due to stack overflow on some arches
429ef36c4f arm64: dts: meson-g12: drop BL32 region from SEI510/SEI610
1415f22ee5 arm64: dts: meson-g12: add ATF BL32 reserved-memory region
605080f19e arm64: dts: meson-gx: add ATF BL32 reserved-memory region
eefb68794f netfilter: conntrack: don't refresh sctp entries in closed state
1ab4824857 irqchip/sifive-plic: Add missing thead,c900-plic match string
98bc06c46d phy: usb: Leave some clocks running during suspend
717f2fa858 ARM: OMAP2+: adjust the location of put_device() call in omapdss_init_of
6932353af7 ARM: OMAP2+: hwmod: Add of_node_put() before break
521dcc107e NFS: Don't set NFS_INO_INVALID_XATTR if there is no xattr cache
fb00319afb KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
0ee4bb8ce8 KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a perf event
99cd2a0437 KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
91d8866ca5 Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
a176d559e8 mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
1a49b1b0b0 mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
8c848744c1 tty: n_tty: do not look ahead for EOL character past the end of the buffer
8daa0436ce NFS: Do not report writeback errors in nfs_getattr()
f9b7385c0f NFS: LOOKUP_DIRECTORY is also ok with symlinks
598dbaf74b block/wbt: fix negative inflight counter when remove scsi device
dc6faa0ede ASoC: tas2770: Insert post reset delay
9dcedbe943 KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
a4eeeaca50 mtd: rawnand: gpmi: don't leak PM reference in error path
fb26219b40 powerpc/lib/sstep: fix 'ptesync' build error
54f76366cd ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
0df1badfdf ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
1ef76832fe ALSA: hda: Fix missing codec probe on Shenker Dock 15
c72c3b597a ALSA: hda: Fix regression on forced probe mask option
63b1602c2f ALSA: hda/realtek: Fix deadlock by COEF mutex
b6a5e8f45f ALSA: hda/realtek: Add quirk for Legion Y9000X 2019
67de71b943 selftests/exec: Add non-regular to TEST_GEN_PROGS
d3018a1962 perf bpf: Defer freeing string after possible strlen() on it
016e3ca9c5 dpaa2-eth: Initialize mutex used in one step timestamping path
50f3b00d4c libsubcmd: Fix use-after-free for realloc(..., 0)
ffa8df4f0e bonding: fix data-races around agg_select_timer
d9bd9d4c60 net_sched: add __rcu annotation to netdev->qdisc
877a05672f drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
a0e004e620 bonding: force carrier update when releasing slave
8dec3c4e73 ping: fix the dif and sdif check in ping_lookup
6793a9b028 net: ieee802154: ca8210: Fix lifs/sifs periods
f48bd34137 net: dsa: lantiq_gswip: fix use after free in gswip_remove()
d9b2203e5a net: dsa: lan9303: fix reset on probe
4f523f15e5 ipv6: per-netns exclusive flowlabel checks
100344200a netfilter: nft_synproxy: unregister hooks on init error path
26931971db selftests: netfilter: fix exit value for nft_concat_range
b26ea3f6b7 iwlwifi: pcie: gen2: fix locking when "HW not ready"
8867f99379 iwlwifi: pcie: fix locking when "HW not ready"
f3c1910257 drm/i915/gvt: Make DRM_I915_GVT depend on X86
87cd1bbd66 vsock: remove vsock from connected table when connect is interrupted by a signal
eb7bf11e8e drm/i915/opregion: check port number bounds for SWSCI display power state
5564d83ebc drm/radeon: Fix backlight control on iMac 12,1
008508c16a iwlwifi: fix use-after-free
44b81136e8 kbuild: lto: Merge module sections if and only if CONFIG_LTO_CLANG is enabled
8b53e5f737 kbuild: lto: merge module sections
45102b538a random: wake up /dev/random writers after zap
143aaf79ba gcc-plugins/stackleak: Use noinstr in favor of notrace
de55891e16 Revert "module, async: async_synchronize_full() on module init iff async is used"
3c958dbcba x86/Xen: streamline (and fix) PV CPU enumeration
e76d0a9692 drm/amdgpu: fix logic inversion in check
324f5bdc52 nvme-rdma: fix possible use-after-free in transport error_recovery work
e192184cf8 nvme-tcp: fix possible use-after-free in transport error_recovery work
0ead57ceb2 nvme: fix a possible use-after-free in controller reset during load
fe9ac3eaa2 scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
d872e7b5fe scsi: pm8001: Fix use-after-free for aborted TMF sas_task
1e73f5cfc1 quota: make dquot_quota_sync return errors from ->sync_fs
c405640aad vfs: make freeze_super abort when sync_filesystem returns error
b9a229fd48 ax25: improve the incomplete fix to avoid UAF and NPD bugs
139fce2992 selftests: skip mincore.check_file_mmap when fs lacks needed support
204a2390da selftests: openat2: Skip testcases that fail with EOPNOTSUPP
2be48bfac7 selftests: openat2: Add missing dependency in Makefile
74a30666b4 selftests: openat2: Print also errno in failure messages
bfc84cfd90 selftests/zram: Adapt the situation that /dev/zram0 is being used
f0eba714c1 selftests/zram01.sh: Fix compression ratio calculation
7bb704b69f selftests/zram: Skip max_comp_streams interface on newer kernel
0fd484644c net: ieee802154: at86rf230: Stop leaking skb's
0c18a75193 kselftest: signal all child processes
1136141f19 selftests: rtc: Increase test timeout so that all tests run
79175b6ee6 platform/x86: ISST: Fix possible circular locking dependency detected
066c905ed0 platform/x86: touchscreen_dmi: Add info for the RWC NANOTE P8 AY07J 2-in-1
0b17d4b51c btrfs: send: in case of IO error log it
78a68bbebd parisc: Add ioread64_lo_hi() and iowrite64_lo_hi()
ade1077c7f PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology
254090925e mm: don't try to NUMA-migrate COW pages that have other uses
ab2b4e65a1 mmc: block: fix read single on recovery logic
7756716872 parisc: Fix sglist access in ccio-dma.c
f8f519d7df parisc: Fix data TLB miss in sba_unmap_sg
4d569b959e parisc: Drop __init from map_pages declaration
8e3f9a098e serial: parisc: GSC: fix build when IOSAPIC is not set
fe383750d4 Revert "svm: Add warning message for AVIC IPI invalid target"
126382b556 HID:Add support for UGTABLET WP5540
f100e758ce scsi: lpfc: Fix mailbox command failure during driver initialization
4578b979ef can: isotp: add SF_BROADCAST support for functional addressing
5d42865fc3 can: isotp: prevent race between isotp_bind() and isotp_setsockopt()
db3f3636e4 fs/proc: task_mmu.c: don't read mapcount for migration entry
0849f83e47 fget: clarify and improve __fget_files() implementation
657991fb06 rcu: Do not report strict GPs for outgoing CPUs
8c8385972e mm: memcg: synchronize objcg lists with a dedicated spinlock
d0f4aa2d97 drm/nouveau/pmu/gm200-: use alternate falcon reset sequence
add227a8d8 Merge branch 'android12-5.10' into `android12-5.10-lts`

The .xml abi file was also updated due to changes required from the -lts
branch that were merged there:

Leaf changes summary: 1 artifact changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

'struct snd_pcm_runtime at pcm.h:344:1' changed:
  type size changed from 6144 to 6592 (in bits)
  2 data member insertions:
    'mutex buffer_mutex', at offset 6144 (in bits) at pcm.h:432:1
    'atomic_t buffer_accessing', at offset 6528 (in bits) at pcm.h:433:1
  114 impacted interfaces

Change-Id: Ie9262400472eda3e30d1ef26738df1d5dd4c319d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

kernel/async.c

@@ -205,9 +205,6 @@ async_cookie_t async_schedule_node_domain(async_func_t func, void *data,
 	atomic_inc(&entry_count);
 	spin_unlock_irqrestore(&async_lock, flags);
 
-	/* mark that this task has queued an async job, used by module init */
-	current->flags |= PF_USED_ASYNC;
-
 	/* schedule for execution */
 	queue_work_node(node, system_unbound_wq, &entry->work);
 

kernel/audit.h

@@ -191,6 +191,10 @@ struct audit_context {
 		struct {
 			char			*name;
 		} module;
+		struct {
+			struct audit_ntp_data	ntp_data;
+			struct timespec64	tk_injoffset;
+		} time;
 	};
 	int fds[2];
 	struct audit_proctitle proctitle;

kernel/auditsc.c

@@ -1214,6 +1214,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
 			 from_kuid(&init_user_ns, name->fcap.rootid));
 }
 
+static void audit_log_time(struct audit_context *context, struct audit_buffer **ab)
+{
+	const struct audit_ntp_data *ntp = &context->time.ntp_data;
+	const struct timespec64 *tk = &context->time.tk_injoffset;
+	static const char * const ntp_name[] = {
+		"offset",
+		"freq",
+		"status",
+		"tai",
+		"tick",
+		"adjust",
+	};
+	int type;
+
+	if (context->type == AUDIT_TIME_ADJNTPVAL) {
+		for (type = 0; type < AUDIT_NTP_NVALS; type++) {
+			if (ntp->vals[type].newval != ntp->vals[type].oldval) {
+				if (!*ab) {
+					*ab = audit_log_start(context,
+							GFP_KERNEL,
+							AUDIT_TIME_ADJNTPVAL);
+					if (!*ab)
+						return;
+				}
+				audit_log_format(*ab, "op=%s old=%lli new=%lli",
+						 ntp_name[type],
+						 ntp->vals[type].oldval,
+						 ntp->vals[type].newval);
+				audit_log_end(*ab);
+				*ab = NULL;
+			}
+		}
+	}
+	if (tk->tv_sec != 0 || tk->tv_nsec != 0) {
+		if (!*ab) {
+			*ab = audit_log_start(context, GFP_KERNEL,
+					      AUDIT_TIME_INJOFFSET);
+			if (!*ab)
+				return;
+		}
+		audit_log_format(*ab, "sec=%lli nsec=%li",
+				 (long long)tk->tv_sec, tk->tv_nsec);
+		audit_log_end(*ab);
+		*ab = NULL;
+	}
+}
+
 static void show_special(struct audit_context *context, int *call_panic)
 {
 	struct audit_buffer *ab;
@@ -1319,6 +1366,11 @@ static void show_special(struct audit_context *context, int *call_panic)
 			audit_log_format(ab, "(null)");
 
 		break;
+	case AUDIT_TIME_ADJNTPVAL:
+	case AUDIT_TIME_INJOFFSET:
+		/* this call deviates from the rest, eating the buffer */
+		audit_log_time(context, &ab);
+		break;
 	}
 	audit_log_end(ab);
 }
@@ -2560,31 +2612,26 @@ void __audit_fanotify(unsigned int response)
 
 void __audit_tk_injoffset(struct timespec64 offset)
 {
-	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET,
-		  "sec=%lli nsec=%li",
-		  (long long)offset.tv_sec, offset.tv_nsec);
-}
+	struct audit_context *context = audit_context();
 
-static void audit_log_ntp_val(const struct audit_ntp_data *ad,
-			      const char *op, enum audit_ntp_type type)
-{
-	const struct audit_ntp_val *val = &ad->vals[type];
-
-	if (val->newval == val->oldval)
-		return;
-
-	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL,
-		  "op=%s old=%lli new=%lli", op, val->oldval, val->newval);
+	/* only set type if not already set by NTP */
+	if (!context->type)
+		context->type = AUDIT_TIME_INJOFFSET;
+	memcpy(&context->time.tk_injoffset, &offset, sizeof(offset));
 }
 
 void __audit_ntp_log(const struct audit_ntp_data *ad)
 {
-	audit_log_ntp_val(ad, "offset",	AUDIT_NTP_OFFSET);
-	audit_log_ntp_val(ad, "freq",	AUDIT_NTP_FREQ);
-	audit_log_ntp_val(ad, "status",	AUDIT_NTP_STATUS);
-	audit_log_ntp_val(ad, "tai",	AUDIT_NTP_TAI);
-	audit_log_ntp_val(ad, "tick",	AUDIT_NTP_TICK);
-	audit_log_ntp_val(ad, "adjust",	AUDIT_NTP_ADJUST);
+	struct audit_context *context = audit_context();
+	int type;
+
+	for (type = 0; type < AUDIT_NTP_NVALS; type++)
+		if (ad->vals[type].newval != ad->vals[type].oldval) {
+			/* unconditionally set type, overwriting TK */
+			context->type = AUDIT_TIME_ADJNTPVAL;
+			memcpy(&context->time.ntp_data, ad, sizeof(*ad));
+			break;
+		}
 }
 
 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,

kernel/bpf/stackmap.c

@@ -358,7 +358,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
 }
 
 static struct perf_callchain_entry *
-get_callchain_entry_for_task(struct task_struct *task, u32 init_nr)
+get_callchain_entry_for_task(struct task_struct *task, u32 max_depth)
 {
 #ifdef CONFIG_STACKTRACE
 	struct perf_callchain_entry *entry;
@@ -369,9 +369,8 @@ get_callchain_entry_for_task(struct task_struct *task, u32 init_nr)
 	if (!entry)
 		return NULL;
 
-	entry->nr = init_nr +
-		stack_trace_save_tsk(task, (unsigned long *)(entry->ip + init_nr),
-				     sysctl_perf_event_max_stack - init_nr, 0);
+	entry->nr = stack_trace_save_tsk(task, (unsigned long *)entry->ip,
+					 max_depth, 0);
 
 	/* stack_trace_save_tsk() works on unsigned long array, while
 	 * perf_callchain_entry uses u64 array. For 32-bit systems, it is
@@ -383,7 +382,7 @@ get_callchain_entry_for_task(struct task_struct *task, u32 init_nr)
 		int i;
 
 		/* copy data from the end to avoid using extra buffer */
-		for (i = entry->nr - 1; i >= (int)init_nr; i--)
+		for (i = entry->nr - 1; i >= 0; i--)
 			to[i] = (u64)(from[i]);
 	}
 
@@ -400,27 +399,19 @@ static long __bpf_get_stackid(struct bpf_map *map,
 {
 	struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
 	struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
-	u32 max_depth = map->value_size / stack_map_data_size(map);
-	/* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */
-	u32 init_nr = sysctl_perf_event_max_stack - max_depth;
 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
 	u32 hash, id, trace_nr, trace_len;
 	bool user = flags & BPF_F_USER_STACK;
 	u64 *ips;
 	bool hash_matches;
 
-	/* get_perf_callchain() guarantees that trace->nr >= init_nr
-	 * and trace-nr <= sysctl_perf_event_max_stack, so trace_nr <= max_depth
-	 */
-	trace_nr = trace->nr - init_nr;
-
-	if (trace_nr <= skip)
+	if (trace->nr <= skip)
 		/* skipping more than usable stack trace */
 		return -EFAULT;
 
-	trace_nr -= skip;
+	trace_nr = trace->nr - skip;
 	trace_len = trace_nr * sizeof(u64);
-	ips = trace->ip + skip + init_nr;
+	ips = trace->ip + skip;
 	hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
 	id = hash & (smap->n_buckets - 1);
 	bucket = READ_ONCE(smap->buckets[id]);
@@ -477,8 +468,7 @@ BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
 	   u64, flags)
 {
 	u32 max_depth = map->value_size / stack_map_data_size(map);
-	/* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */
-	u32 init_nr = sysctl_perf_event_max_stack - max_depth;
+	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
 	bool user = flags & BPF_F_USER_STACK;
 	struct perf_callchain_entry *trace;
 	bool kernel = !user;
@@ -487,8 +477,12 @@ BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
 			       BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
 		return -EINVAL;
 
-	trace = get_perf_callchain(regs, init_nr, kernel, user,
-				   sysctl_perf_event_max_stack, false, false);
+	max_depth += skip;
+	if (max_depth > sysctl_perf_event_max_stack)
+		max_depth = sysctl_perf_event_max_stack;
+
+	trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
+				   false, false);
 
 	if (unlikely(!trace))
 		/* couldn't fetch the stack trace */
@@ -579,7 +573,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 			    struct perf_callchain_entry *trace_in,
 			    void *buf, u32 size, u64 flags)
 {
-	u32 init_nr, trace_nr, copy_len, elem_size, num_elem;
+	u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
 	bool user_build_id = flags & BPF_F_USER_BUILD_ID;
 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
 	bool user = flags & BPF_F_USER_STACK;
@@ -604,30 +598,28 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 		goto err_fault;
 
 	num_elem = size / elem_size;
-	if (sysctl_perf_event_max_stack < num_elem)
-		init_nr = 0;
-	else
-		init_nr = sysctl_perf_event_max_stack - num_elem;
+	max_depth = num_elem + skip;
+	if (sysctl_perf_event_max_stack < max_depth)
+		max_depth = sysctl_perf_event_max_stack;
 
 	if (trace_in)
 		trace = trace_in;
 	else if (kernel && task)
-		trace = get_callchain_entry_for_task(task, init_nr);
+		trace = get_callchain_entry_for_task(task, max_depth);
 	else
-		trace = get_perf_callchain(regs, init_nr, kernel, user,
-					   sysctl_perf_event_max_stack,
+		trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
 					   false, false);
 	if (unlikely(!trace))
 		goto err_fault;
 
-	trace_nr = trace->nr - init_nr;
-	if (trace_nr < skip)
+	if (trace->nr < skip)
 		goto err_fault;
 
-	trace_nr -= skip;
+	trace_nr = trace->nr - skip;
 	trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
 	copy_len = trace_nr * elem_size;
-	ips = trace->ip + skip + init_nr;
+
+	ips = trace->ip + skip;
 	if (user && user_build_id)
 		stack_map_get_build_id_offset(buf, ips, trace_nr, user);
 	else

kernel/bpf/syscall.c

@@ -1310,6 +1310,7 @@ int generic_map_delete_batch(struct bpf_map *map,
 		maybe_wait_bpf_programs(map);
 		if (err)
 			break;
+		cond_resched();
 	}
 	if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
 		err = -EFAULT;
@@ -1367,6 +1368,7 @@ int generic_map_update_batch(struct bpf_map *map,
 
 		if (err)
 			break;
+		cond_resched();
 	}
 
 	if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
@@ -1464,6 +1466,7 @@ int generic_map_lookup_batch(struct bpf_map *map,
 		swap(prev_key, key);
 		retry = MAP_LOOKUP_RETRIES;
 		cp++;
+		cond_resched();
 	}
 
 	if (err == -EFAULT)

kernel/cgroup/cgroup-internal.h

@@ -65,6 +65,25 @@ static inline struct cgroup_fs_context *cgroup_fc2context(struct fs_context *fc)
 	return container_of(kfc, struct cgroup_fs_context, kfc);
 }
 
+struct cgroup_pidlist;
+
+struct cgroup_file_ctx {
+	struct cgroup_namespace	*ns;
+
+	struct {
+		void			*trigger;
+	} psi;
+
+	struct {
+		bool			started;
+		struct css_task_iter	iter;
+	} procs;
+
+	struct {
+		struct cgroup_pidlist	*pidlist;
+	} procs1;
+};
+
 /*
  * A cgroup can be associated with multiple css_sets as different tasks may
  * belong to different cgroups on different hierarchies.  In the other

kernel/cgroup/cgroup-v1.c

@@ -394,6 +394,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 	 * next pid to display, if any
 	 */
 	struct kernfs_open_file *of = s->private;
+	struct cgroup_file_ctx *ctx = of->priv;
 	struct cgroup *cgrp = seq_css(s)->cgroup;
 	struct cgroup_pidlist *l;
 	enum cgroup_filetype type = seq_cft(s)->private;
@@ -403,25 +404,24 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 	mutex_lock(&cgrp->pidlist_mutex);
 
 	/*
-	 * !NULL @of->priv indicates that this isn't the first start()
-	 * after open.  If the matching pidlist is around, we can use that.
-	 * Look for it.  Note that @of->priv can't be used directly.  It
-	 * could already have been destroyed.
+	 * !NULL @ctx->procs1.pidlist indicates that this isn't the first
+	 * start() after open. If the matching pidlist is around, we can use
+	 * that. Look for it. Note that @ctx->procs1.pidlist can't be used
+	 * directly. It could already have been destroyed.
 	 */
-	if (of->priv)
-		of->priv = cgroup_pidlist_find(cgrp, type);
+	if (ctx->procs1.pidlist)
+		ctx->procs1.pidlist = cgroup_pidlist_find(cgrp, type);
 
 	/*
 	 * Either this is the first start() after open or the matching
 	 * pidlist has been destroyed inbetween.  Create a new one.
 	 */
-	if (!of->priv) {
-		ret = pidlist_array_load(cgrp, type,
-					 (struct cgroup_pidlist **)&of->priv);
+	if (!ctx->procs1.pidlist) {
+		ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist);
 		if (ret)
 			return ERR_PTR(ret);
 	}
-	l = of->priv;
+	l = ctx->procs1.pidlist;
 
 	if (pid) {
 		int end = l->length;
@@ -449,7 +449,8 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 {
 	struct kernfs_open_file *of = s->private;
-	struct cgroup_pidlist *l = of->priv;
+	struct cgroup_file_ctx *ctx = of->priv;
+	struct cgroup_pidlist *l = ctx->procs1.pidlist;
 
 	if (l)
 		mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork,
@@ -460,7 +461,8 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v)
 static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
 {
 	struct kernfs_open_file *of = s->private;
-	struct cgroup_pidlist *l = of->priv;
+	struct cgroup_file_ctx *ctx = of->priv;
+	struct cgroup_pidlist *l = ctx->procs1.pidlist;
 	pid_t *p = v;
 	pid_t *end = l->list + l->length;
 	/*
@@ -545,6 +547,7 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
 					  char *buf, size_t nbytes, loff_t off)
 {
 	struct cgroup *cgrp;
+	struct cgroup_file_ctx *ctx;
 
 	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
 
@@ -552,8 +555,9 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
 	 * Release agent gets called with all capabilities,
 	 * require capabilities to set release agent.
 	 */
-	if ((of->file->f_cred->user_ns != &init_user_ns) ||
-	    !capable(CAP_SYS_ADMIN))
+	ctx = of->priv;
+	if ((ctx->ns->user_ns != &init_user_ns) ||
+	    !file_ns_capable(of->file, &init_user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 
 	cgrp = cgroup_kn_lock_live(of->kn, false);

kernel/cgroup/cgroup.c

@@ -3617,6 +3617,7 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v)
 static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf,
 					  size_t nbytes, enum psi_res res)
 {
+	struct cgroup_file_ctx *ctx = of->priv;
 	struct psi_trigger *new;
 	struct cgroup *cgrp;
 	struct psi_group *psi;
@@ -3629,7 +3630,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf,
 	cgroup_kn_unlock(of->kn);
 
 	/* Allow only one trigger per file descriptor */
-	if (of->priv) {
+	if (ctx->psi.trigger) {
 		cgroup_put(cgrp);
 		return -EBUSY;
 	}
@@ -3641,7 +3642,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf,
 		return PTR_ERR(new);
 	}
 
-	smp_store_release(&of->priv, new);
+	smp_store_release(&ctx->psi.trigger, new);
 	cgroup_put(cgrp);
 
 	return nbytes;
@@ -3671,12 +3672,15 @@ static ssize_t cgroup_cpu_pressure_write(struct kernfs_open_file *of,
 static __poll_t cgroup_pressure_poll(struct kernfs_open_file *of,
 					  poll_table *pt)
 {
-	return psi_trigger_poll(&of->priv, of->file, pt);
+	struct cgroup_file_ctx *ctx = of->priv;
+	return psi_trigger_poll(&ctx->psi.trigger, of->file, pt);
 }
 
 static void cgroup_pressure_release(struct kernfs_open_file *of)
 {
-	psi_trigger_destroy(of->priv);
+	struct cgroup_file_ctx *ctx = of->priv;
+
+	psi_trigger_destroy(ctx->psi.trigger);
 }
 
 bool cgroup_psi_enabled(void)
@@ -3729,24 +3733,43 @@ static ssize_t cgroup_freeze_write(struct kernfs_open_file *of,
 static int cgroup_file_open(struct kernfs_open_file *of)
 {
 	struct cftype *cft = of->kn->priv;
+	struct cgroup_file_ctx *ctx;
+	int ret;
 
-	if (cft->open)
-		return cft->open(of);
-	return 0;
+	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	ctx->ns = current->nsproxy->cgroup_ns;
+	get_cgroup_ns(ctx->ns);
+	of->priv = ctx;
+
+	if (!cft->open)
+		return 0;
+
+	ret = cft->open(of);
+	if (ret) {
+		put_cgroup_ns(ctx->ns);
+		kfree(ctx);
+	}
+	return ret;
 }
 
 static void cgroup_file_release(struct kernfs_open_file *of)
 {
 	struct cftype *cft = of->kn->priv;
+	struct cgroup_file_ctx *ctx = of->priv;
 
 	if (cft->release)
 		cft->release(of);
+	put_cgroup_ns(ctx->ns);
+	kfree(ctx);
 }
 
 static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
 				 size_t nbytes, loff_t off)
 {
-	struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
+	struct cgroup_file_ctx *ctx = of->priv;
 	struct cgroup *cgrp = of->kn->parent->priv;
 	struct cftype *cft = of->kn->priv;
 	struct cgroup_subsys_state *css;
@@ -3763,7 +3786,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
 	 */
 	if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) &&
 	    !(cft->flags & CFTYPE_NS_DELEGATABLE) &&
-	    ns != &init_cgroup_ns && ns->root_cset->dfl_cgrp == cgrp)
+	    ctx->ns != &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp == cgrp)
 		return -EPERM;
 
 	if (cft->write)
@@ -4671,21 +4694,21 @@ void css_task_iter_end(struct css_task_iter *it)
 
 static void cgroup_procs_release(struct kernfs_open_file *of)
 {
-	if (of->priv) {
-		css_task_iter_end(of->priv);
-		kfree(of->priv);
-	}
+	struct cgroup_file_ctx *ctx = of->priv;
+
+	if (ctx->procs.started)
+		css_task_iter_end(&ctx->procs.iter);
 }
 
 static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos)
 {
 	struct kernfs_open_file *of = s->private;
-	struct css_task_iter *it = of->priv;
+	struct cgroup_file_ctx *ctx = of->priv;
 
 	if (pos)
 		(*pos)++;
 
-	return css_task_iter_next(it);
+	return css_task_iter_next(&ctx->procs.iter);
 }
 
 static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
@@ -4693,21 +4716,18 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
 {
 	struct kernfs_open_file *of = s->private;
 	struct cgroup *cgrp = seq_css(s)->cgroup;
-	struct css_task_iter *it = of->priv;
+	struct cgroup_file_ctx *ctx = of->priv;
+	struct css_task_iter *it = &ctx->procs.iter;
 
 	/*
 	 * When a seq_file is seeked, it's always traversed sequentially
 	 * from position 0, so we can simply keep iterating on !0 *pos.
 	 */
-	if (!it) {
+	if (!ctx->procs.started) {
 		if (WARN_ON_ONCE((*pos)))
 			return ERR_PTR(-EINVAL);
-
-		it = kzalloc(sizeof(*it), GFP_KERNEL);
-		if (!it)
-			return ERR_PTR(-ENOMEM);
-		of->priv = it;
 		css_task_iter_start(&cgrp->self, iter_flags, it);
+		ctx->procs.started = true;
 	} else if (!(*pos)) {
 		css_task_iter_end(it);
 		css_task_iter_start(&cgrp->self, iter_flags, it);
@@ -4758,9 +4778,9 @@ static int cgroup_may_write(const struct cgroup *cgrp, struct super_block *sb)
 
 static int cgroup_procs_write_permission(struct cgroup *src_cgrp,
 					 struct cgroup *dst_cgrp,
-					 struct super_block *sb)
+					 struct super_block *sb,
+					 struct cgroup_namespace *ns)
 {
-	struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
 	struct cgroup *com_cgrp = src_cgrp;
 	int ret;
 
@@ -4789,11 +4809,12 @@ static int cgroup_procs_write_permission(struct cgroup *src_cgrp,
 
 static int cgroup_attach_permissions(struct cgroup *src_cgrp,
 				     struct cgroup *dst_cgrp,
-				     struct super_block *sb, bool threadgroup)
+				     struct super_block *sb, bool threadgroup,
+				     struct cgroup_namespace *ns)
 {
 	int ret = 0;
 
-	ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, sb);
+	ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, sb, ns);
 	if (ret)
 		return ret;
 
@@ -4810,6 +4831,7 @@ static int cgroup_attach_permissions(struct cgroup *src_cgrp,
 static ssize_t cgroup_procs_write(struct kernfs_open_file *of,
 				  char *buf, size_t nbytes, loff_t off)
 {
+	struct cgroup_file_ctx *ctx = of->priv;
 	struct cgroup *src_cgrp, *dst_cgrp;
 	struct task_struct *task;
 	ssize_t ret;
@@ -4830,7 +4852,8 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of,
 	spin_unlock_irq(&css_set_lock);
 
 	ret = cgroup_attach_permissions(src_cgrp, dst_cgrp,
-					of->file->f_path.dentry->d_sb, true);
+					of->file->f_path.dentry->d_sb, true,
+					ctx->ns);
 	if (ret)
 		goto out_finish;
 
@@ -4852,6 +4875,7 @@ static void *cgroup_threads_start(struct seq_file *s, loff_t *pos)
 static ssize_t cgroup_threads_write(struct kernfs_open_file *of,
 				    char *buf, size_t nbytes, loff_t off)
 {
+	struct cgroup_file_ctx *ctx = of->priv;
 	struct cgroup *src_cgrp, *dst_cgrp;
 	struct task_struct *task;
 	ssize_t ret;
@@ -4875,7 +4899,8 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of,
 
 	/* thread migrations follow the cgroup.procs delegation rule */
 	ret = cgroup_attach_permissions(src_cgrp, dst_cgrp,
-					of->file->f_path.dentry->d_sb, false);
+					of->file->f_path.dentry->d_sb, false,
+					ctx->ns);
 	if (ret)
 		goto out_finish;
 
@@ -6058,7 +6083,8 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs)
 		goto err;
 
 	ret = cgroup_attach_permissions(cset->dfl_cgrp, dst_cgrp, sb,
-					!(kargs->flags & CLONE_THREAD));
+					!(kargs->flags & CLONE_THREAD),
+					current->nsproxy->cgroup_ns);
 	if (ret)
 		goto err;
 

kernel/cgroup/cpuset.c

@@ -2238,6 +2238,7 @@ static void cpuset_attach(struct cgroup_taskset *tset)
 	cgroup_taskset_first(tset, &css);
 	cs = css_cs(css);
 
+	cpus_read_lock();
 	mutex_lock(&cpuset_mutex);
 
 	guarantee_online_mems(cs, &cpuset_attach_nodemask_to);
@@ -2291,6 +2292,7 @@ static void cpuset_attach(struct cgroup_taskset *tset)
 		wake_up(&cpuset_attach_wq);
 
 	mutex_unlock(&cpuset_mutex);
+	cpus_read_unlock();
 }
 
 /* The various types of files and directories in a cpuset file system */

kernel/debug/kdb/kdb_support.c

@@ -350,7 +350,7 @@ int kdb_getarea_size(void *res, unsigned long addr, size_t size)
  */
 int kdb_putarea_size(unsigned long addr, void *res, size_t size)
 {
-	int ret = copy_from_kernel_nofault((char *)addr, (char *)res, size);
+	int ret = copy_to_kernel_nofault((char *)addr, (char *)res, size);
 	if (ret) {
 		if (!KDB_STATE(SUPPRESS)) {
 			kdb_printf("kdb_putarea: Bad address 0x%lx\n", addr);

kernel/dma/debug.c

@@ -928,7 +928,7 @@ static __init int dma_debug_cmdline(char *str)
 		global_disable = true;
 	}
 
-	return 0;
+	return 1;
 }
 
 static __init int dma_debug_entries_cmdline(char *str)
@@ -937,7 +937,7 @@ static __init int dma_debug_entries_cmdline(char *str)
 		return -EINVAL;
 	if (!get_option(&str, &nr_prealloc_entries))
 		nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
-	return 0;
+	return 1;
 }
 
 __setup("dma_debug=", dma_debug_cmdline);

kernel/dma/swiotlb.c

@@ -598,7 +598,8 @@ phys_addr_t swiotlb_tbl_map_single(struct device *dev, phys_addr_t orig_addr,
 
 	tlb_addr = slot_addr(io_tlb_start, index) + offset;
 	if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) &&
-	    (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL))
+	    (!(attrs & DMA_ATTR_OVERWRITE) || dir == DMA_TO_DEVICE ||
+	    dir == DMA_BIDIRECTIONAL))
 		swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE);
 	return tlb_addr;
 }

kernel/events/core.c

@@ -10220,8 +10220,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
 			}
 
 			/* ready to consume more filters */
+			kfree(filename);
+			filename = NULL;
 			state = IF_STATE_ACTION;
 			filter = NULL;
+			kernel = 0;
 		}
 	}
 

kernel/fork.c

@@ -2315,10 +2315,6 @@ static __latent_entropy struct task_struct *copy_process(
 		goto bad_fork_cancel_cgroup;
 	}
 
-	/* past the last point of failure */
-	if (pidfile)
-		fd_install(pidfd, pidfile);
-
 	init_task_pid_links(p);
 	if (likely(p->pid)) {
 		ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
@@ -2367,6 +2363,9 @@ static __latent_entropy struct task_struct *copy_process(
 	syscall_tracepoint_update(p);
 	write_unlock_irq(&tasklist_lock);
 
+	if (pidfile)
+		fd_install(pidfd, pidfile);
+
 	proc_fork_connector(p);
 	sched_post_fork(p);
 	cgroup_post_fork(p, args);

kernel/livepatch/core.c

@@ -191,7 +191,7 @@ static int klp_find_object_symbol(const char *objname, const char *name,
 	return -EINVAL;
 }
 
-static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab,
+static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab,
 			       unsigned int symndx, Elf_Shdr *relasec,
 			       const char *sec_objname)
 {
@@ -219,7 +219,7 @@ static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab,
 	relas = (Elf_Rela *) relasec->sh_addr;
 	/* For each rela in this klp relocation section */
 	for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) {
-		sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
+		sym = (Elf_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
 		if (sym->st_shndx != SHN_LIVEPATCH) {
 			pr_err("symbol %s is not marked as a livepatch symbol\n",
 			       strtab + sym->st_name);

kernel/locking/lockdep.c

@@ -182,11 +182,9 @@ static DECLARE_BITMAP(list_entries_in_use, MAX_LOCKDEP_ENTRIES);
 static struct hlist_head lock_keys_hash[KEYHASH_SIZE];
 unsigned long nr_lock_classes;
 unsigned long nr_zapped_classes;
-#ifndef CONFIG_DEBUG_LOCKDEP
-static
-#endif
+unsigned long max_lock_class_idx;
 struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
-static DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS);
+DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS);
 
 static inline struct lock_class *hlock_class(struct held_lock *hlock)
 {
@@ -337,7 +335,7 @@ static inline void lock_release_holdtime(struct held_lock *hlock)
  * elements. These elements are linked together by the lock_entry member in
  * struct lock_class.
  */
-LIST_HEAD(all_lock_classes);
+static LIST_HEAD(all_lock_classes);
 static LIST_HEAD(free_lock_classes);
 
 /**
@@ -1239,6 +1237,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 	struct lockdep_subclass_key *key;
 	struct hlist_head *hash_head;
 	struct lock_class *class;
+	int idx;
 
 	DEBUG_LOCKS_WARN_ON(!irqs_disabled());
 
@@ -1304,6 +1303,9 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 	 * of classes.
 	 */
 	list_move_tail(&class->lock_entry, &all_lock_classes);
+	idx = class - lock_classes;
+	if (idx > max_lock_class_idx)
+		max_lock_class_idx = idx;
 
 	if (verbose(class)) {
 		graph_unlock();
@@ -3387,7 +3389,7 @@ struct lock_class *lock_chain_get_class(struct lock_chain *chain, int i)
 	u16 chain_hlock = chain_hlocks[chain->base + i];
 	unsigned int class_idx = chain_hlock_class_idx(chain_hlock);
 
-	return lock_classes + class_idx - 1;
+	return lock_classes + class_idx;
 }
 
 /*
@@ -3455,7 +3457,7 @@ static void print_chain_keys_chain(struct lock_chain *chain)
 		hlock_id = chain_hlocks[chain->base + i];
 		chain_key = print_chain_key_iteration(hlock_id, chain_key);
 
-		print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id) - 1);
+		print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id));
 		printk("\n");
 	}
 }
@@ -5919,6 +5921,8 @@ static void zap_class(struct pending_free *pf, struct lock_class *class)
 		WRITE_ONCE(class->name, NULL);
 		nr_lock_classes--;
 		__clear_bit(class - lock_classes, lock_classes_in_use);
+		if (class - lock_classes == max_lock_class_idx)
+			max_lock_class_idx--;
 	} else {
 		WARN_ONCE(true, "%s() failed for class %s\n", __func__,
 			  class->name);

kernel/locking/lockdep_internals.h

@@ -121,7 +121,6 @@ static const unsigned long LOCKF_USED_IN_IRQ_READ =
 
 #define MAX_LOCKDEP_CHAIN_HLOCKS (MAX_LOCKDEP_CHAINS*5)
 
-extern struct list_head all_lock_classes;
 extern struct lock_chain lock_chains[];
 
 #define LOCK_USAGE_CHARS (2*XXX_LOCK_USAGE_STATES + 1)
@@ -151,6 +150,10 @@ extern unsigned int nr_large_chain_blocks;
 
 extern unsigned int max_lockdep_depth;
 extern unsigned int max_bfs_queue_depth;
+extern unsigned long max_lock_class_idx;
+
+extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
+extern unsigned long lock_classes_in_use[];
 
 #ifdef CONFIG_PROVE_LOCKING
 extern unsigned long lockdep_count_forward_deps(struct lock_class *);
@@ -205,7 +208,6 @@ struct lockdep_stats {
 };
 
 DECLARE_PER_CPU(struct lockdep_stats, lockdep_stats);
-extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
 
 #define __debug_atomic_inc(ptr)					\
 	this_cpu_inc(lockdep_stats.ptr);

kernel/locking/lockdep_proc.c

@@ -24,14 +24,33 @@
 
 #include "lockdep_internals.h"
 
+/*
+ * Since iteration of lock_classes is done without holding the lockdep lock,
+ * it is not safe to iterate all_lock_classes list directly as the iteration
+ * may branch off to free_lock_classes or the zapped list. Iteration is done
+ * directly on the lock_classes array by checking the lock_classes_in_use
+ * bitmap and max_lock_class_idx.
+ */
+#define iterate_lock_classes(idx, class)				\
+	for (idx = 0, class = lock_classes; idx <= max_lock_class_idx;	\
+	     idx++, class++)
+
 static void *l_next(struct seq_file *m, void *v, loff_t *pos)
 {
-	return seq_list_next(v, &all_lock_classes, pos);
+	struct lock_class *class = v;
+
+	++class;
+	*pos = class - lock_classes;
+	return (*pos > max_lock_class_idx) ? NULL : class;
 }
 
 static void *l_start(struct seq_file *m, loff_t *pos)
 {
-	return seq_list_start_head(&all_lock_classes, *pos);
+	unsigned long idx = *pos;
+
+	if (idx > max_lock_class_idx)
+		return NULL;
+	return lock_classes + idx;
 }
 
 static void l_stop(struct seq_file *m, void *v)
@@ -57,14 +76,16 @@ static void print_name(struct seq_file *m, struct lock_class *class)
 
 static int l_show(struct seq_file *m, void *v)
 {
-	struct lock_class *class = list_entry(v, struct lock_class, lock_entry);
+	struct lock_class *class = v;
 	struct lock_list *entry;
 	char usage[LOCK_USAGE_CHARS];
+	int idx = class - lock_classes;
 
-	if (v == &all_lock_classes) {
+	if (v == lock_classes)
 		seq_printf(m, "all lock classes:\n");
+
+	if (!test_bit(idx, lock_classes_in_use))
 		return 0;
-	}
 
 	seq_printf(m, "%p", class->key);
 #ifdef CONFIG_DEBUG_LOCKDEP
@@ -218,8 +239,11 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 
 #ifdef CONFIG_PROVE_LOCKING
 	struct lock_class *class;
+	unsigned long idx;
 
-	list_for_each_entry(class, &all_lock_classes, lock_entry) {
+	iterate_lock_classes(idx, class) {
+		if (!test_bit(idx, lock_classes_in_use))
+			continue;
 
 		if (class->usage_mask == 0)
 			nr_unused++;
@@ -252,6 +276,7 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 
 		sum_forward_deps += lockdep_count_forward_deps(class);
 	}
+
 #ifdef CONFIG_DEBUG_LOCKDEP
 	DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused);
 #endif
@@ -343,6 +368,8 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 	seq_printf(m, " max bfs queue depth:           %11u\n",
 			max_bfs_queue_depth);
 #endif
+	seq_printf(m, " max lock class index:          %11lu\n",
+			max_lock_class_idx);
 	lockdep_stats_debug_show(m);
 	seq_printf(m, " debug_locks:                   %11u\n",
 			debug_locks);
@@ -620,12 +647,16 @@ static int lock_stat_open(struct inode *inode, struct file *file)
 	if (!res) {
 		struct lock_stat_data *iter = data->stats;
 		struct seq_file *m = file->private_data;
+		unsigned long idx;
 
-		list_for_each_entry(class, &all_lock_classes, lock_entry) {
+		iterate_lock_classes(idx, class) {
+			if (!test_bit(idx, lock_classes_in_use))
+				continue;
 			iter->class = class;
 			iter->stats = lock_stats(class);
 			iter++;
 		}
+
 		data->iter_end = iter;
 
 		sort(data->stats, data->iter_end - data->stats,
@@ -643,6 +674,7 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf,
 			       size_t count, loff_t *ppos)
 {
 	struct lock_class *class;
+	unsigned long idx;
 	char c;
 
 	if (count) {
@@ -652,8 +684,11 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf,
 		if (c != '0')
 			return count;
 
-		list_for_each_entry(class, &all_lock_classes, lock_entry)
+		iterate_lock_classes(idx, class) {
+			if (!test_bit(idx, lock_classes_in_use))
+				continue;
 			clear_lock_stats(class);
+		}
 	}
 	return count;
 }

kernel/module.c

@@ -3739,12 +3739,6 @@ static noinline int do_init_module(struct module *mod)
 	}
 	freeinit->module_init = mod->init_layout.base;
 
-	/*
-	 * We want to find out whether @mod uses async during init.  Clear
-	 * PF_USED_ASYNC.  async_schedule*() will set it.
-	 */
-	current->flags &= ~PF_USED_ASYNC;
-
 	do_mod_ctors(mod);
 	/* Start the module */
 	if (mod->init != NULL)
@@ -3770,22 +3764,13 @@ static noinline int do_init_module(struct module *mod)
 
 	/*
 	 * We need to finish all async code before the module init sequence
-	 * is done.  This has potential to deadlock.  For example, a newly
-	 * detected block device can trigger request_module() of the
-	 * default iosched from async probing task.  Once userland helper
-	 * reaches here, async_synchronize_full() will wait on the async
-	 * task waiting on request_module() and deadlock.
+	 * is done. This has potential to deadlock if synchronous module
+	 * loading is requested from async (which is not allowed!).
 	 *
-	 * This deadlock is avoided by perfomring async_synchronize_full()
-	 * iff module init queued any async jobs.  This isn't a full
-	 * solution as it will deadlock the same if module loading from
-	 * async jobs nests more than once; however, due to the various
-	 * constraints, this hack seems to be the best option for now.
-	 * Please refer to the following thread for details.
-	 *
-	 * http://thread.gmane.org/gmane.linux.kernel/1420814
+	 * See commit 0fdff3ec6d87 ("async, kmod: warn on synchronous
+	 * request_module() from async workers") for more details.
 	 */
-	if (!mod->async_probe_requested && (current->flags & PF_USED_ASYNC))
+	if (!mod->async_probe_requested)
 		async_synchronize_full();
 
 	ftrace_free_mem(mod, mod->init_layout.base, mod->init_layout.base +

kernel/power/hibernate.c

@@ -1323,7 +1323,7 @@ static int __init resumedelay_setup(char *str)
 	int rc = kstrtouint(str, 0, &resume_delay);
 
 	if (rc)
-		return rc;
+		pr_warn("resumedelay: bad option string '%s'\n", str);
 	return 1;
 }
 

kernel/power/suspend_test.c

@@ -157,22 +157,22 @@ static int __init setup_test_suspend(char *value)
 	value++;
 	suspend_type = strsep(&value, ",");
 	if (!suspend_type)
-		return 0;
+		return 1;
 
 	repeat = strsep(&value, ",");
 	if (repeat) {
 		if (kstrtou32(repeat, 0, &test_repeat_count_max))
-			return 0;
+			return 1;
 	}
 
 	for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
 		if (!strcmp(pm_labels[i], suspend_type)) {
 			test_state_label = pm_labels[i];
-			return 0;
+			return 1;
 		}
 
 	printk(warn_bad_state, suspend_type);
-	return 0;
+	return 1;
 }
 __setup("test_suspend", setup_test_suspend);
 

kernel/printk/printk.c

@@ -149,8 +149,10 @@ static int __control_devkmsg(char *str)
 
 static int __init control_devkmsg(char *str)
 {
-	if (__control_devkmsg(str) < 0)
+	if (__control_devkmsg(str) < 0) {
+		pr_warn("printk.devkmsg: bad option string '%s'\n", str);
 		return 1;
+	}
 
 	/*
 	 * Set sysctl string accordingly:
@@ -169,7 +171,7 @@ static int __init control_devkmsg(char *str)
 	 */
 	devkmsg_log |= DEVKMSG_LOG_MASK_LOCK;
 
-	return 0;
+	return 1;
 }
 __setup("printk.devkmsg=", control_devkmsg);
 

kernel/ptrace.c

@@ -370,6 +370,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
 	return !err;
 }
 
+static int check_ptrace_options(unsigned long data)
+{
+	if (data & ~(unsigned long)PTRACE_O_MASK)
+		return -EINVAL;
+
+	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {
+		if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||
+		    !IS_ENABLED(CONFIG_SECCOMP))
+			return -EINVAL;
+
+		if (!capable(CAP_SYS_ADMIN))
+			return -EPERM;
+
+		if (seccomp_mode(&current->seccomp) != SECCOMP_MODE_DISABLED ||
+		    current->ptrace & PT_SUSPEND_SECCOMP)
+			return -EPERM;
+	}
+	return 0;
+}
+
 static int ptrace_attach(struct task_struct *task, long request,
 			 unsigned long addr,
 			 unsigned long flags)
@@ -381,8 +401,16 @@ static int ptrace_attach(struct task_struct *task, long request,
 	if (seize) {
 		if (addr != 0)
 			goto out;
+		/*
+		 * This duplicates the check in check_ptrace_options() because
+		 * ptrace_attach() and ptrace_setoptions() have historically
+		 * used different error codes for unknown ptrace options.
+		 */
 		if (flags & ~(unsigned long)PTRACE_O_MASK)
 			goto out;
+		retval = check_ptrace_options(flags);
+		if (retval)
+			return retval;
 		flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);
 	} else {
 		flags = PT_PTRACED;
@@ -655,22 +683,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
 static int ptrace_setoptions(struct task_struct *child, unsigned long data)
 {
 	unsigned flags;
+	int ret;
 
-	if (data & ~(unsigned long)PTRACE_O_MASK)
-		return -EINVAL;
-
-	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {
-		if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||
-		    !IS_ENABLED(CONFIG_SECCOMP))
-			return -EINVAL;
-
-		if (!capable(CAP_SYS_ADMIN))
-			return -EPERM;
-
-		if (seccomp_mode(&current->seccomp) != SECCOMP_MODE_DISABLED ||
-		    current->ptrace & PT_SUSPEND_SECCOMP)
-			return -EPERM;
-	}
+	ret = check_ptrace_options(data);
+	if (ret)
+		return ret;
 
 	/* Avoid intermediate state when all opts are cleared */
 	flags = child->ptrace;

kernel/rcu/tree_plugin.h

@@ -541,6 +541,7 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
 		/* Unboost if we were boosted. */
 		if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex)
 			rt_mutex_futex_unlock(&rnp->boost_mtx);
+
 	} else {
 		local_irq_restore(flags);
 	}
@@ -628,7 +629,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
 			set_tsk_need_resched(current);
 			set_preempt_need_resched();
 			if (IS_ENABLED(CONFIG_IRQ_WORK) && irqs_were_disabled &&
-			    !rdp->defer_qs_iw_pending && exp) {
+			    !rdp->defer_qs_iw_pending && exp && cpu_online(rdp->cpu)) {
 				// Get scheduler to re-evaluate and call hooks.
 				// If !IRQ_WORK, FQS scan will eventually IPI.
 				init_irq_work(&rdp->defer_qs_iw,
@@ -1646,7 +1647,11 @@ static void wake_nocb_gp(struct rcu_data *rdp, bool force,
 		rcu_nocb_unlock_irqrestore(rdp, flags);
 		return;
 	}
-	del_timer(&rdp->nocb_timer);
+
+	if (READ_ONCE(rdp->nocb_defer_wakeup) > RCU_NOCB_WAKE_NOT) {
+		WRITE_ONCE(rdp->nocb_defer_wakeup, RCU_NOCB_WAKE_NOT);
+		del_timer(&rdp->nocb_timer);
+	}
 	rcu_nocb_unlock_irqrestore(rdp, flags);
 	raw_spin_lock_irqsave(&rdp_gp->nocb_gp_lock, flags);
 	if (force || READ_ONCE(rdp_gp->nocb_gp_sleep)) {
@@ -2164,7 +2169,6 @@ static void do_nocb_deferred_wakeup_common(struct rcu_data *rdp)
 		return;
 	}
 	ndw = READ_ONCE(rdp->nocb_defer_wakeup);
-	WRITE_ONCE(rdp->nocb_defer_wakeup, RCU_NOCB_WAKE_NOT);
 	wake_nocb_gp(rdp, ndw == RCU_NOCB_WAKE_FORCE, flags);
 	trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("DeferredWake"));
 }

kernel/rseq.c

@@ -120,8 +120,13 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)
 	u32 sig;
 	int ret;
 
-	if (copy_from_user(&ptr, &t->rseq->rseq_cs.ptr64, sizeof(ptr)))
+#ifdef CONFIG_64BIT
+	if (get_user(ptr, &t->rseq->rseq_cs))
 		return -EFAULT;
+#else
+	if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr)))
+		return -EFAULT;
+#endif
 	if (!ptr) {
 		memset(rseq_cs, 0, sizeof(*rseq_cs));
 		return 0;
@@ -204,9 +209,13 @@ static int clear_rseq_cs(struct task_struct *t)
 	 *
 	 * Set rseq_cs to NULL.
 	 */
-	if (clear_user(&t->rseq->rseq_cs.ptr64, sizeof(t->rseq->rseq_cs.ptr64)))
+#ifdef CONFIG_64BIT
+	return put_user(0UL, &t->rseq->rseq_cs);
+#else
+	if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs)))
 		return -EFAULT;
 	return 0;
+#endif
 }
 
 /*

kernel/sched/core.c

@@ -39,6 +39,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_rt_tp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_dl_tp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_irq_tp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_se_tp);
+EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_thermal_tp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(sched_cpu_capacity_tp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(sched_overutilized_tp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_cfs_tp);

kernel/sched/debug.c

@@ -910,25 +910,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf,
 static void sched_show_numa(struct task_struct *p, struct seq_file *m)
 {
 #ifdef CONFIG_NUMA_BALANCING
-	struct mempolicy *pol;
-
 	if (p->mm)
 		P(mm->numa_scan_seq);
 
-	task_lock(p);
-	pol = p->mempolicy;
-	if (pol && !(pol->flags & MPOL_F_MORON))
-		pol = NULL;
-	mpol_get(pol);
-	task_unlock(p);
-
 	P(numa_pages_migrated);
 	P(numa_preferred_nid);
 	P(total_numa_faults);
 	SEQ_printf(m, "current_node=%d, numa_group_id=%d\n",
 			task_node(p), task_numa_group_id(p));
 	show_numa_stats(p, m);
-	mpol_put(pol);
 #endif
 }
 

kernel/sched/topology.c

@@ -1542,66 +1542,58 @@ static void init_numa_topology_type(void)
 	}
 }
 
+
+#define NR_DISTANCE_VALUES (1 << DISTANCE_BITS)
+
 void sched_init_numa(void)
 {
-	int next_distance, curr_distance = node_distance(0, 0);
 	struct sched_domain_topology_level *tl;
-	int level = 0;
-	int i, j, k;
-
-	sched_domains_numa_distance = kzalloc(sizeof(int) * (nr_node_ids + 1), GFP_KERNEL);
-	if (!sched_domains_numa_distance)
-		return;
-
-	/* Includes NUMA identity node at level 0. */
-	sched_domains_numa_distance[level++] = curr_distance;
-	sched_domains_numa_levels = level;
+	unsigned long *distance_map;
+	int nr_levels = 0;
+	int i, j;
 
 	/*
 	 * O(nr_nodes^2) deduplicating selection sort -- in order to find the
 	 * unique distances in the node_distance() table.
-	 *
-	 * Assumes node_distance(0,j) includes all distances in
-	 * node_distance(i,j) in order to avoid cubic time.
 	 */
-	next_distance = curr_distance;
+	distance_map = bitmap_alloc(NR_DISTANCE_VALUES, GFP_KERNEL);
+	if (!distance_map)
+		return;
+
+	bitmap_zero(distance_map, NR_DISTANCE_VALUES);
 	for (i = 0; i < nr_node_ids; i++) {
 		for (j = 0; j < nr_node_ids; j++) {
-			for (k = 0; k < nr_node_ids; k++) {
-				int distance = node_distance(i, k);
+			int distance = node_distance(i, j);
 
-				if (distance > curr_distance &&
-				    (distance < next_distance ||
-				     next_distance == curr_distance))
-					next_distance = distance;
-
-				/*
-				 * While not a strong assumption it would be nice to know
-				 * about cases where if node A is connected to B, B is not
-				 * equally connected to A.
-				 */
-				if (sched_debug() && node_distance(k, i) != distance)
-					sched_numa_warn("Node-distance not symmetric");
-
-				if (sched_debug() && i && !find_numa_distance(distance))
-					sched_numa_warn("Node-0 not representative");
+			if (distance < LOCAL_DISTANCE || distance >= NR_DISTANCE_VALUES) {
+				sched_numa_warn("Invalid distance value range");
+				return;
 			}
-			if (next_distance != curr_distance) {
-				sched_domains_numa_distance[level++] = next_distance;
-				sched_domains_numa_levels = level;
-				curr_distance = next_distance;
-			} else break;
-		}
 
-		/*
-		 * In case of sched_debug() we verify the above assumption.
-		 */
-		if (!sched_debug())
-			break;
+			bitmap_set(distance_map, distance, 1);
+		}
+	}
+	/*
+	 * We can now figure out how many unique distance values there are and
+	 * allocate memory accordingly.
+	 */
+	nr_levels = bitmap_weight(distance_map, NR_DISTANCE_VALUES);
+
+	sched_domains_numa_distance = kcalloc(nr_levels, sizeof(int), GFP_KERNEL);
+	if (!sched_domains_numa_distance) {
+		bitmap_free(distance_map);
+		return;
 	}
 
+	for (i = 0, j = 0; i < nr_levels; i++, j++) {
+		j = find_next_bit(distance_map, NR_DISTANCE_VALUES, j);
+		sched_domains_numa_distance[i] = j;
+	}
+
+	bitmap_free(distance_map);
+
 	/*
-	 * 'level' contains the number of unique distances
+	 * 'nr_levels' contains the number of unique distances
 	 *
 	 * The sched_domains_numa_distance[] array includes the actual distance
 	 * numbers.
@@ -1610,15 +1602,15 @@ void sched_init_numa(void)
 	/*
 	 * Here, we should temporarily reset sched_domains_numa_levels to 0.
 	 * If it fails to allocate memory for array sched_domains_numa_masks[][],
-	 * the array will contain less then 'level' members. This could be
+	 * the array will contain less then 'nr_levels' members. This could be
 	 * dangerous when we use it to iterate array sched_domains_numa_masks[][]
 	 * in other functions.
 	 *
-	 * We reset it to 'level' at the end of this function.
+	 * We reset it to 'nr_levels' at the end of this function.
 	 */
 	sched_domains_numa_levels = 0;
 
-	sched_domains_numa_masks = kzalloc(sizeof(void *) * level, GFP_KERNEL);
+	sched_domains_numa_masks = kzalloc(sizeof(void *) * nr_levels, GFP_KERNEL);
 	if (!sched_domains_numa_masks)
 		return;
 
@@ -1626,7 +1618,7 @@ void sched_init_numa(void)
 	 * Now for each level, construct a mask per node which contains all
 	 * CPUs of nodes that are that many hops away from us.
 	 */
-	for (i = 0; i < level; i++) {
+	for (i = 0; i < nr_levels; i++) {
 		sched_domains_numa_masks[i] =
 			kzalloc(nr_node_ids * sizeof(void *), GFP_KERNEL);
 		if (!sched_domains_numa_masks[i])
@@ -1634,12 +1626,17 @@ void sched_init_numa(void)
 
 		for (j = 0; j < nr_node_ids; j++) {
 			struct cpumask *mask = kzalloc(cpumask_size(), GFP_KERNEL);
+			int k;
+
 			if (!mask)
 				return;
 
 			sched_domains_numa_masks[i][j] = mask;
 
 			for_each_node(k) {
+				if (sched_debug() && (node_distance(j, k) != node_distance(k, j)))
+					sched_numa_warn("Node-distance not symmetric");
+
 				if (node_distance(j, k) > sched_domains_numa_distance[i])
 					continue;
 
@@ -1651,7 +1648,7 @@ void sched_init_numa(void)
 	/* Compute default topology size */
 	for (i = 0; sched_domain_topology[i].mask; i++);
 
-	tl = kzalloc((i + level + 1) *
+	tl = kzalloc((i + nr_levels + 1) *
 			sizeof(struct sched_domain_topology_level), GFP_KERNEL);
 	if (!tl)
 		return;
@@ -1674,7 +1671,7 @@ void sched_init_numa(void)
 	/*
 	 * .. and append 'j' levels of NUMA goodness.
 	 */
-	for (j = 1; j < level; i++, j++) {
+	for (j = 1; j < nr_levels; i++, j++) {
 		tl[i] = (struct sched_domain_topology_level){
 			.mask = sd_numa_mask,
 			.sd_flags = cpu_numa_flags,
@@ -1686,8 +1683,8 @@ void sched_init_numa(void)
 
 	sched_domain_topology = tl;
 
-	sched_domains_numa_levels = level;
-	sched_max_numa_distance = sched_domains_numa_distance[level - 1];
+	sched_domains_numa_levels = nr_levels;
+	sched_max_numa_distance = sched_domains_numa_distance[nr_levels - 1];
 
 	init_numa_topology_type();
 }

kernel/stackleak.c

@@ -48,7 +48,7 @@ int stack_erasing_sysctl(struct ctl_table *table, int write,
 #define skip_erasing()	false
 #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
 
-asmlinkage void notrace stackleak_erase(void)
+asmlinkage void noinstr stackleak_erase(void)
 {
 	/* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
 	unsigned long kstack_ptr = current->lowest_stack;
@@ -102,9 +102,8 @@ asmlinkage void notrace stackleak_erase(void)
 	/* Reset the 'lowest_stack' value for the next syscall */
 	current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64;
 }
-NOKPROBE_SYMBOL(stackleak_erase);
 
-void __used __no_caller_saved_registers notrace stackleak_track_stack(void)
+void __used __no_caller_saved_registers noinstr stackleak_track_stack(void)
 {
 	unsigned long sp = current_stack_pointer;
 

kernel/trace/trace.c

@@ -234,7 +234,7 @@ static char trace_boot_options_buf[MAX_TRACER_SIZE] __initdata;
 static int __init set_trace_boot_options(char *str)
 {
 	strlcpy(trace_boot_options_buf, str, MAX_TRACER_SIZE);
-	return 0;
+	return 1;
 }
 __setup("trace_options=", set_trace_boot_options);
 
@@ -245,12 +245,16 @@ static int __init set_trace_boot_clock(char *str)
 {
 	strlcpy(trace_boot_clock_buf, str, MAX_TRACER_SIZE);
 	trace_boot_clock = trace_boot_clock_buf;
-	return 0;
+	return 1;
 }
 __setup("trace_clock=", set_trace_boot_clock);
 
 static int __init set_tracepoint_printk(char *str)
 {
+	/* Ignore the "tp_printk_stop_on_boot" param */
+	if (*str == '_')
+		return 0;
+
 	if ((strcmp(str, "=0") != 0 && strcmp(str, "=off") != 0))
 		tracepoint_printk = 1;
 	return 1;
@@ -1487,10 +1491,12 @@ static int __init set_buf_size(char *str)
 	if (!str)
 		return 0;
 	buf_size = memparse(str, &str);
-	/* nr_entries can not be zero */
-	if (buf_size == 0)
-		return 0;
-	trace_buf_size = buf_size;
+	/*
+	 * nr_entries can not be zero and the startup
+	 * tests require some buffer space. Therefore
+	 * ensure we have at least 4096 bytes of buffer.
+	 */
+	trace_buf_size = max(4096UL, buf_size);
 	return 1;
 }
 __setup("trace_buf_size=", set_buf_size);

kernel/trace/trace_events_filter.c

@@ -5,6 +5,7 @@
  * Copyright (C) 2009 Tom Zanussi <tzanussi@gmail.com>
  */
 
+#include <linux/uaccess.h>
 #include <linux/module.h>
 #include <linux/ctype.h>
 #include <linux/mutex.h>
@@ -654,6 +655,52 @@ DEFINE_EQUALITY_PRED(32);
 DEFINE_EQUALITY_PRED(16);
 DEFINE_EQUALITY_PRED(8);
 
+/* user space strings temp buffer */
+#define USTRING_BUF_SIZE	1024
+
+struct ustring_buffer {
+	char		buffer[USTRING_BUF_SIZE];
+};
+
+static __percpu struct ustring_buffer *ustring_per_cpu;
+
+static __always_inline char *test_string(char *str)
+{
+	struct ustring_buffer *ubuf;
+	char *kstr;
+
+	if (!ustring_per_cpu)
+		return NULL;
+
+	ubuf = this_cpu_ptr(ustring_per_cpu);
+	kstr = ubuf->buffer;
+
+	/* For safety, do not trust the string pointer */
+	if (!strncpy_from_kernel_nofault(kstr, str, USTRING_BUF_SIZE))
+		return NULL;
+	return kstr;
+}
+
+static __always_inline char *test_ustring(char *str)
+{
+	struct ustring_buffer *ubuf;
+	char __user *ustr;
+	char *kstr;
+
+	if (!ustring_per_cpu)
+		return NULL;
+
+	ubuf = this_cpu_ptr(ustring_per_cpu);
+	kstr = ubuf->buffer;
+
+	/* user space address? */
+	ustr = (char __user *)str;
+	if (!strncpy_from_user_nofault(kstr, ustr, USTRING_BUF_SIZE))
+		return NULL;
+
+	return kstr;
+}
+
 /* Filter predicate for fixed sized arrays of characters */
 static int filter_pred_string(struct filter_pred *pred, void *event)
 {
@@ -667,19 +714,43 @@ static int filter_pred_string(struct filter_pred *pred, void *event)
 	return match;
 }
 
-/* Filter predicate for char * pointers */
-static int filter_pred_pchar(struct filter_pred *pred, void *event)
+static __always_inline int filter_pchar(struct filter_pred *pred, char *str)
 {
-	char **addr = (char **)(event + pred->offset);
 	int cmp, match;
-	int len = strlen(*addr) + 1;	/* including tailing '\0' */
+	int len;
 
-	cmp = pred->regex.match(*addr, &pred->regex, len);
+	len = strlen(str) + 1;	/* including tailing '\0' */
+	cmp = pred->regex.match(str, &pred->regex, len);
 
 	match = cmp ^ pred->not;
 
 	return match;
 }
+/* Filter predicate for char * pointers */
+static int filter_pred_pchar(struct filter_pred *pred, void *event)
+{
+	char **addr = (char **)(event + pred->offset);
+	char *str;
+
+	str = test_string(*addr);
+	if (!str)
+		return 0;
+
+	return filter_pchar(pred, str);
+}
+
+/* Filter predicate for char * pointers in user space*/
+static int filter_pred_pchar_user(struct filter_pred *pred, void *event)
+{
+	char **addr = (char **)(event + pred->offset);
+	char *str;
+
+	str = test_ustring(*addr);
+	if (!str)
+		return 0;
+
+	return filter_pchar(pred, str);
+}
 
 /*
  * Filter predicate for dynamic sized arrays of characters.
@@ -1158,6 +1229,7 @@ static int parse_pred(const char *str, void *data,
 	struct filter_pred *pred = NULL;
 	char num_buf[24];	/* Big enough to hold an address */
 	char *field_name;
+	bool ustring = false;
 	char q;
 	u64 val;
 	int len;
@@ -1192,6 +1264,12 @@ static int parse_pred(const char *str, void *data,
 		return -EINVAL;
 	}
 
+	/* See if the field is a user space string */
+	if ((len = str_has_prefix(str + i, ".ustring"))) {
+		ustring = true;
+		i += len;
+	}
+
 	while (isspace(str[i]))
 		i++;
 
@@ -1320,8 +1398,20 @@ static int parse_pred(const char *str, void *data,
 
 		} else if (field->filter_type == FILTER_DYN_STRING)
 			pred->fn = filter_pred_strloc;
-		else
-			pred->fn = filter_pred_pchar;
+		else {
+
+			if (!ustring_per_cpu) {
+				/* Once allocated, keep it around for good */
+				ustring_per_cpu = alloc_percpu(struct ustring_buffer);
+				if (!ustring_per_cpu)
+					goto err_mem;
+			}
+
+			if (ustring)
+				pred->fn = filter_pred_pchar_user;
+			else
+				pred->fn = filter_pred_pchar;
+		}
 		/* go past the last quote */
 		i++;
 
@@ -1387,6 +1477,9 @@ static int parse_pred(const char *str, void *data,
 err_free:
 	kfree(pred);
 	return -EINVAL;
+err_mem:
+	kfree(pred);
+	return -ENOMEM;
 }
 
 enum {

kernel/trace/trace_events_hist.c

@@ -1985,9 +1985,9 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
 			/*
 			 * For backward compatibility, if field_name
 			 * was "cpu", then we treat this the same as
-			 * common_cpu.
+			 * common_cpu. This also works for "CPU".
 			 */
-			if (strcmp(field_name, "cpu") == 0) {
+			if (field && field->filter_type == FILTER_CPU) {
 				*flags |= HIST_FIELD_FL_CPU;
 			} else {
 				hist_err(tr, HIST_ERR_FIELD_NOT_FOUND,
@@ -4365,7 +4365,7 @@ static int create_tracing_map_fields(struct hist_trigger_data *hist_data)
 
 			if (hist_field->flags & HIST_FIELD_FL_STACKTRACE)
 				cmp_fn = tracing_map_cmp_none;
-			else if (!field)
+			else if (!field || hist_field->flags & HIST_FIELD_FL_CPU)
 				cmp_fn = tracing_map_cmp_num(hist_field->size,
 							     hist_field->is_signed);
 			else if (is_string_field(field))

kernel/trace/trace_events_trigger.c

@@ -940,6 +940,16 @@ static void
 traceon_trigger(struct event_trigger_data *data, void *rec,
 		struct ring_buffer_event *event)
 {
+	struct trace_event_file *file = data->private_data;
+
+	if (file) {
+		if (tracer_tracing_is_on(file->tr))
+			return;
+
+		tracer_tracing_on(file->tr);
+		return;
+	}
+
 	if (tracing_is_on())
 		return;
 
@@ -950,8 +960,15 @@ static void
 traceon_count_trigger(struct event_trigger_data *data, void *rec,
 		      struct ring_buffer_event *event)
 {
-	if (tracing_is_on())
-		return;
+	struct trace_event_file *file = data->private_data;
+
+	if (file) {
+		if (tracer_tracing_is_on(file->tr))
+			return;
+	} else {
+		if (tracing_is_on())
+			return;
+	}
 
 	if (!data->count)
 		return;
@@ -959,13 +976,26 @@ traceon_count_trigger(struct event_trigger_data *data, void *rec,
 	if (data->count != -1)
 		(data->count)--;
 
-	tracing_on();
+	if (file)
+		tracer_tracing_on(file->tr);
+	else
+		tracing_on();
 }
 
 static void
 traceoff_trigger(struct event_trigger_data *data, void *rec,
 		 struct ring_buffer_event *event)
 {
+	struct trace_event_file *file = data->private_data;
+
+	if (file) {
+		if (!tracer_tracing_is_on(file->tr))
+			return;
+
+		tracer_tracing_off(file->tr);
+		return;
+	}
+
 	if (!tracing_is_on())
 		return;
 
@@ -976,8 +1006,15 @@ static void
 traceoff_count_trigger(struct event_trigger_data *data, void *rec,
 		       struct ring_buffer_event *event)
 {
-	if (!tracing_is_on())
-		return;
+	struct trace_event_file *file = data->private_data;
+
+	if (file) {
+		if (!tracer_tracing_is_on(file->tr))
+			return;
+	} else {
+		if (!tracing_is_on())
+			return;
+	}
 
 	if (!data->count)
 		return;
@@ -985,7 +1022,10 @@ traceoff_count_trigger(struct event_trigger_data *data, void *rec,
 	if (data->count != -1)
 		(data->count)--;
 
-	tracing_off();
+	if (file)
+		tracer_tracing_off(file->tr);
+	else
+		tracing_off();
 }
 
 static int

kernel/trace/trace_kprobe.c

@@ -31,7 +31,7 @@ static int __init set_kprobe_boot_events(char *str)
 	strlcpy(kprobe_boot_events_buf, str, COMMAND_LINE_SIZE);
 	disable_tracing_selftest("running kprobe events");
 
-	return 0;
+	return 1;
 }
 __setup("kprobe_event=", set_kprobe_boot_events);
 

kernel/watch_queue.c

@@ -54,6 +54,7 @@ static void watch_queue_pipe_buf_release(struct pipe_inode_info *pipe,
 	bit += page->index;
 
 	set_bit(bit, wqueue->notes_bitmap);
+	generic_pipe_buf_release(pipe, buf);
 }
 
 // No try_steal function => no stealing
@@ -112,7 +113,7 @@ static bool post_one_notification(struct watch_queue *wqueue,
 	buf->offset = offset;
 	buf->len = len;
 	buf->flags = PIPE_BUF_FLAG_WHOLE;
-	pipe->head = head + 1;
+	smp_store_release(&pipe->head, head + 1); /* vs pipe_read() */
 
 	if (!test_and_clear_bit(note, wqueue->notes_bitmap)) {
 		spin_unlock_irq(&pipe->rd_wait.lock);
@@ -243,7 +244,8 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
 		goto error;
 	}
 
-	ret = pipe_resize_ring(pipe, nr_notes);
+	nr_notes = nr_pages * WATCH_QUEUE_NOTES_PER_PAGE;
+	ret = pipe_resize_ring(pipe, roundup_pow_of_two(nr_notes));
 	if (ret < 0)
 		goto error;
 
@@ -268,11 +270,11 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
 	wqueue->notes = pages;
 	wqueue->notes_bitmap = bitmap;
 	wqueue->nr_pages = nr_pages;
-	wqueue->nr_notes = nr_pages * WATCH_QUEUE_NOTES_PER_PAGE;
+	wqueue->nr_notes = nr_notes;
 	return 0;
 
 error_p:
-	for (i = 0; i < nr_pages; i++)
+	while (--i >= 0)
 		__free_page(pages[i]);
 	kfree(pages);
 error:
@@ -320,7 +322,7 @@ long watch_queue_set_filter(struct pipe_inode_info *pipe,
 		    tf[i].info_mask & WATCH_INFO_LENGTH)
 			goto err_filter;
 		/* Ignore any unknown types */
-		if (tf[i].type >= sizeof(wfilter->type_filter) * 8)
+		if (tf[i].type >= WATCH_TYPE__NR)
 			continue;
 		nr_filter++;
 	}
@@ -336,7 +338,7 @@ long watch_queue_set_filter(struct pipe_inode_info *pipe,
 
 	q = wfilter->filters;
 	for (i = 0; i < filter.nr_filters; i++) {
-		if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)
+		if (tf[i].type >= WATCH_TYPE__NR)
 			continue;
 
 		q->type			= tf[i].type;
@@ -371,6 +373,8 @@ static void __put_watch_queue(struct kref *kref)
 
 	for (i = 0; i < wqueue->nr_pages; i++)
 		__free_page(wqueue->notes[i]);
+	kfree(wqueue->notes);
+	bitmap_free(wqueue->notes_bitmap);
 
 	wfilter = rcu_access_pointer(wqueue->filter);
 	if (wfilter)
@@ -395,6 +399,7 @@ static void free_watch(struct rcu_head *rcu)
 	put_watch_queue(rcu_access_pointer(watch->queue));
 	atomic_dec(&watch->cred->user->nr_watches);
 	put_cred(watch->cred);
+	kfree(watch);
 }
 
 static void __put_watch(struct kref *kref)
@@ -566,7 +571,7 @@ void watch_queue_clear(struct watch_queue *wqueue)
 	rcu_read_lock();
 	spin_lock_bh(&wqueue->lock);
 
-	/* Prevent new additions and prevent notifications from happening */
+	/* Prevent new notifications from being stored. */
 	wqueue->defunct = true;
 
 	while (!hlist_empty(&wqueue->watches)) {