37436 Commits

Author	SHA1	Message	Date
Liujie Xie	2f55d5cbe2	ANDROID: vendor_hooks: Add hooks for mutex ... Current might be preempt after spin_unlock(&lock->wait_lock), we want to add a hook after wake_up_q(&wake_q) in which to disable owner's privilege in scheduler. Bug: 231647361 Change-Id: I3016da2fd31b8bdc8435df4e800f91381a64af4f Signed-off-by: Liujie Xie <xieliujie@oppo.com>	2022-05-06 14:09:25 +08:00
Tengfei Fan	0599810a93	sched/walt: use num_mvp_tasks for check if rq have mvp task ... There is mvp task running on rq if num_mvp_task not equal 0, so use num_mvp_tasks check if rq have mvp task. Change-Id: Ia653b8d1dbbaa642ccc06296338617252bf1225b Signed-off-by: Tengfei Fan <quic_tengfan@quicinc.com>	2022-05-06 09:36:50 +08:00
Tengfei Fan	dcb8d22387	sched/walt: don't requeue mvp task if only have one mvp task on rq ... Don't requeue mvp task if only have one mvp task on rq, because only have one mvp task on rq, current mvp task will be select for running if this mvp task runtime still less than limit. Change-Id: Idaf343e7471665c01fe711e86a3d7747e501ed76 Signed-off-by: Tengfei Fan <quic_tengfan@quicinc.com>	2022-05-06 09:35:16 +08:00
qctecmdr	c63cee40b3	Merge "Merge keystone/android12-5.10-keystone-qcom-release.101+ (49a1520) into msm-5.10"	2022-05-05 13:50:36 -07:00
Ashay Jaiswal	56cc536e73	sched: walt: fix out of bound access ... Use "for_each_possible_cpu" for iterating over all cpus instead of fixed loop, this will ensure only valid cpus gets iterated. Change-Id: I2ac4a15eef85bec446ec29594426fc39204fbdef Signed-off-by: Ashay Jaiswal <quic_ashayj@quicinc.com>	2022-05-05 11:54:13 +05:30
Sivasri Kumar, Vanka	812893becb	Merge keystone/android12-5.10-keystone-qcom-release.101+ (49a1520) into msm-5.10 ... * refs/heads/tmp-49a1520: BACKPORT: media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls FROMLIST: remoteproc: Use unbounded workqueue for recovery work UPSTREAM: xfrm: fix tunnel model fragmentation behavior ANDROID: GKI: Enable CRYPTO_DES ANDROID: GKI: set more vfs-only exports into their own namespace ANDROID: Split ANDROID_STRUCT_PADDING into separate configs ANDROID: selftests: incfs: skip large_file_test test is not enough free space ANDROID: selftests: incfs: Add -fno-omit-frame-pointer ANDROID: incremental-fs: limit mount stack depth ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus ANDROID: vendor_hooks: Reduce pointless modversions CRC churn UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class ANDROID: mm: Fix implicit declaration of function 'isolate_lru_page' ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: Add hook symbol to symbol list Revert "ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree" ANDROID: vendor_hooks: Add hooks to for free_unref_page_commit ANDROID: vendor_hooks: Add hooks to for alloc_contig_range ANDROID: GKI: Update symbols to symbol list ANDROID: vendor_hooks: Add hook in shrink_node_memcgs ANDROID: GKI: Add symbols to symbol list FROMGIT: iommu/iova: Improve 32-bit free space estimate ANDROID: export walk_page_range and swp_swap_info ANDROID: vendor_hooks: export shrink_slab ANDROID: usb: gadget: f_accessory: add compat_ioctl support UPSTREAM: sr9700: sanity check for packet length UPSTREAM: io_uring: return back safer resurrect UPSTREAM: Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" UPSTREAM: usb: gadget: don't release an existing dev->buf UPSTREAM: usb: gadget: clear related members when goto fail UPSTREAM: usb: gadget: Fix use-after-free bug by not setting udc->dev.driver UPSTREAM: usb: gadget: rndis: prevent integer overflow in rndis_set_response() FROMGIT: mm/migrate: fix race between lock page and clear PG_Isolated UPSTREAM: arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting UPSTREAM: arm64: Use the clearbhb instruction in mitigations UPSTREAM: KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated UPSTREAM: arm64: Mitigate spectre style branch history side channels UPSTREAM: arm64: Do not include __READ_ONCE() block in assembly files UPSTREAM: KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A UPSTREAM: arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 UPSTREAM: arm64: Add percpu vectors for EL1 Revert "BACKPORT: FROMLIST: scsi: core: Reserve one tag for the UFS driver" UPSTREAM: arm64: entry: Add macro for reading symbol addresses from the trampoline UPSTREAM: arm64: entry: Add vectors that have the bhb mitigation sequences UPSTREAM: arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations UPSTREAM: arm64: entry: Allow the trampoline text to occupy multiple pages UPSTREAM: arm64: entry: Make the kpti trampoline's kpti sequence optional UPSTREAM: arm64: entry: Move trampoline macros out of ifdef'd section UPSTREAM: arm64: entry: Don't assume tramp_vectors is the start of the vectors UPSTREAM: arm64: entry: Allow tramp_alias to access symbols after the 4K boundary UPSTREAM: arm64: entry: Move the trampoline data page before the text page UPSTREAM: arm64: entry: Free up another register on kpti's tramp_exit path UPSTREAM: arm64: entry: Make the trampoline cleanup optional UPSTREAM: arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit UPSTREAM: arm64: entry.S: Add ventry overflow sanity checks UPSTREAM: arm64: cpufeature: add HWCAP for FEAT_RPRES UPSTREAM: arm64: cpufeature: add HWCAP for FEAT_AFP UPSTREAM: arm64: add ID_AA64ISAR2_EL1 sys register UPSTREAM: arm64: Add HWCAP for self-synchronising virtual counter UPSTREAM: arm64: Add Cortex-X2 CPU part definition UPSTREAM: arm64: cputype: Add CPU implementor & types for the Apple M1 cores Linux 5.10.101 iommu: Fix potential use-after-free during probe perf: Fix list corruption in perf_cgroup_switch() arm64: dts: imx8mq: fix lcdif port node scsi: lpfc: Reduce log messages seen after firmware download scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled can: isotp: fix error path in isotp_sendmsg() to unlock wait queue Makefile.extrawarn: Move -Wunaligned-access to W=1 hwmon: (dell-smm) Speed up setting of fan speed phy: ti: Fix missing sentinel for clk_div_table speakup-dectlk: Restore pitch setting USB: serial: cp210x: add CPI Bulk Coin Recycler id USB: serial: cp210x: add NCR Retail IO box id USB: serial: ch341: add support for GW Instek USB2.0-Serial devices USB: serial: option: add ZTE MF286D modem USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 usb: raw-gadget: fix handling of dual-direction-capable endpoints usb: gadget: f_uac2: Define specific wTerminalType usb: gadget: rndis: check size of RNDIS_MSG_SET command USB: gadget: validate interface OS descriptor requests usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition usb: dwc3: gadget: Prevent core from processing stale TRBs usb: ulpi: Call of_node_put correctly usb: ulpi: Move of_node_put to ulpi_dev_release net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured" usb: dwc2: drd: fix soft connect when gadget is unconfigured eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX n_tty: wake up poll(POLLRDNORM) on receiving data vt_ioctl: add array_index_nospec to VT_ACTIVATE vt_ioctl: fix array_index_nospec in vt_setactivate net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister net: mscc: ocelot: fix mutex lock error during ethtool stats read ice: fix IPIP and SIT TSO offload ice: fix an error code in ice_cfg_phy_fec() dpaa2-eth: unregister the netdev before disconnecting from the PHY net: amd-xgbe: disable interrupts during pci removal tipc: rate limit warning for received illegal binding update net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE veth: fix races around rq->rx_notify_masked net: fix a memleak when uncloning an skb dst and its metadata net: do not keep the dst cache when uncloning an skb dst and its metadata nfp: flower: fix ida_idx not being released ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path net: dsa: lantiq_gswip: don't use devres for mdiobus net: dsa: felix: don't use devres for mdiobus net: dsa: bcm_sf2: don't use devres for mdiobus net: dsa: ar9331: register the mdiobus under devres net: dsa: mv88e6xxx: don't use devres for mdiobus bonding: pair enable_port with slave_arr_updates gpio: sifive: use the correct register to read output values ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE drm/panel: simple: Assign data from panel_dpi_probe() correctly ixgbevf: Require large buffers for build_skb on 82599VF arm64: dts: meson-g12b-odroid-n2: fix typo 'dio2133' netfilter: ctnetlink: disable helper autoassign misc: fastrpc: avoid double fput() on failed usercopy drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd. gpio: aggregator: Fix calling into sleeping GPIO controllers usb: f_fs: Fix use-after-free for epfile ARM: dts: imx7ulp: Fix 'assigned-clocks-parents' typo phy: xilinx: zynqmp: Fix bus width setting for SGMII ARM: dts: imx6qdl-udoo: Properly describe the SD card detect staging: fbtft: Fix error path in fbtft_driver_module_init() ARM: dts: meson8b: Fix the UART device-tree schema validation ARM: dts: meson8: Fix the UART device-tree schema validation ARM: dts: meson: Fix the UART compatible strings ARM: dts: Fix timer regression for beagleboard revision c drm/rockchip: vop: Correct RK3399 VOP register fields PM: s2idle: ACPI: Fix wakeup interrupts handling ACPI/IORT: Check node revision for PMCG resources nvme-tcp: fix bogus request completion when failing to send AER ARM: socfpga: fix missing RESET_CONTROLLER ARM: dts: Fix boot regression on Skomer ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group riscv: fix build with binutils 2.38 KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER KVM: eventfd: Fix false positive RCU usage warning net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs perf: Always wake the parent event usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend PM: hibernate: Remove register_nosave_region_late() scsi: myrs: Fix crash in error case scsi: ufs: Treat link loss as fatal error scsi: pm8001: Fix bogus FW crash for maxcpus=1 scsi: qedf: Fix refcount issue when LOGO is received during TMF scsi: qedf: Add stag_work to all the vports scsi: ufs: ufshcd-pltfrm: Check the return value of devm_kstrdup() scsi: target: iscsi: Make sure the np under each tpg is unique powerpc/fixmap: Fix VM debug warning on unmap net: sched: Clarify error message when qdisc kind is unknown drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer x86/perf: Avoid warning for Arch LBR without XSAVE NFSv4 handle port presence in fs_location server string NFSv4 expose nfs_parse_server_name function NFSv4 remove zero number of fs_locations entries error check NFSv4.1: Fix uninitialised variable in devicenotify nfs: nfs4clinet: check the return value of kstrdup() NFSv4 only print the label when its queried NFS: change nfs_access_get_cached to only report the mask tracing: Propagate is_signed to expression drm/amdgpu: Set a suitable dev_info.gart_page_size NFSD: Fix offset type in I/O trace points NFSD: Clamp WRITE offsets NFS: Fix initialisation of nfs_client cl_flags field net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs can: isotp: fix potential CAN frame reception race in isotp_rcv() mmc: sdhci-of-esdhc: Check for error num after setting mask ima: Do not print policy rule with inactive LSM labels ima: Allow template selection with ima_template[_fmt]= after ima_hash= ima: Remove ima_policy file before directory integrity: check the return value of audit_log_start() Linux 5.10.100 tipc: improve size validations for received domain records crypto: api - Move cryptomgr soft dependency into algapi KVM: s390: Return error on SIDA memop on normal guest moxart: fix potential use-after-free on remove path Linux 5.10.99 selftests: nft_concat_range: add test for reload with no element add/del cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning net: dsa: mt7530: make NET_DSA_MT7530 select MEDIATEK_GE_PHY ext4: fix incorrect type issue during replay_del_range ext4: fix error handling in ext4_fc_record_modified_inode() ext4: fix error handling in ext4_restore_inline_data() ext4: modify the logic of ext4_mb_new_blocks_simple ext4: prevent used blocks from being allocated during fast commit replay EDAC/xgene: Fix deferred probing EDAC/altera: Fix deferred probing x86/perf: Default set FREEZE_ON_SMI for all perf/x86/intel/pt: Fix crash with stop filters in single-range mode perf stat: Fix display of grouped aliased events fbcon: Add option to enable legacy hardware acceleration Revert "fbcon: Disable accelerated scrolling" rtc: cmos: Evaluate century appropriate tools/resolve_btfids: Do not print any commands when building silently selftests: futex: Use variable MAKE instead of make selftests/exec: Remove pipe from TEST_GEN_FILES bpf: Use VM_MAP instead of VM_ALLOC for ringbuf gve: fix the wrong AdminQ buffer queue index check nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe pinctrl: bcm2835: Fix a few error paths pinctrl: intel: fix unexpected interrupt pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line ASoC: max9759: fix underflow in speaker_gain_control_put() ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes ASoC: fsl: Add missing error handling in pcm030_fabric_probe drm/i915/overlay: Prevent divide by zero bugs in scaling net: stmmac: ensure PTP time register reads are consistent net: stmmac: dump gmac4 DMA registers correctly net: macsec: Verify that send_sci is on when setting Tx sci explicitly net: macsec: Fix offload support for NETDEV_UNREGISTER event net: ieee802154: Return meaningful error codes from the netlink helpers net: ieee802154: ca8210: Stop leaking skb's net: ieee802154: mcr20a: Fix lifs/sifs periods net: ieee802154: hwsim: Ensure proper channel selection at probe time spi: uniphier: fix reference count leak in uniphier_spi_probe() spi: meson-spicc: add IRQ check in meson_spicc_probe spi: mediatek: Avoid NULL pointer crash in interrupt spi: bcm-qspi: check for valid cs before applying chip select iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() RDMA/mlx4: Don't continue event handler after memory allocation failure RDMA/siw: Fix broken RDMA Read Fence/Resume logic. IB/rdmavt: Validate remote_addr during loopback atomic tests RDMA/ucma: Protect mc during concurrent multicast leaves RDMA/cma: Use correct address when leaving multicast group memcg: charge fs_context and legacy_fs_context Revert "ASoC: mediatek: Check for error clk pointer" IB/hfi1: Fix AIP early init panic dma-buf: heaps: Fix potential spectre v1 gadget block: bio-integrity: Advance seed correctly for larger interval sizes mm/kmemleak: avoid scanning potential huge holes mm/pgtable: define pte_index so that preprocessor could recognize it mm/debug_vm_pgtable: remove pte entry from the page table nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels drm/nouveau: fix off by one in BIOS boundary checking btrfs: fix deadlock between quota disable and qgroup rescan worker ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks ALSA: hda/realtek: Add quirk for ASUS GU603 ALSA: hda: realtek: Fix race at concurrent COEF updates ALSA: hda: Fix UAF of leds class devs at unbinding ALSA: usb-audio: Correct quirk for VF0770 ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() audit: improve audit queue handling when "audit=1" on cmdline selinux: fix double free of cond_list on error paths Revert "perf: Fix perf_event_read_local() time" Linux 5.10.98 Revert "drm/vc4: hdmi: Make sure the device is powered with CEC" again Revert "drm/vc4: hdmi: Make sure the device is powered with CEC" Linux 5.10.97 tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() af_packet: fix data-race in packet_setsockopt / packet_setsockopt cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() net: sched: fix use-after-free in tc_new_tfilter() fanotify: Fix stale file descriptor in copy_event_to_user() net: amd-xgbe: Fix skb data length underflow net: amd-xgbe: ensure to reset the tx_timer_active flag ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback net/mlx5: E-Switch, Fix uninitialized variable modact net/mlx5: Use del_timer_sync in fw reset flow of halting poll net/mlx5e: Fix handling of wrong devices during bond netevent cgroup-v1: Require capabilities to set release_agent drm/vc4: hdmi: Make sure the device is powered with CEC x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN x86/mce: Add Xeon Sapphire Rapids to list of CPUs that support PPIN psi: Fix uaf issue when psi trigger is destroyed while being polled KVM: x86: Forcibly leave nested virt when SMM state is toggled Revert "drivers: bus: simple-pm-bus: Add support for probing simple bus only devices" net: ipa: prevent concurrent replenish net: ipa: use a bitmap for endpoint replenish_enabled net: ipa: fix atomic update in ipa_endpoint_replenish() PCI: pciehp: Fix infinite loop in IRQ handler upon power fault Linux 5.10.96 mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip() block: Fix wrong offset in bio_truncate() fsnotify: invalidate dcache before IN_DELETE event usr/include/Makefile: add linux/nfc.h to the compile-test coverage dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config net: bridge: vlan: fix memory leak in __allowed_ingress ipv4: remove sparse error in ip_neigh_gw4() ipv4: tcp: send zero IPID in SYNACK messages ipv4: raw: lock the socket in raw_bind() net: bridge: vlan: fix single net device option dumping Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values" net: hns3: handle empty unknown interrupt for VF net: cpsw: Properly initialise struct page_pool_params yam: fix a memory leak in yam_siocdevprivate() drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy video: hyperv_fb: Fix validation of screen resolution ibmvnic: don't spin in tasklet ibmvnic: init ->running_cap_crqs early ipv4: fix ip option filtering for locally generated fragments net: ipv4: Fix the warning for dereference net: ipv4: Move ip_options_fragment() out of loop powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending hwmon: (lm90) Mark alert as broken for MAX6654 efi/libstub: arm64: Fix image check alignment at entry rxrpc: Adjust retransmission backoff octeontx2-pf: Forward error codes to VF phylib: fix potential use-after-free net: phy: broadcom: hook up soft_reset for BCM54616S sched/pelt: Relax the sync of util_sum with util_avg perf: Fix perf_event_read_local() time kernel: delete repeated words in comments netfilter: conntrack: don't increment invalid counter on NF_REPEAT powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 NFS: Ensure the server has an up to date ctime before renaming NFS: Ensure the server has an up to date ctime before hardlinking ipv6: annotate accesses to fn->fn_sernum drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable drm/msm/dsi: Fix missing put_device() call in dsi_get_phy drm/msm: Fix wrong size calculation net-procfs: show net devices bound packet types NFSv4: nfs_atomic_open() can race when looking up a non-regular file NFSv4: Handle case where the lookup of a directory fails hwmon: (lm90) Reduce maximum conversion rate for G781 ipv4: avoid using shared IP generator for connected sockets ping: fix the sk_bound_dev_if match in ping_lookup hwmon: (lm90) Mark alert as broken for MAX6680 hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649 net: fix information leakage in /proc/net/ptype ipv6_tunnel: Rate limit warning messages scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev usb: roles: fix include/linux/usb/role.h compile issue i40e: fix unsigned stat widths i40e: Fix for failed to init adminq while VF reset i40e: Fix queues reservation for XDP i40e: Fix issue when maximum queues is exceeded i40e: Increase delay to 1 s after global EMP reset powerpc/32: Fix boot failure with GCC latent entropy plugin powerpc/32s: Fix kasan_init_region() for KASAN powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs x86/MCE/AMD: Allow thresholding interface updates after init sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask ocfs2: fix a deadlock when commit trans jbd2: export jbd2_journal_[grab|put]_journal_head ucsi_ccg: Check DEV_INT bit only when starting CCG4 usb: typec: tcpm: Do not disconnect while receiving VBUS off USB: core: Fix hang in usb_kill_urb by adding memory barriers usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS usb: common: ulpi: Fix crash in ulpi_match() usb: xhci-plat: fix crash when suspend if remote wake enable usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge tty: Add support for Brainboxes UC cards. tty: n_gsm: fix SW flow control encoding/handling serial: stm32: fix software flow control transfer serial: 8250: of: Fix mapped region size when using reg-offset property netfilter: nft_payload: do not update layer 4 checksum when mangling fragments arm64: errata: Fix exec handling in erratum 1418040 workaround KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS drm/etnaviv: relax submit size limits perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX Revert "KVM: SVM: avoid infinite loop on NPF from bad address" fsnotify: fix fsnotify hooks in pseudo filesystems ceph: set pool_ns in new inode layout for async creates ceph: properly put ceph_string reference after async create attempt tracing: Don't inc err_log entry count if entry allocation fails tracing/histogram: Fix a potential memory leak for kstrdup() PM: wakeup: simplify the output logic of pm_show_wakelocks() efi: runtime: avoid EFIv2 runtime services on Apple x86 machines udf: Fix NULL ptr deref when converting from inline format udf: Restore i_lenAlloc when inode expansion fails scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() s390/hypfs: include z/VM guests with access control group set s390/module: fix loading modules with a lot of relocations net: stmmac: skip only stmmac_ptp_register when resume from suspend net: sfp: ignore disabled SFP node media: venus: core: Drop second v4l2 device unregister Bluetooth: refactor malicious adv data check ANDROID: Fix CRC issue up with xfrm headers in 5.10.94 Revert "xfrm: rate limit SA mapping change message to user space" Revert "clocksource: Reduce clocksource-skew threshold" Revert "clocksource: Avoid accidental unstable marking of clocksources" Linux 5.10.95 drm/vmwgfx: Fix stale file descriptors on failed usercopy select: Fix indefinitely sleeping task in poll_schedule_timeout() KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU rcu: Tighten rcu_advance_cbs_nowake() checks bnx2x: Invalidate fastpath HSI version for VFs bnx2x: Utilize firmware 7.13.21.0 drm/i915: Flush TLBs before releasing backing store Linux 5.10.94 scripts: sphinx-pre-install: Fix ctex support on Debian scripts: sphinx-pre-install: add required ctex dependency ath10k: Fix the MTU size on QCA9377 SDIO mtd: nand: bbt: Fix corner case in bad block table handling lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault lib82596: Fix IRQ check in sni_82596_probe scripts/dtc: dtx_diff: remove broken example from help text dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7 dt-bindings: display: meson-vpu: Add missing amlogic,canvas property dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property net: mscc: ocelot: fix using match before it is set net: sfp: fix high power modules without diagnostic monitoring net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() bcmgenet: add WOL IRQ check net_sched: restore "mpu xxx" handling net: bonding: fix bond_xmit_broadcast return value error bug arm64: dts: qcom: msm8996: drop not documented adreno properties devlink: Remove misleading internal_flags from health reporter dump perf probe: Fix ppc64 'perf probe add events failed' case dmaengine: at_xdmac: Fix at_xdmac_lld struct definition dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix concurrency over xfers_list dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending dmaengine: at_xdmac: Don't start transactions at tx_submit level perf script: Fix hex dump character output libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() xfrm: Don't accidentally set RTO_ONLINK in decode_session4() netns: add schedule point in ops_exit_list() inet: frags: annotate races around fqdir->dead and fqdir->high_thresh taskstats: Cleanup the use of task->exit_code virtio_ring: mark ring unused on error vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 rtc: pxa: fix null pointer dereference HID: vivaldi: fix handling devices not using numbered reports net: axienet: increase default TX ring size to 128 net: axienet: fix for TX busy handling net: axienet: fix number of TX ring slots for available check net: axienet: Fix TX ring slot available check net: axienet: limit minimum TX ring size net: axienet: add missing memory barriers net: axienet: reset core on initialization prior to MDIO access net: axienet: Wait for PhyRstCmplt after core reset net: axienet: increase reset timeout net/smc: Fix hung_task when removing SMC-R devices clk: si5341: Fix clock HW provider cleanup clk: Emit a stern warning with writable debugfs enabled af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress f2fs: fix to reserve space for IO align feature f2fs: compress: fix potential deadlock of compress file parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module net/fsl: xgmac_mdio: Add workaround for erratum A-009885 ipv4: avoid quadratic behavior in netns dismantle ipv4: update fib_info_cnt under spinlock protection perf evsel: Override attr->sample_period for non-libpfm4 events xdp: check prog type before updating BPF link bpftool: Remove inclusion of utilities.mak from Makefiles block: Fix fsync always failed if once failed powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses powerpc/cell: Fix clang -Wimplicit-fallthrough warning Revert "net/mlx5: Add retry mechanism to the command entry index allocation" dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK RDMA/rxe: Fix a typo in opcode name RDMA/hns: Modify the mapping attribute of doorbell to device dmaengine: uniphier-xdmac: Fix type of address variables scsi: core: Show SCMD_LAST in text form Bluetooth: hci_sync: Fix not setting adv set duration Documentation: fix firewire.rst ABI file path error Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Documentation: ACPI: Fix data node reference documentation Documentation: dmaengine: Correctly describe dmatest with channel unset media: correct MEDIA_TEST_SUPPORT help text drm/vc4: hdmi: Make sure the device is powered with CEC media: rcar-csi2: Optimize the selection PHTW register can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message firmware: Update Kconfig help text for Google firmware of: base: Improve argument length mismatch error drm/radeon: fix error handling in radeon_driver_open_kms ext4: don't use the orphan list when migrating an inode ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal ext4: fast commit may miss tracking unwritten range during ftruncate ext4: use ext4_ext_remove_space() for fast commit replay delete range ext4: Fix BUG_ON in ext4_bread when write quota data ext4: set csum seed in tmp inode while migrating to extents ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE ext4: initialize err_blk before calling __ext4_get_inode_loc ext4: fix a possible ABBA deadlock due to busy PA ext4: make sure quota gets properly shutdown on error ext4: make sure to reset inode lockdep class when quota enabling fails btrfs: respect the max size in the header when activating swap file btrfs: check the root node for uptodate before returning it btrfs: fix deadlock between quota enable and other quota operations xfrm: fix policy lookup for ipv6 gre packets PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device PCI: pci-bridge-emul: Correctly set PCIe capabilities PCI: pci-bridge-emul: Fix definitions of reserved bits PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors PCI: xgene: Fix IB window setup powerpc/64s/radix: Fix huge vmap false positive parisc: Fix lpa and lpa_user defines drm/bridge: analogix_dp: Make PSR-exit block less drm/nouveau/kms/nv04: use vzalloc for nv04_display drm/etnaviv: limit submit sizes device property: Fix fwnode_graph_devcon_match() fwnode leak s390/mm: fix 2KB pgtable release race iwlwifi: mvm: Increase the scan timeout guard to 30 seconds tracing/kprobes: 'nmissed' not showed correctly for kretprobe cputime, cpuacct: Include guest time in user time in cpuacct.stat serial: Fix incorrect rs485 polarity on uart open fuse: Pass correct lend value to filemap_write_and_wait_range() xen/gntdev: fix unmap notification order spi: uniphier: Fix a bug that doesn't point to private data correctly tpm: fix NPE on probe for missing device ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers crypto: caam - replace this_cpu_ptr with raw_cpu_ptr crypto: stm32/crc32 - Fix kernel BUG triggered in probe() crypto: omap-aes - Fix broken pm_runtime_and_get() usage rpmsg: core: Clean up resources on announce_create failure. phy: mediatek: Fix missing check in mtk_mipi_tx_probe ASoC: mediatek: mt8183: fix device_node leak ASoC: mediatek: mt8173: fix device_node leak scsi: sr: Don't use GFP_DMA MIPS: Octeon: Fix build errors using clang i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time MIPS: OCTEON: add put_device() after of_find_device_by_node() udf: Fix error handling in udf_new_inode() powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic powerpc: handle kdump appropriately with crash_kexec_post_notifiers option selftests/powerpc/spectre_v2: Return skip code when miss_percent is high powerpc/40x: Map 32Mbytes of memory at startup MIPS: Loongson64: Use three arguments for slti ALSA: seq: Set upper limit of processed events scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup dm: fix alloc_dax error handling in alloc_dev nvmem: core: set size for sysfs bin file w1: Misuse of get_user()/put_user() reported by sparse KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots powerpc/powermac: Add missing lockdep_register_key() clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB i2c: mpc: Correct I2C reset procedure powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: i801: Don't silently correct invalid transfer size powerpc/watchdog: Fix missed watchdog reset due to memory ordering race powerpc/btext: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/6xx: add missing of_node_put x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs parisc: Avoid calling faulthandler_disabled() twice random: do not throw away excess input to crng_fast_load serial: core: Keep mctrl register state and cached copy in sync serial: pl010: Drop CR register reset on set_termios regulator: qcom_smd: Align probe function with rpmh-regulator net: gemini: allow any RGMII interface mode net: phy: marvell: configure RGMII delays for 88E1118 mlxsw: pci: Avoid flow control for EMAD packets dm space map common: add bounds check to sm_ll_lookup_bitmap() dm btree: add a defensive bounds check to insert_at() mac80211: allow non-standard VHT MCS-10/11 net: mdio: Demote probed message to debug print btrfs: remove BUG_ON(!eie) in find_parent_nodes btrfs: remove BUG_ON() in find_parent_nodes() ACPI: battery: Add the ThinkPad "Not Charging" quirk amdgpu/pm: Make sysfs pm attributes as read-only for VFs drm/amdgpu: fixup bad vram size on gmc v8 ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 ACPICA: Fix wrong interpretation of PCC address ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions jffs2: GC deadlock reading a page that is used in jffs2_write_begin() drm/etnaviv: consider completed fence seqno in hang check xfrm: rate limit SA mapping change message to user space Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES ath11k: Fix napi related hang um: registers: Rename function names to avoid conflicts and build problems iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ iwlwifi: mvm: Fix calculation of frame length iwlwifi: remove module loading failure message iwlwifi: fix leaks/bad data after failed firmware load PM: AVS: qcom-cpr: Use div64_ul instead of do_div rtw88: 8822c: update rx settings to prevent potential hw deadlock ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 cpufreq: Fix initialization of min and max frequency QoS requests PM: runtime: Add safety net to supplier device release arm64: tegra: Adjust length of CCPLEX cluster MMIO region arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus audit: ensure userspace is penalized the same as the kernel when under pressure mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() media: igorplugusb: receiver overflow should be reported HID: quirks: Allow inverting the absolute X/Y values bpf: Do not WARN in bpf_warn_invalid_xdp_action() net: bonding: debug: avoid printing debug logs when bond is not notifying peers x86/mce: Mark mce_read_aux() noinstr x86/mce: Mark mce_end() noinstr x86/mce: Mark mce_panic() noinstr x86/mce: Allow instrumentation during task work queueing ath11k: Avoid false DEADLOCK warning reported by lockdep selftests/ftrace: make kprobe profile testcase description unique gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock net: phy: prefer 1000baseT over 1000baseKX net-sysfs: update the queue counts in the unregistration path ath10k: Fix tx hanging ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work iwlwifi: mvm: avoid clearing a just saved session protection id iwlwifi: mvm: synchronize with FW after multicast commands thunderbolt: Runtime PM activate both ends of the device link media: m920x: don't use stack on USB reads media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: rcar-vin: Update format alignment constraints media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. drm: rcar-du: Fix CRTC timings when CMM is used x86/mm: Flush global TLB when switching to trampoline page-table floppy: Add max size check for user space request usb: uhci: add aspeed ast2600 uhci support arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win ACPI / x86: Allow specifying acpi_device_override_status() quirks by path ACPI: Change acpi_device_always_present() into acpi_device_override_status() ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions ath11k: Avoid NULL ptr access during mgmt tx cleanup rsi: Fix out-of-bounds read in rsi_read_pkt() rsi: Fix use-after-free in rsi_rx_done_handler() mwifiex: Fix skb_over_panic in mwifiex_usb_recv() crypto: jitter - consider 32 LSB for APT HSI: core: Fix return freed object in hsi_new_client gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown() drm/bridge: megachips: Ensure both bridges are probed before registration mlxsw: pci: Add shutdown method in PCI driver soc: ti: pruss: fix referenced node in error message drm/amdgpu/display: set vblank_disable_immediate for DC drm/amd/display: check top_pipe_to_program pointer ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART EDAC/synopsys: Use the quirk for version instead of ddr version media: b2c2: Add missing check in flexcop_pci_isr: HID: apple: Do not reset quirks when the Fn key is not found drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L usb: gadget: f_fs: Use stream_open() for endpoint files ath11k: Fix crash caused by uninitialized TX ring media: atomisp: handle errors at sh_css_create_isp_params() batman-adv: allow netlink usage in unprivileged containers ARM: shmobile: rcar-gen2: Add missing of_node_put() media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure media: atomisp: set per-device's default mode media: atomisp: fix try_fmt logic drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply selftests/bpf: Fix bpf_object leak in skb_ctx selftest drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y fs: dlm: filter user dlm messages for kernel locks Bluetooth: Fix debugfs entry leak in hci_register_dev() ARM: dts: omap3-n900: Fix lp5523 for multi color of: base: Fix phandle argument length mismatch error message clk: bm1880: remove kfrees on static allocations ASoC: fsl_asrc: refine the check of available clock divider RDMA/cxgb4: Set queue pair state when being queried ASoC: fsl_mqs: fix MODULE_ALIAS powerpc/xive: Add missing null check after calling kmalloc mips: bcm63xx: add support for clk_set_parent() mips: lantiq: add support for clk_set_parent() arm64: tegra: Remove non existent Tegra194 reset arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering counter: stm32-lptimer-cnt: remove iio counter abi misc: lattice-ecp3-config: Fix task hung when firmware load failed ASoC: samsung: idma: Check of ioremap return value ASoC: mediatek: Check for error clk pointer phy: uniphier-usb3ss: fix unintended writing zeros to PHY register scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() iommu/iova: Fix race between FQ timeout and teardown ASoC: Intel: catpt: Test dmaengine_submit() result before moving on iommu/amd: Restore GA log/tail pointer on host resume iommu/amd: Remove iommu_init_ga() dmaengine: pxa/mmp: stop referencing config->slave_id mips: fix Kconfig reference to PHYS_ADDR_T_64BIT mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell of: unittest: 64 bit dma address test requires arch support of: unittest: fix warning on PowerPC frame size warning ASoC: rt5663: Handle device_property_read_u32_array error codes RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry RDMA/core: Let ib_find_gid() continue search even after empty entry powerpc/powermac: Add additional missing lockdep_register_key() PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() RDMA/qedr: Fix reporting max_{send/recv}_wr attrs scsi: ufs: Fix race conditions related to driver data iommu/io-pgtable-arm: Fix table descriptor paddr formatting openrisc: Add clone3 ABI wrapper binder: fix handling of error during copy char/mwave: Adjust io port register size ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID ALSA: oss: fix compile error when OSS_DEBUG is enabled clocksource: Avoid accidental unstable marking of clocksources clocksource: Reduce clocksource-skew threshold powerpc/32s: Fix shift-out-of-bounds in KASAN init powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC powerpc/irq: Add helper to set regs->softe powerpc/perf: move perf irq/nmi handling details into traps.c powerpc/perf: MMCR0 control for PMU registers under PMCC=00 powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C dt-bindings: thermal: Fix definition of cooling-maps contribution property ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA powerpc/prom_init: Fix improper check of prom_getprop() clk: imx8mn: Fix imx8mn_clko1_sels scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd() RDMA/hns: Validate the pkey index RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" ALSA: hda: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ext4: avoid trim error on fs with small groups net: mcs7830: handle usb read errors properly iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing() pcmcia: fix setting of kthread task states can: xilinx_can: xcan_probe(): check for error irq can: softing: softing_startstop(): fix set but not used variable warning tpm_tis: Fix an error handling path in 'tpm_tis_core_init()' tpm: add request_locality before write TPM_INT_ENABLE can: mcp251xfd: add missing newline to printed strings regmap: Call regmap_debugfs_exit() prior to _init() netrom: fix api breakage in nr_setsockopt() ax25: uninitialized variable in ax25_setsockopt() spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() lib/mpi: Add the return value check of kcalloc() net/mlx5: Set command entry semaphore up once got index free Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" net/mlx5e: Don't block routes with nexthop objects in SW net/mlx5e: Fix page DMA map/unmap attributes debugfs: lockdown: Allow reading debugfs files that are not world readable HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe Bluetooth: hci_bcm: Check for error irq fsl/fman: Check for null pointer after calling devm_ioremap staging: greybus: audio: Check null pointer rocker: fix a sleeping in atomic bug ppp: ensure minimum packet size in ppp_write() netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). bpf: Don't promote bogus looking registers after null check. netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() power: reset: mt6397: Check for null res pointer pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes x86/mce/inject: Avoid out-of-bounds write when setting flags hwmon: (mr75203) fix wrong power-up delay value x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS Bluetooth: hci_qca: Stop IBS timer during BT OFF software node: fix wrong node passed to find nargs_prop backlight: qcom-wled: Respect enabled-strings in set_brightness backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion backlight: qcom-wled: Override default length with qcom,enabled-strings backlight: qcom-wled: Fix off-by-one maximum with default num_strings backlight: qcom-wled: Pass number of elements to read to read_u32_array backlight: qcom-wled: Validate enabled string indices in DT bpftool: Enable line buffering for stdout Bluetooth: L2CAP: Fix using wrong mode um: virtio_uml: Fix time-travel external time propagation um: fix ndelay/udelay defines selinux: fix potential memleak in selinux_add_opt() mmc: meson-mx-sdio: add IRQ check mmc: meson-mx-sdhc: add IRQ check iwlwifi: mvm: test roc running status bits before removing the sta iwlwifi: mvm: fix 32-bit build in FTM ARM: dts: armada-38x: Add generic compatible to UART nodes arm64: dts: marvell: cn9130: enable CP0 GPIO controllers arm64: dts: marvell: cn9130: add GPIO and SPI aliases usb: ftdi-elan: fix memory leak on device disconnect ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding xfrm: state and policy should fail if XFRMA_IF_ID 0 xfrm: interface with if_id 0 should return error media: hantro: Fix probe func error path drm/tegra: vic: Fix DMA API misuse drm/bridge: ti-sn65dsi86: Set max register for regmap drm/msm/dpu: fix safe status debugfs file arm64: dts: qcom: ipq6018: Fix gpio-ranges property arm64: dts: qcom: c630: Fix soundcard setup ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes media: msi001: fix possible null-ptr-deref in msi001_probe() media: dw2102: Fix use after free ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors ath11k: Fix deleting uninitialized kernel timer during fragment cache flush crypto: stm32 - Revert broken pm_runtime_resume_and_get changes crypto: stm32/cryp - fix bugs and crash in tests crypto: stm32/cryp - fix lrw chaining mode crypto: stm32/cryp - fix double pm exit crypto: stm32/cryp - check early input data crypto: stm32/cryp - fix xts and race condition in crypto_engine requests crypto: stm32/cryp - fix CTR counter carry crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter selftests: harness: avoid false negatives if test has no ASSERTs selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST x86/uaccess: Move variable into switch case statement xfrm: fix a small bug in xfrm_sa_len() mwifiex: Fix possible ABBA deadlock rcu/exp: Mark current CPU as exp-QS in IPI loop second pass drm/msm/dp: displayPort driver need algorithm rational sched/rt: Try to restart rt period timer when rt runtime exceeded wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma media: si2157: Fix "warm" tuner state detection media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: dib8000: Fix a memleak in dib8000_init() arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 arm64: lib: Annotate {clear, copy}_page() as position-independent bpf: Remove config check to enable bpf support for branch records bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) bpf: Adjust BTF log size limit. sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity sched/fair: Fix detection of per-CPU kthreads waking a task Bluetooth: btmtksdio: fix resume failure staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() staging: rtl8192e: return error code from rtllib_softmac_init() floppy: Fix hang in watchdog when disk is ejected serial: amba-pl011: do not request memory region twice tty: serial: uartlite: allow 64 bit address arm64: dts: ti: k3-j7200: Correct the d-cache-sets info arm64: dts: ti: k3-j721e: Fix the L2 cache sets arm64: dts: ti: k3-j7200: Fix the L2 cache sets drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() thermal/drivers/imx8mm: Enable ADC when enabling monitor ACPI: EC: Rework flushing of EC work while suspended to idle cgroup: Trace event cgroup id fields should be u64 arm64: dts: qcom: msm8916: fix MMC controller aliases netfilter: bridge: add support for pppoe filtering thermal/drivers/imx: Implement runtime PM support media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' media: venus: core: Fix a potential NULL pointer dereference in an error handling path media: venus: core, venc, vdec: Fix probe dependency error media: venus: pm_helpers: Control core power domain manually media: coda: fix CODA960 JPEG encoder buffer overflow media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() media: imx-pxp: Initialize the spinlock prior to using it media: rcar-csi2: Correct the selection of hsfreqrange mfd: atmel-flexcom: Use .resume_noirq mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP tty: serial: atmel: Call dma_async_issue_pending() tty: serial: atmel: Check return code of dmaengine_submit() arm64: dts: ti: k3-j721e: correct cache-sets info ath11k: Use host CE parameters for CE interrupts configuration crypto: qat - fix undetected PFVF timeout in ACK loop crypto: qat - make pfvf send message direction agnostic crypto: qat - remove unnecessary collision prevention step in PFVF crypto: qat - fix spelling mistake: "messge" -> "message" ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove crypto: qce - fix uaf on qce_skcipher_register_one crypto: qce - fix uaf on qce_ahash_register_one media: dmxdev: fix UAF when dvb_register_device() fails arm64: dts: renesas: cat875: Add rx/tx delays drm/vboxvideo: fix a NULL vs IS_ERR() check fs: dlm: fix build with CONFIG_IPV6 disabled tee: fix put order in teedev_close_context() ath11k: reset RSN/WPA present state for open BSS ath11k: clear the keys properly via DISABLE_KEY ath11k: Fix ETSI regd with weather radar overlap Bluetooth: stop proccessing malicious adv data memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails fs: dlm: don't call kernel_getpeername() in error_report() fs: dlm: use sk->sk_socket instead of con->sock arm64: dts: meson-gxbb-wetek: fix missing GPIO binding arm64: dts: meson-gxbb-wetek: fix HDMI in early boot arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name media: aspeed: Update signal status immediately to ensure sane hw state media: em28xx: fix memory leak in em28xx_init_dev media: aspeed: fix mode-detect always time out at 2nd run media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() media: atomisp: fix enum formats logic media: atomisp: add NULL check for asd obtained from atomisp_video_pipe media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c media: atomisp: fix ifdefs in sh_css.c media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() media: atomisp: do not use err var when checking port validity for ISP2400 media: atomisp: fix inverted logic in buffers_needed() media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() media: videobuf2: Fix the size printk format mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware wcn36xx: fix RX BD rate mapping for 5GHz legacy rates wcn36xx: populate band before determining rate on RX wcn36xx: Put DXE block into reset before freeing memory wcn36xx: Release DMA channel descriptor allocations wcn36xx: Fix DMA channel enable/disable cycle wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan drm/vc4: hdmi: Set a default HSM rate clk: bcm-2835: Remove rounding up the dividers clk: bcm-2835: Pick the closest clock rate Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails drm/rockchip: dsi: Reconfigure hardware on resume() drm/rockchip: dsi: Disable PLL clock on bind error drm/rockchip: dsi: Hold pm-runtime across bind/unbind drm/rockchip: dsi: Fix unbalanced clock on probe error drm/panel: innolux-p079zca: Delete panel on attach() failure drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure drm: fix null-ptr-deref in drm_dev_init_release() drm/bridge: display-connector: fix an uninitialized pointer in probe() Bluetooth: L2CAP: Fix not initializing sk_peer_pid drm/ttm: Put BO in its memory manager's lru list shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages dma/pool: create dma atomic pool only if dma zone has managed pages mm_zone: add function to check if managed dma zone exists PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() gpu: host1x: Add back arm_iommu_detach_device() iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs can: softing_cs: softingcs_probe(): fix memleak on registration failure media: cec-pin: fix interrupt en/disable handling media: stk1160: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: redrat3: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: s2255: fix control-message timeouts media: cpia2: fix control-message timeouts media: em28xx: fix control-message timeouts media: mceusb: fix control-message timeouts media: flexcop-usb: fix control-message timeouts media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE rtc: cmos: take rtc_lock while reading from CMOS tools/nolibc: fix incorrect truncation of exit code tools/nolibc: i386: fix initial stack alignment tools/nolibc: x86-64: Fix startup code bug x86/gpu: Reserve stolen memory for first integrated Intel GPU mtd: rawnand: davinci: Rewrite function description mtd: rawnand: davinci: Avoid duplicated page read mtd: rawnand: davinci: Don't calculate ECC when reading page mtd: Fixed breaking list in __mtd_del_partition. mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() f2fs: fix to do sanity check in is_alive() HID: wacom: Avoid using stale array indicies to read contact count HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Reset expected and received contact counts at the same time HID: uhid: Fix worker destroying device without any protection KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Linux 5.10.93 mtd: fixup CFI on ixp4xx powerpc/pseries: Get entry and uaccess flush required bits from H_GET_CPU_CHARACTERISTICS ALSA: hda/realtek: Re-order quirk entries for Lenovo ALSA: hda/realtek: Add quirk for Legion Y9000X 2020 ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices KVM: x86: remove PMU FIXED_CTR3 from msrs_to_save_all firmware: qemu_fw_cfg: fix kobject leak in probe error path firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries firmware: qemu_fw_cfg: fix sysfs information leak rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled media: uvcvideo: fix division by zero at stream start video: vga16fb: Only probe for EGA and VGA 16 color graphic cards 9p: only copy valid iattrs in 9P2000.L setattr implementation KVM: s390: Clarify SIGP orders versus STOP/RESTART KVM: x86: Register Processor Trace interrupt hook iff PT enabled in guest perf: Protect perf_guest_cbs with RCU vfs: fs_context: fix up param length parsing in legacy_parse_param remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() devtmpfs regression fix: reconfigure on each mount kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test Linux 5.10.92 staging: greybus: fix stack size warning with UBSAN drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() media: Revert "media: uvcvideo: Set unique vdev name based in type" random: fix crash on multiple early calls to add_bootloader_randomness() random: fix data race on crng init time random: fix data race on crng_node_pool can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} can: isotp: convert struct tpcon::{idx,len} to unsigned int can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() veth: Do not record rx queue hint in veth_xmit mmc: sdhci-pci: Add PCI ID for Intel ADL ath11k: Fix buffer overflow when scanning with extraie USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status USB: core: Fix bug in resuming hub's handling of wakeup requests ARM: dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100 Bluetooth: bfusb: fix division by zero in send path Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0 Bluetooth: btusb: Add support for Foxconn MT7922A Bluetooth: btusb: Add two more Bluetooth parts for WCN6855 Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb() bpf: Fix out of bounds access from invalid *_or_null type verification workqueue: Fix unbind_workers() VS wq_worker_running() race md: revert io stats accounting Linux 5.10.91 Input: zinitix - make sure the IRQ is allocated before it gets enabled ARM: dts: gpio-ranges property is now required ipv6: raw: check passed optlen before reading drm/amd/display: Added power down for DCN10 mISDN: change function names to avoid conflicts atlantic: Fix buff_ring OOB in aq_ring_rx_clean net: udp: fix alignment problem in udp4_seq_show() ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() usb: mtu3: fix interval value for intr and isoc ipv6: Do cleanup if attribute validation fails in multipath route ipv6: Continue processing multipath route even if gateway attribute is invalid power: bq25890: Enable continuous conversion for ADC at charging phonet: refcount leak in pep_sock_accep rndis_host: support Hytera digital radios power: reset: ltc2952: Fix use of floating point literals power: supply: core: Break capacity loop xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate net: ena: Fix error handling when calculating max IO queues number net: ena: Fix undefined state when tx request id is out of bounds sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc batman-adv: mcast: don't send link-local multicast to mcast routers lwtunnel: Validate RTA_ENCAP_TYPE attribute length ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route ipv6: Check attribute length for RTA_GATEWAY in multipath route ipv4: Check attribute length for RTA_FLOW in multipath route ipv4: Check attribute length for RTA_GATEWAY in multipath route ftrace/samples: Add missing prototypes direct functions i40e: Fix incorrect netdev's real number of RX/TX queues i40e: Fix for displaying message regarding NVM version i40e: fix use-after-free in i40e_sync_filters_subtask() sfc: The RX page_ring is optional mac80211: initialize variable have_higher_than_11mbit RDMA/uverbs: Check for null return of kmalloc_array netrom: fix copying in user data in nr_setsockopt RDMA/core: Don't infoleak GRH fields iavf: Fix limit of total number of queues to active queues of VF i40e: Fix to not show opcode msg on unsuccessful VF MAC change ieee802154: atusb: fix uninit value in atusb_set_extended_addr tracing: Tag trace_percpu_buffer as a percpu pointer tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() f2fs: quota: fix potential deadlock Linux 5.10.90 bpf: Add kconfig knob for disabling unpriv bpf by default perf script: Fix CPU filtering of a script's switch events net: fix use-after-free in tw_timer_handler Input: spaceball - fix parsing of movement data packets Input: appletouch - initialize work before device registration scsi: vmw_pvscsi: Set residual data length conditionally binder: fix async_free_space accounting for empty parcels usb: mtu3: set interval of FS intr and isoc endpoint usb: mtu3: fix list_head check warning usb: mtu3: add memory barrier before set GPD's HWO usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. drm/amdgpu: add support for IP discovery gc_info table v2 drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled uapi: fix linux/nfc.h userspace compilation errors nfc: uapi: use kernel size_t to fix user-space builds i2c: validate user data in compat ioctl fsl/fman: Fix missing put_device() call in fman_port_probe net/ncsi: check for error return from call to nla_put_u32 selftests/net: udpgso_bench_tx: fix dst ip argument net/mlx5e: Fix wrong features assignment in case of error ionic: Initialize the 'lif->dbid_inuse' bitmap igc: Fix TX timestamp support for non-MSI-X platforms net/smc: fix kernel panic caused by race of smc_sock net/smc: don't send CDC/LLC message if link not ready net/smc: improved fix wait on already cleared link NFC: st21nfca: Fix memory leak in device probe and remove net: lantiq_xrx200: fix statistics of received bytes net: ag71xx: Fix a potential double free in error handling paths net: usb: pegasus: Do not drop long Ethernet frames net/smc: fix using of uninitialized completions sctp: use call_rcu to free endpoint selftests: Calculate udpgso segment count without header adjustment udp: using datalen to cap ipv6 udp max gso segments net/mlx5e: Fix ICOSQ recovery flow for XSK net/mlx5e: Wrap the tx reporter dump callback to extract the sq net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() selinux: initialize proto variable in selinux_ip_postroute_compat() recordmcount.pl: fix typo in s390 mcount regex memblock: fix memblock_phys_alloc() section mismatch error platform/x86: apple-gmux: use resource_size() with res parisc: Clear stale IIR value on instruction access rights trap tomoyo: use hwight16() in tomoyo_domain_quota_is_ok() tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). Input: i8042 - enable deferred probe quirk for ASUS UM325UA Input: i8042 - add deferred probe support Linux 5.10.89 phonet/pep: refuse to enable an unbound pipe hamradio: improve the incomplete fix to avoid NPD hamradio: defer ax25 kfree after unregister_netdev ax25: NPD bug when detaching AX25 device hwmon: (lm90) Do not report 'busy' status bit as alarm hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681 pinctrl: mediatek: fix global-out-of-bounds issue ASoC: rt5682: fix the wrong jack type detected ASoC: tas2770: Fix setting of high sample rates Input: goodix - add id->model mapping for the "9111" model Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312 mm: mempolicy: fix THP allocations escaping mempolicy restrictions KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state usb: gadget: u_ether: fix race in setting MAC address in setup phase ceph: fix up non-directory creation in SGID directories f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() tee: optee: Fix incorrect page free bug mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() mac80211: fix locking in ieee80211_start_ap error path ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling mmc: mmci: stm32: clear DLYB_CR after sending tuning command mmc: core: Disable card detect during shutdown mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands mmc: sdhci-tegra: Fix switch to HS400ES mode gpio: dln2: Fix interrupts when replugging the device pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU platform/x86: intel_pmc_core: fix memleak on registration failure x86/pkey: Fix undefined behaviour with PKRU_WD_BIT tee: handle lookup of shm with reference count 0 parisc: Fix mask used to select futex spinlock parisc: Correct completer in lws start ipmi: fix initialization when workqueue allocation fails ipmi: ssif: initialize ssif_info->client early ipmi: bail out if init_srcu_struct fails Input: atmel_mxt_ts - fix double free in mxt_read_info_block ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s ALSA: hda/realtek: Fix quirk for Clevo NJ51CU ALSA: hda/realtek: Add new alc285-hp-amp-init model ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 ALSA: drivers: opl3: Fix incorrect use of vp->state ALSA: jack: Check the return value of kstrdup() hwmon: (lm90) Drop critical attribute support for MAX6654 hwmon: (lm90) Introduce flag indicating extended temperature support hwmon: (lm90) Add basic support for TI TMP461 hwmon: (lm90) Fix usage of CONFIG2 register in detect function pinctrl: bcm2835: Change init order for gpio hogs Input: elantech - fix stack out of bound access in elantech_change_report_id() sfc: falcon: Check null pointer of rx_queue->page_ring sfc: Check null pointer of rx_queue->page_ring net: ks8851: Check for error irq drivers: net: smc911x: Check for error irq fjes: Check for error irq bonding: fix ad_actor_system option setting to default ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module igb: fix deadlock caused by taking RTNL in RPM resume path net: skip virtio_net_hdr_set_proto if protocol already set net: accept UFOv6 packages in virtio_net_hdr_to_skb qlcnic: potential dereference null pointer of rx_queue->page_ring net: marvell: prestera: fix incorrect return of port_find ARM: dts: imx6qdl-wandboard: Fix Ethernet support netfilter: fix regression in looped (broad|multi)cast's MAC handling RDMA/hns: Replace kfree() with kvfree() IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent() spi: change clk_disable_unprepare to clk_unprepare arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode HID: potential dereference of null pointer HID: holtek: fix mouse probing ext4: check for inconsistent extents between index and leaf block ext4: check for out-of-order index extents in ext4_valid_extent_entries() ext4: prevent partial update of the extent blocks net: usb: lan78xx: add Allied Telesis AT29M2-AF arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd arm64: vdso32: drop -no-integrated-as flag Linux 5.10.88 xen/netback: don't queue unlimited number of packages xen/netback: fix rx queue stall detection xen/console: harden hvc_xen against event channel storms xen/netfront: harden netfront against event channel storms xen/blkfront: harden blkfront against event channel storms Revert "xsk: Do not sleep in poll() when need_wakeup set" bus: ti-sysc: Fix variable set but not used warning for reinit_modules rcu: Mark accesses to rcu_state.n_force_qs scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() scsi: scsi_debug: Fix type in min_t to avoid stack OOB scsi: scsi_debug: Don't call kcalloc() if size arg is zero ovl: fix warning in ovl_create_real() fuse: annotate lock in fuse_reverse_inval_entry() media: mxl111sf: change mutex_init() location xsk: Do not sleep in poll() when need_wakeup set ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name Input: touchscreen - avoid bitwise vs logical OR warning drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE libata: if T_LENGTH is zero, dma direction should be DMA_NONE timekeeping: Really make sure wall_to_monotonic isn't positive serial: 8250_fintek: Fix garbled text for console iocost: Fix divide-by-zero on donation from low hweight cgroup zonefs: add MODULE_ALIAS_FS btrfs: fix double free of anon_dev after failure to create subvolume btrfs: fix memory leak in __add_inode_ref() USB: serial: option: add Telit FN990 compositions USB: serial: cp210x: fix CP2105 GPIO registration usb: xhci: Extend support for runtime power management for AMD's Yellow carp. PCI/MSI: Mask MSI-X vectors only on success PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES Revert "usb: early: convert to readl_poll_timeout_atomic()" USB: gadget: bRequestType is a bitfield, not a enum powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n bpf, selftests: Fix racing issue in btf_skc_cls_ingress test sit: do not call ipip6_dev_free() from sit_init_net() net: systemport: Add global locking for descriptor lifecycle net/smc: Prevent smc_release() from long blocking net: Fix double 0x prefix print in SKB dump sfc_ef100: potential dereference of null pointer net/packet: rx_owner_map depends on pg_vec netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc ixgbe: set X550 MDIO speed before talking to PHY ixgbe: Document how to enable NBASE-T support igc: Fix typo in i225 LTR functions igbvf: fix double free in `igbvf_probe` igb: Fix removal of unicast MAC filters of VFs soc/tegra: fuse: Fix bitwise vs. logical OR warning mptcp: clear 'kern' flag from fallback sockets drm/amd/pm: fix a potential gpu_metrics_table memory leak rds: memory leak in __rds_conn_create() flow_offload: return EOPNOTSUPP for the unsupported mpls action type mac80211: fix lookup when adding AddBA extension element mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock drm/ast: potential dereference of null pointer selftest/net/forwarding: declare NETIFS p9 p10 net/sched: sch_ets: don't remove idle classes from the round-robin list dmaengine: st_fdma: fix MODULE_ALIAS selftests: Fix IPv6 address bind tests selftests: Fix raw socket bind tests with VRF selftests: Add duplicate config only for MD5 VRF tests net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg inet_diag: fix kernel-infoleak for UDP sockets sch_cake: do not call cake_destroy() from cake_init() s390/kexec_file: fix error handling when applying relocations selftests: net: Correct ping6 expected rc from 2 to 1 virtio/vsock: fix the transport to work with VMADDR_CID_ANY soc: imx: Register SoC device only on i.MX boards clk: Don't parent clks until the parent is fully registered ARM: socfpga: dts: fix qspi node compatible ceph: initialize pathlen variable in reconnect_caps_cb ceph: fix duplicate increment of opened_inodes metric tee: amdtee: fix an IS_ERR() vs NULL bug mac80211: track only QoS data frames for admission control arm64: dts: rockchip: fix audio-supply for Rock Pi 4 arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge arm64: dts: imx8mp-evk: Improve the Ethernet PHY description arm64: dts: imx8m: correct assigned clocks for FEC audit: improve robustness of the audit queue handling dm btree remove: fix use after free in rebalance_children() recordmcount.pl: look for jgnop instruction as well as bcrl on s390 vdpa: check that offsets are within bounds virtio_ring: Fix querying of maximum DMA mapping size for virtio device bpf, selftests: Add test case trying to taint map value pointer bpf: Make 32->64 bounds propagation slightly more robust bpf: Fix signed bounds propagation after mov32 firmware: arm_scpi: Fix string overflow in SCPI genpd driver mac80211: validate extended element ID is present mac80211: send ADDBA requests using the tid/queue of the aggregation session mac80211: mark TX-during-stop for TX in in_reconfig mac80211: fix regression in SSN handling of addba tx KVM: downgrade two BUG_ONs to WARN_ON_ONCE KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE Linux 5.10.87 arm: ioremap: don't abuse pfn_valid() to check if pfn is in RAM arm: extend pfn_valid to take into account freed memory map alignment memblock: ensure there is no overflow in memblock_overlaps_region() memblock: align freed memory map on pageblock boundaries with SPARSEMEM memblock: free_unused_memmap: use pageblock units instead of MAX_ORDER perf intel-pt: Fix error timestamp setting on the decoder error path perf intel-pt: Fix missing 'instruction' events with 'q' option perf intel-pt: Fix next 'err' value, walking trace perf intel-pt: Fix state setting when receiving overflow (OVF) packet perf intel-pt: Fix intel_pt_fup_event() assumptions about setting state type perf intel-pt: Fix sync state when a PSB (synchronization) packet is found perf intel-pt: Fix some PGE (packet generation enable/control flow packets) usage perf inject: Fix itrace space allowed for new attributes ethtool: do not perform operations on net devices being unregistered hwmon: (dell-smm) Fix warning on /proc/i8k creation error fuse: make sure reclaim doesn't write the inode bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc staging: most: dim2: use device release method KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req tracing: Fix a kmemleak false positive in tracing_map drm/amd/display: add connector type check for CRC source set drm/amd/display: Fix for the no Audio bug with Tiled Displays net: netlink: af_netlink: Prevent empty skb by adding a check on len. i2c: rk3x: Handle a spurious start completion interrupt flag parisc/agp: Annotate parisc agp init functions with __init ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid net/mlx4_en: Update reported link modes for 1/10G Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP" s390/test_unwind: use raw opcode instead of invalid instruction KVM: arm64: Save PSTATE early on exit drm/msm/dsi: set default num_data_lanes nfc: fix segfault in nfc_genl_dump_devices_done Linux 5.10.86 netfilter: selftest: conntrack_vrf.sh: fix file permission Linux 5.10.85 Documentation/Kbuild: Remove references to gcc-plugin.sh MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal doc: gcc-plugins: update gcc-plugins.rst kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc bpf: Add selftests to cover packet access corner cases misc: fastrpc: fix improper packet size calculation irqchip: nvic: Fix offset for Interrupt Priority Offsets irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL irqchip/armada-370-xp: Fix support for Multi-MSI interrupts irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() irqchip/aspeed-scu: Replace update_bits with write_bits. csky: fix typo of fpu config macro iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove iio: ad7768-1: Call iio_trigger_notify_done() on error iio: adc: axp20x_adc: fix charging current reporting on AXP22x iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda iio: at91-sama5d2: Fix incorrect sign extension iio: dln2: Check return value of devm_iio_trigger_register() iio: dln2-adc: Fix lockdep complaint iio: itg3200: Call iio_trigger_notify_done() on error iio: kxsd9: Don't return error code in trigger handler iio: ltr501: Don't return error code in trigger handler iio: mma8452: Fix trigger reference couting iio: stk3310: Don't return error code in interrupt handler iio: trigger: stm32-timer: fix MODULE_ALIAS iio: trigger: Fix reference counting iio: gyro: adxrs290: fix data signedness xhci: avoid race between disable slot command and host runtime suspend usb: core: config: using bit mask instead of individual bits xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending usb: core: config: fix validation of wMaxPacketValue entries USB: gadget: zero allocate endpoint 0 buffers USB: gadget: detect too-big endpoint 0 requests selftests/fib_tests: Rework fib_rp_filter_test() net/qla3xxx: fix an error code in ql_adapter_up() net, neigh: clear whole pneigh_entry at alloc time net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() net: altera: set a couple error code in probe() net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero tools build: Remove needless libpython-version feature check that breaks test-all fast path dt-bindings: net: Reintroduce PHY no lane swap binding Documentation/locking/locktypes: Update migrate_disable() bits. perf tools: Fix SMT detection fast read path Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge" i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc mtd: rawnand: fsmc: Fix timing computation mtd: rawnand: fsmc: Take instruction delay into account i40e: Fix pre-set max number of queues for VF i40e: Fix failed opcode appearing if handling messages from VF clk: imx: use module_platform_driver RDMA/hns: Do not destroy QP resources in the hw resetting phase RDMA/hns: Do not halt commands during reset until later ASoC: codecs: wcd934x: return correct value from mixer put ASoC: codecs: wcd934x: handle channel mappping list correctly ASoC: codecs: wsa881x: fix return values from kcontrol put ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer ASoC: rt5682: Fix crash due to out of scope stack vars PM: runtime: Fix pm_runtime_active() kerneldoc comment qede: validate non LSO skb length scsi: scsi_debug: Fix buffer size of REPORT ZONES command scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc() block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) tracefs: Set all files to the same group ownership as the mount option net: mvpp2: fix XDP rx queues registering aio: fix use-after-free due to missing POLLFREE handling aio: keep poll requests on waitqueue until completed signalfd: use wake_up_pollfree() binder: use wake_up_pollfree() wait: add wake_up_pollfree() libata: add horkage for ASMedia 1092 can: m_can: Disable and ignore ELO interrupt can: pch_can: pch_can_rx_normal: fix use after free drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. clk: qcom: regmap-mux: fix parent clock lookup mmc: renesas_sdhi: initialize variable properly when tuning tracefs: Have new files inherit the ownership of their parent nfsd: Fix nsfd startup race (again) nfsd: fix use-after-free due to delegation race md: fix update super 1.0 on rdev size change btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling btrfs: clear extent buffer uptodate when we fail to write it scsi: qla2xxx: Format log strings only if needed ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() ALSA: pcm: oss: Limit the period size to 16MB ALSA: pcm: oss: Fix negative period/buffer sizes ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform ALSA: ctl: Fix copy of updated id with element read/write mm: bdi: initialize bdi_min_ratio when bdi is unregistered KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall net/sched: fq_pie: prevent dismantle issue devlink: fix netns refcount leak in devlink_nl_cmd_reload() IB/hfi1: Correct guard on eager buffer deallocation iavf: Fix reporting when setting descriptor count iavf: restore MSI state on reset netfilter: conntrack: annotate data-races around ct->timeout udp: using datalen to cap max gso segments seg6: fix the iif in the IPv6 socket control block nfp: Fix memory leak in nfp_cpp_area_cache_add() bonding: make tx_rebalance_counter an atomic ice: ignore dropped packets during init bpf: Fix the off-by-two error in range markings bpf, x86: Fix "no previous prototype" warning vrf: don't run conntrack on vrf with !dflt qdisc selftests: netfilter: add a vrf+conntrack testcase nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done drm/amdkfd: fix boot failure when iommu is disabled in Picasso. drm/amdgpu: init iommu after amdkfd device init drm/amdgpu: move iommu_resume before ip init/resume drm/amdgpu: add amdgpu_amdkfd_resume_iommu drm/amdkfd: separate kfd_iommu_resume from kfd_resume drm/amd/amdkfd: adjust dummy functions' placement x86/sme: Explicitly map new EFI memmap table as encrypted can: sja1000: fix use after free in ems_pcmcia_add_card() can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter can: kvaser_usb: get CAN clock frequency from device IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr IB/hfi1: Fix early init panic IB/hfi1: Insure use of smp_processor_id() is preempt disabled nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups HID: check for valid USB device for many HID drivers HID: wacom: fix problems when device is not a valid USB device HID: bigbenff: prevent null pointer dereference HID: add USB_HID dependancy on some USB HID drivers HID: add USB_HID dependancy to hid-chicony HID: add USB_HID dependancy to hid-prodikeys HID: add hid_is_usb() function to make it simpler for USB detection HID: google: add eel USB id HID: quirks: Add quirk for the Microsoft Surface 3 type-cover gcc-plugins: fix gcc 11 indigestion with plugins... gcc-plugins: simplify GCC plugin-dev capability test usb: gadget: uvc: fix multiple opens ANDROID: GKI: fix up abi breakage in fib_rules.h Linux 5.10.84 ipmi: msghandler: Make symbol 'remove_work_wq' static net/tls: Fix authentication failure in CCM mode parisc: Mark cr16 CPU clocksource unstable on all SMP machines iwlwifi: mvm: retry init flow if failed serial: 8250: Fix RTS modem control while in rs485 mode serial: 8250_pci: rewrite pericom_do_set_divisor() serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array serial: core: fix transmit-buffer reset and memleak serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 serial: pl011: Add ACPI SBSA UART match id tty: serial: msm_serial: Deactivate RX DMA for polling support x86/64/mm: Map all kernel memory into trampoline_pgd x86/tsc: Disable clocksource watchdog for TSC on qualified platorms x86/tsc: Add a timer to make sure TSC_adjust is always checked usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub xhci: Fix commad ring abort, write all 64 bits to CRCR register. vgacon: Propagate console boot parameters before calling `vc_resize' parisc: Fix "make install" on newer debian releases parisc: Fix KBUILD_IMAGE for self-extracting kernel x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry() x86/pv: Switch SWAPGS to ALTERNATIVE sched/uclamp: Fix rq->uclamp_max not set on first enqueue x86/xen: Add xenpv_restore_regs_and_return_to_usermode() x86/entry: Use the correct fence macro after swapgs in kernel CR3 x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword KVM: VMX: Set failure code in prepare_vmcs02() KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register atlantic: Remove warn trace message. atlantic: Fix statistics logic for production hardware Remove Half duplex mode speed capabilities. atlantic: Add missing DIDs and fix 115c. atlantic: Fix to display FW bundle version instead of FW mac version. atlatnic: enable Nbase-t speeds with base-t atlantic: Increase delay for fw transactions drm/msm: Do hw_init() before capturing GPU state drm/msm/a6xx: Allocate enough space for GMU registers net/smc: Keep smc_close_final rc during active close net/rds: correct socket tunable error in rds_tcp_tune() net/smc: fix wrong list_del in smc_lgr_cleanup_early ipv4: convert fib_num_tclassid_users to atomic_t net: annotate data-races on txq->xmit_lock_owner dpaa2-eth: destroy workqueue at the end of remove function net: marvell: mvpp2: Fix the computation of shared CPUs net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() ASoC: tegra: Fix kcontrol put callback in AHUB ASoC: tegra: Fix kcontrol put callback in DSPK ASoC: tegra: Fix kcontrol put callback in DMIC ASoC: tegra: Fix kcontrol put callback in I2S ASoC: tegra: Fix kcontrol put callback in ADMAIF ASoC: tegra: Fix wrong value type in DSPK ASoC: tegra: Fix wrong value type in DMIC ASoC: tegra: Fix wrong value type in I2S ASoC: tegra: Fix wrong value type in ADMAIF mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode selftests: net: Correct case name net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() arm64: ftrace: add missing BTIs siphash: use _unaligned version by default net: mpls: Fix notifications when deleting a device net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() tcp: fix page frag corruption on page fault natsemi: xtensa: fix section mismatch warnings i2c: cbus-gpio: set atomic transfer callback i2c: stm32f7: stop dma transfer in case of NACK i2c: stm32f7: recover the bus on access timeout i2c: stm32f7: flush TX FIFO upon transfer errors wireguard: ratelimiter: use kvcalloc() instead of kvzalloc() wireguard: receive: drop handshakes if queue lock is contended wireguard: receive: use ring buffer for incoming handshakes wireguard: device: reset peer src endpoint when netns exits wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST wireguard: selftests: actually test for routing loops wireguard: allowedips: add missing __rcu annotation to satisfy sparse wireguard: selftests: increase default dmesg log size tracing/histograms: String compares should not care about signed values KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg() KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1 KVM: x86: Use a stable condition around all VT-d PI paths KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST KVM: Disallow user memslot with size that exceeds "unsigned long" drm/amd/display: Allow DSC on supported MST branch devices ipv6: fix memory leak in fib6_rule_suppress sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl fget: check that the fd still exists after getting a ref to it s390/pci: move pseudo-MMIO to prevent MIO overlap cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink() ipmi: Move remove_work to dedicated workqueue rt2x00: do not mark device gone on EPROTO errors during start kprobes: Limit max data_size of the kretprobe instances vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit ACPI: Add stubs for wakeup handler functions net/smc: Avoid warning of possible recursive locking perf report: Fix memory leaks around perf_tip() perf hist: Fix memory leak of a perf_hpp_fmt perf inject: Fix ARM SPE handling net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound ipv6: check return value of ipv6_skip_exthdr ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile drm/amd/amdgpu: fix potential memleak drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again scsi: iscsi: Unblock session then wake up error handler thermal: core: Reset previous low and high trip during thermal zone init btrfs: check-integrity: fix a warning on write caching disabled disk s390/setup: avoid using memblock_enforce_memory_limit platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep platform/x86: thinkpad_acpi: Add support for dual fan control net: return correct error code atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait net/smc: Transfer remaining wait queue entries during fallback mac80211: do not access the IV when it was stripped drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory" gfs2: Fix length of holes reported at end-of-file gfs2: release iopen glock early in evict ovl: fix deadlock in splice write ovl: simplify file splice can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM NFSv42: Fix pagecache invalidation after COPY/CLONE ANDROID: GKI: update abi_gki_aarch64.xml due to bpf changes in 5.10.83 Revert "net: ipv6: add fib6_nh_release_dsts stub" Revert "net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group" Revert "mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB" Linux 5.10.83 drm/amdgpu/gfx9: switch to golden tsc registers for renoir+ net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP shm: extend forced shm destroy to support objects from several IPC nses s390/mm: validate VMA in PGSTE manipulation functions tty: hvc: replace BUG_ON() with negative return value xen/netfront: don't trust the backend response data blindly xen/netfront: disentangle tx_skb_freelist xen/netfront: don't read data from request on the ring page xen/netfront: read response from backend only once xen/blkfront: don't trust the backend response data blindly xen/blkfront: don't take local copy of a request from the ring page xen/blkfront: read response from backend only once xen: sync include/xen/interface/io/ring.h with Xen's newest version tracing: Check pid filtering when creating events vhost/vsock: fix incorrect used length reported to the guest iommu/amd: Clarify AMD IOMMUv2 initialization messages smb3: do not error on fsync when readonly ceph: properly handle statfs on multifs setups f2fs: set SBI_NEED_FSCK flag when inconsistent node block found sched/scs: Reset task stack state in bringup_cpu() tcp: correctly handle increased zerocopy args struct size net: mscc: ocelot: correctly report the timestamping RX filters in ethtool net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP net: hns3: fix VF RSS failed problem after PF enable multi-TCs net/smc: Don't call clcsock shutdown twice when smc shutdown net: vlan: fix underflow for the real_dev refcnt net/sched: sch_ets: don't peek at classes beyond 'nbands' tls: fix replacing proto_ops tls: splice_read: fix record type check MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 MIPS: loongson64: fix FTLB configuration igb: fix netpoll exit with traffic nvmet: use IOCB_NOWAIT only if the filesystem supports it net/smc: Fix loop in smc_listen net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() net: phylink: Force retrigger in case of latched link-fail indicator net: phylink: Force link down and retrigger resolve on interface change lan743x: fix deadlock in lan743x_phy_link_status_change() tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows drm/amd/display: Set plane update flags for all planes in reset PM: hibernate: use correct mode for swsusp_close() net/ncsi : Add payload to be 32-bit aligned to fix dropped packets nvmet-tcp: fix incomplete data digest send net: marvell: mvpp2: increase MTU limit when XDP enabled mlxsw: spectrum: Protect driver from buggy firmware mlxsw: Verify the accessed index doesn't exceed the array length net/smc: Ensure the active closing peer first closes clcsock erofs: fix deadlock when shrink erofs slab scsi: scsi_debug: Zero clear zones at reset write pointer scsi: core: sysfs: Fix setting device state to SDEV_RUNNING ice: avoid bpf_prog refcount underflow ice: fix vsi->txq_map sizing net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group net: ipv6: add fib6_nh_release_dsts stub net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume nfp: checking parameter process for rx-usecs/tx-usecs is invalid ipv6: fix typos in __ip6_finish_output() firmware: smccc: Fix check for ARCH_SOC_ID not implemented mptcp: fix delack timer ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec iavf: Prevent changing static ITR values if adaptive moderation is on net: marvell: prestera: fix double free issue on err path drm/vc4: fix error code in vc4_create_object() scsi: mpt3sas: Fix kernel panic during drive powercycle test drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE NFSv42: Don't fail clone() unless the OP_CLONE operation failed firmware: arm_scmi: pm: Propagate return value to caller net: ieee802154: handle iftypes as u32 ASoC: codecs: wcd934x: return error code correctly from hw_params ASoC: topology: Add missing rwsem around snd_ctl_remove() calls ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer ARM: dts: bcm2711: Fix PCIe interrupts ARM: dts: BCM5301X: Add interrupt properties to GPIO node ARM: dts: BCM5301X: Fix I2C controller interrupt netfilter: flowtable: fix IPv6 tunnel addr match netfilter: ipvs: Fix reuse connection if RS weight is 0 netfilter: ctnetlink: do not erase error code with EINVAL netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY proc/vmcore: fix clearing user buffer by properly using clear_user() PCI: aardvark: Fix link training PCI: aardvark: Simplify initialization of rootcap on virtual bridge PCI: aardvark: Implement re-issuing config requests on CRS response PCI: aardvark: Update comment about disabling link training PCI: aardvark: Deduplicate code in advk_pcie_rd_conf() powerpc/32: Fix hardlockup on vmap stack overflow mdio: aspeed: Fix "Link is Down" issue mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB mmc: sdhci-esdhc-imx: disable CMDQ support tracing: Fix pid filtering when triggers are attached tracing/uprobe: Fix uprobe_perf_open probes iteration KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB xen: detect uninitialized xenbus in xenbus_init xen: don't continue xenstore initialization in case of errors fuse: release pipe buf after last use staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() staging: greybus: Add missing rwsem around snd_ctl_remove() calls staging/fbtft: Fix backlight HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts Revert "parisc: Fix backtrace to always include init funtion names" media: cec: copy sequence field for the reply ALSA: hda/realtek: Fix LED on HP ProBook 435 G7 ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 ALSA: ctxfi: Fix out-of-range access binder: fix test regression due to sender_euid change usb: hub: Fix locking issues with address0_mutex usb: hub: Fix usb enumeration issue due to address0 race usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe net: nexthop: fix null pointer dereference when IPv6 is not enabled usb: dwc3: gadget: Fix null pointer exception usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer usb: dwc3: gadget: Ignore NoStream after End Transfer usb: dwc2: hcd_queue: Fix use of floating point literal usb: dwc2: gadget: Fix ISOC flow for elapsed frames USB: serial: option: add Fibocom FM101-GL variants USB: serial: option: add Telit LE910S1 0x9200 composition ACPI: Get acpi_device's parent from the parent field bpf: Fix toctou on read-only map's constant scalar tracking Linux 5.10.82 Revert "perf: Rework perf_event_exit_event()" ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() ALSA: hda: hdac_ext_stream: fix potential locking issues x86/Kconfig: Fix an unused variable error in dell-smm-hwmon btrfs: update device path inode time instead of bd_inode fs: export an inode_update_time helper ice: Delete always true check of PF pointer usb: max-3421: Use driver data instead of maintaining a list of bound devices ASoC: DAPM: Cover regression by kctl change notification fix selinux: fix NULL-pointer dereference when hashtab allocation fails RDMA/netlink: Add __maybe_unused to static inline in C file hugetlbfs: flush TLBs correctly after huge_pmd_unshare scsi: ufs: core: Fix task management completion timeout race scsi: ufs: core: Fix task management completion drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors drm/i915/dp: Ensure sink rate values are always valid drm/nouveau: clean up all clients on device removal drm/nouveau: use drm_dev_unplug() during device removal drm/nouveau: Add a dedicated mutex for the clients list drm/udl: fix control-message timeout drm/amd/display: Update swizzle mode enums cfg80211: call cfg80211_stop_ap when switch from P2P_GO type parisc/sticon: fix reverse colors btrfs: fix memory ordering between normal and ordered work functions net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform udf: Fix crash after seekdir KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load block: Check ADMIN before NICE for IOPRIO_CLASS_RT s390/kexec: fix memory leak of ipl report buffer scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag ipc: WARN if trying to remove ipc object which is absent tipc: check for null after calling kmemdup hexagon: clean up timer-regs.h hexagon: export raw I/O routines for modules tun: fix bonding active backup with arp monitoring arm64: vdso32: suppress error message for 'make mrproper' net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices s390/kexec: fix return code handling perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server pinctrl: qcom: sdm845: Enable dual edge errata KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr() e100: fix device suspend/resume NFC: add NCI_UNREG flag to eliminate the race net: nfc: nci: Change the NCI close sequence NFC: reorder the logic in nfc_{un,}register_device NFC: reorganize the functions in nci_request i40e: Fix display error code in dmesg i40e: Fix creation of first queue by omitting it if is not power of two i40e: Fix warning message and call stack during rmmod i40e driver i40e: Fix ping is lost after configuring ADq on VF i40e: Fix changing previously set num_queue_pairs for PFs i40e: Fix NULL ptr dereference on VSI filter sync i40e: Fix correct max_pkt_size on VF RX queue net: virtio_net_hdr_to_skb: count transport header in UFO net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove net: sched: act_mirred: drop dst for the direction from egress to ingress scsi: core: sysfs: Fix hang when device state is set via sysfs net/mlx5: E-Switch, return error if encap isn't supported net/mlx5: E-Switch, Change mode lock from mutex to rw semaphore net/mlx5: Lag, update tracker when state change event received net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' mips: lantiq: add support for clk_get_parent() mips: bcm63xx: add support for clk_get_parent() MIPS: generic/yamon-dt: fix uninitialized variable error iavf: Fix for setting queues to 0 iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset iavf: validate pointers iavf: prevent accidental free of filter structure iavf: Fix failure to exit out from last all-multicast mode iavf: free q_vectors before queues in iavf_disable_vf iavf: check for null in iavf_fix_features iavf: Fix return of set the new channel count net/smc: Make sure the link_id is unique sock: fix /proc/net/sockstat underflow in sk_clone_lock() net: reduce indentation level in sk_clone_lock() tipc: only accept encrypted MSG_CRYPTO msgs bnxt_en: reject indirect blk offload when hw-tc-offload is off net: bnx2x: fix variable dereferenced before check net: ipa: disable HOLB drop when updating timer tracing: Add length protection to histogram string copies tcp: Fix uninitialized access in skb frags array for Rx 0cp. net-zerocopy: Refactor skb frag fast-forward op. net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy. drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame perf tests: Remove bash construct from record+zstd_comp_decomp.sh perf bench futex: Fix memory leak of perf_cpu_map__new() perf bpf: Avoid memory leak from perf_env__insert_btf() tracing/histogram: Do not copy the fixed-size char array field over the field size blkcg: Remove extra blkcg_bio_issue_init perf/x86/vlbr: Add c->flags to vlbr event constraints sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk clk/ast2600: Fix soc revision for AHB clk: ingenic: Fix bugs with divided dividers f2fs: fix incorrect return value in f2fs_sanity_check_ckpt() f2fs: compress: disallow disabling compress on non-empty compressed file sh: define __BIG_ENDIAN for math-emu sh: math-emu: drop unused functions sh: fix kconfig unmet dependency warning for FRAME_POINTER f2fs: fix to use WHINT_MODE f2fs: fix up f2fs_lookup tracepoints maple: fix wrong return value of maple_bus_init(). sh: check return code of request_irq powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST powerpc/dcr: Use cmplwi instead of 3-argument cmpli ALSA: gus: fix null pointer dereference on pointer block ARM: dts: qcom: fix memory and mdio nodes naming for RB3011 powerpc/5200: dts: fix memory node unit name iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() scsi: target: Fix alua_tg_pt_gps_count tracking scsi: target: Fix ordered tag handling scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() MIPS: sni: Fix the build tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc ALSA: ISA: not for M68K ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash ARM: dts: ls1021a: move thermal-zones node out of soc/ usb: host: ohci-tmio: check return value after calling platform_get_resource() ARM: dts: omap: fix gpmc,mux-add-data type firmware_loader: fix pre-allocated buf built-in firmware use ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec scsi: advansys: Fix kernel pointer leak ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect clk: imx: imx6ul: Move csi_sel mux to correct base register ASoC: SOF: Intel: hda-dai: fix potential locking issue arm64: dts: freescale: fix arm,sp805 compatible string arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency ARM: BCM53016: Specify switch ports for Meraki MR32 staging: rtl8723bs: remove possible deadlock when disconnect (v2) ARM: dts: ux500: Skomer regulator fixes usb: typec: tipd: Remove WARN_ON in tps6598x_block_read usb: musb: tusb6010: check return value after calling platform_get_resource() bus: ti-sysc: Use context lost quirk for otg bus: ti-sysc: Add quirk handling for reinit on context lost RDMA/bnxt_re: Check if the vlan is valid before reporting arm64: dts: hisilicon: fix arm,sp805 compatible string arm64: dts: rockchip: Disable CDN DP on Pinebook Pro scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() ARM: dts: NSP: Fix mpcore, mmc node names staging: wfx: ensure IRQ is ready before enabling it arm64: dts: allwinner: a100: Fix thermal zone node name arm64: dts: allwinner: h5: Fix GPU thermal zone node name ARM: dts: sunxi: Fix OPPs node name arm64: zynqmp: Fix serial compatible string arm64: zynqmp: Do not duplicate flash partition label property Conflicts: Documentation/devicetree/bindings Documentation/devicetree/bindings/arm/omap/omap.txt Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml Documentation/devicetree/bindings/net/can/tcan4x5x.txt Documentation/devicetree/bindings/net/ethernet-phy.yaml Documentation/devicetree/bindings/thermal/thermal-zones.yaml Documentation/devicetree/bindings/watchdog/samsung-wdt.yaml drivers/clk/qcom/common.c drivers/remoteproc/qcom_pil_info.c idrivers/virtio/virtio_ring.c Change-Id: I1ddf9efa935eae6e64c34f041d09a2573a2ab26f Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com>	2022-05-04 21:38:11 +05:30
Daniel Norman	2a7a08d7e7	Merge remote-tracking branch into HEAD ... * keystone/mirror-android12-5.10-2022-04: (1854 commits) BACKPORT: media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls FROMLIST: remoteproc: Use unbounded workqueue for recovery work UPSTREAM: xfrm: fix tunnel model fragmentation behavior ANDROID: GKI: Enable CRYPTO_DES ANDROID: GKI: set more vfs-only exports into their own namespace ANDROID: Split ANDROID_STRUCT_PADDING into separate configs ANDROID: selftests: incfs: skip large_file_test test is not enough free space ANDROID: selftests: incfs: Add -fno-omit-frame-pointer ANDROID: incremental-fs: limit mount stack depth ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus ANDROID: vendor_hooks: Reduce pointless modversions CRC churn UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class ANDROID: mm: Fix implicit declaration of function 'isolate_lru_page' ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: Add hook symbol to symbol list Revert "ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree" ANDROID: vendor_hooks: Add hooks to for free_unref_page_commit ANDROID: vendor_hooks: Add hooks to for alloc_contig_range ANDROID: GKI: Update symbols to symbol list ... Signed-off-by: Daniel Norman <danielnorman@google.com> Change-Id: Ieaa00e9702ce27689208b4702b0fe2b7e0c1005b	2022-05-03 10:55:53 -07:00
Faiyaz Mohammed	29b115b6b9	msm-sysstats: check the return value of nla_strdup_cust ... Static code analyser pointed derefrence of comm pointer returned by nla_strdup_cust() without doing null pointer check. Adding check the return value of nla_strdup_cust, before doing the strcmp. Change-Id: Ia55ced8a64459b2c86a64a98ef09ba4a642799eb Signed-off-by: Faiyaz Mohammed <quic_faiyazm@quicinc.com>	2022-05-02 11:33:19 +05:30
Peifeng LI	eb80a7e84f	ANDROID: vendor_hooks: Add hooks for rwsem ... we want to record tasks who will own sem, so we need to add some hook in rwsem.c Bug: 230829284 Change-Id: Ide66540aa38d6058d8aad5f94f4403be991078a4 Signed-off-by: Peifeng Li <lipeifeng@oppo.com>	2022-04-29 16:57:10 +08:00
Greg Kroah-Hartman	de64d941a7	Merge 5.10.112 into android12-5.10-lts ... Changes in 5.10.112 drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu hamradio: defer 6pack kfree after unregister_netdev hamradio: remove needs_free_netdev to avoid UAF cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() drm/msm: Add missing put_task_struct() in debugfs path memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe firmware: arm_scmi: Fix sorting of retrieved clock rates media: rockchip/rga: do proper error checking in probe SUNRPC: Fix the svc_deferred_event trace class net/sched: flower: fix parsing of ethertype following VLAN header veth: Ensure eth header is in skb's linear part gpiolib: acpi: use correct format characters net: mdio: Alphabetically sort header inclusion mlxsw: i2c: Fix initialization error flow net/sched: fix initialization order when updating chain 0 head net: dsa: felix: suppress -EPROBE_DEFER errors net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link net/sched: taprio: Check if socket flags are valid cfg80211: hold bss_lock while updating nontrans_list drm/msm: Fix range size vs end confusion drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart sctp: Initialize daddr on peeled off socket testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set perf tools: Fix misleading add event PMU debug message nfc: nci: add flush_workqueue to prevent uaf cifs: potential buffer overflow in handling symlinks dm mpath: only use ktime_get_ns() in historical selector net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" drm/amd: Add USBC connector ID btrfs: fix fallocate to use file_modified to update permissions consistently btrfs: do not warn for free space inode in cow_file_range drm/amd/display: fix audio format not updated after edid updated drm/amd/display: FEC check in timing validation drm/amd/display: Update VTEM Infopacket definition drm/amdkfd: Fix Incorrect VMIDs passed to HWS drm/amdgpu/vcn: improve vcn dpg stop procedure drm/amdkfd: Check for potential null return of kmalloc_array() Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer scsi: target: tcmu: Fix possible page UAF scsi: lpfc: Fix queue failures when recovering from PCI parity error scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 net: micrel: fix KS8851_MLL Kconfig ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs gpu: ipu-v3: Fix dev_dbg frequency output regulator: wm8994: Add an off-on delay for WM8994 variant arm64: alternatives: mark patch_alternative() as `noinstr` tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry net: axienet: setup mdio unconditionally net: usb: aqc111: Fix out-of-bounds accesses in RX fixup myri10ge: fix an incorrect free for skb in myri10ge_sw_tso drm/amd/display: Revert FEC check in validation drm/amd/display: Fix allocate_mst_payload assert on resume scsi: mvsas: Add PCI ID of RocketRaid 2640 scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan drivers: net: slip: fix NPD bug in sl_tx_timeout() perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant mm, page_alloc: fix build_zonerefs_node() mm: fix unexpected zeroed page mapping with zram swap mm: kmemleak: take a full lowmem check in kmemleak_*_phys() KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded memory: renesas-rpc-if: fix platform-device leak in error path gcc-plugins: latent_entropy: use /dev/urandom ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info btrfs: fix root ref counts in error handling in btrfs_get_root_ref btrfs: mark resumed async balance as writing ALSA: hda/realtek: Add quirk for Clevo PD50PNT ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers ALSA: pcm: Test for "silence" field in struct "pcm_format_data" nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size ipv6: fix panic when forwarding a pkt with no in6 dev drm/amd/display: don't ignore alpha property on pre-multiplied mode drm/amdgpu: Enable gfxoff quirk on MacBook Pro genirq/affinity: Consider that CPUs on nodes can be unbalanced tick/nohz: Use WARN_ON_ONCE() to prevent console saturation ARM: davinci: da850-evm: Avoid NULL pointer dereference dm integrity: fix memory corruption when tag_size is less than digest size smp: Fix offline cpu check in flush_smp_call_function_queue() i2c: pasemi: Wait for write xfers to finish timers: Fix warning condition in __run_timers() dma-direct: avoid redundant memory sync for swiotlb scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling ax25: add refcount in ax25_dev to avoid UAF bugs ax25: fix reference count leaks of ax25_dev ax25: fix UAF bugs of net_device caused by rebinding operation ax25: Fix refcount leaks caused by ax25_cb_del() ax25: fix UAF bug in ax25_send_control() ax25: fix NPD bug in ax25_disconnect ax25: Fix NULL pointer dereferences in ax25 timers ax25: Fix UAF bugs in ax25 timers Linux 5.10.112 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9ce7b432f335445dbfb4a67a34a8a1c279011954	2022-04-29 09:15:09 +02:00
SeongJae Park	a9ec7ed936	BACKPORT: timers: implement usleep_idle_range() ... Patch series "mm/damon: Fix fake /proc/loadavg reports", v3. This patchset fixes DAMON's fake load report issue. The first patch makes yet another variant of usleep_range() for this fix, and the second patch fixes the issue of DAMON by making it using the newly introduced function. This patch (of 2): Some kernel threads such as DAMON could need to repeatedly sleep in micro seconds level. Because usleep_range() sleeps in uninterruptible state, however, such threads would make /proc/loadavg reports fake load. To help such cases, this commit implements a variant of usleep_range() called usleep_idle_range(). It is same to usleep_range() but sets the state of the current task as TASK_IDLE while sleeping. Link: https://lkml.kernel.org/r/20211126145015.15862-1-sj@kernel.org Link: https://lkml.kernel.org/r/20211126145015.15862-2-sj@kernel.org Signed-off-by: SeongJae Park <sj@kernel.org> Suggested-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name> Cc: John Stultz <john.stultz@linaro.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit e4779015fd5d2fb8390c258268addff24d6077c7) Bug: 228223814 Signed-off-by: Hailong Tu <tuhailong@oppo.com> Change-Id: Ie590ba5fcff22c981d0a7ecae6d8e551160136f3	2022-04-28 23:09:17 +08:00
Zhipeng Xie	51d9cbbb0f	perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled ... [ Upstream commit 60490e7966659b26d74bf1fa4aa8693d9a94ca88 ] This problem can be reproduced with CONFIG_PERF_USE_VMALLOC enabled on both x86_64 and aarch64 arch when using sysdig -B(using ebpf)[1]. sysdig -B works fine after rebuilding the kernel with CONFIG_PERF_USE_VMALLOC disabled. I tracked it down to the if condition event->rb->nr_pages != nr_pages in perf_mmap is true when CONFIG_PERF_USE_VMALLOC is enabled where event->rb->nr_pages = 1 and nr_pages = 2048 resulting perf_mmap to return -EINVAL. This is because when CONFIG_PERF_USE_VMALLOC is enabled, rb->nr_pages is always equal to 1. Arch with CONFIG_PERF_USE_VMALLOC enabled by default: arc/arm/csky/mips/sh/sparc/xtensa Arch with CONFIG_PERF_USE_VMALLOC disabled by default: x86_64/aarch64/... Fix this problem by using data_page_nr() [1] https://github.com/draios/sysdig Fixes: 906010b213 ("perf_event: Provide vmalloc() based mmap() backing") Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20220209145417.6495-1-xiezhipeng1@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-27 13:53:56 +02:00
kuyo chang	88fcfd6ee6	sched/pelt: Fix attach_entity_load_avg() corner case ... [ Upstream commit 40f5aa4c5eaebfeaca4566217cb9c468e28ed682 ] The warning in cfs_rq_is_decayed() triggered: SCHED_WARN_ON(cfs_rq->avg.load_avg || cfs_rq->avg.util_avg || cfs_rq->avg.runnable_avg) There exists a corner case in attach_entity_load_avg() which will cause load_sum to be zero while load_avg will not be. Consider se_weight is 88761 as per the sched_prio_to_weight[] table. Further assume the get_pelt_divider() is 47742, this gives: se->avg.load_avg is 1. However, calculating load_sum: se->avg.load_sum = div_u64(se->avg.load_avg * se->avg.load_sum, se_weight(se)); se->avg.load_sum = 1*47742/88761 = 0. Then enqueue_load_avg() adds this to the cfs_rq totals: cfs_rq->avg.load_avg += se->avg.load_avg; cfs_rq->avg.load_sum += se_weight(se) * se->avg.load_sum; Resulting in load_avg being 1 with load_sum is 0, which will trigger the WARN. Fixes: f207934fb7 ("sched/fair: Align PELT windows between cfs_rq and its se") Signed-off-by: kuyo chang <kuyo.chang@mediatek.com> [peterz: massage changelog] Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org> Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com> Link: https://lkml.kernel.org/r/20220414090229.342-1-kuyo.chang@mediatek.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-27 13:53:56 +02:00
Daniel Bristot de Oliveira	5e8446e382	tracing: Dump stacktrace trigger to the corresponding instance ... commit ce33c845b030c9cf768370c951bc699470b09fa7 upstream. The stacktrace event trigger is not dumping the stacktrace to the instance where it was enabled, but to the global "instance." Use the private_data, pointing to the trigger file, to figure out the corresponding trace instance, and use it in the trigger action, like snapshot_trigger does. Link: https://lkml.kernel.org/r/afbb0b4f18ba92c276865bc97204d438473f4ebc.1645396236.git.bristot@kernel.org Cc: stable@vger.kernel.org Fixes: ae63b31e4d ("tracing: Separate out trace events from global variables") Reviewed-by: Tom Zanussi <zanussi@kernel.org> Tested-by: Tom Zanussi <zanussi@kernel.org> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-27 13:53:46 +02:00
Greg Kroah-Hartman	5dadf6321c	Merge 5.10.111 into android12-5.10-lts ... Changes in 5.10.111 ubifs: Rectify space amount budget for mkdir/tmpfile operations gfs2: Check for active reservation in gfs2_release gfs2: Fix gfs2_release for non-writers regression gfs2: gfs2_setattr_size error path fix rtc: wm8350: Handle error for wm8350_register_irq KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs KVM: x86/emulator: Emulate RDPID only if it is enabled in guest drm: Add orientation quirk for GPD Win Max ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 drm/amd/display: Add signal type check when verify stream backends same drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj usb: gadget: tegra-xudc: Do not program SPARAM usb: gadget: tegra-xudc: Fix control endpoint's definitions ptp: replace snprintf with sysfs_emit powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 ath11k: fix kernel panic during unload/load ath11k modules ath11k: mhi: use mhi_sync_power_up() bpf: Make dst_port field in struct bpf_sock 16-bit wide scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() power: supply: axp20x_battery: properly report current when discharging mt76: dma: initialize skip_unmap in mt76_dma_rx_fill cfg80211: don't add non transmitted BSS to 6GHz scanned channels libbpf: Fix build issue with llvm-readelf ipv6: make mc_forwarding atomic powerpc: Set crashkernel offset to mid of RMA region drm/amdgpu: Fix recursive locking warning PCI: aardvark: Fix support for MSI interrupts iommu/arm-smmu-v3: fix event handling soft lockup usb: ehci: add pci device support for Aspeed platforms PCI: endpoint: Fix alignment fault error in copy tests tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. PCI: pciehp: Add Qualcomm quirk for Command Completed erratum power: supply: axp288-charger: Set Vhold to 4.4V iwlwifi: mvm: Correctly set fragmented EBS ipv4: Invalidate neighbour for broadcast address upon address addition dm ioctl: prevent potential spectre v1 gadget dm: requeue IO if mapping table not yet available drm/amdkfd: make CRAT table missing message informational only scsi: pm8001: Fix pm80xx_pci_mem_copy() interface scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: pm8001: Fix task leak in pm8001_send_abort_all() scsi: pm8001: Fix tag leaks on error scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() mt76: mt7615: Fix assigning negative values to unsigned variable scsi: aha152x: Fix aha152x_setup() __setup handler return value scsi: hisi_sas: Free irq vectors in order for v3 HW net/smc: correct settings of RMB window update limit mips: ralink: fix a refcount leak in ill_acc_of_setup() macvtap: advertise link netns via netlink tuntap: add sanity checks about msg_controllen in sendmsg Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} Bluetooth: use memset avoid memory leaks bnxt_en: Eliminate unintended link toggle during FW reset PCI: endpoint: Fix misused goto label MIPS: fix fortify panic when copying asm exception handlers powerpc/secvar: fix refcount leak in format_show() scsi: libfc: Fix use after free in fc_exch_abts_resp() can: isotp: set default value for N_As to 50 micro seconds net: account alternate interface name memory net: limit altnames to 64k total net: sfp: add 2500base-X quirk for Lantech SFP module usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm xtensa: fix DTC warning unit_address_format MIPS: ingenic: correct unit node address Bluetooth: Fix use after free in hci_send_acl netlabel: fix out-of-bounds memory accesses ceph: fix memory leak in ceph_readdir when note_last_dentry returns error init/main.c: return 1 from handled __setup() functions minix: fix bug when opening a file with O_DIRECT clk: si5341: fix reported clk_rate when output divider is 2 staging: vchiq_core: handle NULL result of find_service_by_handle phy: amlogic: meson8b-usb2: Use dev_err_probe() staging: wfx: fix an error handling in wfx_init_common() w1: w1_therm: fixes w1_seq for ds28ea00 sensors NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() NFSv4: Protect the state recovery thread against direct reclaim xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 clk: ti: Preserve node in ti_dt_clocks_register() clk: Enforce that disjoints limits are invalid SUNRPC/call_alloc: async tasks mustn't block waiting for memory SUNRPC/xprt: async tasks mustn't block waiting for memory SUNRPC: remove scheduling boost for "SWAPPER" tasks. NFS: swap IO handling is slightly different for O_DIRECT IO NFS: swap-out must always use STABLE writes. x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() virtio_console: eliminate anonymous module_init & module_exit jfs: prevent NULL deref in diFree SUNRPC: Fix socket waits for write buffer space NFS: nfsiod should not block forever in mempool_alloc() NFS: Avoid writeback threads getting stuck in mempool_alloc() parisc: Fix CPU affinity for Lasi, WAX and Dino chips parisc: Fix patch code locking and flushing mm: fix race between MADV_FREE reclaim and blkdev direct IO read Revert "hv: utils: add PTP_1588_CLOCK to Kconfig to fix build" drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() Drivers: hv: vmbus: Fix potential crash on module unload Revert "NFSv4: Handle the special Linux file open access mode" NFSv4: fix open failure with O_ACCMODE flag scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() net/tls: fix slab-out-of-bounds bug in decrypt_internal ice: Clear default forwarding VSI during VSI release net: ipv4: fix route with nexthop object delete warning net: stmmac: Fix unset max_speed difference between DT and non-DT platforms drm/imx: imx-ldb: Check for null pointer after calling kmemdup drm/imx: Fix memory leak in imx_pd_connector_get_modes bnxt_en: reserve space inside receive page for skb_shared_info sfc: Do not free an empty page_ring RDMA/mlx5: Don't remove cache MRs when a delay is needed IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe ice: Set txq_teid to ICE_INVAL_TEID on ring creation ice: Do not skip not enabled queues in ice_vc_dis_qs_msg ipv6: Fix stats accounting in ip6_pkt_drop ice: synchronize_rcu() when terminating rings net: openvswitch: don't send internal clone attribute to the userspace. net: openvswitch: fix leak of nested actions rxrpc: fix a race in rxrpc_exit_net() net: phy: mscc-miim: reject clause 45 register accesses qede: confirm skb is allocated before using spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() bpf: Support dual-stack sockets in bpf_tcp_check_syncookie drbd: Fix five use after free bugs in get_initial_state io_uring: don't touch scm_fp_list after queueing skb SUNRPC: Handle ENOMEM in call_transmit_status() SUNRPC: Handle low memory situations in call_status() SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() iommu/omap: Fix regression in probe for NULL pointer dereference perf: arm-spe: Fix perf report --mem-mode perf tools: Fix perf's libperf_print callback perf session: Remap buf if there is no space for event arm64: Add part number for Arm Cortex-A78AE Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" mmc: mmci: stm32: correctly check all elements of sg list mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete lz4: fix LZ4_decompress_safe_partial read out of bound mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) mm/mempolicy: fix mpol_new leak in shared_policy_replace io_uring: fix race between timeout flush and removal x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume btrfs: fix qgroup reserve overflow the qgroup limit btrfs: prevent subvol with swapfile from being deleted arm64: patch_text: Fixup last cpu should be master RDMA/hfi1: Fix use-after-free bug for mm struct gpio: Restrict usage of GPIO chip irq members before initialization ata: sata_dwc_460ex: Fix crash due to OOB write perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator irqchip/gic-v3: Fix GICR_CTLR.RWP polling drm/amdgpu/smu10: fix SoC/fclk units in auto mode drm/nouveau/pmu: Add missing callbacks for Tegra devices drm/amdkfd: Create file descriptor after client is added to smi_clients list perf build: Don't use -ffat-lto-objects in the python feature test when building with clang-13 perf python: Fix probing for some clang command line options tools build: Filter out options and warnings not supported by clang tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" ubsan: remove CONFIG_UBSAN_OBJECT_SIZE mm: don't skip swap entry even if zap_details specified cgroup: Use open-time credentials for process migraton perm checks selftests/cgroup: Fix build on older distros selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 selftests: cgroup: Test open-time credential usage for migration checks selftests: cgroup: Test open-time cgroup namespace usage for migration checks arm64: module: remove (NOLOAD) from linker script Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb() irqchip/gic, gic-v3: Prevent GSI to SGI translations mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Linux 5.10.111 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9b4c1d30ae226b865494df03d871db2a2b9281c7	2022-04-21 14:27:41 +02:00
Chao Gao	26f827e095	dma-direct: avoid redundant memory sync for swiotlb ... commit 9e02977bfad006af328add9434c8bffa40e053bb upstream. When we looked into FIO performance with swiotlb enabled in VM, we found swiotlb_bounce() is always called one more time than expected for each DMA read request. It turns out that the bounce buffer is copied to original DMA buffer twice after the completion of a DMA request (one is done by in dma_direct_sync_single_for_cpu(), the other by swiotlb_tbl_unmap_single()). But the content in bounce buffer actually doesn't change between the two rounds of copy. So, one round of copy is redundant. Pass DMA_ATTR_SKIP_CPU_SYNC flag to swiotlb_tbl_unmap_single() to skip the memory copy in it. This fix increases FIO 64KB sequential read throughput in a guest with swiotlb=force by 5.6%. Fixes: 55897af630 ("dma-direct: merge swiotlb_dma_ops into the dma_direct code") Reported-by: Wang Zhaoyang1 <zhaoyang1.wang@intel.com> Reported-by: Gao Liang <liang.gao@intel.com> Signed-off-by: Chao Gao <chao.gao@intel.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-20 09:23:30 +02:00
Anna-Maria Behnsen	9a5a4d23e2	timers: Fix warning condition in __run_timers() ... commit c54bc0fc84214b203f7a0ebfd1bd308ce2abe920 upstream. When the timer base is empty, base::next_expiry is set to base::clk + NEXT_TIMER_MAX_DELTA and base::next_expiry_recalc is false. When no timer is queued until jiffies reaches base::next_expiry value, the warning for not finding any expired timer and base::next_expiry_recalc is false in __run_timers() triggers. To prevent triggering the warning in this valid scenario base::timers_pending needs to be added to the warning condition. Fixes: 31cd0e119d ("timers: Recalculate next timer interrupt only when necessary") Reported-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Anna-Maria Behnsen <anna-maria@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Link: https://lore.kernel.org/r/20220405191732.7438-3-anna-maria@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-20 09:23:30 +02:00
Nadav Amit	89496d80bf	smp: Fix offline cpu check in flush_smp_call_function_queue() ... commit 9e949a3886356fe9112c6f6f34a6e23d1d35407f upstream. The check in flush_smp_call_function_queue() for callbacks that are sent to offline CPUs currently checks whether the queue is empty. However, flush_smp_call_function_queue() has just deleted all the callbacks from the queue and moved all the entries into a local list. This checks would only be positive if some callbacks were added in the short time after llist_del_all() was called. This does not seem to be the intention of this check. Change the check to look at the local list to which the entries were moved instead of the queue from which all the callbacks were just removed. Fixes: 8d056c48e4 ("CPU hotplug, smp: flush any pending IPI callbacks before CPU offline") Signed-off-by: Nadav Amit <namit@vmware.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20220319072015.1495036-1-namit@vmware.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-20 09:23:29 +02:00
Paul Gortmaker	0806f19305	tick/nohz: Use WARN_ON_ONCE() to prevent console saturation ... commit 40e97e42961f8c6cc7bd5fe67cc18417e02d78f1 upstream. While running some testing on code that happened to allow the variable tick_nohz_full_running to get set but with no "possible" NOHZ cores to back up that setting, this warning triggered: if (unlikely(tick_do_timer_cpu == TICK_DO_TIMER_NONE)) WARN_ON(tick_nohz_full_running); The console was overwhemled with an endless stream of one WARN per tick per core and there was no way to even see what was going on w/o using a serial console to capture it and then trace it back to this. Change it to WARN_ON_ONCE(). Fixes: 08ae95f4fd ("nohz_full: Allow the boot CPU to be nohz_full") Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211206145950.10927-3-paul.gortmaker@windriver.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-20 09:23:29 +02:00
Rei Yamamoto	0275c75955	genirq/affinity: Consider that CPUs on nodes can be unbalanced ... commit 08d835dff916bfe8f45acc7b92c7af6c4081c8a7 upstream. If CPUs on a node are offline at boot time, the number of nodes is different when building affinity masks for present cpus and when building affinity masks for possible cpus. This causes the following problem: In the case that the number of vectors is less than the number of nodes there are cases where bits of masks for present cpus are overwritten when building masks for possible cpus. Fix this by excluding CPUs, which are not part of the current build mask (present/possible). [ tglx: Massaged changelog and added comment ] Fixes: b825921990 ("genirq/affinity: Spread IRQs to all available NUMA nodes") Signed-off-by: Rei Yamamoto <yamamoto.rei@jp.fujitsu.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Ming Lei <ming.lei@redhat.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220331003309.10891-1-yamamoto.rei@jp.fujitsu.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-20 09:23:29 +02:00
Greg Kroah-Hartman	95f4203fc9	Merge 5.10.110 into android12-5.10-lts ... Changes in 5.10.110 swiotlb: fix info leak with DMA_FROM_DEVICE USB: serial: pl2303: add IBM device IDs USB: serial: simple: add Nokia phone driver hv: utils: add PTP_1588_CLOCK to Kconfig to fix build netdevice: add the case if dev is NULL HID: logitech-dj: add new lightspeed receiver id xfrm: fix tunnel model fragmentation behavior ARM: mstar: Select HAVE_ARM_ARCH_TIMER virtio_console: break out of buf poll on remove vdpa/mlx5: should verify CTRL_VQ feature exists for MQ tools/virtio: fix virtio_test execution ethernet: sun: Free the coherent when failing in probing gpio: Revert regression in sysfs-gpio (gpiolib.c) spi: Fix invalid sgs value net:mcf8390: Use platform_get_irq() to get the interrupt Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" spi: Fix erroneous sgs value with min_t() Input: zinitix - do not report shadow fingers af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register net: dsa: microchip: add spi_device_id tables locking/lockdep: Avoid potential access of invalid memory in lock_class iommu/iova: Improve 32-bit free space estimate tpm: fix reference counting for struct tpm_chip virtio-blk: Use blk_validate_block_size() to validate block size USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c xhci: fix garbage USBSTS being logged in some cases xhci: fix runtime PM imbalance in USB2 resume xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry coresight: Fix TRCCONFIGR.QE sysfs interface iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation greybus: svc: fix an error handling bug in gb_svc_hello() clk: uniphier: Fix fixed-rate initialization ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE KEYS: fix length validation in keyctl_pkey_params_get_2() Documentation: add link to stable release candidate tree Documentation: update stable tree link firmware: stratix10-svc: add missing callback parameter on RSU HID: intel-ish-hid: Use dma_alloc_coherent for firmware update SUNRPC: avoid race between mod_timer() and del_timer_sync() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems f2fs: fix to unlock page correctly in error path of is_alive() f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to do sanity check on .cp_pack_total_block_count remoteproc: Fix count check in rproc_coredump_write() pinctrl: samsung: drop pin banks references on error paths spi: mxic: Fix the transmit path mtd: rawnand: protect access to rawnand devices while in suspend can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_scan_medium mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mm: invalidate hwpoison page cache page in fault path mempolicy: mbind_range() set_policy() after vma_merge() scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands qed: display VF trust config qed: validate and restrict untrusted VFs vlan promisc mode riscv: Fix fill_callchain return value riscv: Increase stack size under KASAN Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() ALSA: cs4236: fix an incorrect NULL check on list iterator ALSA: hda: Avoid unsol event during RPM suspending ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm,hwpoison: unmap poisoned page before invalidation mm/kmemleak: reset tag when compare object pointer dm integrity: set journal entry unused when shrinking device drbd: fix potential silent data corruption can: isotp: sanitize CAN ID checks in isotp_bind() powerpc/kvm: Fix kvm_use_magic_page udp: call udp_encap_enable for v6 sockets when enabling encap arm64: signal: nofpsimd: Do not allocate fp/simd context when not available arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs ACPI: properties: Consistently return -ENOENT if there are no more references coredump: Also dump first pages of non-executable ELF libraries ext4: fix ext4_fc_stats trace point ext4: fix fs corruption when tring to remove a non-empty directory with IO error drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() mailbox: tegra-hsp: Flush whole channel block: limit request dispatch loop duration block: don't merge across cgroup boundaries if blkcg is enabled drm/edid: check basic audio support on CEA extension block video: fbdev: sm712fb: Fix crash in smtcfb_read() video: fbdev: atari: Atari 2 bpp (STe) palette bugfix ARM: dts: at91: sama5d2: Fix PMERRLOC resource size ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 mgag200 fix memmapsl configuration in GCTL6 register carl9170: fix missing bit-wise or operator for tx_params pstore: Don't use semaphores in always-atomic-context code thermal: int340x: Increase bitmap size lib/raid6/test: fix multiple definition linking error exec: Force single empty string when argv is empty crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() bcache: fixup multiple threads crash DEC: Limit PMAX memory probing to R3k systems media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs drm/i915/opregion: check port number bounds for SWSCI display power state drm/i915/gem: add missing boundary check in vm_access PCI: pciehp: Clear cmd_busy bit in polling mode PCI: xgene: Revert "PCI: xgene: Fix IB window setup" regulator: qcom_smd: fix for_each_child.cocci warnings selinux: check return value of sel_make_avc_files hwrng: cavium - Check health status while reading random data hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER crypto: sun8i-ss - really disable hash on A80 crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: mxs-dcp - Fix scatterlist processing thermal: int340x: Check for NULL after calling kmemdup() spi: tegra114: Add missing IRQ check in tegra_spi_probe arm64/mm: avoid fixmap race condition when create pud mapping selftests/x86: Add validity check and allow field splitting crypto: rockchip - ECB does not need IV audit: log AUDIT_TIME_* records only from rules EVM: fix the evm= __setup handler return value crypto: ccree - don't attempt 0 len DMA mappings spi: pxa2xx-pci: Balance reference count for PCI DMA device hwmon: (pmbus) Add mutex to regulator ops hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING nvme: cleanup __nvme_check_ids block: don't delete queue kobject before its children PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler spi: spi-zynqmp-gqspi: Handle error for dma_set_mask hwrng: atmel - disable trng on failure path crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled crypto: vmx - add missing dependencies clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() ACPI: APEI: fix return value of __setup handlers crypto: ccp - ccp_dmaengine_unregister release dma channels crypto: ccree - Fix use after free in cc_cipher_exit() vfio: platform: simplify device removal amba: Make the remove callback return void hwrng: nomadik - Change clk_disable to clk_disable_unprepare hwmon: (pmbus) Add Vin unit off handling clocksource: acpi_pm: fix return value of __setup handler io_uring: terminate manual loop iterator loop correctly for non-vecs watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch f2fs: fix to enable ATGC correctly via gc_idle sysfs interface sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa sched/core: Export pelt_thermal_tp rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() rseq: Remove broken uapi field layout on 32-bit little endian perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel f2fs: fix missing free nid in f2fs_handle_failed_inode nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix to avoid potential deadlock btrfs: fix unexpected error path when reflinking an inline extent f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption selftests, x86: fix how check_cc.sh is being invoked kunit: make kunit_test_timeout compatible with comment media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: mtk-vcodec: potential dereference of null pointer media: bttv: fix WARNING regression on tunerless devices ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting ASoC: generic: simple-card-utils: remove useless assignment media: coda: Fix missing put_device() call in coda_get_vdoa_data media: meson: vdec: potential dereference of null pointer media: hantro: Fix overfill bottom register field name media: aspeed: Correct value for h-total-pixels video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen video: fbdev: controlfb: Fix set but not used warnings video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() firmware: qcom: scm: Remove reassignment to desc following initializer ARM: dts: qcom: ipq4019: fix sleep clock soc: qcom: rpmpd: Check for null return of devm_kcalloc soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: aoss: remove spurious IRQF_ONESHOT flags arm64: dts: qcom: sdm845: fix microphone bias properties and values arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ARM: dts: sun8i: v3s: Move the csi1 block to follow address order ARM: dts: imx: Add missing LVDS decoder on M53Menlo media: video/hdmi: handle short reads of hdmi info frame. media: em28xx: initialize refcount before kref_get media: usb: go7007: s2250-board: fix leak in probe() media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put uaccess: fix nios2 and microblaze get_user_8() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() arm64: dts: ns2: Fix spi-cpol and spi-cpha property arm64: dts: broadcom: Fix sata nodename printk: fix return value of printk.devkmsg __setup handler ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts memory: emif: check the pointer temp in get_device_details() ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED media: vidtv: Check for null return of vzalloc ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of media: saa7134: convert list_for_each to entry variant media: saa7134: fix incorrect use to determine if list is empty ivtv: fix incorrect device_caps for ivtvfb ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: fsl_spdif: Disable TX clock when stop ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe mmc: davinci_mmc: Handle error for clk_enable ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm: bridge: adv7511: Fix ADV7535 HPD enablement ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm/panfrost: Check for error num after setting mask libbpf: Fix possible NULL pointer dereference when destroying skeleton udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() mtd: onenand: Check for error irq mtd: rawnand: gpmi: fix controller timings setting drm/edid: Don't clear formats if using deep color ionic: fix type complaint in ionic_dev_cmd_clean() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function ath9k_htc: fix uninit value bugs RDMA/core: Set MR type in ib_reg_user_mr KVM: PPC: Fix vmx/vsx mixup in mmio emulation i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe ray_cs: Check ioremap return value powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc/perf: Don't use perf_hw_context for trace IMC PMU mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update net: dsa: mv88e6xxx: Enable port policy support on 6097 scripts/dtc: Call pkg-config POSIXly correct livepatch: Fix build failure on 32 bits processors PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge drm/bridge: dw-hdmi: use safe format when first in bridge chain power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports iommu/ipmmu-vmsa: Check for error num after setting mask drm/amd/pm: enable pm sysfs write for one VF mode drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug IB/cma: Allow XRC INI QPs to set their local ACK timeout dax: make sure inodes are flushed before destroy cache iwlwifi: Fix -EIO error code that is never returned iwlwifi: mvm: Fix an error code in iwl_mvm_up() drm/msm/dp: populate connector of struct dp_panel drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR drm/amd/display: Remove vupdate_int_entry definition TOMOYO: fix __setup handlers return values ext2: correct max file size computing drm/tegra: Fix reference leak in tegra_dsi_ganged_probe power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return scsi: hisi_sas: Change permission of parameter prot_mask drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info gpu: host1x: Fix a memory leak in 'host1x_remove()' libbpf: Skip forward declaration when counting duplicated type names powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit KVM: x86: Fix emulation in writing cr8 KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() hv_balloon: rate-limit "Unhandled message" warning i2c: xiic: Make bus names unique power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq IB/hfi1: Allow larger MTU without AIP PCI: Reduce warnings on possible RW1C corruption net: axienet: fix RX ring refill allocation failure handling mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n powerpc/sysdev: fix incorrect use to determine if list is empty mfd: mc13xxx: Add check for mc13xxx_irq_request libbpf: Unmap rings when umem deleted selftests/bpf: Make test_lwt_ip_encap more stable and faster platform/x86: huawei-wmi: check the return value of device_create_file() powerpc: 8xx: fix a return value error in mpc8xx_pic_init vxcan: enable local echo for sent CAN frames ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base MIPS: RB532: fix return value of __setup handler MIPS: pgalloc: fix memory leak caused by pgd_free() mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init RDMA/mlx5: Fix memory leak in error flow for subscribe event routine bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg samples/bpf, xdpsock: Fix race when running for fix duration of time USB: storage: ums-realtek: fix error code in rts51x_read_mem() can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf: Fix error reporting from sock_fields programs Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt ipv4: Fix route lookups when handling ICMP redirects and PMTU updates af_netlink: Fix shift out of bounds in group mask calculation i2c: meson: Fix wrong speed use from probe i2c: mux: demux-pinctrl: do not deactivate a master that is not active selftests/bpf/test_lirc_mode2.sh: Exit with proper code PCI: Avoid broken MSI on SB600 USB devices net: bcmgenet: Use stronger register read/writes to assure ordering tcp: ensure PMTU updates are processed during fastopen openvswitch: always update flow key after nat tipc: fix the timer expires after interval 100ms mfd: asic3: Add missing iounmap() on error asic3_mfd_probe mxser: fix xmit_buf leak in activate when LSR == 0xff pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() fsi: aspeed: convert to devm_platform_ioremap_resource fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse soundwire: intel: fix wrong register name in intel_shim_wake clk: qcom: ipq8074: fix PCI-E clock oops iio: mma8452: Fix probe failing when an i2c_device_id is used staging:iio:adc:ad7280a: Fix handing of device address bit reversing. pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states clk: qcom: ipq8074: Use floor ops for SDCC1 clock phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device NFS: Use of mapping_set_error() results in spurious errors serial: 8250: Fix race condition in RTS-after-send handling iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device NFS: Return valid errors from nfs2/3_decode_dirent() dma-debug: fix return value of __setup handlers clk: imx7d: Remove audio_mclk_root_clk clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region nvdimm/region: Fix default alignment for small regions clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver NFS: remove unneeded check in decode_devicenotify_args() staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdbts: fix return value of __setup handler firmware: google: Properly state IOMEM dependency driver core: dd: fix return value of __setup handler jfs: fix divide error in dbNextAG netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error kdb: Fix the putarea helper function clk: qcom: gcc-msm8994: Fix gpll4 width clk: Initialize orphan req_rate xen: fix is_xen_pmu() net: enetc: report software timestamping via SO_TIMESTAMPING net: hns3: fix bug when PF set the duplicate MAC address for VFs net: phy: broadcom: Fix brcm_fet_config_init() selftests: test_vxlan_under_vrf: Fix broken test case qlcnic: dcb: default to returning -EOPNOTSUPP net/x25: Fix null-ptr-deref caused by x25_disconnect NFSv4/pNFS: Fix another issue with a list iterator pointing to the head net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator fs: fd tables have to be multiples of BITS_PER_LONG lib/test: use after free in register_test_dev_kmod() fs: fix fd table size alignment properly LSM: general protection fault in legacy_parse_param regulator: rpi-panel: Handle I2C errors/timing to the Atmel gcc-plugins/stackleak: Exactly match strings instead of prefixes pinctrl: npcm: Fix broken references to chip->parent_device block, bfq: don't move oom_bfqq selinux: use correct type for context length selinux: allow FIOCLEX and FIONCLEX with policy capability loop: use sysfs_emit() in the sysfs xxx show() Fix incorrect type in assignment of ipv6 port for audit irqchip/qcom-pdc: Fix broken locking irqchip/nvic: Release nvic_base upon failure fs/binfmt_elf: Fix AT_PHDR for unusual ELF files bfq: fix use-after-free in bfq_dispatch_request ACPICA: Avoid walking the ACPI Namespace if it is not there lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Revert "Revert "block, bfq: honor already-setup queue merges"" ACPI/APEI: Limit printable size of BERT table data PM: core: keep irq flags in device_pm_check_callbacks() parisc: Fix handling off probe non-access faults nvme-tcp: lockdep: annotate in-kernel sockets spi: tegra20: Use of_device_get_match_data() locking/lockdep: Iterate lock_classes directly when reading lockdep files ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: don't BUG if someone dirty pages without asking ext4 first f2fs: fix to do sanity check on curseg->alloc_type NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: compress: fix to print raw data size in error path of lz4 decompression ntfs: add sanity check on allocation size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: fix various V4L2 compliance errors media: ir_toy: free before error exiting video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow video: fbdev: w100fb: Reset global state video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 ARM: dts: bcm2837: Add the missing L1/L2 cache information ASoC: madera: Add dependencies on MFD media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards media: atomisp: fix dummy_ptr check to avoid duplicate active_bo ARM: ftrace: avoid redundant loads or clobbering IP ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk arm64: defconfig: build imx-sdma as a module video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit ARM: dts: bcm2711: Add the missing L1/L2 cache information ASoC: soc-core: skip zero num_dai component in searching dai name media: cx88-mpeg: clear interrupt status register before streaming video uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: tegra: tamonten: Fix I2C3 pad setting ARM: mmp: Fix failure to remove sram device video: fbdev: sm712fb: Fix crash in smtcfb_write() media: Revert "media: em28xx: add missing em28xx_close_extension" media: hdpvr: initialize dev->worker at hdpvr_register_videodev mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: atomisp: fix bad usage at error handling logic ALSA: hda/realtek: Add alc256-samsung-headphone fixup KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU powerpc/kasan: Fix early region not updated correctly powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Use correct feature type field during RFF_ID processing platform: chrome: Split trace include file KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated KVM: Prevent module exit until all VMs are freed KVM: x86: fix sending PV IPI KVM: SVM: fix panic on out-of-bounds guest IRQ ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM ubifs: rename_whiteout: Fix double free for whiteout_ui->data ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: Fix to add refcount once page is set private ubifs: rename_whiteout: correct old_dir size computing wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: socket: ignore v6 endpoints when ipv6 is disabled XArray: Fix xas_create_range() when multi-order entry present can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path can: mcba_usb: properly check endpoint type can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value XArray: Update the LRU list in xas_split() rtc: check if __rtc_read_time was successful gfs2: Make sure FITRIM minlen is rounded up to fs block size net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware rxrpc: Fix call timer start racing with call destruction mailbox: imx: fix wakeup failure from freeze mode crypto: arm/aes-neonbs-cbc - Select generic cbc and aes watch_queue: Free the page array when watch_queue is dismantled pinctrl: pinconf-generic: Print arguments for bias-pull-* watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl ARM: iop32x: offset IRQ numbers by 1 io_uring: fix memory leak of uid in files registration riscv module: remove (NOLOAD) ACPI: CPPC: Avoid out of bounds access when parsing _CPC data platform/chrome: cros_ec_typec: Check for EC device can: isotp: restore accidentally removed MSG_PEEK feature proc: bootconfig: Add null pointer check staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet ASoC: soc-compress: Change the check for codec_dai batman-adv: Check ptr for NULL before reducing its refcnt mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler bpf: Adjust BPF stack helper functions to accommodate skip > 0 bpf: Fix comment for helper bpf_current_task_under_cgroup() dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory ubi: fastmap: Return error code if memory allocation fails in add_aeb() ASoC: topology: Allow TLV control to be either read or write ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties um: Fix uml_mconsole stop/go docs: sysctl/kernel: add missing bit to panic_print openvswitch: Fixed nd target mask field in the flow dump. KVM: x86/mmu: do compare-and-exchange of gPTE via the user address can: m_can: m_can_tx_handler(): fix use after free of skb can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path coredump: Snapshot the vmas in do_coredump coredump: Remove the WARN_ON in dump_vma_snapshot coredump/elf: Pass coredump_params into fill_note_info coredump: Use the vma snapshot in fill_files_note arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Linux 5.10.110 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I12fbe227793dd40c0582588e1700cf88cafd0ac6	2022-04-18 17:41:18 +02:00
Ashay Jaiswal	323f6089a9	sched: walt: handle support for single and two cluster system ... Update walt_newidle load balance to support single and two cluster topology. Change-Id: Ic2bbbe7a273267c1a7aa340f9908b5e5325d21ba Signed-off-by: Ashay Jaiswal <quic_ashayj@quicinc.com>	2022-04-16 22:13:38 +05:30
Tejun Heo	4665722d36	cgroup: Use open-time credentials for process migraton perm checks ... commit 1756d7994ad85c2479af6ae5a9750b92324685af upstream. cgroup process migration permission checks are performed at write time as whether a given operation is allowed or not is dependent on the content of the write - the PID. This currently uses current's credentials which is a potential security weakness as it may allow scenarios where a less privileged process tricks a more privileged one into writing into a fd that it created. This patch makes both cgroup2 and cgroup1 process migration interfaces to use the credentials saved at the time of open (file->f_cred) instead of current's. Reported-by: "Eric W. Biederman" <ebiederm@xmission.com> Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> Fixes: 187fe84067 ("cgroup: require write perm on common ancestor when moving processes on the default hierarchy") Reviewed-by: Michal Koutný <mkoutny@suse.com> Signed-off-by: Tejun Heo <tj@kernel.org> [OP: apply original __cgroup_procs_write() changes to cgroup_threads_write() and cgroup_procs_write(), as the refactoring commit da70862efe006 ("cgroup: cgroup.{procs,threads} factor out common parts") is not present in 5.10-stable] Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-13 21:01:10 +02:00
Charan Teja Reddy	c11c03e18c	msm-sysstats: given process name return the pid's ... Add support to give the range of pid's that corresponds to a given running process. Change-Id: I93d258edd40373c233177bfa9c299434e13cc718 Signed-off-by: Charan Teja Reddy <quic_charante@quicinc.com>	2022-04-12 18:37:06 +05:30
Namhyung Kim	90805175a2	bpf: Adjust BPF stack helper functions to accommodate skip > 0 ... commit ee2a098851bfbe8bcdd964c0121f4246f00ff41e upstream. Let's say that the caller has storage for num_elem stack frames. Then, the BPF stack helper functions walk the stack for only num_elem frames. This means that if skip > 0, one keeps only 'num_elem - skip' frames. This is because it sets init_nr in the perf_callchain_entry to the end of the buffer to save num_elem entries only. I believe it was because the perf callchain code unwound the stack frames until it reached the global max size (sysctl_perf_event_max_stack). However it now has perf_callchain_entry_ctx.max_stack to limit the iteration locally. This simplifies the code to handle init_nr in the BPF callstack entries and removes the confusion with the perf_event's __PERF_SAMPLE_CALLCHAIN_EARLY which sets init_nr to 0. Also change the comment on bpf_get_stack() in the header file to be more explicit what the return value means. Fixes: c195651e56 ("bpf: add bpf_get_stack helper") Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/30a7b5d5-6726-1cc2-eaee-8da2828a9a9c@oracle.com Link: https://lore.kernel.org/bpf/20220314182042.71025-1-namhyung@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Based-on-patch-by: Eugene Loh <eugene.loh@oracle.com>	2022-04-08 14:40:43 +02:00
Eric Dumazet	7169f60110	watch_queue: Free the page array when watch_queue is dismantled ... commit b490207017ba237d97b735b2aa66dc241ccd18f5 upstream. Commit 7ea1a0124b6d ("watch_queue: Free the alloc bitmap when the watch_queue is torn down") took care of the bitmap, but not the page array. BUG: memory leak unreferenced object 0xffff88810d9bc140 (size 32): comm "syz-executor335", pid 3603, jiffies 4294946994 (age 12.840s) hex dump (first 32 bytes): 40 a7 40 04 00 ea ff ff 00 00 00 00 00 00 00 00 @.@............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: kmalloc_array include/linux/slab.h:621 [inline] kcalloc include/linux/slab.h:652 [inline] watch_queue_set_size+0x12f/0x2e0 kernel/watch_queue.c:251 pipe_ioctl+0x82/0x140 fs/pipe.c:632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] Reported-by: syzbot+25ea042ae28f3888727a@syzkaller.appspotmail.com Fixes: c73be61ced ("pipe: Add general notification queue support") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Cc: Jann Horn <jannh@google.com> Link: https://lore.kernel.org/r/20220322004654.618274-1-eric.dumazet@gmail.com/ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:40:41 +02:00
Waiman Long	ecd384c436	locking/lockdep: Iterate lock_classes directly when reading lockdep files ... [ Upstream commit fb7275acd6fb988313dddd8d3d19efa70d9015ad ] When dumping lock_classes information via /proc/lockdep, we can't take the lockdep lock as the lock hold time is indeterminate. Iterating over all_lock_classes without holding lock can be dangerous as there is a slight chance that it may branch off to other lists leading to infinite loop or even access invalid memory if changes are made to all_lock_classes list in parallel. To avoid this problem, iteration of lock classes is now done directly on the lock_classes array itself. The lock_classes_in_use bitmap is checked to see if the lock class is being used. To avoid iterating the full array all the times, a new max_lock_class_idx value is added to track the maximum lock_class index that is currently being used. We can theoretically take the lockdep lock for iterating all_lock_classes when other lockdep files (lockdep_stats and lock_stat) are accessed as the lock hold time will be shorter for them. For consistency, they are also modified to iterate the lock_classes array directly. Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20220211035526.1329503-2-longman@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:32 +02:00
Daniel Thompson	e2a2625392	kdb: Fix the putarea helper function ... [ Upstream commit c1cb81429df462eca1b6ba615cddd21dd3103c46 ] Currently kdb_putarea_size() uses copy_from_kernel_nofault() to write *to* arbitrary kernel memory. This is obviously wrong and means the memory modify ('mm') command is a serious risk to debugger stability: if we poke to a bad address we'll double-fault and lose our debug session. Fix this the (very) obvious way. Note that there are two Fixes: tags because the API was renamed and this patch will only trivially backport as far as the rename (and this is probably enough). Nevertheless Christoph's rename did not introduce this problem so I wanted to record that! Fixes: fe557319aa ("maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault") Fixes: 5d5314d679 ("kdb: core for kgdb back end (1 of 2)") Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org> Reviewed-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20220128144055.207267-1-daniel.thompson@linaro.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:29 +02:00
Randy Dunlap	867258d3f3	dma-debug: fix return value of __setup handlers ... [ Upstream commit 80e4390981618e290616dbd06ea190d4576f219d ] When valid kernel command line parameters dma_debug=off dma_debug_entries=100 are used, they are reported as Unknown parameters and added to init's environment strings, polluting it. Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5 dma_debug=off dma_debug_entries=100", will be passed to user space. and Run /sbin/init as init process with arguments: /sbin/init with environment: HOME=/ TERM=linux BOOT_IMAGE=/boot/bzImage-517rc5 dma_debug=off dma_debug_entries=100 Return 1 from these __setup handlers to indicate that the command line option has been handled. Fixes: 59d3daafa1 ("dma-debug: add kernel command line parameters") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: Joerg Roedel <joro@8bytes.org> Cc: Christoph Hellwig <hch@lst.de> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: iommu@lists.linux-foundation.org Cc: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:25 +02:00
Christophe Leroy	b1af8b9ec0	livepatch: Fix build failure on 32 bits processors ... [ Upstream commit 2f293651eca3eacaeb56747dede31edace7329d2 ] Trying to build livepatch on powerpc/32 results in: kernel/livepatch/core.c: In function 'klp_resolve_symbols': kernel/livepatch/core.c:221:23: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 221 | sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info); | ^ kernel/livepatch/core.c:221:21: error: assignment to 'Elf32_Sym *' {aka 'struct elf32_sym *'} from incompatible pointer type 'Elf64_Sym *' {aka 'struct elf64_sym *'} [-Werror=incompatible-pointer-types] 221 | sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info); | ^ kernel/livepatch/core.c: In function 'klp_apply_section_relocs': kernel/livepatch/core.c:312:35: error: passing argument 1 of 'klp_resolve_symbols' from incompatible pointer type [-Werror=incompatible-pointer-types] 312 | ret = klp_resolve_symbols(sechdrs, strtab, symndx, sec, sec_objname); | ^~~~~~~ | | | Elf32_Shdr * {aka struct elf32_shdr *} kernel/livepatch/core.c:193:44: note: expected 'Elf64_Shdr *' {aka 'struct elf64_shdr *'} but argument is of type 'Elf32_Shdr *' {aka 'struct elf32_shdr *'} 193 | static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab, | ~~~~~~~~~~~~^~~~~~~ Fix it by using the right types instead of forcing 64 bits types. Fixes: 7c8e2bdd5f ("livepatch: Apply vmlinux-specific KLP relocations early") Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> Acked-by: Petr Mladek <pmladek@suse.com> Acked-by: Joe Lawrence <joe.lawrence@redhat.com> Acked-by: Miroslav Benes <mbenes@suse.cz> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/5288e11b018a762ea3351cc8fb2d4f15093a4457.1640017960.git.christophe.leroy@csgroup.eu Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:15 +02:00
Randy Dunlap	a754ea0de3	printk: fix return value of printk.devkmsg __setup handler ... [ Upstream commit b665eae7a788c5e2bc10f9ac3c0137aa0ad1fc97 ] If an invalid option value is used with "printk.devkmsg=<value>", it is silently ignored. If a valid option value is used, it is honored but the wrong return value (0) is used, indicating that the command line option had an error and was not handled. This string is not added to init's environment strings due to init/main.c::unknown_bootoption() checking for a '.' in the boot option string and then considering that string to be an "Unused module parameter". Print a warning message if a bad option string is used. Always return 1 from the __setup handler to indicate that the command line option has been handled. Fixes: 750afe7bab ("printk: add kernel parameter to control writes to /dev/kmsg") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: Borislav Petkov <bp@suse.de> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Petr Mladek <pmladek@suse.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: John Ogness <john.ogness@linutronix.de> Reviewed-by: John Ogness <john.ogness@linutronix.de> Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Petr Mladek <pmladek@suse.com> Link: https://lore.kernel.org/r/20220228220556.23484-1-rdunlap@infradead.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:08 +02:00
Adrian Hunter	13c8e37e1f	perf/core: Fix address filter parser for multiple filters ... [ Upstream commit d680ff24e9e14444c63945b43a37ede7cd6958f9 ] Reset appropriate variables in the parser loop between parsing separate filters, so that they do not interfere with parsing the next filter. Fixes: 375637bc52 ("perf/core: Introduce address range filtering") Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/20220131072453.2839535-4-adrian.hunter@intel.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
Mathieu Desnoyers	a9faa5beda	rseq: Remove broken uapi field layout on 32-bit little endian ... [ Upstream commit bfdf4e6208051ed7165b2e92035b4bf11f43eb63 ] The rseq rseq_cs.ptr.{ptr32,padding} uapi endianness handling is entirely wrong on 32-bit little endian: a preprocessor logic mistake wrongly uses the big endian field layout on 32-bit little endian architectures. Fortunately, those ptr32 accessors were never used within the kernel, and only meant as a convenience for user-space. Remove those and replace the whole rseq_cs union by a __u64 type, as this is the only thing really needed to express the ABI. Document how 32-bit architectures are meant to interact with this field. Fixes: ec9c82e03a ("rseq: uapi: Declare rseq_cs field as union, update includes") Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20220127152720.25898-1-mathieu.desnoyers@efficios.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
Eric Dumazet	f0250e05e5	rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() ... [ Upstream commit 5e0ccd4a3b01c5a71732a13186ca110a138516ea ] Commit ec9c82e03a ("rseq: uapi: Declare rseq_cs field as union, update includes") added regressions for our servers. Using copy_from_user() and clear_user() for 64bit values is suboptimal. We can use faster put_user() and get_user() on 64bit arches. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Link: https://lkml.kernel.org/r/20210413203352.71350-4-eric.dumazet@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
Qais Yousef	ecc17de4b9	sched/core: Export pelt_thermal_tp ... [ Upstream commit 77cf151b7bbdfa3577b3c3f3a5e267a6c60a263b ] We can't use this tracepoint in modules without having the symbol exported first, fix that. Fixes: 765047932f ("sched/pelt: Add support to track thermal pressure") Signed-off-by: Qais Yousef <qais.yousef@arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20211028115005.873539-1-qais.yousef@arm.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
Bharata B Rao	40732cab51	sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa ... [ Upstream commit 28c988c3ec29db74a1dda631b18785958d57df4f ] The older format of /proc/pid/sched printed home node info which required the mempolicy and task lock around mpol_get(). However the format has changed since then and there is no need for sched_show_numa() any more to have mempolicy argument, asssociated mpol_get/put and task_lock/unlock. Remove them. Fixes: 397f2378f1 ("sched/numa: Fix numa balancing stats in /proc/pid/sched") Signed-off-by: Bharata B Rao <bharata@amd.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Acked-by: Mel Gorman <mgorman@suse.de> Link: https://lore.kernel.org/r/20220118050515.2973-1-bharata@amd.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
David Howells	9d92be1a09	watch_queue: Actually free the watch ... [ Upstream commit 3d8dcf278b1ee1eff1e90be848fa2237db4c07a7 ] free_watch() does everything barring actually freeing the watch object. Fix this by adding the missing kfree. kmemleak produces a report something like the following. Note that as an address can be seen in the first word, the watch would appear to have gone through call_rcu(). BUG: memory leak unreferenced object 0xffff88810ce4a200 (size 96): comm "syz-executor352", pid 3605, jiffies 4294947473 (age 13.720s) hex dump (first 32 bytes): e0 82 48 0d 81 88 ff ff 00 00 00 00 00 00 00 00 ..H............. 80 a2 e4 0c 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8214e6cc>] kmalloc include/linux/slab.h:581 [inline] [<ffffffff8214e6cc>] kzalloc include/linux/slab.h:714 [inline] [<ffffffff8214e6cc>] keyctl_watch_key+0xec/0x2e0 security/keys/keyctl.c:1800 [<ffffffff8214ec84>] __do_sys_keyctl+0x3c4/0x490 security/keys/keyctl.c:2016 [<ffffffff84493a25>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84493a25>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: c73be61ced ("pipe: Add general notification queue support") Reported-and-tested-by: syzbot+6e2de48f06cdb2884bfc@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
David Howells	5ae75b4ed3	watch_queue: Fix NULL dereference in error cleanup ... [ Upstream commit a635415a064e77bcfbf43da413fd9dfe0bbed9cb ] In watch_queue_set_size(), the error cleanup code doesn't take account of the fact that __free_page() can't handle a NULL pointer when trying to free up buffer pages that did get allocated. Fix this by only calling __free_page() on the pages actually allocated. Without the fix, this can lead to something like the following: BUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473 Read of size 4 at addr 0000000000000034 by task syz-executor168/3599 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 __kasan_report mm/kasan/report.c:446 [inline] kasan_report.cold+0x66/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:71 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline] page_ref_count include/linux/page_ref.h:67 [inline] put_page_testzero include/linux/mm.h:717 [inline] __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473 watch_queue_set_size+0x499/0x630 kernel/watch_queue.c:275 pipe_ioctl+0xac/0x2b0 fs/pipe.c:632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: c73be61ced ("pipe: Add general notification queue support") Reported-and-tested-by: syzbot+d55757faa9b80590767b@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:03 +02:00
Randy Dunlap	3928a04bc6	PM: suspend: fix return value of __setup handler ... [ Upstream commit 7a64ca17e4dd50d5f910769167f3553902777844 ] If an invalid option is given for "test_suspend=<option>", the entire string is added to init's environment, so return 1 instead of 0 from the __setup handler. Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5 test_suspend=invalid" and Run /sbin/init as init process with arguments: /sbin/init with environment: HOME=/ TERM=linux BOOT_IMAGE=/boot/bzImage-517rc5 test_suspend=invalid Fixes: 2ce986892f ("PM / sleep: Enhance test_suspend option with repeat capability") Fixes: 27ddcc6596 ("PM / sleep: Add state field to pm_states[] entries") Fixes: a9d7052363 ("PM: Separate suspend to RAM functionality from core") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:01 +02:00
Randy Dunlap	052a218db0	PM: hibernate: fix __setup handler error handling ... [ Upstream commit ba7ffcd4c4da374b0f64666354eeeda7d3827131 ] If an invalid value is used in "resumedelay=<seconds>", it is silently ignored. Add a warning message and then let the __setup handler return 1 to indicate that the kernel command line option has been handled. Fixes: 317cf7e5e8 ("PM / hibernate: convert simple_strtoul to kstrtoul") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:01 +02:00
Richard Guy Briggs	a137f93ae5	audit: log AUDIT_TIME_* records only from rules ... [ Upstream commit 272ceeaea355214b301530e262a0df8600bfca95 ] AUDIT_TIME_* events are generated when there are syscall rules present that are not related to time keeping. This will produce noisy log entries that could flood the logs and hide events we really care about. Rather than immediately produce the AUDIT_TIME_* records, store the data in the context and log it at syscall exit time respecting the filter rules. Note: This eats the audit_buffer, unlike any others in show_special(). Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919 Fixes: 7e8eda734d ("ntp: Audit NTP parameters adjustment") Fixes: 2d87a0674b ("timekeeping: Audit clock adjustments") Signed-off-by: Richard Guy Briggs <rgb@redhat.com> [PM: fixed style/whitespace issues] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:00 +02:00
Jann Horn	5a41a3033a	ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE ... commit ee1fee900537b5d9560e9f937402de5ddc8412f3 upstream. Setting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged operation because it allows the tracee to completely bypass all seccomp filters on kernels with CONFIG_CHECKPOINT_RESTORE=y. It is only supposed to be settable by a process with global CAP_SYS_ADMIN, and only if that process is not subject to any seccomp filters at all. However, while these permission checks were done on the PTRACE_SETOPTIONS path, they were missing on the PTRACE_SEIZE path, which also sets user-specified ptrace flags. Move the permissions checks out into a helper function and let both ptrace_attach() and ptrace_setoptions() call it. Cc: stable@kernel.org Fixes: 13c4a90119 ("seccomp: add ptrace options for suspend/resume") Signed-off-by: Jann Horn <jannh@google.com> Link: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:39:50 +02:00
Waiman Long	68c80088f5	locking/lockdep: Avoid potential access of invalid memory in lock_class ... commit 61cc4534b6550997c97a03759ab46b29d44c0017 upstream. It was found that reading /proc/lockdep after a lockdep splat may potentially cause an access to freed memory if lockdep_unregister_key() is called after the splat but before access to /proc/lockdep [1]. This is due to the fact that graph_lock() call in lockdep_unregister_key() fails after the clearing of debug_locks by the splat process. After lockdep_unregister_key() is called, the lock_name may be freed but the corresponding lock_class structure still have a reference to it. That invalid memory pointer will then be accessed when /proc/lockdep is read by a user and a use-after-free (UAF) error will be reported if KASAN is enabled. To fix this problem, lockdep_unregister_key() is now modified to always search for a matching key irrespective of the debug_locks state and zap the corresponding lock class if a matching one is found. [1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/ Fixes: 8b39adbee8 ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again") Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Cc: Cheng-Jui Wang <cheng-jui.wang@mediatek.com> Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:39:48 +02:00
Halil Pasic	d4d975e792	swiotlb: fix info leak with DMA_FROM_DEVICE ... commit ddbd89deb7d32b1fbb879f48d68fda1a8ac58e8e upstream. The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV and a corresponding dxferp. The peculiar thing about this is that TUR is not reading from the device. 2) In sg_start_req() the invocation of blk_rq_map_user() effectively bounces the user-space buffer. As if the device was to transfer into it. Since commit a45b599ad8 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") we make sure this first bounce buffer is allocated with GFP_ZERO. 3) For the rest of the story we keep ignoring that we have a TUR, so the device won't touch the buffer we prepare as if the we had a DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device and the buffer allocated by SG is mapped by the function virtqueue_add_split() which uses DMA_FROM_DEVICE for the "in" sgs (here scatter-gather and not scsi generics). This mapping involves bouncing via the swiotlb (we need swiotlb to do virtio in protected guest like s390 Secure Execution, or AMD SEV). 4) When the SCSI TUR is done, we first copy back the content of the second (that is swiotlb) bounce buffer (which most likely contains some previous IO data), to the first bounce buffer, which contains all zeros. Then we copy back the content of the first bounce buffer to the user-space buffer. 5) The test case detects that the buffer, which it zero-initialized, ain't all zeros and fails. One can argue that this is an swiotlb problem, because without swiotlb we leak all zeros, and the swiotlb should be transparent in a sense that it does not affect the outcome (if all other participants are well behaved). Copying the content of the original buffer into the swiotlb buffer is the only way I can think of to make swiotlb transparent in such scenarios. So let's do just that if in doubt, but allow the driver to tell us that the whole mapped buffer is going to be overwritten, in which case we can preserve the old behavior and avoid the performance impact of the extra bounce. Signed-off-by: Halil Pasic <pasic@linux.ibm.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:39:46 +02:00
Waiman Long	002528dfb5	UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class ... commit 61cc4534b6550997c97a03759ab46b29d44c0017 upstream. It was found that reading /proc/lockdep after a lockdep splat may potentially cause an access to freed memory if lockdep_unregister_key() is called after the splat but before access to /proc/lockdep [1]. This is due to the fact that graph_lock() call in lockdep_unregister_key() fails after the clearing of debug_locks by the splat process. After lockdep_unregister_key() is called, the lock_name may be freed but the corresponding lock_class structure still have a reference to it. That invalid memory pointer will then be accessed when /proc/lockdep is read by a user and a use-after-free (UAF) error will be reported if KASAN is enabled. To fix this problem, lockdep_unregister_key() is now modified to always search for a matching key irrespective of the debug_locks state and zap the corresponding lock class if a matching one is found. [1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/ Bug: 225086211 Fixes: 8b39adbee8 ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again") Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com Signed-off-by: Cheng Jui Wang <cheng-jui.wang@mediatek.com> Change-Id: I1b03e363142d2b9905f8f263b02d3c7cfdbc515a	2022-04-01 17:14:44 +00:00
Greg Kroah-Hartman	51790ed529	Merge 5.10.109 into android12-5.10-lts ... Changes in 5.10.109 nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION net: ipv6: fix skb_over_panic in __ip6_append_data exfat: avoid incorrectly releasing for root inode cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv cgroup: Use open-time cgroup namespace for process migration perm checks cgroup-v1: Correct privileges check in release_agent writes tpm: Fix error handling in async work staging: fbtft: fb_st7789v: reset display before initialization llc: fix netdevice reference leaks in llc_ui_bind() ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: cmipci: Restore aux vol on suspend/resume ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec drivers: net: xgene: Fix regression in CRC stripping netfilter: nf_tables: initialize registers in nft_do_chain() ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU crypto: qat - disable registration of algorithms Revert "ath: add support for special 0x0 regulatory domain" rcu: Don't deboost before reporting expedited quiescent state mac80211: fix potential double free on mesh join tpm: use try_get_ops() in tpm-space.c wcn36xx: Differentiate wcn3660 from wcn3620 nds32: fix access_ok() checks in get/put_user llc: only change llc->dev when bind() succeeds Linux 5.10.109 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ifd757f0ec4ba643f7cbaf78aa899d3c159c4b877	2022-03-28 10:10:32 +02:00
Paul E. McKenney	fcc9797d0d	rcu: Don't deboost before reporting expedited quiescent state ... commit 10c535787436d62ea28156a4b91365fd89b5a432 upstream. Currently rcu_preempt_deferred_qs_irqrestore() releases rnp->boost_mtx before reporting the expedited quiescent state. Under heavy real-time load, this can result in this function being preempted before the quiescent state is reported, which can in turn prevent the expedited grace period from completing. Tim Murray reports that the resulting expedited grace periods can take hundreds of milliseconds and even more than one second, when they should normally complete in less than a millisecond. This was fine given that there were no particular response-time constraints for synchronize_rcu_expedited(), as it was designed for throughput rather than latency. However, some users now need sub-100-millisecond response-time constratints. This patch therefore follows Neeraj's suggestion (seconded by Tim and by Uladzislau Rezki) of simply reversing the two operations. Reported-by: Tim Murray <timmurray@google.com> Reported-by: Joel Fernandes <joelaf@google.com> Reported-by: Neeraj Upadhyay <quic_neeraju@quicinc.com> Reviewed-by: Neeraj Upadhyay <quic_neeraju@quicinc.com> Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com> Tested-by: Tim Murray <timmurray@google.com> Cc: Todd Kjos <tkjos@google.com> Cc: Sandeep Patil <sspatil@google.com> Cc: <stable@vger.kernel.org> # 5.4.x Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-28 09:57:10 +02:00
Michal Koutný	ea21245cdc	cgroup-v1: Correct privileges check in release_agent writes ... commit 467a726b754f474936980da793b4ff2ec3e382a7 upstream. The idea is to check: a) the owning user_ns of cgroup_ns, b) capabilities in init_user_ns. The commit 24f600856418 ("cgroup-v1: Require capabilities to set release_agent") got this wrong in the write handler of release_agent since it checked user_ns of the opener (may be different from the owning user_ns of cgroup_ns). Secondly, to avoid possibly confused deputy, the capability of the opener must be checked. Fixes: 24f600856418 ("cgroup-v1: Require capabilities to set release_agent") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/stable/20220216121142.GB30035@blackbody.suse.cz/ Signed-off-by: Michal Koutný <mkoutny@suse.com> Reviewed-by: Masami Ichikawa(CIP) <masami.ichikawa@cybertrust.co.jp> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-28 09:57:08 +02:00
Tejun Heo	824a950c3f	cgroup: Use open-time cgroup namespace for process migration perm checks ... commit e57457641613fef0d147ede8bd6a3047df588b95 upstream. cgroup process migration permission checks are performed at write time as whether a given operation is allowed or not is dependent on the content of the write - the PID. This currently uses current's cgroup namespace which is a potential security weakness as it may allow scenarios where a less privileged process tricks a more privileged one into writing into a fd that it created. This patch makes cgroup remember the cgroup namespace at the time of open and uses it for migration permission checks instad of current's. Note that this only applies to cgroup2 as cgroup1 doesn't have namespace support. This also fixes a use-after-free bug on cgroupns reported in https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com Note that backporting this fix also requires the preceding patch. Reported-by: "Eric W. Biederman" <ebiederm@xmission.com> Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> Cc: Michal Koutný <mkoutny@suse.com> Cc: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Michal Koutný <mkoutny@suse.com> Reported-by: syzbot+50f5cf33a284ce738b62@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com Fixes: 5136f6365c ("cgroup: implement "nsdelegate" mount option") Signed-off-by: Tejun Heo <tj@kernel.org> [mkoutny: v5.10: duplicate ns check in procs/threads write handler, adjust context] Signed-off-by: Michal Koutný <mkoutny@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-28 09:57:07 +02:00
Tejun Heo	f28364fe38	cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv ... commit 0d2b5955b36250a9428c832664f2079cbf723bec upstream. of->priv is currently used by each interface file implementation to store private information. This patch collects the current two private data usages into struct cgroup_file_ctx which is allocated and freed by the common path. This allows generic private data which applies to multiple files, which will be used to in the following patch. Note that cgroup_procs iterator is now embedded as procs.iter in the new cgroup_file_ctx so that it doesn't need to be allocated and freed separately. v2: union dropped from cgroup_file_ctx and the procs iterator is embedded in cgroup_file_ctx as suggested by Linus. v3: Michal pointed out that cgroup1's procs pidlist uses of->priv too. Converted. Didn't change to embedded allocation as cgroup1 pidlists get stored for caching. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Reviewed-by: Michal Koutný <mkoutny@suse.com> [mkoutny: v5.10: modify cgroup.pressure handlers, adjust context] Signed-off-by: Michal Koutný <mkoutny@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-28 09:57:07 +02:00