Changes in 5.10.219
x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
speakup: Fix sizeof() vs ARRAY_SIZE() bug
ring-buffer: Fix a race between readers and resize checks
net: smc91x: Fix m68k kernel compilation for ColdFire CPU
nilfs2: fix unexpected freezing of nilfs_segctor_sync()
nilfs2: fix potential hang in nilfs_detach_log_writer()
ALSA: core: Fix NULL module pointer assignment at card init
wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
net: usb: qmi_wwan: add Telit FN920C04 compositions
drm/amd/display: Set color_mgmt_changed to true on unsuspend
ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
regulator: vqmmc-ipq4019: fix module autoloading
ASoC: rt715: add vendor clear control register
ASoC: da7219-aad: fix usage of device_get_named_child_node()
drm/amdkfd: Flush the process wq before creating a kfd_process
nvme: find numa distance only if controller has valid numa id
openpromfs: finish conversion to the new mount API
crypto: bcm - Fix pointer arithmetic
firmware: raspberrypi: Use correct device for DMA mappings
ecryptfs: Fix buffer size for tag 66 packet
nilfs2: fix out-of-range warning
parisc: add missing export of __cmpxchg_u8()
crypto: ccp - drop platform ifdef checks
crypto: x86/nh-avx2 - add missing vzeroupper
crypto: x86/sha256-avx2 - add missing vzeroupper
s390/cio: fix tracepoint subchannel type field
jffs2: prevent xattr node from overflowing the eraseblock
soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
null_blk: Fix missing mutex_destroy() at module removal
md: fix resync softlockup when bitmap size is less than array size
wifi: ath10k: poll service ready message before failing
x86/boot: Ignore relocations in .notes sections in walk_relocs() too
qed: avoid truncating work queue length
scsi: ufs: qcom: Perform read back after writing reset bit
scsi: ufs-qcom: Fix ufs RST_n spec violation
scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
scsi: ufs: qcom: Perform read back after writing unipro mode
scsi: ufs: qcom: Perform read back after writing CGC enable
scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
scsi: ufs: core: Perform read back after disabling interrupts
scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
irqchip/alpine-msi: Fix off-by-one in allocation error path
irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
ACPI: disable -Wstringop-truncation
gfs2: Fix "ignore unlock failures after withdraw"
selftests/bpf: Fix umount cgroup2 error in test_sockmap
cpufreq: Reorganize checks in cpufreq_offline()
cpufreq: Split cpufreq_offline()
cpufreq: Rearrange locking in cpufreq_remove_dev()
cpufreq: exit() callback is optional
net: export inet_lookup_reuseport and inet6_lookup_reuseport
net: remove duplicate reuseport_lookup functions
udp: Avoid call to compute_score on multiple sites
scsi: libsas: Fix the failure of adding phy with zero-address to port
scsi: hpsa: Fix allocation size for Scsi_Host private data
x86/purgatory: Switch to the position-independent small code model
wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
wifi: ath10k: populate board data for WCN3990
tcp: avoid premature drops in tcp_add_backlog()
net: give more chances to rcu in netdev_wait_allrefs_any()
macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
wifi: carl9170: add a proper sanity check for endpoints
wifi: ar5523: enable proper endpoint verification
sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
Revert "sh: Handle calling csum_partial with misaligned data"
selftests/binderfs: use the Makefile's rules, not Make's implicit rules
HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
scsi: bfa: Ensure the copied buf is NUL terminated
scsi: qedf: Ensure the copied buf is NUL terminated
wifi: mwl8k: initialize cmd->addr[] properly
usb: aqc111: stop lying about skb->truesize
net: usb: sr9700: stop lying about skb->truesize
m68k: Fix spinlock race in kernel thread creation
m68k: mac: Fix reboot hang on Mac IIci
net: ipv6: fix wrong start position when receive hop-by-hop fragment
eth: sungem: remove .ndo_poll_controller to avoid deadlocks
net: ethernet: cortina: Locking fixes
af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
net: usb: smsc95xx: stop lying about skb->truesize
net: openvswitch: fix overwriting ct original tuple for ICMPv6
ipv6: sr: add missing seg6_local_exit
ipv6: sr: fix incorrect unregister order
ipv6: sr: fix invalid unregister error path
net/mlx5: Discard command completions in internal error
drm/amd/display: Fix potential index out of bounds in color transformation function
ASoC: soc-acpi: add helper to identify parent driver.
ASoC: Intel: Disable route checks for Skylake boards
mtd: rawnand: hynix: fixed typo
fbdev: shmobile: fix snprintf truncation
drm/meson: vclk: fix calculation of 59.94 fractional rates
drm/mediatek: Add 0 size check to mtk_drm_gem_obj
powerpc/fsl-soc: hide unused const variable
fbdev: sisfb: hide unused variables
media: ngene: Add dvb_ca_en50221_init return value check
media: radio-shark2: Avoid led_names truncations
drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
fbdev: sh7760fb: allow modular build
media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
drm/arm/malidp: fix a possible null pointer dereference
drm: vc4: Fix possible null pointer dereference
ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
drm/bridge: lt9611: Don't log an error when DSI host can't be found
drm/bridge: tc358775: Don't log an error when DSI host can't be found
drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
drm/mipi-dsi: use correct return type for the DSC functions
RDMA/hns: Refactor the hns_roce_buf allocation flow
RDMA/hns: Create QP with selected QPN for bank load balance
RDMA/hns: Fix incorrect symbol types
RDMA/hns: Fix return value in hns_roce_map_mr_sg
RDMA/hns: Use complete parentheses in macros
RDMA/hns: Modify the print level of CQE error
clk: qcom: mmcc-msm8998: fix venus clock issue
x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
ext4: avoid excessive credit estimate in ext4_tmpfile()
sunrpc: removed redundant procp check
ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
ext4: fix unit mismatch in ext4_mb_new_blocks_simple
ext4: try all groups in ext4_mb_new_blocks_simple
ext4: remove unused parameter from ext4_mb_new_blocks_simple()
ext4: fix potential unnitialized variable
SUNRPC: Fix gss_free_in_token_pages()
selftests/kcmp: Make the test output consistent and clear
selftests/kcmp: remove unused open mode
RDMA/IPoIB: Fix format truncation compilation errors
net: qrtr: fix null-ptr-deref in qrtr_ns_remove
net: qrtr: ns: Fix module refcnt
netrom: fix possible dead-lock in nr_rt_ioctl()
af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
greybus: lights: check return of get_channel_from_mode
f2fs: fix to wait on page writeback in __clone_blkaddrs()
soundwire: cadence: fix invalid PDI offset
dmaengine: idma64: Add check for dma_set_max_seg_size
firmware: dmi-id: add a release callback function
serial: max3100: Lock port->lock when calling uart_handle_cts_change()
serial: max3100: Update uart_driver_registered on driver removal
serial: max3100: Fix bitwise types
greybus: arche-ctrl: move device table to its right location
serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
f2fs: compress: support chksum
f2fs: add compress_mode mount option
f2fs: compress: clean up parameter of __f2fs_cluster_blocks()
f2fs: compress: remove unneeded preallocation
f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit
f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
f2fs: add cp_error check in f2fs_write_compressed_pages
f2fs: fix to force keeping write barrier for strict fsync mode
f2fs: do not allow partial truncation on pinned file
f2fs: fix typos in comments
f2fs: fix to relocate check condition in f2fs_fallocate()
f2fs: fix to check pinfile flag in f2fs_move_file_range()
iio: pressure: dps310: support negative temperature values
fpga: region: change FPGA indirect article to an
fpga: region: Rename dev to parent for parent device
docs: driver-api: fpga: avoid using UTF-8 chars
fpga: region: Use standard dev_release for class driver
fpga: region: add owner module and take its refcount
microblaze: Remove gcc flag for non existing early_printk.c file
microblaze: Remove early printk call from cpuinfo-static.c
usb: gadget: u_audio: Clear uac pointer when freed.
stm class: Fix a double free in stm_register_device()
ppdev: Remove usage of the deprecated ida_simple_xx() API
ppdev: Add an error check in register_device
extcon: max8997: select IRQ_DOMAIN instead of depending on it
PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
f2fs: fix to release node block count in error path of f2fs_new_node_page()
f2fs: compress: don't allow unaligned truncation on released compress inode
serial: sh-sci: protect invalidating RXDMA on shutdown
libsubcmd: Fix parse-options memory leak
s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
s390/ipl: Fix incorrect initialization of nvme dump block
Input: ims-pcu - fix printf string overflow
Input: ioc3kbd - convert to platform remove callback returning void
Input: ioc3kbd - add device table
mmc: sdhci_am654: Add tuning algorithm for delay chain
mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
mmc: sdhci_am654: Add OTAP/ITAP delay enable
mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
drm/msm/dpu: Always flush the slave INTF on the CTL
um: Fix return value in ubd_init()
um: Add winch to winch_handlers before registering winch IRQ
um: vector: fix bpfflash parameter evaluation
drm/bridge: tc358775: fix support for jeida-18 and jeida-24
media: stk1160: fix bounds checking in stk1160_copy_video()
scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
media: flexcop-usb: clean up endpoint sanity checks
media: flexcop-usb: fix sanity check of bNumEndpoints
powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
um: Fix the -Wmissing-prototypes warning for __switch_mm
media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
media: cec: cec-api: add locking in cec_release()
media: core headers: fix kernel-doc warnings
media: cec: fix a deadlock situation
media: cec: call enable_adap on s_log_addrs
media: cec: abort if the current transmit was canceled
media: cec: correctly pass on reply results
media: cec: use call_op and check for !unregistered
media: cec-adap.c: drop activate_cnt, use state info instead
media: cec: core: avoid recursive cec_claim_log_addrs
media: cec: core: avoid confusing "transmit timed out" message
null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
regulator: bd71828: Don't overwrite runtime voltages
x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
nfc: nci: Fix uninit-value in nci_rx_work
ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
sunrpc: fix NFSACL RPC retry on soft mount
rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
ipv6: sr: fix memleak in seg6_hmac_init_algo
params: lift param_set_uint_minmax to common code
tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
openvswitch: Set the skbuff pkt_type for proper pmtud support.
arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
net: fec: avoid lock evasion when reading pps_enable
tls: fix missing memory barrier in tls_init
nfc: nci: Fix kcov check in nci_rx_work()
nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
netfilter: nft_payload: restore vlan q-in-q match support
spi: Don't mark message DMA mapped when no transfer in it is
nvmet: fix ns enable/disable possible hang
net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
bpf: Fix potential integer overflow in resolve_btfids
enic: Validate length of nl attributes in enic_set_vf_port
net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
bpf: Allow delete from sockmap/sockhash only if update is allowed
net:fec: Add fec_enet_deinit()
netfilter: tproxy: bail out if IP has been disabled on the device
kconfig: fix comparison to constant symbols, 'm', 'n'
spi: stm32: Don't warn about spurious interrupts
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
hwmon: (shtc1) Fix property misspelling
ALSA: timer: Set lower bound of start tick time
genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
media: cec: core: add adap_nb_transmit_canceled() callback
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
binder: fix max_thread type inconsistency
mmc: core: Do not force a retune before RPMB switch
io_uring: fail NOP if non-zero op flags is passed in
afs: Don't cross .backup mountpoint from backup volume
nilfs2: fix use-after-free of timer for log writer thread
vxlan: Fix regression when dropping packets due to invalid src addresses
x86/mm: Remove broken vsyscall emulation code from the page fault code
netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
media: lgdt3306a: Add a check against null-pointer-def
drm/amdgpu: add error handle to avoid out-of-bounds
ata: pata_legacy: make legacy_exit() work again
ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
arm64: tegra: Correct Tegra132 I2C alias
arm64: dts: qcom: qcs404: fix bluetooth device address
md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
arm64: dts: hi3798cv200: fix the size of GICR
media: mc: mark the media devnode as registered from the, start
media: mxl5xx: Move xpt structures off stack
media: v4l2-core: hold videodev_lock until dev reg, finishes
mmc: core: Add mmc_gpiod_set_cd_config() function
mmc: sdhci-acpi: Sort DMI quirks alphabetically
mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
fbdev: savage: Handle err return when savagefb_check_var failed
KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
crypto: ecrdsa - Fix module auto-load on add_key
crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
net/ipv6: Fix route deleting failure when metric equals 0
net/9p: fix uninit-value in p9_client_rpc()
intel_th: pci: Add Meteor Lake-S CPU support
sparc64: Fix number of online CPUs
watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
kdb: Fix buffer overflow during tab-complete
kdb: Use format-strings rather than '\0' injection in kdb_read()
kdb: Fix console handling when editing and tab-completing commands
kdb: Merge identical case statements in kdb_read()
kdb: Use format-specifiers rather than memset() for padding in kdb_read()
net: fix __dst_negative_advice() race
sparc: move struct termio to asm/termios.h
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
s390/ap: Fix crash in AP internal function modify_bitmap()
nfs: fix undefined behavior in nfs_block_bits()
NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
f2fs: compress: fix compression chksum
RDMA/hns: Use mutex instead of spinlock for ida allocation
RDMA/hns: Fix CQ and QP cache affinity
Linux 5.10.219
Change-Id: I0e21ff44d28df2a2802a9fb35f0959bb5ab528fc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 42316941335644a98335f209daafa4c122f28983 upstream.
The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from
size_t to __u32 in order to avoid incompatibility issues between 32 and
64-bit kernels. However, the internal types used to copy from user and
store the value were never updated. Use u32 to fix the inconsistency.
Fixes: a9350fc859 ("staging: android: binder: fix BINDER_SET_MAX_THREADS declaration")
Reported-by: Arve Hjønnevåg <arve@android.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240421173750.3117808-1-cmllamas@google.com
[cmllamas: resolve minor conflicts due to missing commit 421518a2740f]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aaef73821a3b0194a01bd23ca77774f704a04d40 upstream.
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying
txn") introduced changes to how binder objects are copied. In doing so,
it unintentionally removed an offset alignment check done through calls
to binder_alloc_copy_from_buffer() -> check_buffer().
These calls were replaced in binder_get_object() with copy_from_user(),
so now an explicit offset alignment check is needed here. This avoids
later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320
("binder: add function to copy binder object from buffer"), likely
removed due to redundancy at the time.
Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240330190115.1877819-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Changes in 5.10.210
usb: cdns3: Fixes for sparse warnings
usb: cdns3: fix uvc failure work since sg support enabled
usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
usb: cdns3: fix iso transfer error when mult is not zero
usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
PCI: mediatek: Clear interrupt status before dispatching handler
units: change from 'L' to 'UL'
units: add the HZ macros
serial: sc16is7xx: set safe default SPI clock frequency
spi: introduce SPI_MODE_X_MASK macro
serial: sc16is7xx: add check for unsupported SPI modes during probe
iio: adc: ad7091r: Set alert bit in config register
iio: adc: ad7091r: Allow users to configure device events
iio: adc: ad7091r: Enable internal vref if external vref is not supplied
dmaengine: fix NULL pointer in channel unregistration function
iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
ext4: allow for the last group to be marked as trimmed
crypto: api - Disallow identical driver names
PM: hibernate: Enforce ordering during image compression/decompression
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
crypto: s390/aes - Fix buffer overread in CTR mode
rpmsg: virtio: Free driver_override when rpmsg_remove()
bus: mhi: host: Drop chan lock before queuing buffers
parisc/firmware: Fix F-extend for PDC addresses
async: Split async_schedule_node_domain()
async: Introduce async_schedule_dev_nocall()
arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
lsm: new security_file_ioctl_compat() hook
scripts/get_abi: fix source path leak
mmc: core: Use mrq.sbc in close-ended ffu
mmc: mmc_spi: remove custom DMA mapped buffers
rtc: Adjust failure return code for cmos_set_alarm()
nouveau/vmm: don't set addr on the fail path to avoid warning
ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
rename(): fix the locking of subdirectories
block: Remove special-casing of compound pages
stddef: Introduce DECLARE_FLEX_ARRAY() helper
smb3: Replace smb2pdu 1-element arrays with flex-arrays
mm: vmalloc: introduce array allocation functions
KVM: use __vcalloc for very large allocations
net/smc: fix illegal rmb_desc access in SMC-D connection dump
tcp: make sure init the accept_queue's spinlocks once
bnxt_en: Wait for FLR to complete during probe
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
llc: make llc_ui_sendmsg() more robust against bonding changes
llc: Drop support for ETH_P_TR_802_2.
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
tracing: Ensure visibility when inserting an element into tracing_map
afs: Hide silly-rename files from userspace
tcp: Add memory barrier to tcp_push()
netlink: fix potential sleeping issue in mqueue_flush_file
ipv6: init the accept_queue's spinlocks in inet6_create
net/mlx5: DR, Use the right GVMI number for drop action
net/mlx5e: fix a double-free in arfs_create_groups
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
netfilter: nf_tables: validate NFPROTO_* family
net: mvpp2: clear BM pool before initialization
selftests: netdevsim: fix the udp_tunnel_nic test
fjes: fix memleaks in fjes_hw_setup
net: fec: fix the unhandled context fault from smmu
btrfs: ref-verify: free ref cache before clearing mount opt
btrfs: tree-checker: fix inline ref size in error messages
btrfs: don't warn if discard range is not aligned to sector
btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
rbd: don't move requests to the running list on errors
exec: Fix error handling in begin_new_exec()
wifi: iwlwifi: fix a memory corruption
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
drm: Don't unref the same fb many times by mistake due to deadlock handling
drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
drm/tidss: Fix atomic_flush check
drm/bridge: nxp-ptn3460: simplify some error checking
PM: sleep: Use dev_printk() when possible
PM: sleep: Avoid calling put_device() under dpm_list_mtx
PM: core: Remove unnecessary (void *) conversions
PM: sleep: Fix possible deadlocks in core system-wide PM code
fs/pipe: move check to pipe_has_watch_queue()
pipe: wakeup wr_wait after setting max_usage
ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts
arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
mm: use __pfn_to_section() instead of open coding it
mm/sparsemem: fix race in accessing memory_section->usage
btrfs: remove err variable from btrfs_delete_subvolume
btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted
drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
drm/exynos: fix accidental on-stack copy of exynos_drm_plane
drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
gpio: eic-sprd: Clear interrupt after set the interrupt type
spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
tick/sched: Preserve number of idle sleeps across CPU hotplug events
x86/entry/ia32: Ensure s32 is sign extended to s64
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
powerpc: Fix build error due to is_valid_bugaddr()
powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
x86/boot: Ignore NMIs during very early boot
powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
powerpc/lib: Validate size for vector operations
x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
debugobjects: Stop accessing objects after releasing hash bucket lock
regulator: core: Only increment use_count when enable_count changes
audit: Send netlink ACK before setting connection in auditd_set
ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
PNP: ACPI: fix fortify warning
ACPI: extlog: fix NULL pointer dereference check
PM / devfreq: Synchronize devfreq_monitor_[start/stop]
ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
UBSAN: array-index-out-of-bounds in dtSplitRoot
jfs: fix slab-out-of-bounds Read in dtSearch
jfs: fix array-index-out-of-bounds in dbAdjTree
jfs: fix uaf in jfs_evict_inode
pstore/ram: Fix crash when setting number of cpus to an odd number
crypto: stm32/crc32 - fix parsing list of devices
afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
jfs: fix array-index-out-of-bounds in diNewExt
s390/ptrace: handle setting of fpc register correctly
KVM: s390: fix setting of fpc register
SUNRPC: Fix a suspicious RCU usage warning
ecryptfs: Reject casefold directory inodes
ext4: fix inconsistent between segment fstrim and full fstrim
ext4: unify the type of flexbg_size to unsigned int
ext4: remove unnecessary check from alloc_flex_gd()
ext4: avoid online resizing failures due to oversized flex bg
wifi: rt2x00: restart beacon queue when hardware reset
selftests/bpf: satisfy compiler by having explicit return in btf test
selftests/bpf: Fix pyperf180 compilation failure with clang18
scsi: lpfc: Fix possible file string name overflow when updating firmware
PCI: Add no PM reset quirk for NVIDIA Spectrum devices
bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
scsi: arcmsr: Support new PCI device IDs 1883 and 1886
ARM: dts: imx7d: Fix coresight funnel ports
ARM: dts: imx7s: Fix lcdif compatible
ARM: dts: imx7s: Fix nand-controller #size-cells
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
bpf: Add map and need_defer parameters to .map_fd_put_ptr()
scsi: libfc: Don't schedule abort twice
scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
bpf: Set uattr->batch.count as zero before batched update or deletion
ARM: dts: rockchip: fix rk3036 hdmi ports node
ARM: dts: imx25/27-eukrea: Fix RTC node name
ARM: dts: imx: Use flash@0,0 pattern
ARM: dts: imx27: Fix sram node
ARM: dts: imx1: Fix sram node
ionic: pass opcode to devcmd_wait
block/rnbd-srv: Check for unlikely string overflow
ARM: dts: imx25: Fix the iim compatible string
ARM: dts: imx25/27: Pass timing0
ARM: dts: imx27-apf27dev: Fix LED name
ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
ARM: dts: imx23/28: Fix the DMA controller node name
net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
block: prevent an integer overflow in bvec_try_merge_hw_page
md: Whenassemble the array, consult the superblock of the freshest device
arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
Bluetooth: L2CAP: Fix possible multiple reject send
i40e: Fix VF disable behavior to block all traffic
f2fs: fix to check return value of f2fs_reserve_new_block()
ALSA: hda: Refer to correct stream index at loops
ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
fast_dput(): handle underflows gracefully
RDMA/IPoIB: Fix error code return in ipoib_mcast_join
drm/amd/display: Fix tiled display misalignment
f2fs: fix write pointers on zoned device after roll forward
drm/drm_file: fix use of uninitialized variable
drm/framebuffer: Fix use of uninitialized variable
drm/mipi-dsi: Fix detach call without attach
media: stk1160: Fixed high volume of stk1160_dbg messages
media: rockchip: rga: fix swizzling for RGB formats
PCI: add INTEL_HDA_ARL to pci_ids.h
ALSA: hda: Intel: add HDA_ARL PCI ID support
ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
IB/ipoib: Fix mcast list locking
media: ddbridge: fix an error code problem in ddb_probe
drm/msm/dpu: Ratelimit framedone timeout msgs
clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
drm/amdgpu: Let KFD sync with VM fences
drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
leds: trigger: panic: Don't register panic notifier if creating the trigger failed
um: Fix naming clash between UML and scheduler
um: Don't use vfprintf() for os_info()
um: net: Fix return type of uml_net_start_xmit()
i3c: master: cdns: Update maximum prescaler value for i2c clock
xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
mfd: ti_am335x_tscadc: Fix TI SoC dependencies
PCI: Only override AMD USB controller if required
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
usb: hub: Replace hardcoded quirk value with BIT() macro
tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
fs/kernfs/dir: obey S_ISGID
PCI/AER: Decode Requester ID when no error info found
libsubcmd: Fix memory leak in uniq()
virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
blk-mq: fix IO hang from sbitmap wakeup race
ceph: fix deadlock or deadcode of misusing dget()
drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
perf: Fix the nr_addr_filters fix
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
drm: using mul_u32_u32() requires linux/math64.h
scsi: isci: Fix an error code problem in isci_io_request_build()
scsi: core: Introduce enum scsi_disposition
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
ip6_tunnel: use dev_sw_netstats_rx_add()
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
net-zerocopy: Refactor frag-is-remappable test.
tcp: add sanity checks to rx zerocopy
ixgbe: Remove non-inclusive language
ixgbe: Refactor returning internal error codes
ixgbe: Refactor overtemp event handling
ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
llc: call sock_orphan() at release time
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
net: ipv4: fix a memleak in ip_setup_cork
af_unix: fix lockdep positive in sk_diag_dump_icons()
net: sysfs: Fix /sys/class/net/<iface> path
HID: apple: Add support for the 2021 Magic Keyboard
HID: apple: Add 2021 magic keyboard FN key mapping
bonding: remove print in bond_verify_device_path
uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
PM: sleep: Fix error handling in dpm_prepare()
dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
dmaengine: ti: k3-udma: Report short packet errors
dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
selftests: net: avoid just another constant wait
tunnels: fix out of bounds access when building IPv6 PMTU error
atm: idt77252: fix a memleak in open_card_ubr0
hwmon: (aspeed-pwm-tacho) mutex for tach reading
hwmon: (coretemp) Fix out-of-bounds memory access
hwmon: (coretemp) Fix bogus core_id to attr name mapping
inet: read sk->sk_family once in inet_recv_error()
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
ppp_async: limit MRU to 64K
netfilter: nft_compat: reject unused compat flag
netfilter: nft_compat: restrict match/target protocol to u16
netfilter: nft_ct: reject direction for ct id
netfilter: nft_set_pipapo: store index in scratch maps
netfilter: nft_set_pipapo: add helper to release pcpu scratch area
netfilter: nft_set_pipapo: remove scratch_aligned pointer
scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
blk-iocost: Fix an UBSAN shift-out-of-bounds warning
net/af_iucv: clean up a try_then_request_module()
USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
USB: serial: option: add Fibocom FM101-GL variant
USB: serial: cp210x: add ID for IMST iM871A-USB
usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
hrtimer: Report offline hrtimer enqueue
Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
vhost: use kzalloc() instead of kmalloc() followed by memset()
clocksource: Skip watchdog check for large watchdog intervals
net: stmmac: xgmac: use #define for string constants
net: stmmac: xgmac: fix a typo of register name in DPP safety handling
netfilter: nft_set_rbtree: skip end interval element from gc
btrfs: forbid creating subvol qgroups
btrfs: do not ASSERT() if the newly created subvolume already got read
btrfs: forbid deleting live subvol qgroup
btrfs: send: return EOPNOTSUPP on unknown flags
of: unittest: Fix compile in the non-dynamic case
net: openvswitch: limit the number of recursions from action sets
spi: ppc4xx: Drop write-only variable
ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
net: sysfs: Fix /sys/class/net/<iface> path for statistics
MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
i40e: Fix waiting for queues of all VSIs to be disabled
tracing/trigger: Fix to return error if failed to alloc snapshot
mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32
ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
HID: wacom: generic: Avoid reporting a serial of '0' to userspace
HID: wacom: Do not register input devices until after hid_hw_start
usb: ucsi_acpi: Fix command completion handling
USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
usb: f_mass_storage: forbid async queue when shutdown happen
media: ir_toy: fix a memleak in irtoy_tx
powerpc/kasan: Fix addr error caused by page alignment
i2c: i801: Remove i801_set_block_buffer_mode
i2c: i801: Fix block process call transactions
modpost: trim leading spaces when processing source files list
scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
lsm: fix the logic in security_inode_getsecctx()
firewire: core: correct documentation of fw_csr_string() kernel API
kbuild: Fix changing ELF file type for output of gen_btf for big endian
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
xen-netback: properly sync TX responses
ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
binder: signal epoll threads of self-work
misc: fastrpc: Mark all sessions as invalid in cb_remove
ext4: fix double-free of blocks due to wrong extents moved_len
tracing: Fix wasted memory in saved_cmdlines logic
staging: iio: ad5933: fix type mismatch regression
iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
iio: accel: bma400: Fix a compilation problem
media: rc: bpf attach/detach requires write permission
hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
ring-buffer: Clean ring_buffer_poll_wait() error return
serial: max310x: set default value when reading clock ready bit
serial: max310x: improve crystal stable clock detection
x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
mmc: slot-gpio: Allow non-sleeping GPIO ro
ALSA: hda/conexant: Add quirk for SWS JS201D
nilfs2: fix data corruption in dsync block recovery for small block sizes
nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
nfp: use correct macro for LengthSelect in BAR config
nfp: flower: prevent re-adding mac index for bonded port
wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
irqchip/irq-brcmstb-l2: Add write memory barrier before exit
irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
s390/qeth: Fix potential loss of L3-IP@ in case of network issues
ceph: prevent use-after-free in encode_cap_msg()
of: property: fix typo in io-channels
can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
pmdomain: core: Move the unused cleanup to a _sync initcall
tracing: Inform kmemleak of saved_cmdlines allocation
Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
bus: moxtet: Add spi device table
PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
mips: Fix max_mapnr being uninitialized on early stages
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
serial: Add rs485_supported to uart_port
serial: 8250_exar: Fill in rs485_supported
serial: 8250_exar: Set missing rs485_supported flag
scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm
scripts/decode_stacktrace.sh: support old bash version
scripts: decode_stacktrace: demangle Rust symbols
scripts/decode_stacktrace.sh: optionally use LLVM utilities
netfilter: ipset: fix performance regression in swap operation
netfilter: ipset: Missing gc cancellations fixed
hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
Revert "arm64: Stash shadow stack pointer in the task struct on interrupt"
net: prevent mss overflow in skb_segment()
sched/membarrier: reduce the ability to hammer on sys_membarrier
nilfs2: fix potential bug in end_buffer_async_write
nilfs2: replace WARN_ONs for invalid DAT metadata block requests
dm: limit the number of targets and parameter size area
PM: runtime: add devm_pm_runtime_enable helper
PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
drm/msm/dsi: Enable runtime PM
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
net: bcmgenet: Fix EEE implementation
PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
Linux 5.10.210
Change-Id: I5e7327f58dd6abd26ac2b1e328a81c1010d1147c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying
txn") introduced changes to how binder objects are copied. In doing so,
it unintentionally removed an offset alignment check done through calls
to binder_alloc_copy_from_buffer() -> check_buffer().
These calls were replaced in binder_get_object() with copy_from_user(),
so now an explicit offset alignment check is needed here. This avoids
later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320
("binder: add function to copy binder object from buffer"), likely
removed due to redundancy at the time.
Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn")
Cc: <stable@vger.kernel.org>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Bug: 320661088
Link: https://lore.kernel.org/all/20240330190115.1877819-1-cmllamas@google.com/
Change-Id: Iaddabaa28de7ba7b7d35dbb639d38ca79dbc5077
Signed-off-by: Carlos Llamas <cmllamas@google.com>
When cpu loading is high, the task maybe preempted after restoring the
sched priority in trace_android_vh_binder_free_buf(). This means that
node->has_async_transaction can't be cleared immediately and the work
isn't added to the proc->todo queue as soon as possible.
To fix this we add a new hook trace_android_vh_binder_buffer_release()
to restore the priority after node->has_async_transaction has been
updated and the node->work has been added to the proc->todo queue.
Note: the old trace_android_vh_binder_free_buf() hook is kept to avoid
breaking KMI but is not extrictly needed.
Bug: 327307900
Fixes: 0eb66ec39ca8 ("ANDROID: vendor_hooks: Add hooks for binder")
Change-Id: I8126c79c9c68faa3ce0cd87ce83e2591bd61d5dd
Signed-off-by: Fuchun Liao <lfc@oppo.com>
[cmllamas: fix-up commit log and variable naming]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream.
In (e)poll mode, threads often depend on I/O events to determine when
data is ready for consumption. Within binder, a thread may initiate a
command via BINDER_WRITE_READ without a read buffer and then make use
of epoll_wait() or similar to consume any responses afterwards.
It is then crucial that epoll threads are signaled via wakeup when they
queue their own work. Otherwise, they risk waiting indefinitely for an
event leaving their work unhandled. What is worse, subsequent commands
won't trigger a wakeup either as the thread has pending work.
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Martijn Coenen <maco@android.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Steven Moreland <smoreland@google.com>
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Changes in 5.10.209
f2fs: explicitly null-terminate the xattr list
pinctrl: lochnagar: Don't build on MIPS
ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
mptcp: fix uninit-value in mptcp_incoming_options
debugfs: fix automount d_fsdata usage
drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
nvme-core: check for too small lba shift
ASoC: wm8974: Correct boost mixer inputs
ASoC: Intel: Skylake: Fix mem leak in few functions
ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
ASoC: Intel: Skylake: mem leak in skl register function
ASoC: cs43130: Fix the position of const qualifier
ASoC: cs43130: Fix incorrect frame delay configuration
ASoC: rt5650: add mutex to avoid the jack detection failure
nouveau/tu102: flush all pdbs on vmm flush
net/tg3: fix race condition in tg3_reset_task()
ASoC: da7219: Support low DC impedance headset
nvme: introduce helper function to get ctrl state
drm/exynos: fix a potential error pointer dereference
drm/exynos: fix a wrong error checking
clk: rockchip: rk3128: Fix HCLK_OTG gate register
jbd2: correct the printing of write_flags in jbd2_write_superblock()
drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
neighbour: Don't let neigh_forced_gc() disable preemption for long
jbd2: fix soft lockup in journal_finish_inode_data_buffers()
tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
tracing: Add size check when printing trace_marker output
ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
Input: atkbd - skip ATKBD_CMD_GETID in translated mode
Input: i8042 - add nomux quirk for Acer P459-G2-M
s390/scm: fix virtual vs physical address confusion
ARC: fix spare error
Input: xpad - add Razer Wolverine V2 support
i2c: rk3x: fix potential spinlock recursion on poll
ida: Fix crash in ida_free when the bitmap is empty
net: qrtr: ns: Return 0 if server port is not present
ARM: sun9i: smp: fix return code check of of_property_match_string
drm/crtc: fix uninitialized variable use
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
binder: use EPOLLERR from eventpoll.h
binder: fix trivial typo of binder_free_buf_locked()
binder: fix comment on binder_alloc_new_buf() return value
uio: Fix use-after-free in uio_open
parport: parport_serial: Add Brainboxes BAR details
parport: parport_serial: Add Brainboxes device IDs and geometry
PCI: Add ACS quirk for more Zhaoxin Root Ports
coresight: etm4x: Fix width of CCITMIN field
x86/lib: Fix overflow when counting digits
EDAC/thunderx: Fix possible out-of-bounds string access
powerpc: add crtsavres.o to always-y instead of extra-y
powerpc: Remove in_kernel_text()
powerpc/44x: select I2C for CURRITUCK
powerpc/pseries/memhotplug: Quieten some DLPAR operations
powerpc/pseries/memhp: Fix access beyond end of drmem array
selftests/powerpc: Fix error handling in FPU/VMX preemption tests
powerpc/powernv: Add a null pointer check to scom_debug_init_one()
powerpc/powernv: Add a null pointer check in opal_event_init()
powerpc/powernv: Add a null pointer check in opal_powercap_init()
powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
ACPI: video: check for error while searching for backlight device parent
ACPI: LPIT: Avoid u32 multiplication overflow
of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
of: Add of_property_present() helper
cpufreq: Use of_property_present() for testing DT property presence
cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
net: netlabel: Fix kerneldoc warnings
netlabel: remove unused parameter in netlbl_netlink_auditinfo()
calipso: fix memory leak in netlbl_calipso_add_pass()
efivarfs: force RO when remounting if SetVariable is not supported
spi: sh-msiof: Enforce fixed DTDL for R-Car H3
ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
virtio-crypto: introduce akcipher service
virtio-crypto: implement RSA algorithm
virtio-crypto: change code style
virtio-crypto: use private buffer for control request
virtio-crypto: wait ctrl queue instead of busy polling
crypto: virtio - Handle dataq logic with tasklet
crypto: sa2ul - Return crypto_aead_setkey to transfer the error
crypto: ccp - fix memleak in ccp_init_dm_workarea
crypto: af_alg - Disallow multiple in-flight AIO requests
crypto: sahara - remove FLAGS_NEW_KEY logic
crypto: sahara - fix cbc selftest failure
crypto: sahara - fix ahash selftest failure
crypto: sahara - fix processing requests with cryptlen < sg->length
crypto: sahara - fix error handling in sahara_hw_descriptor_create()
pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
fs: indicate request originates from old mount API
Revert "gfs2: Don't reject a supposedly full bitmap if we have blocks reserved"
gfs2: Also reflect single-block allocations in rgd->rd_extfail_pt
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
crypto: virtio - Wait for tasklet to complete on device remove
crypto: sahara - avoid skcipher fallback code duplication
crypto: sahara - handle zero-length aes requests
crypto: sahara - fix ahash reqsize
crypto: sahara - fix wait_for_completion_timeout() error handling
crypto: sahara - improve error handling in sahara_sha_process()
crypto: sahara - fix processing hash requests with req->nbytes < sg->length
crypto: sahara - do not resize req->src when doing hash operations
crypto: scomp - fix req->dst buffer overflow
blocklayoutdriver: Fix reference leak of pnfs_device_node
NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
bpf, lpm: Fix check prefixlen before walking trie
bpf: Add crosstask check to __bpf_get_stack
wifi: ath11k: Defer on rproc_get failure
wifi: libertas: stop selecting wext
ARM: dts: qcom: apq8064: correct XOADC register address
ncsi: internal.h: Fix a spello
net/ncsi: Fix netlink major/minor version numbers
firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
firmware: meson_sm: populate platform devices from sm device tree data
wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
bpf: fix check for attempt to corrupt spilled pointer
scsi: fnic: Return error if vmalloc() failed
arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
bpf: Fix verification of indirect var-off stack access
scsi: hisi_sas: Replace with standard error code return value
selftests/net: fix grep checking for fib_nexthop_multiprefix
virtio/vsock: fix logic which reduces credit update messages
dma-mapping: Add dma_release_coherent_memory to DMA API
dma-mapping: clear dev->dma_mem to NULL after freeing it
wifi: rtlwifi: add calculate_bit_shift()
wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
rtlwifi: rtl8192de: make arrays static const, makes object smaller
wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
netfilter: nf_tables: mark newset as dead on transaction abort
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
Bluetooth: btmtkuart: fix recv_buf() return value
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
ARM: davinci: always select CONFIG_CPU_ARM926T
RDMA/usnic: Silence uninitialized symbol smatch warnings
drm/panel-elida-kd35t133: hold panel in reset for unprepare
rcu: Create an unrcu_pointer() to remove __rcu from a pointer
drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
media: pvrusb2: fix use after free on context disconnection
drm/bridge: Fix typo in post_disable() description
f2fs: fix to avoid dirent corruption
drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
drm/radeon: check return value of radeon_ring_lock()
ASoC: cs35l33: Fix GPIO name and drop legacy include
ASoC: cs35l34: Fix GPIO name and drop legacy include
drm/msm/mdp4: flush vblank event on disable
drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
drm/drv: propagate errors from drm_modeset_register_all()
drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
drm/radeon/dpm: fix a memleak in sumo_parse_power_table
drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
drm/bridge: tc358767: Fix return value on error case
media: cx231xx: fix a memleak in cx231xx_init_isoc
clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
media: rkisp1: Disable runtime PM in probe error path
f2fs: fix to check compress file in f2fs_move_file_range()
f2fs: fix to update iostat correctly in f2fs_filemap_fault()
media: dvbdev: drop refcount on error path in dvb_device_open()
media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
drm/amd/pm: fix a double-free in si_dpm_init
drivers/amd/pm: fix a use-after-free in kv_parse_power_table
gpu/drm/radeon: fix two memleaks in radeon_vm_init
dt-bindings: clock: Update the videocc resets for sm8150
clk: qcom: videocc-sm8150: Update the videocc resets
clk: qcom: videocc-sm8150: Add missing PLL config property
drivers: clk: zynqmp: calculate closest mux rate
clk: zynqmp: make bestdiv unsigned
clk: zynqmp: Add a check for NULL pointer
drivers: clk: zynqmp: update divider round rate logic
watchdog: set cdev owner before adding
watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
clk: si5341: fix an error code problem in si5341_output_clk_set_rate
clk: fixed-rate: add devm_clk_hw_register_fixed_rate
clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
pwm: stm32: Fix enable count for clk in .probe()
mmc: sdhci_am654: Fix TI SoC dependencies
mmc: sdhci_omap: Fix TI SoC dependencies
IB/iser: Prevent invalidating wrong MR
of: Fix double free in of_parse_phandle_with_args_map
of: unittest: Fix of_count_phandle_with_args() expected value message
keys, dns: Fix size check of V1 server-list header
binder: fix async space check for 0-sized buffers
binder: fix unused alloc->free_async_space
binder: fix use-after-free in shinker's callback
Input: atkbd - use ab83 as id when skipping the getid command
dma-mapping: Fix build error unused-value
virtio-crypto: fix memory-leak
virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
net: ethernet: mtk_eth_soc: remove duplicate if statements
xen-netback: don't produce zero-size SKB frags
binder: fix race between mmput() and do_exit()
tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
Revert "usb: dwc3: Soft reset phy on probe for host"
Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
usb: chipidea: wait controller resume finished for wakeup irq
Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
usb: typec: class: fix typec_altmode_put_partner to put plugs
usb: mon: Fix atomicity violation in mon_bin_vma_fault
serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
ALSA: oxygen: Fix right channel of capture volume mixer
ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
fbdev: flush deferred work in fb_deferred_io_fsync()
pwm: jz4740: Don't use dev_err_probe() in .request()
io_uring/rw: ensure io->bytes_done is always initialized
rootfs: Fix support for rootfstype= when root= is given
Bluetooth: Fix atomicity violation in {min,max}_key_size_set
iommu/arm-smmu-qcom: Add missing GMU entry to match table
wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
wifi: mwifiex: configure BSSID consistently when starting AP
x86/kvm: Do not try to disable kvmclock if it was not enabled
KVM: arm64: vgic-v4: Restore pending state on host userspace write
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
iio: adc: ad7091r: Pass iio_dev to event handler
HID: wacom: Correct behavior when processing some confidence == false touches
mfd: syscon: Fix null pointer dereference in of_syscon_register()
leds: aw2013: Select missing dependency REGMAP_I2C
mips: dmi: Fix early remap on MIPS32
mips: Fix incorrect max_low_pfn adjustment
MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
power: supply: cw2015: correct time_to_empty units in sysfs
serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
libapi: Add missing linux/types.h header to get the __u64 type on io.h
acpi: property: Let args be NULL in __acpi_node_get_property_reference
software node: Let args be NULL in software_node_get_reference_args
serial: imx: fix tx statemachine deadlock
iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
iio: adc: ad9467: fix reset gpio handling
iio: adc: ad9467: don't ignore error codes
iio: adc: ad9467: fix scale setting
perf genelf: Set ELF program header addresses properly
tty: change tty_write_lock()'s ndelay parameter to bool
tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
tty: don't check for signal_pending() in send_break()
tty: use 'if' in send_break() instead of 'goto'
usb: cdc-acm: return correct error code on unsupported break
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
nvmet-tcp: fix a crash in nvmet_req_complete()
perf env: Avoid recursively taking env->bpf_progs.lock
apparmor: avoid crash when parsed profile name is empty
serial: imx: Correct clock error message in function probe()
nvmet-tcp: Fix the H2C expected PDU len calculation
PCI: keystone: Fix race condition when initializing PHYs
s390/pci: fix max size calculation in zpci_memcpy_toio()
net: qualcomm: rmnet: fix global oob in rmnet_policy
net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
net: phy: micrel: populate .soft_reset for KSZ9131
net: ravb: Fix dma_addr_t truncation in error case
net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
netfilter: nf_tables: do not allow mismatch field size and set key length
netfilter: nf_tables: skip dead set elements in netlink dump
netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
ipvs: avoid stat macros calls from preemptible context
kdb: Fix a potential buffer overflow in kdb_local()
ethtool: netlink: Add missing ethnl_ops_begin/complete
mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
mlxsw: spectrum_acl_tcam: Make fini symmetric to init
mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
mlxsw: spectrum_acl_tcam: Fix stack corruption
selftests: mlxsw: qos_pfc: Convert to iproute2 dcb
selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
i2c: s3c24xx: fix read transfers in polling mode
i2c: s3c24xx: fix transferring more than one message in polling mode
arm64: dts: armada-3720-turris-mox: set irq type for RTC
Linux 5.10.209
Change-Id: I86438e299a811ccb08c5a27b2259c33cd482ff00
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream.
Use EPOLLERR instead of POLLERR to make sure it is cast to the correct
__poll_t type. This fixes the following sparse issue:
drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types)
drivers/android/binder.c:5030:24: expected restricted __poll_t
drivers/android/binder.c:5030:24: got int
Fixes: f88982679f ("binder: check for binder_thread allocation failure in binder_poll()")
Cc: stable@vger.kernel.org
Cc: Eric Biggers <ebiggers@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1aa3aaf8953c84bad398adf6c3cabc9d6685bf7d upstream
A transaction complete work is allocated and queued for each
transaction. Under certain conditions the work->type might be marked as
BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT to notify userspace about
potential spamming threads or as BINDER_WORK_TRANSACTION_PENDING when
the target is currently frozen.
However, these work types are not being handled in binder_release_work()
so they will leak during a cleanup. This was reported by syzkaller with
the following kmemleak dump:
BUG: memory leak
unreferenced object 0xffff88810e2d6de0 (size 32):
comm "syz-executor338", pid 5046, jiffies 4294968230 (age 13.590s)
hex dump (first 32 bytes):
e0 6d 2d 0e 81 88 ff ff e0 6d 2d 0e 81 88 ff ff .m-......m-.....
04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff83d41873>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff83d41873>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83d41873>] binder_transaction+0x573/0x4050 drivers/android/binder.c:3152
[<ffffffff83d45a05>] binder_thread_write+0x6b5/0x1860 drivers/android/binder.c:4010
[<ffffffff83d486dc>] binder_ioctl_write_read drivers/android/binder.c:5066 [inline]
[<ffffffff83d486dc>] binder_ioctl+0x1b2c/0x3cf0 drivers/android/binder.c:5352
[<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
[<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fix the leaks by kfreeing these work types in binder_release_work() and
handle them as a BINDER_WORK_TRANSACTION_COMPLETE cleanup.
Cc: stable@vger.kernel.org
Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
Reported-by: syzbot+7f10c1653e35933c0f1e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7f10c1653e35933c0f1e
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20230922175138.230331-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[cmllamas: backport to v5.15 by dropping BINDER_WORK_TRANSACTION_PENDING
as commit 0567461a7a6e is not present. Remove fixes tag accordingly.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Link: https://lore.kernel.org/all/20231208034842.997899-1-cmllamas@google.com/
Change-Id: I8e1ee7af87ef5706544e4f320e9498b8f4855a6b
[cmllamas: also backport to v5.10 to fix OOT 0493c72d6d]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Add hooks to support oem's binder feature of improving binder_thread->task sched priority
1) Check if it is a specific task in trace_android_vh_alloc_oem_binder_struct() and store the flag to t->android_vendor_data1
2) If it is a specific binder task and binder_thread selected, raise the sched priority of binder_thread->task in runqueue.
3) If it is a specific binder task but no binder_thread selected (e.g pending_async or no free threads), insert t->work to the appropriate position in the list.
4) Reset the sched priority when BR_TRANSACTION or BC_FREE_BUFFER.
Some high-priority async binder task reset the sched priority when BC_FREE_BUFFER in trace_android_vh_binder_free_buf().
Some middle-priority async binder task reset the sched priority when driver return server "BR_TRANSACTION" in trace_android_vh_binder_transaction_received().
Bug: 308391339
Change-Id: Iab4939fe4a4881b31961aaa2fef500b51c944743
Signed-off-by: lfc <lfc@oppo.com>
Changes in 5.10.191
wireguard: allowedips: expand maximum node depth
mmc: moxart: read scr register without changing byte order
ipv6: adjust ndisc_is_useropt() to also return true for PIO
bpf: allow precision tracking for programs with subprogs
bpf: stop setting precise in current state
bpf: aggressively forget precise markings during state checkpointing
selftests/bpf: make test_align selftest more robust
selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
selftests/bpf: Fix sk_assign on s390x
dmaengine: pl330: Return DMA_PAUSED when transaction is paused
riscv,mmio: Fix readX()-to-delay() ordering
drm/nouveau/gr: enable memory loads on helper invocation on all channels
drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
drm/amd/display: check attr flag before set cursor degamma on DCN3+
hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
radix tree test suite: fix incorrect allocation size for pthreads
x86/pkeys: Revert a5eff72597 ("x86/pkeys: Add PKRU value to init_fpstate")
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
io_uring: correct check for O_TMPFILE
iio: cros_ec: Fix the allocation size for cros_ec_command
binder: fix memory leak in binder_init()
usb-storage: alauda: Fix uninit-value in alauda_check_media()
usb: dwc3: Properly handle processing of pending events
usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
x86/srso: Fix build breakage with the LLVM linker
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
x86/speculation: Add cpu_show_gds() prototype
x86: Move gds_ucode_mitigated() declaration to header
drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
selftests/rseq: Fix build with undefined __weak
selftests: forwarding: Add a helper to skip test when using veth pairs
selftests: forwarding: ethtool: Skip when using veth pairs
selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
selftests: forwarding: Skip test when no interfaces are specified
selftests: forwarding: Switch off timeout
selftests: forwarding: tc_flower: Relax success criterion
mISDN: Update parameter type of dsp_cmx_send()
net/packet: annotate data-races around tp->status
tunnels: fix kasan splat when generating ipv4 pmtu error
bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
dccp: fix data-race around dp->dccps_mss_cache
drivers: net: prevent tun_build_skb() to exceed the packet size limit
IB/hfi1: Fix possible panic during hotplug remove
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
net: phy: at803x: remove set/get wol callbacks for AR8032
net: hns3: refactor hclge_mac_link_status_wait for interface reuse
net: hns3: add wait until mac link down
dmaengine: mcf-edma: Fix a potential un-allocated memory access
net/mlx5: Allow 0 for total host VFs
ibmvnic: Enforce stronger sanity checks on login response
ibmvnic: Unmap DMA login rsp buffer on send login fail
ibmvnic: Handle DMA unmapping of login buffs in release functions
btrfs: don't stop integrity writeback too early
btrfs: set cache_block_group_error if we find an error
nvme-tcp: fix potential unbalanced freeze & unfreeze
nvme-rdma: fix potential unbalanced freeze & unfreeze
netfilter: nf_tables: report use refcount overflow
scsi: core: Fix legacy /proc parsing buffer overflow
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
scsi: 53c700: Check that command slot is not NULL
scsi: snic: Fix possible memory leak if device_add() fails
scsi: core: Fix possible memory leak if device_add() fails
scsi: qedi: Fix firmware halt over suspend and resume
scsi: qedf: Fix firmware halt over suspend and resume
alpha: remove __init annotation from exported page_is_ram()
sch_netem: fix issues in netem_change() vs get_dist_table()
Linux 5.10.191
Change-Id: Ice1868f0a7b328bb0e56985ac0bb5af9434fd073
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream.
In binder_transaction_buffer_release() the 'failed_at' offset indicates
the number of objects to clean up. However, this function was changed by
commit 44d8047f1d ("binder: use standard functions to allocate fds"),
to release all the objects in the buffer when 'failed_at' is zero.
This introduced an issue when a transaction buffer is released without
any objects having been processed so far. In this case, 'failed_at' is
indeed zero yet it is misinterpreted as releasing the entire buffer.
This leads to use-after-free errors where nodes are incorrectly freed
and subsequently accessed. Such is the case in the following KASAN
report:
==================================================================
BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30
Read of size 8 at addr ffff4faf037cfc58 by task poc/474
CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec
show_stack+0x18/0x24
dump_stack_lvl+0x48/0x60
print_report+0xf8/0x5b8
kasan_report+0xb8/0xfc
__asan_load8+0x9c/0xb8
binder_thread_read+0xc40/0x1f30
binder_ioctl+0xd9c/0x1768
__arm64_sys_ioctl+0xd4/0x118
invoke_syscall+0x60/0x188
[...]
Allocated by task 474:
kasan_save_stack+0x3c/0x64
kasan_set_track+0x2c/0x40
kasan_save_alloc_info+0x24/0x34
__kasan_kmalloc+0xb8/0xbc
kmalloc_trace+0x48/0x5c
binder_new_node+0x3c/0x3a4
binder_transaction+0x2b58/0x36f0
binder_thread_write+0x8e0/0x1b78
binder_ioctl+0x14a0/0x1768
__arm64_sys_ioctl+0xd4/0x118
invoke_syscall+0x60/0x188
[...]
Freed by task 475:
kasan_save_stack+0x3c/0x64
kasan_set_track+0x2c/0x40
kasan_save_free_info+0x38/0x5c
__kasan_slab_free+0xe8/0x154
__kmem_cache_free+0x128/0x2bc
kfree+0x58/0x70
binder_dec_node_tmpref+0x178/0x1fc
binder_transaction_buffer_release+0x430/0x628
binder_transaction+0x1954/0x36f0
binder_thread_write+0x8e0/0x1b78
binder_ioctl+0x14a0/0x1768
__arm64_sys_ioctl+0xd4/0x118
invoke_syscall+0x60/0x188
[...]
==================================================================
In order to avoid these issues, let's always calculate the intended
'failed_at' offset beforehand. This is renamed and wrapped in a helper
function to make it clear and convenient.
Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup")
Reported-by: Zi Fan Tan <zifantan@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com
[cmllamas: resolve trivial conflict due to missing commit 9864bb4801331]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In binder_transaction_buffer_release() the 'failed_at' offset indicates
the number of objects to clean up. However, this function was changed by
commit 44d8047f1d ("binder: use standard functions to allocate fds"),
to release all the objects in the buffer when 'failed_at' is zero.
This introduced an issue when a transaction buffer is released without
any objects having been processed so far. In this case, 'failed_at' is
indeed zero yet it is misinterpreted as releasing the entire buffer.
This leads to use-after-free errors where nodes are incorrectly freed
and subsequently accessed. Such is the case in the following KASAN
report:
==================================================================
BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30
Read of size 8 at addr ffff4faf037cfc58 by task poc/474
CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x94/0xec
show_stack+0x18/0x24
dump_stack_lvl+0x48/0x60
print_report+0xf8/0x5b8
kasan_report+0xb8/0xfc
__asan_load8+0x9c/0xb8
binder_thread_read+0xc40/0x1f30
binder_ioctl+0xd9c/0x1768
__arm64_sys_ioctl+0xd4/0x118
invoke_syscall+0x60/0x188
[...]
Allocated by task 474:
kasan_save_stack+0x3c/0x64
kasan_set_track+0x2c/0x40
kasan_save_alloc_info+0x24/0x34
__kasan_kmalloc+0xb8/0xbc
kmalloc_trace+0x48/0x5c
binder_new_node+0x3c/0x3a4
binder_transaction+0x2b58/0x36f0
binder_thread_write+0x8e0/0x1b78
binder_ioctl+0x14a0/0x1768
__arm64_sys_ioctl+0xd4/0x118
invoke_syscall+0x60/0x188
[...]
Freed by task 475:
kasan_save_stack+0x3c/0x64
kasan_set_track+0x2c/0x40
kasan_save_free_info+0x38/0x5c
__kasan_slab_free+0xe8/0x154
__kmem_cache_free+0x128/0x2bc
kfree+0x58/0x70
binder_dec_node_tmpref+0x178/0x1fc
binder_transaction_buffer_release+0x430/0x628
binder_transaction+0x1954/0x36f0
binder_thread_write+0x8e0/0x1b78
binder_ioctl+0x14a0/0x1768
__arm64_sys_ioctl+0xd4/0x118
invoke_syscall+0x60/0x188
[...]
==================================================================
In order to avoid these issues, let's always calculate the intended
'failed_at' offset beforehand. This is renamed and wrapped in a helper
function to make it clear and convenient.
Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup")
Reported-by: Zi Fan Tan <zifantan@google.com>
Link: https://b.corp.google.com/issues/275041864
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Bug: 275041864
Link: https://lore.kernel.org/all/20230505203020.4101154-1-cmllamas@google.com
Change-Id: I4bcc8bde77a8118872237d100cccb5caf95d99a1
Signed-off-by: Carlos Llamas <cmllamas@google.com>
[ Upstream commit 9fe83c43e71cdb8e5b9520bcb98706a2b3c680c8 ]
The function close_fd_get_file is explicitly a variant of
__close_fd[1]. Now that __close_fd has been renamed close_fd, rename
close_fd_get_file to be consistent with close_fd.
When __alloc_fd, __close_fd and __fd_install were introduced the
double underscore indicated that the function took a struct
files_struct parameter. The function __close_fd_get_file never has so
the naming has always been inconsistent. This just cleans things up
so there are not any lingering mentions or references __close_fd left
in the code.
[1] 80cd795630 ("binder: fix use-after-free due to ksys_close() during fdget()")
Link: https://lkml.kernel.org/r/20201120231441.29911-23-ebiederm@xmission.com
Change-Id: I1c759a36dfa09259eff5b09127fde4e041777a3e
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 57b2053036)
Bug: 268174392
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 9fe83c43e71cdb8e5b9520bcb98706a2b3c680c8 ]
The function close_fd_get_file is explicitly a variant of
__close_fd[1]. Now that __close_fd has been renamed close_fd, rename
close_fd_get_file to be consistent with close_fd.
When __alloc_fd, __close_fd and __fd_install were introduced the
double underscore indicated that the function took a struct
files_struct parameter. The function __close_fd_get_file never has so
the naming has always been inconsistent. This just cleans things up
so there are not any lingering mentions or references __close_fd left
in the code.
[1] 80cd795630 ("binder: fix use-after-free due to ksys_close() during fdget()")
Link: https://lkml.kernel.org/r/20201120231441.29911-23-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ef38de9217a04c9077629a24652689d8fdb4c6c6 upstream.
Some android userspace is sending BINDER_TYPE_FDA objects with
num_fds=0. Like the previous patch, this is reproducible when
playing a video.
Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0
were 'correctly handled', as in no fixup was performed.
After commit 09184ae9b575 we aggregate fixup and skip regions in
binder_ptr_fixup structs and distinguish between the two by using
the skip_size field: if it's 0, then it's a fixup, otherwise skip.
When processing BINDER_TYPE_FDA objects with num_fds=0 we add a
skip region of skip_size=0, and this causes issues because now
binder_do_deferred_txn_copies will think this was a fixup region.
To address that, return early from binder_translate_fd_array to
avoid adding an empty skip region.
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 upstream.
When handling BINDER_TYPE_FDA object we are pushing a parent fixup
with a certain skip_size but no scatter-gather copy object, since
the copy is handled standalone.
If BINDER_TYPE_FDA is the last children the scatter-gather copy
loop will never stop to skip it, thus we are left with an item in
the parent fixup list. This will trigger the BUG_ON().
This is reproducible in android when playing a video.
We receive a transaction that looks like this:
obj[0] BINDER_TYPE_PTR, parent
obj[1] BINDER_TYPE_PTR, child
obj[2] BINDER_TYPE_PTR, child
obj[3] BINDER_TYPE_FDA, child
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9a0a930fe2535a76ad70d3f43caeccf0d86a3009 upstream.
binder_uintptr_t is not the same as uintptr_t, so converting it into a
pointer requires a second cast:
drivers/android/binder.c: In function 'binder_translate_fd_array':
drivers/android/binder.c:2511:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
2511 | sender_ufda_base = (void __user *)sender_uparent->buffer + fda->parent_offset;
| ^
Fixes: 656e01f3ab54 ("binder: read pre-translated fds from sender buffer")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211207122448.1185769-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 09184ae9b5756cc469db6fd1d1cfdcffbf627c2d upstream.
BINDER_TYPE_PTR objects point to memory areas in the
source process to be copied into the target buffer
as part of a transaction. This implements a scatter-
gather model where non-contiguous memory in a source
process is "gathered" into a contiguous region in
the target buffer.
The data can include pointers that must be fixed up
to correctly point to the copied data. To avoid making
source process pointers visible to the target process,
this patch defers the copy until the fixups are known
and then copies and fixeups are done together.
There is a special case of BINDER_TYPE_FDA which applies
the fixup later in the target process context. In this
case the user data is skipped (so no untranslated fds
become visible to the target).
Reviewed-by: Martijn Coenen <maco@android.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-5-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[cmllamas: fix trivial merge conflict]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 656e01f3ab54afe71bed066996fc2640881e1220 upstream.
This patch is to prepare for an up coming patch where we read
pre-translated fds from the sender buffer and translate them before
copying them to the target. It does not change run time.
The patch adds two new parameters to binder_translate_fd_array() to
hold the sender buffer and sender buffer parent. These parameters let
us call copy_from_user() directly from the sender instead of using
binder_alloc_copy_from_buffer() to copy from the target. Also the patch
adds some new alignment checks. Previously the alignment checks would
have been done in a different place, but this lets us print more
useful error messages.
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-4-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6d98eb95b450a75adb4516a1d33652dc78d2b20c upstream.
Transactions are copied from the sender to the target
first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA
are then fixed up. This means there is a short period where
the sender's version of these objects are visible to the
target prior to the fixups.
Instead of copying all of the data first, copy data only
after any needed fixups have been applied.
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[cmllamas: fix trivial merge conflict]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Some android userspace is sending BINDER_TYPE_FDA objects with
num_fds=0. Like the previous patch, this is reproducible when
playing a video.
Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0
were 'correctly handled', as in no fixup was performed.
After commit 09184ae9b575 we aggregate fixup and skip regions in
binder_ptr_fixup structs and distinguish between the two by using
the skip_size field: if it's 0, then it's a fixup, otherwise skip.
When processing BINDER_TYPE_FDA objects with num_fds=0 we add a
skip region of skip_size=0, and this causes issues because now
binder_do_deferred_txn_copies will think this was a fixup region.
To address that, return early from binder_translate_fd_array to
avoid adding an empty skip region.
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit ef38de9217a04c9077629a24652689d8fdb4c6c6)
Change-Id: I34fab41c0c1beee366a5df4724b263e4385ad13b
Signed-off-by: Carlos Llamas <cmllamas@google.com>
When handling BINDER_TYPE_FDA object we are pushing a parent fixup
with a certain skip_size but no scatter-gather copy object, since
the copy is handled standalone.
If BINDER_TYPE_FDA is the last children the scatter-gather copy
loop will never stop to skip it, thus we are left with an item in
the parent fixup list. This will trigger the BUG_ON().
This is reproducible in android when playing a video.
We receive a transaction that looks like this:
obj[0] BINDER_TYPE_PTR, parent
obj[1] BINDER_TYPE_PTR, child
obj[2] BINDER_TYPE_PTR, child
obj[3] BINDER_TYPE_FDA, child
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23)
Change-Id: I3963a98dfc48b01d7bb8166aaa90341818bf6416
Signed-off-by: Carlos Llamas <cmllamas@google.com>
binder_uintptr_t is not the same as uintptr_t, so converting it into a
pointer requires a second cast:
drivers/android/binder.c: In function 'binder_translate_fd_array':
drivers/android/binder.c:2511:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
2511 | sender_ufda_base = (void __user *)sender_uparent->buffer + fda->parent_offset;
| ^
Fixes: 656e01f3ab54 ("binder: read pre-translated fds from sender buffer")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211207122448.1185769-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit 9a0a930fe2535a76ad70d3f43caeccf0d86a3009)
Change-Id: I1c9b86a90bcf2be81012e59e0c472869f551e61a
Signed-off-by: Carlos Llamas <cmllamas@google.com>
BINDER_TYPE_PTR objects point to memory areas in the
source process to be copied into the target buffer
as part of a transaction. This implements a scatter-
gather model where non-contiguous memory in a source
process is "gathered" into a contiguous region in
the target buffer.
The data can include pointers that must be fixed up
to correctly point to the copied data. To avoid making
source process pointers visible to the target process,
this patch defers the copy until the fixups are known
and then copies and fixeups are done together.
There is a special case of BINDER_TYPE_FDA which applies
the fixup later in the target process context. In this
case the user data is skipped (so no untranslated fds
become visible to the target).
Reviewed-by: Martijn Coenen <maco@android.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-5-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 09184ae9b5756cc469db6fd1d1cfdcffbf627c2d)
[cmllamas: fix trivial merge conflict]
Change-Id: I6de75b192d1e3b2cc73c8d91077d97b608e8c5a9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This patch is to prepare for an up coming patch where we read
pre-translated fds from the sender buffer and translate them before
copying them to the target. It does not change run time.
The patch adds two new parameters to binder_translate_fd_array() to
hold the sender buffer and sender buffer parent. These parameters let
us call copy_from_user() directly from the sender instead of using
binder_alloc_copy_from_buffer() to copy from the target. Also the patch
adds some new alignment checks. Previously the alignment checks would
have been done in a different place, but this lets us print more
useful error messages.
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-4-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 656e01f3ab54afe71bed066996fc2640881e1220)
Change-Id: Ib786020e49bd33e35aec88d43965f9d98021fa53
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Transactions are copied from the sender to the target
first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA
are then fixed up. This means there is a short period where
the sender's version of these objects are visible to the
target prior to the fixups.
Instead of copying all of the data first, copy data only
after any needed fixups have been applied.
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 6d98eb95b450a75adb4516a1d33652dc78d2b20c)
Change-Id: I8c14a03a2ee23c5f060c82e1626686f72eff33d9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
commit a0e44c64b6061dda7e00b7c458e4523e2331b739 upstream.
A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the
reference for a node. In this case, the target proc normally releases
the failed reference upon close as expected. However, if the target is
dying in parallel the call will race with binder_deferred_release(), so
the target could have released all of its references by now leaving the
cleanup of the new failed reference unhandled.
The transaction then ends and the target proc gets released making the
ref->proc now a dangling pointer. Later on, ref->node is closed and we
attempt to take spin_lock(&ref->proc->inner_lock), which leads to the
use-after-free bug reported below. Let's fix this by cleaning up the
failed reference on the spot instead of relying on the target to do so.
==================================================================
BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150
Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590
CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
dump_backtrace.part.0+0x1d0/0x1e0
show_stack+0x18/0x70
dump_stack_lvl+0x68/0x84
print_report+0x2e4/0x61c
kasan_report+0xa4/0x110
kasan_check_range+0xfc/0x1a4
__kasan_check_write+0x3c/0x50
_raw_spin_lock+0xa8/0x150
binder_deferred_func+0x5e0/0x9b0
process_one_work+0x38c/0x5f0
worker_thread+0x9c/0x694
kthread+0x188/0x190
ret_from_fork+0x10/0x20
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Cc: stable <stable@kernel.org> # 4.14+
Link: https://lore.kernel.org/r/20220801182511.3371447-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Older kernels lack io_uring POLLFREE handling. As only affected files
are signalfd and android binder the safest option would be to disable
polling those files via io_uring and hope there are no users.
Fixes: 221c5eb233 ("io_uring: add support for IORING_OP_POLL")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit acefa91e51.
The hooks trace_android_vh_binder_proc_transaction_entry and
trace_android_vh_binder_select_worklist_ilocked are not used by any
vendor, so remove it to help with merge issues with future LTS releases.
If this is needed by any real user, it can easily be reverted to add it
back and then the symbol should be added to the abi list at the same
time to prevent it from being removed again later.
Bug: 203756332
Bug: 219898723
Cc: Liujie Xie <xieliujie@oppo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2c04e60fa9d6eb6d85be7882d12f1b70956b8e80
A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the
reference for a node. In this case, the target proc normally releases
the failed reference upon close as expected. However, if the target is
dying in parallel the call will race with binder_deferred_release(), so
the target could have released all of its references by now leaving the
cleanup of the new failed reference unhandled.
The transaction then ends and the target proc gets released making the
ref->proc now a dangling pointer. Later on, ref->node is closed and we
attempt to take spin_lock(&ref->proc->inner_lock), which leads to the
use-after-free bug reported below. Let's fix this by cleaning up the
failed reference on the spot instead of relying on the target to do so.
==================================================================
BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150
Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590
CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
dump_backtrace.part.0+0x1d0/0x1e0
show_stack+0x18/0x70
dump_stack_lvl+0x68/0x84
print_report+0x2e4/0x61c
kasan_report+0xa4/0x110
kasan_check_range+0xfc/0x1a4
__kasan_check_write+0x3c/0x50
_raw_spin_lock+0xa8/0x150
binder_deferred_func+0x5e0/0x9b0
process_one_work+0x38c/0x5f0
worker_thread+0x9c/0x694
kthread+0x188/0x190
ret_from_fork+0x10/0x20
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Bug: 239630375
Link: https://lore.kernel.org/all/20220801182511.3371447-1-cmllamas@google.com/
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I5085dd0dc805a780a64c057e5819f82dd8f02868
(cherry picked from commit ae3fa5d16a02ba7c7b170e0e1ab56d6f0ba33964)
The patchset in [1] exported some definitions to binder_internal.h in
order to make the debugfs entries such as 'stats' and 'transaction_log'
available in a binderfs instance. However, the DEFINE_SHOW_ATTRIBUTE
macro expands into a static function/variable pair, which in turn get
redefined each time a source file includes this internal header.
This problem was made evident after a report from the kernel test robot
<lkp@intel.com> where several W=1 build warnings are seen in downstream
kernels. See the following example:
include/../drivers/android/binder_internal.h:111:23: warning: 'binder_stats_fops' defined but not used [-Wunused-const-variable=]
111 | DEFINE_SHOW_ATTRIBUTE(binder_stats);
| ^~~~~~~~~~~~
include/linux/seq_file.h:174:37: note: in definition of macro 'DEFINE_SHOW_ATTRIBUTE'
174 | static const struct file_operations __name ## _fops = { \
| ^~~~~~
This patch fixes the above issues by moving back the definitions into
binder.c and instead creates an array of the debugfs entries which is
more convenient to share with binderfs and iterate through.
[1] https://lore.kernel.org/all/20190903161655.107408-1-hridya@google.com/
Fixes: 0e13e452da ("binder: Add stats, state and transactions files")
Fixes: 03e2e07e38 ("binder: Make transaction_log available in binderfs")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20220701182041.2134313-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 240404657
(cherry picked from commit b7e241bbff24f9e106bf616408fd58bcedc44bae
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-next)
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I7e9ca1ab1f3a5a4a272e50f24d404c17cad55d32
When the target process is busy, incoming oneway transactions are
queued in the async_todo list. If the clients continue sending extra
oneway transactions while the target process is frozen, this queue can
become too large to accommodate new transactions. That's why binder
driver introduced ONEWAY_SPAM_DETECTION to detect this situation. It's
helpful to debug the async binder buffer exhausting issue, but the
issue itself isn't solved directly.
In real cases applications are designed to send oneway transactions
repeatedly, delivering updated inforamtion to the target process.
Typical examples are Wi-Fi signal strength and some real time sensor
data. Even if the apps might only care about the lastet information,
all outdated oneway transactions are still accumulated there until the
frozen process is thawed later. For this kind of situations, there's
no existing method to skip those outdated transactions and deliver the
latest one only.
This patch introduces a new transaction flag TF_UPDATE_TXN. To use it,
use apps can set this new flag along with TF_ONE_WAY. When such an
oneway transaction is to be queued into the async_todo list of a frozen
process, binder driver will check if any previous pending transactions
can be superseded by comparing their code, flags and target node. If
such an outdated pending transaction is found, the latest transaction
will supersede that outdated one. This effectively prevents the async
binder buffer running out and saves unnecessary binder read workloads.
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Li Li <dualli@google.com>
Link: https://lore.kernel.org/r/20220526220018.3334775-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 231624308
Test: manually check async binder buffer size of frozen apps
Test: stress test with kernel 4.14/4.19/5.10/5.15
(cherry picked from commit 9864bb4801331daa48514face9d0f4861e4d485b
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-next)
Change-Id: I1c4bff1eda1ca15aaaad5bf696c8fc00be743176
This is the merge of the upstream LTS release of 5.10.101 into the
android12-5.10 branch.
This merge contains the following new commits:
c194212a03 Merge 5.10.101 into android12-5.10-lts
3969aba589 Linux 5.10.101
cb86e511e7 iommu: Fix potential use-after-free during probe
f6b5d51976 perf: Fix list corruption in perf_cgroup_switch()
ce3ca12c63 arm64: dts: imx8mq: fix lcdif port node
759aeacdfe scsi: lpfc: Reduce log messages seen after firmware download
57c5d7d420 scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled
199dab00f0 can: isotp: fix error path in isotp_sendmsg() to unlock wait queue
3b10ebeb95 Makefile.extrawarn: Move -Wunaligned-access to W=1
ad53060bdf hwmon: (dell-smm) Speed up setting of fan speed
3c75d1017c phy: ti: Fix missing sentinel for clk_div_table
6eabe53492 speakup-dectlk: Restore pitch setting
3836a5ff4b USB: serial: cp210x: add CPI Bulk Coin Recycler id
51b03a9bcd USB: serial: cp210x: add NCR Retail IO box id
a21e6b2e08 USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
7113440a36 USB: serial: option: add ZTE MF286D modem
b7ed2f9619 USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
e07dde31ac usb: raw-gadget: fix handling of dual-direction-capable endpoints
e9f9b877eb usb: gadget: f_uac2: Define specific wTerminalType
fb4ff0f96d usb: gadget: rndis: check size of RNDIS_MSG_SET command
22ec100472 USB: gadget: validate interface OS descriptor requests
351159167c usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition
3bfca38914 usb: dwc3: gadget: Prevent core from processing stale TRBs
2a17bd9f52 usb: ulpi: Call of_node_put correctly
8b89a69166 usb: ulpi: Move of_node_put to ulpi_dev_release
758290defe net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
a66a2b17b8 Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured"
73961057e9 usb: dwc2: drd: fix soft connect when gadget is unconfigured
a37960df7e eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
1b99fe34e2 n_tty: wake up poll(POLLRDNORM) on receiving data
f1b2573715 vt_ioctl: add array_index_nospec to VT_ACTIVATE
778302ca09 vt_ioctl: fix array_index_nospec in vt_setactivate
22249886dc net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister
3a3c65c487 net: mscc: ocelot: fix mutex lock error during ethtool stats read
809f030745 ice: fix IPIP and SIT TSO offload
cf11949b91 ice: fix an error code in ice_cfg_phy_fec()
f8edc6feab dpaa2-eth: unregister the netdev before disconnecting from the PHY
ff6c9e0fce net: amd-xgbe: disable interrupts during pci removal
657aea7828 tipc: rate limit warning for received illegal binding update
ef5cdae8bc net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE
bf99c14436 veth: fix races around rq->rx_notify_masked
00e6d6c3bc net: fix a memleak when uncloning an skb dst and its metadata
2e9fd2d0f6 net: do not keep the dst cache when uncloning an skb dst and its metadata
0bae953d7a nfp: flower: fix ida_idx not being released
09ac0fcb0a ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
e177d2e85e net: dsa: lantiq_gswip: don't use devres for mdiobus
95e5402f94 net: dsa: felix: don't use devres for mdiobus
2770b79529 net: dsa: bcm_sf2: don't use devres for mdiobus
475ce5dcf2 net: dsa: ar9331: register the mdiobus under devres
8ccebe77df net: dsa: mv88e6xxx: don't use devres for mdiobus
4a384c1e40 bonding: pair enable_port with slave_arr_updates
1ba45dd326 gpio: sifive: use the correct register to read output values
48e413087d ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE
3b72d3f020 drm/panel: simple: Assign data from panel_dpi_probe() correctly
bf35639192 ixgbevf: Require large buffers for build_skb on 82599VF
e5a64f548a arm64: dts: meson-g12b-odroid-n2: fix typo 'dio2133'
04fe6569a7 netfilter: ctnetlink: disable helper autoassign
a5ce7ee5fc misc: fastrpc: avoid double fput() on failed usercopy
21c890ca8e drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd.
70ea005626 gpio: aggregator: Fix calling into sleeping GPIO controllers
0042178a69 usb: f_fs: Fix use-after-free for epfile
5a37fd9fdc ARM: dts: imx7ulp: Fix 'assigned-clocks-parents' typo
39bf132a6e phy: xilinx: zynqmp: Fix bus width setting for SGMII
108868dae2 ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
0a7b5e8d8c staging: fbtft: Fix error path in fbtft_driver_module_init()
74cd5cb219 ARM: dts: meson8b: Fix the UART device-tree schema validation
566b558e94 ARM: dts: meson8: Fix the UART device-tree schema validation
210d70f081 ARM: dts: meson: Fix the UART compatible strings
88f0e61354 ARM: dts: Fix timer regression for beagleboard revision c
c943a297ec drm/rockchip: vop: Correct RK3399 VOP register fields
a941384fba PM: s2idle: ACPI: Fix wakeup interrupts handling
fcbac51a64 ACPI/IORT: Check node revision for PMCG resources
57ede0ce65 nvme-tcp: fix bogus request completion when failing to send AER
3a669d77e5 ARM: socfpga: fix missing RESET_CONTROLLER
435e62d566 ARM: dts: Fix boot regression on Skomer
b217b89e60 ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group
3f9843f2f6 riscv: fix build with binutils 2.38
3aa5c86572 KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow
bd39fe29bb KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode
9efad4cb03 KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS
db58a3d978 KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER
dc129275a7 KVM: eventfd: Fix false positive RCU usage warning
87bbd78a2c net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout()
c9b8cc1046 nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs
d0774cf730 perf: Always wake the parent event
a117e986e9 usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
4607218fde PM: hibernate: Remove register_nosave_region_late()
0e42c4a3d7 scsi: myrs: Fix crash in error case
3bc5b128b9 scsi: ufs: Treat link loss as fatal error
12cf120803 scsi: pm8001: Fix bogus FW crash for maxcpus=1
87f187e526 scsi: qedf: Fix refcount issue when LOGO is received during TMF
aa7352aa15 scsi: qedf: Add stag_work to all the vports
150d448c66 scsi: ufs: ufshcd-pltfrm: Check the return value of devm_kstrdup()
7dbda616fc scsi: target: iscsi: Make sure the np under each tpg is unique
67baac10dd powerpc/fixmap: Fix VM debug warning on unmap
3d0eafd459 net: sched: Clarify error message when qdisc kind is unknown
9b569faabd drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer
0d6b9d15ec x86/perf: Avoid warning for Arch LBR without XSAVE
b37dd03f2f NFSv4 handle port presence in fs_location server string
6f2974b52b NFSv4 expose nfs_parse_server_name function
5a9c613a29 NFSv4 remove zero number of fs_locations entries error check
1c79aad118 NFSv4.1: Fix uninitialised variable in devicenotify
c5619c510f nfs: nfs4clinet: check the return value of kstrdup()
db053bdece NFSv4 only print the label when its queried
e2b4435fd3 NFS: change nfs_access_get_cached to only report the mask
b4e0c9bcf1 tracing: Propagate is_signed to expression
5234de6c79 drm/amdgpu: Set a suitable dev_info.gart_page_size
6215fb4558 NFSD: Fix offset type in I/O trace points
3a6a2d43e3 NFSD: Clamp WRITE offsets
c72f7c2ec3 NFS: Fix initialisation of nfs_client cl_flags field
f47ee3a35f net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs
6a33aa7113 net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs
7b53d2204c can: isotp: fix potential CAN frame reception race in isotp_rcv()
c9cc027c55 mmc: sdhci-of-esdhc: Check for error num after setting mask
8027ba480c ima: Do not print policy rule with inactive LSM labels
8171c8a99f ima: Allow template selection with ima_template[_fmt]= after ima_hash=
0795b7100d ima: Remove ima_policy file before directory
7fea2e5200 integrity: check the return value of audit_log_start()
86e6176a42 Merge 5.10.100 into android12-5.10-lts
d4f7d322a4 Linux 5.10.100
3c7e594355 tipc: improve size validations for received domain records
2951d21689 crypto: api - Move cryptomgr soft dependency into algapi
b62267b8b0 KVM: s390: Return error on SIDA memop on normal guest
be93028d30 moxart: fix potential use-after-free on remove path
ca562bf79c Merge branch 'android12-5.10' into `android12-5.10-lts`
c3b53fcd90 Merge 5.10.99 into android12-5.10-lts
fb063a6465 Linux 5.10.99
4889d6ee9e selftests: nft_concat_range: add test for reload with no element add/del
5577273135 cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning
f1f7d1a22f net: dsa: mt7530: make NET_DSA_MT7530 select MEDIATEK_GE_PHY
84b76a509c ext4: fix incorrect type issue during replay_del_range
62e46e0ffc ext4: fix error handling in ext4_fc_record_modified_inode()
764793b4a5 ext4: fix error handling in ext4_restore_inline_data()
6c5bd55e36 ext4: modify the logic of ext4_mb_new_blocks_simple
8d71fc23fc ext4: prevent used blocks from being allocated during fast commit replay
ef2053afd7 EDAC/xgene: Fix deferred probing
2a12faf55b EDAC/altera: Fix deferred probing
dd274cf852 x86/perf: Default set FREEZE_ON_SMI for all
456f041e03 perf/x86/intel/pt: Fix crash with stop filters in single-range mode
8c0e6a8a63 perf stat: Fix display of grouped aliased events
57e8859acc fbcon: Add option to enable legacy hardware acceleration
460f6b1a23 Revert "fbcon: Disable accelerated scrolling"
460aa9d873 rtc: cmos: Evaluate century appropriate
2324f5fcdf tools/resolve_btfids: Do not print any commands when building silently
1536fafa23 selftests: futex: Use variable MAKE instead of make
8f0fff8b59 selftests/exec: Remove pipe from TEST_GEN_FILES
6304a613a9 bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
f744a06404 gve: fix the wrong AdminQ buffer queue index check
51e88e8922 nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
ec4334152d scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
fd482f2d63 pinctrl: bcm2835: Fix a few error paths
752d9eafc6 pinctrl: intel: fix unexpected interrupt
14bc9978b4 pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line
5a45448ac9 ASoC: max9759: fix underflow in speaker_gain_control_put()
02f4597198 ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name
cb5f1fbd1f ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes
56e0747d59 ASoC: fsl: Add missing error handling in pcm030_fabric_probe
3e69837551 drm/i915/overlay: Prevent divide by zero bugs in scaling
9ea0185361 net: stmmac: ensure PTP time register reads are consistent
41df2da2c1 net: stmmac: dump gmac4 DMA registers correctly
114bf93504 net: macsec: Verify that send_sci is on when setting Tx sci explicitly
2e7f5b6ee1 net: macsec: Fix offload support for NETDEV_UNREGISTER event
87b1c9fab6 net: ieee802154: Return meaningful error codes from the netlink helpers
78b3f20c17 net: ieee802154: ca8210: Stop leaking skb's
0bfe50dc5d net: ieee802154: mcr20a: Fix lifs/sifs periods
75bbda3189 net: ieee802154: hwsim: Ensure proper channel selection at probe time
e895e067d7 spi: uniphier: fix reference count leak in uniphier_spi_probe()
ec942d08e0 spi: meson-spicc: add IRQ check in meson_spicc_probe
c2cf65e100 spi: mediatek: Avoid NULL pointer crash in interrupt
30e05c98b9 spi: bcm-qspi: check for valid cs before applying chip select
6d226e8afe iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
9d9995b037 iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
b3958d3151 RDMA/mlx4: Don't continue event handler after memory allocation failure
d3f8b927df RDMA/siw: Fix broken RDMA Read Fence/Resume logic.
c7db20f5be IB/rdmavt: Validate remote_addr during loopback atomic tests
75c610212b RDMA/ucma: Protect mc during concurrent multicast leaves
371979069a RDMA/cma: Use correct address when leaving multicast group
aa4ecd995f memcg: charge fs_context and legacy_fs_context
080f371d98 Revert "ASoC: mediatek: Check for error clk pointer"
4a9bd1e678 IB/hfi1: Fix AIP early init panic
5d40f1bdad dma-buf: heaps: Fix potential spectre v1 gadget
30de3bc099 block: bio-integrity: Advance seed correctly for larger interval sizes
352715593e mm/kmemleak: avoid scanning potential huge holes
7053188ddb mm/pgtable: define pte_index so that preprocessor could recognize it
bce7f5d74d mm/debug_vm_pgtable: remove pte entry from the page table
2d83a7463d nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts()
a0c73dbdd1 drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels
f071d9fa85 drm/nouveau: fix off by one in BIOS boundary checking
32747e0143 btrfs: fix deadlock between quota disable and qgroup rescan worker
aa5d406153 ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows
d4aa3a9859 ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset)
3a8a8072e3 ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks
532cde962f ALSA: hda/realtek: Add quirk for ASUS GU603
410f231fd7 ALSA: hda: realtek: Fix race at concurrent COEF updates
a7de100213 ALSA: hda: Fix UAF of leds class devs at unbinding
470bbb9cbd ALSA: usb-audio: Correct quirk for VF0770
6877f87579 ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
038f8b7caa ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
a9394f21fb ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
0ff6b80506 audit: improve audit queue handling when "audit=1" on cmdline
f446089a26 selinux: fix double free of cond_list on error paths
08942dae64 Merge 5.10.98 into android-5.10
26d02dc8ef Merge 5.10.97 into android12-5.10-lts
e33a5b611c Revert "perf: Fix perf_event_read_local() time"
0b4470b56e Merge 5.10.96 into android12-5.10-lts
12a0a56cba Linux 5.10.98
97a47e2555 Revert "drm/vc4: hdmi: Make sure the device is powered with CEC" again
e27042060f Revert "drm/vc4: hdmi: Make sure the device is powered with CEC"
c8ed22bd97 Linux 5.10.97
176356550c tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()
32e1799710 af_packet: fix data-race in packet_setsockopt / packet_setsockopt
aa9e96db31 cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()
3bbe2019dd rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
e7be569263 net: sched: fix use-after-free in tc_new_tfilter()
7b4741644c fanotify: Fix stale file descriptor in copy_event_to_user()
4d3fcfe846 net: amd-xgbe: Fix skb data length underflow
cadfa7dce5 net: amd-xgbe: ensure to reset the tx_timer_active flag
77534b114f ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
b4ced7a46d net/mlx5: E-Switch, Fix uninitialized variable modact
502c37b033 net/mlx5: Use del_timer_sync in fw reset flow of halting poll
a01ee1b816 net/mlx5e: Fix handling of wrong devices during bond netevent
1fc3444cda cgroup-v1: Require capabilities to set release_agent
ac4ba79bb0 drm/vc4: hdmi: Make sure the device is powered with CEC
46f919c6bd x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
fbdbf6743f x86/mce: Add Xeon Sapphire Rapids to list of CPUs that support PPIN
d4e4e61d4a psi: Fix uaf issue when psi trigger is destroyed while being polled
080dbe7e9b KVM: x86: Forcibly leave nested virt when SMM state is toggled
063029a882 Revert "drivers: bus: simple-pm-bus: Add support for probing simple bus only devices"
42fdbf8b7d net: ipa: prevent concurrent replenish
ad81380d3a net: ipa: use a bitmap for endpoint replenish_enabled
2ed912e3e0 net: ipa: fix atomic update in ipa_endpoint_replenish()
3b4c966fb1 PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
a9839858b5 Merge 5.10.95 into android12-5.10-lts
f255ac9e87 Linux 5.10.96
b43e9d2f6f mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()
b63e120189 block: Fix wrong offset in bio_truncate()
0b4e82403c fsnotify: invalidate dcache before IN_DELETE event
8bae6db29c usr/include/Makefile: add linux/nfc.h to the compile-test coverage
f36554de78 dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
446ff1fc37 net: bridge: vlan: fix memory leak in __allowed_ingress
bc58a5bb9e ipv4: remove sparse error in ip_neigh_gw4()
ebc5b8e471 ipv4: tcp: send zero IPID in SYNACK messages
58f72918f9 ipv4: raw: lock the socket in raw_bind()
9ffc94a81b net: bridge: vlan: fix single net device option dumping
869f1704f1 Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
699eef4ed9 net: hns3: handle empty unknown interrupt for VF
c9c81b393c net: cpsw: Properly initialise struct page_pool_params
729e54636b yam: fix a memory leak in yam_siocdevprivate()
93a6e920d8 drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
0b7d8db87d drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
d1d4616d3e video: hyperv_fb: Fix validation of screen resolution
0a60d04abc ibmvnic: don't spin in tasklet
55258b5059 ibmvnic: init ->running_cap_crqs early
b469cf91fb ipv4: fix ip option filtering for locally generated fragments
9b44441972 net: ipv4: Fix the warning for dereference
2f56c4845d net: ipv4: Move ip_options_fragment() out of loop
55402a4618 powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending
0bdbf93ee2 hwmon: (lm90) Mark alert as broken for MAX6654
c534287a57 efi/libstub: arm64: Fix image check alignment at entry
3572205b19 rxrpc: Adjust retransmission backoff
5067f5699d octeontx2-pf: Forward error codes to VF
bd024e36f6 phylib: fix potential use-after-free
a839a79f4d net: phy: broadcom: hook up soft_reset for BCM54616S
57b2f3632b sched/pelt: Relax the sync of util_sum with util_avg
91b04e83c7 perf: Fix perf_event_read_local() time
cffed7e631 kernel: delete repeated words in comments
1af995c98b netfilter: conntrack: don't increment invalid counter on NF_REPEAT
129c71829d powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
7a32824f7a NFS: Ensure the server has an up to date ctime before renaming
666f6ab882 NFS: Ensure the server has an up to date ctime before hardlinking
4cd0ef6215 ipv6: annotate accesses to fn->fn_sernum
79c0b5287d drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
3ab44a408b drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
82c310d04b drm/msm: Fix wrong size calculation
f57a99c9a5 net-procfs: show net devices bound packet types
87880e3803 NFSv4: nfs_atomic_open() can race when looking up a non-regular file
ce8c552b88 NFSv4: Handle case where the lookup of a directory fails
b48a05cee2 hwmon: (lm90) Reduce maximum conversion rate for G781
b26fed25e6 ipv4: avoid using shared IP generator for connected sockets
283aa5a5af ping: fix the sk_bound_dev_if match in ping_lookup
7bcb0c19ab hwmon: (lm90) Mark alert as broken for MAX6680
925cbd596a hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
db044d9746 net: fix information leakage in /proc/net/ptype
feb770cc00 ipv6_tunnel: Rate limit warning messages
00849de10f scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
fcaf94c49a rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
1dbb206730 rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
20f6675821 usb: roles: fix include/linux/usb/role.h compile issue
6aeff8a7c7 i40e: fix unsigned stat widths
d2ed5997a9 i40e: Fix for failed to init adminq while VF reset
768eb705e6 i40e: Fix queues reservation for XDP
39896710f7 i40e: Fix issue when maximum queues is exceeded
9068bcb219 i40e: Increase delay to 1 s after global EMP reset
b4c9b6afa3 powerpc/32: Fix boot failure with GCC latent entropy plugin
50f5d0a8bd powerpc/32s: Fix kasan_init_region() for KASAN
5d3af1dfdf powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs
08f090bb9b x86/MCE/AMD: Allow thresholding interface updates after init
791e5d5daa sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask
afbde455eb ocfs2: fix a deadlock when commit trans
97f75e7d4c jbd2: export jbd2_journal_[grab|put]_journal_head
3921d081c9 ucsi_ccg: Check DEV_INT bit only when starting CCG4
598a884c77 usb: typec: tcpm: Do not disconnect while receiving VBUS off
e3b131e30e USB: core: Fix hang in usb_kill_urb by adding memory barriers
3ca928c824 usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
053274bc6b usb: common: ulpi: Fix crash in ulpi_match()
20c51a4c52 usb: xhci-plat: fix crash when suspend if remote wake enable
38d1bf67a3 usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
e0fcae7bd7 tty: Add support for Brainboxes UC cards.
7079283d32 tty: n_gsm: fix SW flow control encoding/handling
2683b0d5d7 serial: stm32: fix software flow control transfer
4628b26df5 serial: 8250: of: Fix mapped region size when using reg-offset property
94b23988c3 netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
bf0d4ae5c6 arm64: errata: Fix exec handling in erratum 1418040 workaround
e92cac1dd8 KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS
6b55af102b drm/etnaviv: relax submit size limits
7a32d17fb7 perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
a2c8e1d9e4 Revert "KVM: SVM: avoid infinite loop on NPF from bad address"
abae88fb37 fsnotify: fix fsnotify hooks in pseudo filesystems
6ceac38e9b ceph: set pool_ns in new inode layout for async creates
e7be12ca7d ceph: properly put ceph_string reference after async create attempt
39986696fe tracing: Don't inc err_log entry count if entry allocation fails
d71b06aa99 tracing/histogram: Fix a potential memory leak for kstrdup()
561a22d44a PM: wakeup: simplify the output logic of pm_show_wakelocks()
b0f1cc093b efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
de7cc8bcca udf: Fix NULL ptr deref when converting from inline format
0a3cfd2589 udf: Restore i_lenAlloc when inode expansion fails
f08801252d scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
ff6bdc205f bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
6520fedfce s390/hypfs: include z/VM guests with access control group set
c10e0627c7 s390/module: fix loading modules with a lot of relocations
ba7c71a777 net: stmmac: skip only stmmac_ptp_register when resume from suspend
11191406f2 net: sfp: ignore disabled SFP node
e651772adc media: venus: core: Drop second v4l2 device unregister
83d5196b65 Bluetooth: refactor malicious adv data check
34fd8cb7e7 ANDROID: Fix CRC issue up with xfrm headers in 5.10.94
a50b069165 Revert "xfrm: rate limit SA mapping change message to user space"
67ea95e0e8 Revert "clocksource: Reduce clocksource-skew threshold"
fae0741a78 Revert "clocksource: Avoid accidental unstable marking of clocksources"
77656fde3c Linux 5.10.95
ae2b20f277 drm/vmwgfx: Fix stale file descriptors on failed usercopy
11ba2c6dfb select: Fix indefinitely sleeping task in poll_schedule_timeout()
a447d7f786 KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
12d3389b7a rcu: Tighten rcu_advance_cbs_nowake() checks
4d63363c88 bnx2x: Invalidate fastpath HSI version for VFs
fdcfabd095 bnx2x: Utilize firmware 7.13.21.0
6a6acf9278 drm/i915: Flush TLBs before releasing backing store
4ec3c2eea5 Merge 5.10.94 into android12-5.10-lts
c525532e4f Linux 5.10.94
c76c132444 scripts: sphinx-pre-install: Fix ctex support on Debian
133cef0b61 scripts: sphinx-pre-install: add required ctex dependency
15ce9329a5 ath10k: Fix the MTU size on QCA9377 SDIO
25b1a6d330 mtd: nand: bbt: Fix corner case in bad block table handling
8104e589fa lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
6292503700 mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
33bb7f027b lib82596: Fix IRQ check in sni_82596_probe
078b5a4498 scripts/dtc: dtx_diff: remove broken example from help text
21513c4615 dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
23bcf3615b dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
66467cc87a dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
4496e4a427 net: mscc: ocelot: fix using match before it is set
ee64479c9c net: sfp: fix high power modules without diagnostic monitoring
819e76bc57 net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
4691c9f047 bcmgenet: add WOL IRQ check
6973b38b9d net_sched: restore "mpu xxx" handling
20949c3816 net: bonding: fix bond_xmit_broadcast return value error bug
799730d182 arm64: dts: qcom: msm8996: drop not documented adreno properties
f6d4c0e017 devlink: Remove misleading internal_flags from health reporter dump
2e51a761b7 perf probe: Fix ppc64 'perf probe add events failed' case
59b44f7760 dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
0078f05371 dmaengine: at_xdmac: Fix lld view setting
7ab120636d dmaengine: at_xdmac: Fix concurrency over xfers_list
b5b27c5e33 dmaengine: at_xdmac: Print debug message after realeasing the lock
c536b351a7 dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
cd22e22e8e dmaengine: at_xdmac: Don't start transactions at tx_submit level
68a83051c8 perf script: Fix hex dump character output
7b9d40e9f6 libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
cd5c24d223 gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
7f2ca96bd2 xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
2b1415c60b netns: add schedule point in ops_exit_list()
edc09548ff inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
69e7e979ed taskstats: Cleanup the use of task->exit_code
56daa21414 virtio_ring: mark ring unused on error
0c4ebcb00d vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
c736ec01a2 rtc: pxa: fix null pointer dereference
8b8ff4c793 HID: vivaldi: fix handling devices not using numbered reports
d7544cf693 net: axienet: increase default TX ring size to 128
557829d42d net: axienet: fix for TX busy handling
41831d4967 net: axienet: fix number of TX ring slots for available check
6301f3566a net: axienet: Fix TX ring slot available check
7a3d3d7f6d net: axienet: limit minimum TX ring size
2f548489d6 net: axienet: add missing memory barriers
bcc5d57e60 net: axienet: reset core on initialization prior to MDIO access
46c0ccaff2 net: axienet: Wait for PhyRstCmplt after core reset
34942a228a net: axienet: increase reset timeout
a66b9bccf7 net/smc: Fix hung_task when removing SMC-R devices
51b52cf354 clk: si5341: Fix clock HW provider cleanup
fe40f7aef3 clk: Emit a stern warning with writable debugfs enabled
38221afa03 af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
a49e402f23 f2fs: fix to reserve space for IO align feature
39ad058117 f2fs: compress: fix potential deadlock of compress file
e1840365ed parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
d806eb5f4e net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
38c798384b net/fsl: xgmac_mdio: Add workaround for erratum A-009885
734f4b0f83 ipv4: avoid quadratic behavior in netns dismantle
86f0587f74 ipv4: update fib_info_cnt under spinlock protection
10e99ae9b5 perf evsel: Override attr->sample_period for non-libpfm4 events
58fa3e9002 xdp: check prog type before updating BPF link
38ee417f59 bpftool: Remove inclusion of utilities.mak from Makefiles
2bcab471a2 block: Fix fsync always failed if once failed
5e59f88535 powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
19aaef6519 powerpc/cell: Fix clang -Wimplicit-fallthrough warning
4cb7aba1e0 Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
78cf5f63a3 dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
16ad0aa917 RDMA/rxe: Fix a typo in opcode name
885860717c RDMA/hns: Modify the mapping attribute of doorbell to device
57cd8597c3 dmaengine: uniphier-xdmac: Fix type of address variables
4fe77b7cd2 scsi: core: Show SCMD_LAST in text form
b30240911d Bluetooth: hci_sync: Fix not setting adv set duration
55698d11c8 Documentation: fix firewire.rst ABI file path error
5d38cbf66d Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
abecf9d748 Documentation: ACPI: Fix data node reference documentation
d1e85fcd73 Documentation: dmaengine: Correctly describe dmatest with channel unset
f6736bd81d media: correct MEDIA_TEST_SUPPORT help text
55b10b88ac drm/vc4: hdmi: Make sure the device is powered with CEC
81ac08a800 media: rcar-csi2: Optimize the selection PHTW register
0baa3729d2 can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message
f62bf6ee4f firmware: Update Kconfig help text for Google firmware
12224c0d19 of: base: Improve argument length mismatch error
7bb99c7e13 drm/radeon: fix error handling in radeon_driver_open_kms
0ca7ec6db2 ext4: don't use the orphan list when migrating an inode
679fb06532 ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
d60e9daba2 ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
f26b24b4c1 ext4: fast commit may miss tracking unwritten range during ftruncate
04b5627306 ext4: use ext4_ext_remove_space() for fast commit replay delete range
53998b3f6d ext4: Fix BUG_ON in ext4_bread when write quota data
da364ab358 ext4: set csum seed in tmp inode while migrating to extents
e4221629d5 ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
720508dd11 ext4: initialize err_blk before calling __ext4_get_inode_loc
f9ed0ea0a9 ext4: fix a possible ABBA deadlock due to busy PA
115b762b48 ext4: make sure quota gets properly shutdown on error
762e4c33e9 ext4: make sure to reset inode lockdep class when quota enabling fails
f8c3ec2e21 btrfs: respect the max size in the header when activating swap file
e7764bccae btrfs: check the root node for uptodate before returning it
09e0ef287e btrfs: fix deadlock between quota enable and other quota operations
56f974d583 xfrm: fix policy lookup for ipv6 gre packets
84166c1177 PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
7aeeb9fe9c PCI: pci-bridge-emul: Correctly set PCIe capabilities
af1d0acdac PCI: pci-bridge-emul: Fix definitions of reserved bits
0f2ae6691e PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
2a0d437d8a PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only
def2825b09 PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
6cbe8f8deb PCI: xgene: Fix IB window setup
e09f47e77b powerpc/64s/radix: Fix huge vmap false positive
eb44b1386a parisc: Fix lpa and lpa_user defines
9b78ee2341 drm/bridge: analogix_dp: Make PSR-exit block less
8cbbf4a6f1 drm/nouveau/kms/nv04: use vzalloc for nv04_display
605583fccc drm/etnaviv: limit submit sizes
6c1e3d8b1b device property: Fix fwnode_graph_devcon_match() fwnode leak
ecb71f7bd5 s390/mm: fix 2KB pgtable release race
798754ba48 iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
c524f4cfb3 tracing/kprobes: 'nmissed' not showed correctly for kretprobe
b72075e395 cputime, cpuacct: Include guest time in user time in cpuacct.stat
13518f058f serial: Fix incorrect rs485 polarity on uart open
9668cf9e4a fuse: Pass correct lend value to filemap_write_and_wait_range()
9fbaddd783 xen/gntdev: fix unmap notification order
67b078d996 spi: uniphier: Fix a bug that doesn't point to private data correctly
05026c4e94 tpm: fix NPE on probe for missing device
76006d33f1 ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
4f0762ac32 crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
9e6ff2d572 crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
2031e0246e crypto: omap-aes - Fix broken pm_runtime_and_get() usage
43e94431c3 rpmsg: core: Clean up resources on announce_create failure.
082ff9e12b phy: mediatek: Fix missing check in mtk_mipi_tx_probe
ff08cf1e34 ASoC: mediatek: mt8183: fix device_node leak
f28672eef4 ASoC: mediatek: mt8173: fix device_node leak
0df5104008 scsi: sr: Don't use GFP_DMA
de9a936b04 MIPS: Octeon: Fix build errors using clang
da7df943e2 i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
f09f7ccb28 irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
bc2d961d82 MIPS: OCTEON: add put_device() after of_find_device_by_node()
ce34b03a71 udf: Fix error handling in udf_new_inode()
15be042e7f powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic
f2e658d9bd powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
044164b419 selftests/powerpc/spectre_v2: Return skip code when miss_percent is high
21125e0116 powerpc/40x: Map 32Mbytes of memory at startup
c330442f46 MIPS: Loongson64: Use three arguments for slti
af8d077350 ALSA: seq: Set upper limit of processed events
297210783a scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
dfde7afed7 dm: fix alloc_dax error handling in alloc_dev
2e2086f49e nvmem: core: set size for sysfs bin file
4a273a94bd w1: Misuse of get_user()/put_user() reported by sparse
87e91d6c6a KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
23bb3f01ce KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots
03c1595a18 powerpc/powermac: Add missing lockdep_register_key()
df29c01b9f clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
30d35a1abd i2c: mpc: Correct I2C reset procedure
4b25aad655 powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
25714ad6bf i2c: i801: Don't silently correct invalid transfer size
75e2cfa5fa powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
a83639521a powerpc/btext: add missing of_node_put
fc10d8f00a powerpc/cell: add missing of_node_put
297ff7d5f1 powerpc/powernv: add missing of_node_put
c83ba875d7 powerpc/6xx: add missing of_node_put
d240b08d8a x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs
3681e9f3f0 parisc: Avoid calling faulthandler_disabled() twice
f2a27dd7a2 random: do not throw away excess input to crng_fast_load
f8fdebfb4b serial: core: Keep mctrl register state and cached copy in sync
a03fd1b198 serial: pl010: Drop CR register reset on set_termios
40ac338926 regulator: qcom_smd: Align probe function with rpmh-regulator
3dc751213f net: gemini: allow any RGMII interface mode
1063de8975 net: phy: marvell: configure RGMII delays for 88E1118
00580670b9 mlxsw: pci: Avoid flow control for EMAD packets
eaf8cffcf5 dm space map common: add bounds check to sm_ll_lookup_bitmap()
5850bef8e9 dm btree: add a defensive bounds check to insert_at()
754b663ea9 mac80211: allow non-standard VHT MCS-10/11
e8da60b3a6 net: mdio: Demote probed message to debug print
6b22c9824d btrfs: remove BUG_ON(!eie) in find_parent_nodes
623c65bc73 btrfs: remove BUG_ON() in find_parent_nodes()
44cbd2a16a ACPI: battery: Add the ThinkPad "Not Charging" quirk
7b6dc07c6e amdgpu/pm: Make sysfs pm attributes as read-only for VFs
516e332d6f drm/amdgpu: fixup bad vram size on gmc v8
ee88ff140d ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
8544074762 ACPICA: Fix wrong interpretation of PCC address
e70be17696 ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
8ea9216d20 ACPICA: Utilities: Avoid deleting the same object twice in a row
fcfd8282c5 ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
e3a51d6c90 jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
e35cb5b122 drm/etnaviv: consider completed fence seqno in hang check
a0b13335a3 xfrm: rate limit SA mapping change message to user space
0b7beb2fea Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
6ac117edac ath11k: Fix napi related hang
756a7188b2 um: registers: Rename function names to avoid conflicts and build problems
d817d10f7a iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
f266e1c5bf iwlwifi: mvm: Fix calculation of frame length
6e44b60054 iwlwifi: remove module loading failure message
febab6b60d iwlwifi: fix leaks/bad data after failed firmware load
81d2e96aba PM: AVS: qcom-cpr: Use div64_ul instead of do_div
c0a1d844e3 rtw88: 8822c: update rx settings to prevent potential hw deadlock
3ef25f3122 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
e10de31055 usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
282286c632 cpufreq: Fix initialization of min and max frequency QoS requests
37b25de3af PM: runtime: Add safety net to supplier device release
5dfc6fa0b8 arm64: tegra: Adjust length of CCPLEX cluster MMIO region
b68c56a149 arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
b6f7f0ad5a audit: ensure userspace is penalized the same as the kernel when under pressure
5d54ed1550 mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
51a5156bb7 media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
f6bc6b178c media: igorplugusb: receiver overflow should be reported
d698e024be HID: quirks: Allow inverting the absolute X/Y values
59f0363346 bpf: Do not WARN in bpf_warn_invalid_xdp_action()
0e8805f73b net: bonding: debug: avoid printing debug logs when bond is not notifying peers
8c72de32ff x86/mce: Mark mce_read_aux() noinstr
1ad3e60f1f x86/mce: Mark mce_end() noinstr
f21ca973b4 x86/mce: Mark mce_panic() noinstr
de360d9443 x86/mce: Allow instrumentation during task work queueing
af371e0abb ath11k: Avoid false DEADLOCK warning reported by lockdep
aec69e2f33 selftests/ftrace: make kprobe profile testcase description unique
07ecabf15a gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
7e09f9d15e net: phy: prefer 1000baseT over 1000baseKX
443133330a net-sysfs: update the queue counts in the unregistration path
58b4c1ce83 ath10k: Fix tx hanging
fcba0bce33 ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
93a108d466 iwlwifi: mvm: avoid clearing a just saved session protection id
ec01e0fe21 iwlwifi: mvm: synchronize with FW after multicast commands
c1976a4248 thunderbolt: Runtime PM activate both ends of the device link
830e5d1b43 media: m920x: don't use stack on USB reads
c33f0f22bf media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
526b6c9b45 media: rcar-vin: Update format alignment constraints
74e60c1dce media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
d0e3ab637d drm: rcar-du: Fix CRTC timings when CMM is used
e61aa46d0f x86/mm: Flush global TLB when switching to trampoline page-table
0946fdd929 floppy: Add max size check for user space request
409d45bcd3 usb: uhci: add aspeed ast2600 uhci support
d0aec428c0 arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
fcb45ac39f ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win
b8b2e74a87 ACPI / x86: Allow specifying acpi_device_override_status() quirks by path
cda755506d ACPI: Change acpi_device_always_present() into acpi_device_override_status()
b029625063 ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table
cf3b1a160d media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions
adbe148672 ath11k: Avoid NULL ptr access during mgmt tx cleanup
ab523ea096 rsi: Fix out-of-bounds read in rsi_read_pkt()
7525876750 rsi: Fix use-after-free in rsi_rx_done_handler()
6036500fdf mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
8a6371d84c crypto: jitter - consider 32 LSB for APT
240cf5d3cb HSI: core: Fix return freed object in hsi_new_client
f4295b7dca gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
f0653cd4da tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()
b8d10f601f drm/bridge: megachips: Ensure both bridges are probed before registration
43fc9e267e mlxsw: pci: Add shutdown method in PCI driver
b2e921fa92 soc: ti: pruss: fix referenced node in error message
07fbbc4dc7 drm/amdgpu/display: set vblank_disable_immediate for DC
019fe9723a drm/amd/display: check top_pipe_to_program pointer
3c3c0b6c4a ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
f54d8cd831 EDAC/synopsys: Use the quirk for version instead of ddr version
0b85d73fdb media: b2c2: Add missing check in flexcop_pci_isr:
c978d39a8b HID: apple: Do not reset quirks when the Fn key is not found
2df002e327 drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
5aa57672c6 usb: gadget: f_fs: Use stream_open() for endpoint files
129e8faaee ath11k: Fix crash caused by uninitialized TX ring
e8b271f2aa media: atomisp: handle errors at sh_css_create_isp_params()
ebe9c978d9 batman-adv: allow netlink usage in unprivileged containers
ff452db961 ARM: shmobile: rcar-gen2: Add missing of_node_put()
ff2138d6c2 media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure
51ef6582a2 media: atomisp: set per-device's default mode
ac08140677 media: atomisp: fix try_fmt logic
518e059789 drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
e3ba02b043 drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR
2f13f10fdd ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
a9d2ccfc7d selftests/bpf: Fix bpf_object leak in skb_ctx selftest
b207356933 drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
db1e878373 fs: dlm: filter user dlm messages for kernel locks
f9c9a46efd Bluetooth: Fix debugfs entry leak in hci_register_dev()
852d7d436f ARM: dts: omap3-n900: Fix lp5523 for multi color
b5793aff11 of: base: Fix phandle argument length mismatch error message
e16e836d51 clk: bm1880: remove kfrees on static allocations
36d46e21c9 ASoC: fsl_asrc: refine the check of available clock divider
5a6864e2e6 RDMA/cxgb4: Set queue pair state when being queried
80524c8cdf ASoC: fsl_mqs: fix MODULE_ALIAS
74988d017d powerpc/xive: Add missing null check after calling kmalloc
588e0b81ce mips: bcm63xx: add support for clk_set_parent()
e3de89d010 mips: lantiq: add support for clk_set_parent()
8f8468a089 arm64: tegra: Remove non existent Tegra194 reset
702902fc7f arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering
24b047d72c counter: stm32-lptimer-cnt: remove iio counter abi
a394606104 misc: lattice-ecp3-config: Fix task hung when firmware load failed
696a50abbc ASoC: samsung: idma: Check of ioremap return value
d491a2c2cf ASoC: mediatek: Check for error clk pointer
c73ccdd62d phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
d781f4cd8c scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
6e2a169544 iommu/iova: Fix race between FQ timeout and teardown
57bc898575 ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
676049a3d2 iommu/amd: Restore GA log/tail pointer on host resume
c2bd7c31de iommu/amd: Remove iommu_init_ga()
62ea255f2b dmaengine: pxa/mmp: stop referencing config->slave_id
0be9ae1e53 mips: fix Kconfig reference to PHYS_ADDR_T_64BIT
88d78b25db mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support
51b8e814bc clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell
dff359e042 of: unittest: 64 bit dma address test requires arch support
918105df78 of: unittest: fix warning on PowerPC frame size warning
0e04518b1d ASoC: rt5663: Handle device_property_read_u32_array error codes
7c0d9c815c RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
2432d325f9 RDMA/core: Let ib_find_gid() continue search even after empty entry
d77916df16 powerpc/powermac: Add additional missing lockdep_register_key()
8b3783e517 PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
7be2a0bcaf RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
e19469468b scsi: ufs: Fix race conditions related to driver data
ed43b2e048 iommu/io-pgtable-arm: Fix table descriptor paddr formatting
e9e4d1fb45 openrisc: Add clone3 ABI wrapper
551a785c26 binder: fix handling of error during copy
88ddf033a5 char/mwave: Adjust io port register size
8937aee4c0 ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
bcd533417f ALSA: oss: fix compile error when OSS_DEBUG is enabled
fd99aeb978 clocksource: Avoid accidental unstable marking of clocksources
cacc6c30e3 clocksource: Reduce clocksource-skew threshold
86ad478c99 powerpc/32s: Fix shift-out-of-bounds in KASAN init
ef798cd035 powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC
58014442a9 powerpc/irq: Add helper to set regs->softe
c9ffa84a3b powerpc/perf: move perf irq/nmi handling details into traps.c
a0758b3be4 powerpc/perf: MMCR0 control for PMU registers under PMCC=00
f4df6db5b0 powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C
a9c9d2ff64 dt-bindings: thermal: Fix definition of cooling-maps contribution property
2bd8d93795 ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
5a821af769 powerpc/prom_init: Fix improper check of prom_getprop()
9ca761ef94 clk: imx8mn: Fix imx8mn_clko1_sels
999528d8a7 scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
c5f414d69a RDMA/hns: Validate the pkey index
04a032ea24 RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit"
84cd5c029d ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
180e9d7384 ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
49d76154ba ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
f871cd8ee0 ext4: avoid trim error on fs with small groups
99590e820f net: mcs7830: handle usb read errors properly
2b948524ae iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
04ce9e2aed pcmcia: fix setting of kthread task states
5064bfe046 can: xilinx_can: xcan_probe(): check for error irq
b6dd1577bc can: softing: softing_startstop(): fix set but not used variable warning
b9ac866c23 tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
fb46223c9f tpm: add request_locality before write TPM_INT_ENABLE
20edf903a3 can: mcp251xfd: add missing newline to printed strings
d71fca5d01 regmap: Call regmap_debugfs_exit() prior to _init()
838acddcdf netrom: fix api breakage in nr_setsockopt()
0d04479857 ax25: uninitialized variable in ax25_setsockopt()
27e9910c45 spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
9d6350cf8e Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
9defd7d4c0 lib/mpi: Add the return value check of kcalloc()
e801f81cee net/mlx5: Set command entry semaphore up once got index free
d2b9ce705d Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
67e1a449a1 net/mlx5e: Don't block routes with nexthop objects in SW
cc40fa05c0 net/mlx5e: Fix page DMA map/unmap attributes
b3dda01d1d debugfs: lockdown: Allow reading debugfs files that are not world readable
b9b5da3e18 HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
541c3a044b HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
c47f842e0c HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
cf5ad827ee HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
94177fcecc usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
4579954bf4 Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
f6bf3d6639 Bluetooth: hci_bcm: Check for error irq
f5e4f68d57 fsl/fman: Check for null pointer after calling devm_ioremap
60aca6fdc1 staging: greybus: audio: Check null pointer
a1068bfee4 rocker: fix a sleeping in atomic bug
2db344725e ppp: ensure minimum packet size in ppp_write()
45643b1b6c netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
8772700a9f bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
342332fb0b bpf: Don't promote bogus looking registers after null check.
0036c78c49 netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
2e718389b9 power: reset: mt6397: Check for null res pointer
4210c35fe8 pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
2dee347f35 pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
0f03132191 ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
595e1ec55b x86/mce/inject: Avoid out-of-bounds write when setting flags
df12681819 hwmon: (mr75203) fix wrong power-up delay value
aea5302d9d x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS
70eec71f32 Bluetooth: hci_qca: Stop IBS timer during BT OFF
1d4e722b62 software node: fix wrong node passed to find nargs_prop
f8f3c1720d backlight: qcom-wled: Respect enabled-strings in set_brightness
de79bcbfaf backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion
c79f9b8d8e backlight: qcom-wled: Override default length with qcom,enabled-strings
bf4daf6153 backlight: qcom-wled: Fix off-by-one maximum with default num_strings
09aed85e8c backlight: qcom-wled: Pass number of elements to read to read_u32_array
f4ed4fc504 backlight: qcom-wled: Validate enabled string indices in DT
e668ac6506 bpftool: Enable line buffering for stdout
009bb7ee15 Bluetooth: L2CAP: Fix using wrong mode
1a2241ad40 um: virtio_uml: Fix time-travel external time propagation
8411722e56 um: fix ndelay/udelay defines
b2b1b490bd selinux: fix potential memleak in selinux_add_opt()
3253cf0914 mmc: meson-mx-sdio: add IRQ check
decb209954 mmc: meson-mx-sdhc: add IRQ check
bdc6c9fc5f iwlwifi: mvm: test roc running status bits before removing the sta
a750fcd604 iwlwifi: mvm: fix 32-bit build in FTM
86b0122d26 ARM: dts: armada-38x: Add generic compatible to UART nodes
1f5428e438 arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
874b97e862 arm64: dts: marvell: cn9130: add GPIO and SPI aliases
407ef1db40 usb: ftdi-elan: fix memory leak on device disconnect
2a65da5a1e ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
47dd693c94 xfrm: state and policy should fail if XFRMA_IF_ID 0
db369047e3 xfrm: interface with if_id 0 should return error
37441ddadc media: hantro: Fix probe func error path
3849ec830b drm/tegra: vic: Fix DMA API misuse
b230114bc5 drm/bridge: ti-sn65dsi86: Set max register for regmap
db97fc2c44 drm/msm/dpu: fix safe status debugfs file
3580055d1f arm64: dts: qcom: ipq6018: Fix gpio-ranges property
6f20a5a98a arm64: dts: qcom: c630: Fix soundcard setup
394ee480aa ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
f6e4a6cbdb media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
1a8869de32 media: msi001: fix possible null-ptr-deref in msi001_probe()
a79327bb01 media: dw2102: Fix use after free
958a8819d4 ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
3e51460638 ath11k: Fix deleting uninitialized kernel timer during fragment cache flush
b35263f000 crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
1f5b81874f crypto: stm32/cryp - fix bugs and crash in tests
1f6151b077 crypto: stm32/cryp - fix lrw chaining mode
2bd40e3a3a crypto: stm32/cryp - fix double pm exit
533af1621d crypto: stm32/cryp - check early input data
5deb24e503 crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
e9e0dd5da8 crypto: stm32/cryp - fix CTR counter carry
c40b1bc851 crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter
93033bbbdc selftests: harness: avoid false negatives if test has no ASSERTs
f568fd97d7 selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST
d21b47c607 x86/uaccess: Move variable into switch case statement
3e801ea43c xfrm: fix a small bug in xfrm_sa_len()
b87034d7a2 mwifiex: Fix possible ABBA deadlock
0836f94040 rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
027165c491 drm/msm/dp: displayPort driver need algorithm rational
268f352456 sched/rt: Try to restart rt period timer when rt runtime exceeded
bb0579ab50 wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
b4b911b164 media: si2157: Fix "warm" tuner state detection
7009a5fbc5 media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
df79d2bf95 media: dib8000: Fix a memleak in dib8000_init()
f0cb43a2c6 arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
88ed31aab4 arm64: lib: Annotate {clear, copy}_page() as position-independent
69e402a985 bpf: Remove config check to enable bpf support for branch records
924886fa22 bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
218d952160 bpf: Adjust BTF log size limit.
b77ef5b4ea sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
d7d5b3bc52 sched/fair: Fix detection of per-CPU kthreads waking a task
ec121517ac Bluetooth: btmtksdio: fix resume failure
2a7edcb3ef staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
49f5cd2b7c staging: rtl8192e: return error code from rtllib_softmac_init()
04fdd426ce floppy: Fix hang in watchdog when disk is ejected
45bbe00801 serial: amba-pl011: do not request memory region twice
8409d2394c tty: serial: uartlite: allow 64 bit address
a001a15ab3 arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
75919207c1 arm64: dts: ti: k3-j721e: Fix the L2 cache sets
2dcfa3c765 arm64: dts: ti: k3-j7200: Fix the L2 cache sets
f277978d6c drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
3ca1b3b82f drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
96e05d2d93 thermal/drivers/imx8mm: Enable ADC when enabling monitor
ef72449e2d ACPI: EC: Rework flushing of EC work while suspended to idle
c0acd5a097 cgroup: Trace event cgroup id fields should be u64
e7e178e264 arm64: dts: qcom: msm8916: fix MMC controller aliases
894d91c633 netfilter: bridge: add support for pppoe filtering
13f64bbe42 thermal/drivers/imx: Implement runtime PM support
c3a59f34e8 media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
50c4244906 media: venus: core: Fix a potential NULL pointer dereference in an error handling path
eeefa2eae8 media: venus: core, venc, vdec: Fix probe dependency error
53f65afc26 media: venus: pm_helpers: Control core power domain manually
89f518b153 media: coda: fix CODA960 JPEG encoder buffer overflow
1da628d351 media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
2028fb832d media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
e8d78f924f media: imx-pxp: Initialize the spinlock prior to using it
621e8ce75d media: rcar-csi2: Correct the selection of hsfreqrange
ad52b9890b mfd: atmel-flexcom: Use .resume_noirq
46d6a23114 mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
f93c9aa1d3 tty: serial: atmel: Call dma_async_issue_pending()
755a6c873b tty: serial: atmel: Check return code of dmaengine_submit()
bd85b2e77a arm64: dts: ti: k3-j721e: correct cache-sets info
32e9947e66 ath11k: Use host CE parameters for CE interrupts configuration
6a49acfaca crypto: qat - fix undetected PFVF timeout in ACK loop
475ac5c565 crypto: qat - make pfvf send message direction agnostic
ee1c74c3c9 crypto: qat - remove unnecessary collision prevention step in PFVF
472f768352 crypto: qat - fix spelling mistake: "messge" -> "message"
ae766527e6 ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
eab4204588 mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
867d4ace48 crypto: qce - fix uaf on qce_skcipher_register_one
e19b3c1b57 crypto: qce - fix uaf on qce_ahash_register_one
5de640f59f media: dmxdev: fix UAF when dvb_register_device() fails
1d64e2bd22 arm64: dts: renesas: cat875: Add rx/tx delays
a33eef23a6 drm/vboxvideo: fix a NULL vs IS_ERR() check
43220a61e7 fs: dlm: fix build with CONFIG_IPV6 disabled
0d7c5d10e7 tee: fix put order in teedev_close_context()
097e601eb8 ath11k: reset RSN/WPA present state for open BSS
fa51addd39 ath11k: clear the keys properly via DISABLE_KEY
df94b37e90 ath11k: Fix ETSI regd with weather radar overlap
ffc9019bd9 Bluetooth: stop proccessing malicious adv data
3273541fed memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
55917db359 fs: dlm: don't call kernel_getpeername() in error_report()
98923ebb03 fs: dlm: use sk->sk_socket instead of con->sock
6edd1bd8e3 arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
eb1f75fa24 arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
6f012f2c44 arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
96d710b1c6 arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
0b57480ed5 media: aspeed: Update signal status immediately to ensure sane hw state
0ff0ae69d2 media: em28xx: fix memory leak in em28xx_init_dev
b441d94287 media: aspeed: fix mode-detect always time out at 2nd run
8d132d9dd8 media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
fc2b95e7ae media: atomisp: fix enum formats logic
6e5353238c media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
6cbabad304 media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c
22b0b68f7d media: atomisp: fix ifdefs in sh_css.c
0bf5e8af6e media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
3cb3e66f58 media: atomisp: do not use err var when checking port validity for ISP2400
08e43223fb media: atomisp: fix inverted logic in buffers_needed()
fb370f6dc7 media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
1daacf9bb6 media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
e1da9301cf media: videobuf2: Fix the size printk format
90807ab437 mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
9bfed11dcf ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
2fe056d979 wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
22406ed4e3 wcn36xx: populate band before determining rate on RX
92fea7bd5a wcn36xx: Put DXE block into reset before freeing memory
0d53c47f6a wcn36xx: Release DMA channel descriptor allocations
1850195a85 wcn36xx: Fix DMA channel enable/disable cycle
38a7842889 wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
fcb267bb95 wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
e53ff4dd70 drm/vc4: hdmi: Set a default HSM rate
b9c2343373 clk: bcm-2835: Remove rounding up the dividers
836dd37fe2 clk: bcm-2835: Pick the closest clock rate
88f1b613c3 Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
9ddfa1c191 drm/rockchip: dsi: Reconfigure hardware on resume()
58904ed186 drm/rockchip: dsi: Disable PLL clock on bind error
6215cde020 drm/rockchip: dsi: Hold pm-runtime across bind/unbind
8ccaafa1ca drm/rockchip: dsi: Fix unbalanced clock on probe error
9bc19022aa drm/panel: innolux-p079zca: Delete panel on attach() failure
b01b7b8684 drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
0499c863a8 drm: fix null-ptr-deref in drm_dev_init_release()
7798757013 drm/bridge: display-connector: fix an uninitialized pointer in probe()
cb5813b0e5 Bluetooth: L2CAP: Fix not initializing sk_peer_pid
ed0b1fd3ec drm/ttm: Put BO in its memory manager's lru list
7b9fa915a5 shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
6c6f86bb61 mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
e04b1dfe15 dma/pool: create dma atomic pool only if dma zone has managed pages
d2e5724117 mm_zone: add function to check if managed dma zone exists
2142a7e9bd PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
45c74f4f54 dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
191a24ceae gpu: host1x: Add back arm_iommu_detach_device()
0680674536 iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
3dae11f8e3 lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
e4a2c924a1 iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
256302cb2f can: softing_cs: softingcs_probe(): fix memleak on registration failure
aa57725e2d media: cec-pin: fix interrupt en/disable handling
2e566cacc3 media: stk1160: fix control-message timeouts
1a0ca711df media: pvrusb2: fix control-message timeouts
2dbf430ead media: redrat3: fix control-message timeouts
6e9c120bf9 media: dib0700: fix undefined behavior in tuner shutdown
5e98ac260d media: s2255: fix control-message timeouts
09b0b918a6 media: cpia2: fix control-message timeouts
d90833106c media: em28xx: fix control-message timeouts
2182575c83 media: mceusb: fix control-message timeouts
460525acc9 media: flexcop-usb: fix control-message timeouts
7cac8a5624 media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
1da0b1cd42 rtc: cmos: take rtc_lock while reading from CMOS
14f6cfe0d7 tools/nolibc: fix incorrect truncation of exit code
5e258640ba tools/nolibc: i386: fix initial stack alignment
06f7528d64 tools/nolibc: x86-64: Fix startup code bug
98259dd54e x86/gpu: Reserve stolen memory for first integrated Intel GPU
e2a17dcad5 mtd: rawnand: davinci: Rewrite function description
8933138a66 mtd: rawnand: davinci: Avoid duplicated page read
677764634b mtd: rawnand: davinci: Don't calculate ECC when reading page
a8a607b004 mtd: Fixed breaking list in __mtd_del_partition.
ff10cd7bb2 mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
538a5e208e mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
777a700ccf nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
08283b076f f2fs: fix to do sanity check in is_alive()
57cfc965e3 HID: wacom: Avoid using stale array indicies to read contact count
7fd22c99bb HID: wacom: Ignore the confidence flag when a touch is removed
9a4800e0f6 HID: wacom: Reset expected and received contact counts at the same time
c2e39d5df0 HID: uhid: Fix worker destroying device without any protection
aa1346113c KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
0347b16583 Merge 5.10.93 into android12-5.10-lts
fd187a4925 Linux 5.10.93
bed97c9036 mtd: fixup CFI on ixp4xx
f50803b519 powerpc/pseries: Get entry and uaccess flush required bits from H_GET_CPU_CHARACTERISTICS
68c1aa82be ALSA: hda/realtek: Re-order quirk entries for Lenovo
4d15a17d06 ALSA: hda/realtek: Add quirk for Legion Y9000X 2020
d7b41464f1 ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk
87246ae94b ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows
9c27e513fb ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices
4c7fb4d519 KVM: x86: remove PMU FIXED_CTR3 from msrs_to_save_all
6b8c3a1853 firmware: qemu_fw_cfg: fix kobject leak in probe error path
889c73305b firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries
ff9588cf15 firmware: qemu_fw_cfg: fix sysfs information leak
358a4b054a rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled
93c4506f9f media: uvcvideo: fix division by zero at stream start
4c3f70be6f video: vga16fb: Only probe for EGA and VGA 16 color graphic cards
161e43ab8c 9p: only copy valid iattrs in 9P2000.L setattr implementation
0e6c0f3f40 KVM: s390: Clarify SIGP orders versus STOP/RESTART
413b427f5f KVM: x86: Register Processor Trace interrupt hook iff PT enabled in guest
723acd75a0 perf: Protect perf_guest_cbs with RCU
eadde287a6 vfs: fs_context: fix up param length parsing in legacy_parse_param
c5f3827716 remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided
5d88e24b23 orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
0084fefe29 devtmpfs regression fix: reconfigure on each mount
ee40594c95 kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test
f45f895af5 Merge branch 'android12-5.10' into `android12-5.10-lts`
7dd0d263fe Merge 5.10.92 into android12-5.10-lts
c982c1a839 Linux 5.10.92
c0091233f3 staging: greybus: fix stack size warning with UBSAN
66d21c005d drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
2d4fda471d staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()
3609fed7ac media: Revert "media: uvcvideo: Set unique vdev name based in type"
9b3c761e78 random: fix crash on multiple early calls to add_bootloader_randomness()
61cca7d191 random: fix data race on crng init time
3de9478230 random: fix data race on crng_node_pool
43c494294f can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
45221a57b6 can: isotp: convert struct tpcon::{idx,len} to unsigned int
bd61ae808b can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data
f68e600017 mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
5f76445a31 veth: Do not record rx queue hint in veth_xmit
ddfa53825f mmc: sdhci-pci: Add PCI ID for Intel ADL
2e691f9894 ath11k: Fix buffer overflow when scanning with extraie
a87cecf943 USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
15982330b6 USB: core: Fix bug in resuming hub's handling of wakeup requests
413108ce3b ARM: dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
b6dd070236 Bluetooth: bfusb: fix division by zero in send path
869e1677a0 Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
c20021ce94 Bluetooth: btusb: Add support for Foxconn MT7922A
8349391838 Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
294c0dd80d Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
35ab8c9085 bpf: Fix out of bounds access from invalid *_or_null type verification
c84fbba8a9 workqueue: Fix unbind_workers() VS wq_worker_running() race
c39d68ab38 md: revert io stats accounting
d605f2f30d Merge 5.10.91 into android12-5.10-lts
df395c763b Linux 5.10.91
674071c9eb Input: zinitix - make sure the IRQ is allocated before it gets enabled
ef81f7d406 ARM: dts: gpio-ranges property is now required
f63fa1a0d4 ipv6: raw: check passed optlen before reading
cf07884e6b drm/amd/display: Added power down for DCN10
10b9ccd067 mISDN: change function names to avoid conflicts
dd8a09cfbb atlantic: Fix buff_ring OOB in aq_ring_rx_clean
c2f4bb251e net: udp: fix alignment problem in udp4_seq_show()
f82b48d1d8 ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
8c87a83ef8 scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
b798b677f9 usb: mtu3: fix interval value for intr and isoc
498d77fc5e ipv6: Do cleanup if attribute validation fails in multipath route
72b0d14a0a ipv6: Continue processing multipath route even if gateway attribute is invalid
5a7d650bb1 power: bq25890: Enable continuous conversion for ADC at charging
4f260ea553 phonet: refcount leak in pep_sock_accep
6195293460 rndis_host: support Hytera digital radios
62cbde77d9 power: reset: ltc2952: Fix use of floating point literals
998d157e3b power: supply: core: Break capacity loop
16d8568378 xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
aa606b82cd net: ena: Fix error handling when calculating max IO queues number
e7f5480978 net: ena: Fix undefined state when tx request id is out of bounds
2de3d961f8 sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
4c34d5fd8c batman-adv: mcast: don't send link-local multicast to mcast routers
f403b5f96e lwtunnel: Validate RTA_ENCAP_TYPE attribute length
48d5adb08d ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
173bfa2782 ipv6: Check attribute length for RTA_GATEWAY in multipath route
914420a2a6 ipv4: Check attribute length for RTA_FLOW in multipath route
a8fe915be6 ipv4: Check attribute length for RTA_GATEWAY in multipath route
786a335fef ftrace/samples: Add missing prototypes direct functions
c859c4de0b i40e: Fix incorrect netdev's real number of RX/TX queues
d0ad64438f i40e: Fix for displaying message regarding NVM version
32845aa602 i40e: fix use-after-free in i40e_sync_filters_subtask()
f7edb6b943 sfc: The RX page_ring is optional
2b3f34da0d mac80211: initialize variable have_higher_than_11mbit
16e5cad6ec RDMA/uverbs: Check for null return of kmalloc_array
a7c2cae997 netrom: fix copying in user data in nr_setsockopt
beeb0fdeda RDMA/core: Don't infoleak GRH fields
3ca132e6b0 iavf: Fix limit of total number of queues to active queues of VF
396e301690 i40e: Fix to not show opcode msg on unsuccessful VF MAC change
7f13d14e56 ieee802154: atusb: fix uninit value in atusb_set_extended_addr
7db1e245cb tracing: Tag trace_percpu_buffer as a percpu pointer
760c6a6255 tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
c1e2da4b3f selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv()
384111e123 f2fs: quota: fix potential deadlock
a1bb21475e Merge 5.10.90 into android12-5.10-lts
d3e491a20d Linux 5.10.90
8c15bfb36a bpf: Add kconfig knob for disabling unpriv bpf by default
d8a5b1377b perf script: Fix CPU filtering of a script's switch events
2386e81a1d net: fix use-after-free in tw_timer_handler
34087cf960 Input: spaceball - fix parsing of movement data packets
9f329d0d6c Input: appletouch - initialize work before device registration
2a4f551dec scsi: vmw_pvscsi: Set residual data length conditionally
1cb8444f31 binder: fix async_free_space accounting for empty parcels
a6e26251dd usb: mtu3: set interval of FS intr and isoc endpoint
3b6efe0b7b usb: mtu3: fix list_head check warning
f10b01c48f usb: mtu3: add memory barrier before set GPD's HWO
1c4ace3e6b usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
1933fe8ce7 xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
b8553330a0 drm/amdgpu: add support for IP discovery gc_info table v2
28863ffe21 drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled
a0f3ac399e uapi: fix linux/nfc.h userspace compilation errors
818c9e0a04 nfc: uapi: use kernel size_t to fix user-space builds
8d31cbab4c i2c: validate user data in compat ioctl
51c94d8fbd fsl/fman: Fix missing put_device() call in fman_port_probe
920932b20e net/ncsi: check for error return from call to nla_put_u32
610af55f9f selftests/net: udpgso_bench_tx: fix dst ip argument
78503589b1 net/mlx5e: Fix wrong features assignment in case of error
6114600808 ionic: Initialize the 'lif->dbid_inuse' bitmap
b7c9a1427b igc: Fix TX timestamp support for non-MSI-X platforms
e8a5988a85 net/smc: fix kernel panic caused by race of smc_sock
97c87c1db9 net/smc: don't send CDC/LLC message if link not ready
99f19566b1 net/smc: improved fix wait on already cleared link
e553265ea5 NFC: st21nfca: Fix memory leak in device probe and remove
8d70dc0eec net: lantiq_xrx200: fix statistics of received bytes
7ef89bd1e8 net: ag71xx: Fix a potential double free in error handling paths
40d3618691 net: usb: pegasus: Do not drop long Ethernet frames
a67becdaa8 net/smc: fix using of uninitialized completions
769d14abd3 sctp: use call_rcu to free endpoint
13c1bf43b6 selftests: Calculate udpgso segment count without header adjustment
abe74fb433 udp: using datalen to cap ipv6 udp max gso segments
5e6ad649e9 net/mlx5e: Fix ICOSQ recovery flow for XSK
73665165b6 net/mlx5e: Wrap the tx reporter dump callback to extract the sq
4cd1da02f0 net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
fcb32eb3d0 scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
4833ad4908 selinux: initialize proto variable in selinux_ip_postroute_compat()
ec941a2277 recordmcount.pl: fix typo in s390 mcount regex
a0e82d5ef9 memblock: fix memblock_phys_alloc() section mismatch error
7da855e939 platform/x86: apple-gmux: use resource_size() with res
d01e9ce1af parisc: Clear stale IIR value on instruction access rights trap
0643d9175d tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
e2048a1f91 tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
210c7c6908 Input: i8042 - enable deferred probe quirk for ASUS UM325UA
bb672eff74 Input: i8042 - add deferred probe support
9b28b48fb3 Merge 5.10.89 into android12-5.10-lts
eb967e323f Linux 5.10.89
52ad5da8e3 phonet/pep: refuse to enable an unbound pipe
7dd52af1eb hamradio: improve the incomplete fix to avoid NPD
450121075a hamradio: defer ax25 kfree after unregister_netdev
8e34d07dd4 ax25: NPD bug when detaching AX25 device
50f78486f9 hwmon: (lm90) Do not report 'busy' status bit as alarm
ec1d222d37 hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
441d387366 pinctrl: mediatek: fix global-out-of-bounds issue
9c75a9657b ASoC: rt5682: fix the wrong jack type detected
94caab5af1 ASoC: tas2770: Fix setting of high sample rates
c7282790c7 Input: goodix - add id->model mapping for the "9111" model
3bb3bf50d6 Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
ee6f34215c mm: mempolicy: fix THP allocations escaping mempolicy restrictions
8008fc1d0b KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
d91ed251fd usb: gadget: u_ether: fix race in setting MAC address in setup phase
6697f29bf5 ceph: fix up non-directory creation in SGID directories
fffb6581a2 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
ad338d825e tee: optee: Fix incorrect page free bug
1f20707674 mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
ac61b9c6c0 mac80211: fix locking in ieee80211_start_ap error path
89876d1083 ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
c3253d3a38 mmc: mmci: stm32: clear DLYB_CR after sending tuning command
0d66b39521 mmc: core: Disable card detect during shutdown
c8e366a01c mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
4af7915361 mmc: sdhci-tegra: Fix switch to HS400ES mode
9a7ec79797 gpio: dln2: Fix interrupts when replugging the device
f5b02912e2 pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
28626e76ba KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU
7a37f2e370 platform/x86: intel_pmc_core: fix memleak on registration failure
b57afd1240 x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
c05d8f66ec tee: handle lookup of shm with reference count 0
0ffb9f83e4 parisc: Fix mask used to select futex spinlock
5deeb9ad59 parisc: Correct completer in lws start
8b745616ba ipmi: fix initialization when workqueue allocation fails
1f6ab84746 ipmi: ssif: initialize ssif_info->client early
a5192f3116 ipmi: bail out if init_srcu_struct fails
bc674f1b21 Input: atmel_mxt_ts - fix double free in mxt_read_info_block
30140e252f ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s
2b4c020b70 ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
7470780f3b ALSA: hda/realtek: Add new alc285-hp-amp-init model
4cb7dc2e30 ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
69e492161c ALSA: drivers: opl3: Fix incorrect use of vp->state
a96c08e0b4 ALSA: jack: Check the return value of kstrdup()
51c7b2a7b8 hwmon: (lm90) Drop critical attribute support for MAX6654
2464738d0e hwmon: (lm90) Introduce flag indicating extended temperature support
196df56c3d hwmon: (lm90) Add basic support for TI TMP461
fa2e149260 hwmon: (lm90) Fix usage of CONFIG2 register in detect function
ba696b4708 pinctrl: bcm2835: Change init order for gpio hogs
676c572439 Input: elantech - fix stack out of bound access in elantech_change_report_id()
2792fde84c sfc: falcon: Check null pointer of rx_queue->page_ring
d70b4001ef sfc: Check null pointer of rx_queue->page_ring
75c962f02a net: ks8851: Check for error irq
9db0f8d395 drivers: net: smc911x: Check for error irq
ca2a15053b fjes: Check for error irq
c6d2754006 bonding: fix ad_actor_system option setting to default
6809da5185 ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
61e6b82e7b igb: fix deadlock caused by taking RTNL in RPM resume path
e00eace232 net: skip virtio_net_hdr_set_proto if protocol already set
ed05e4dcfb net: accept UFOv6 packages in virtio_net_hdr_to_skb
56b0bbba78 qlcnic: potential dereference null pointer of rx_queue->page_ring
78e49d77e5 net: marvell: prestera: fix incorrect return of port_find
861b4413e4 ARM: dts: imx6qdl-wandboard: Fix Ethernet support
d79f5e0d45 netfilter: fix regression in looped (broad|multi)cast's MAC handling
579cefef7c RDMA/hns: Replace kfree() with kvfree()
7cf6466e00 IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
cd9c90682b ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent()
580ecf86e7 spi: change clk_disable_unprepare to clk_unprepare
93a957bbf4 arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode
ef2dce4325 HID: potential dereference of null pointer
3110bc5862 HID: holtek: fix mouse probing
0875873b2a ext4: check for inconsistent extents between index and leaf block
76366c024f ext4: check for out-of-order index extents in ext4_valid_extent_entries()
1d4b1c4e8b ext4: prevent partial update of the extent blocks
f69a47fcbb net: usb: lan78xx: add Allied Telesis AT29M2-AF
8c0059a25c arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
b16b124a42 arm64: vdso32: drop -no-integrated-as flag
ba13eb1927 Merge 5.10.88 into android12-5.10-lts
856f88f27b Linux 5.10.88
88f20cccbe xen/netback: don't queue unlimited number of packages
525875c410 xen/netback: fix rx queue stall detection
8fa3a370cc xen/console: harden hvc_xen against event channel storms
d31b337917 xen/netfront: harden netfront against event channel storms
8ac3b6ee7c xen/blkfront: harden blkfront against event channel storms
76ec7fe2d8 Revert "xsk: Do not sleep in poll() when need_wakeup set"
e24fc89830 bus: ti-sysc: Fix variable set but not used warning for reinit_modules
70692b0620 rcu: Mark accesses to rcu_state.n_force_qs
a9078e7914 scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
bdb854f134 scsi: scsi_debug: Fix type in min_t to avoid stack OOB
aa1f912712 scsi: scsi_debug: Don't call kcalloc() if size arg is zero
6859985a2f ovl: fix warning in ovl_create_real()
5fd7d62daa fuse: annotate lock in fuse_reverse_inval_entry()
b99bdf127a media: mxl111sf: change mutex_init() location
0413f7a1a5 xsk: Do not sleep in poll() when need_wakeup set
6b8d8ecdd9 ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
8affa1b68d Input: touchscreen - avoid bitwise vs logical OR warning
aec5897b27 drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
c1d519263d libata: if T_LENGTH is zero, dma direction should be DMA_NONE
a9f2c6af5a timekeeping: Really make sure wall_to_monotonic isn't positive
6471ebcd6f serial: 8250_fintek: Fix garbled text for console
a7c8067453 iocost: Fix divide-by-zero on donation from low hweight cgroup
bcebb8eb19 zonefs: add MODULE_ALIAS_FS
1c414ff63b btrfs: fix double free of anon_dev after failure to create subvolume
005d9292b5 btrfs: fix memory leak in __add_inode_ref()
cd98cb5216 USB: serial: option: add Telit FN990 compositions
5c93584d9a USB: serial: cp210x: fix CP2105 GPIO registration
8f207f1263 usb: xhci: Extend support for runtime power management for AMD's Yellow carp.
e5949933f3 PCI/MSI: Mask MSI-X vectors only on success
f8aa09186c PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
d17c5a3897 usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
2b2edc8fc5 USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
fd623e16b2 tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
9439fabfc3 KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES
5fe305c6d4 Revert "usb: early: convert to readl_poll_timeout_atomic()"
2b54f485f2 USB: gadget: bRequestType is a bitfield, not a enum
151ffac3ac powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
fcf9194d36 bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
6f46c59e60 sit: do not call ipip6_dev_free() from sit_init_net()
6e1011cd18 net: systemport: Add global locking for descriptor lifecycle
d1765f984c net/smc: Prevent smc_release() from long blocking
337bb7bf7c net: Fix double 0x prefix print in SKB dump
734a3f3106 sfc_ef100: potential dereference of null pointer
7da349f07e net/packet: rx_owner_map depends on pg_vec
1a34fb9e2b netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
d3e1f54508 ixgbe: set X550 MDIO speed before talking to PHY
48e01e3881 ixgbe: Document how to enable NBASE-T support
776ed8b366 igc: Fix typo in i225 LTR functions
74a16e062b igbvf: fix double free in `igbvf_probe`
ddac50d04f igb: Fix removal of unicast MAC filters of VFs
12c1938870 soc/tegra: fuse: Fix bitwise vs. logical OR warning
451f1eded7 mptcp: clear 'kern' flag from fallback sockets
222cebd995 drm/amd/pm: fix a potential gpu_metrics_table memory leak
74dc97dfb2 rds: memory leak in __rds_conn_create()
67f4362ae2 flow_offload: return EOPNOTSUPP for the unsupported mpls action type
03fd6ca056 mac80211: fix lookup when adding AddBA extension element
bef59d6a83 mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
96bc86cac0 drm/ast: potential dereference of null pointer
cac0fd4b9b selftest/net/forwarding: declare NETIFS p9 p10
81fbdd4565 net/sched: sch_ets: don't remove idle classes from the round-robin list
be32c8a788 dmaengine: st_fdma: fix MODULE_ALIAS
dfff1d5e85 selftests: Fix IPv6 address bind tests
08896ecfff selftests: Fix raw socket bind tests with VRF
5ba4dfb8b8 selftests: Add duplicate config only for MD5 VRF tests
12512bc8f2 net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
3a4f6dba1e inet_diag: fix kernel-infoleak for UDP sockets
20ad1ef02f sch_cake: do not call cake_destroy() from cake_init()
1208b445a4 s390/kexec_file: fix error handling when applying relocations
c058c544e7 selftests: net: Correct ping6 expected rc from 2 to 1
9983425c20 virtio/vsock: fix the transport to work with VMADDR_CID_ANY
94a01e6fb2 soc: imx: Register SoC device only on i.MX boards
cc426a91d3 clk: Don't parent clks until the parent is fully registered
429bb01e4d ARM: socfpga: dts: fix qspi node compatible
7b4cc168d9 ceph: initialize pathlen variable in reconnect_caps_cb
e0f06c32af ceph: fix duplicate increment of opened_inodes metric
640e28d618 tee: amdtee: fix an IS_ERR() vs NULL bug
eed897a222 mac80211: track only QoS data frames for admission control
24983f7508 arm64: dts: rockchip: fix audio-supply for Rock Pi 4
49bd597719 arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
9fcdbbf396 arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
ba866840b2 arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge
3516bc1492 arm64: dts: imx8mp-evk: Improve the Ethernet PHY description
06294e7e34 arm64: dts: imx8m: correct assigned clocks for FEC
4cc6badff9 audit: improve robustness of the audit queue handling
0e21e6cd5e dm btree remove: fix use after free in rebalance_children()
f5187a9d52 recordmcount.pl: look for jgnop instruction as well as bcrl on s390
51f6302f81 vdpa: check that offsets are within bounds
e3a1ab5aea virtio_ring: Fix querying of maximum DMA mapping size for virtio device
0612679e48 bpf, selftests: Add test case trying to taint map value pointer
279e0bf80d bpf: Make 32->64 bounds propagation slightly more robust
e2aad0b5f2 bpf: Fix signed bounds propagation after mov32
f0f484714f firmware: arm_scpi: Fix string overflow in SCPI genpd driver
7fd214fc7f mac80211: validate extended element ID is present
0bb50470f1 mac80211: send ADDBA requests using the tid/queue of the aggregation session
29bb131dbb mac80211: mark TX-during-stop for TX in in_reconfig
15640e40e3 mac80211: fix regression in SSN handling of addba tx
49b7e49692 KVM: downgrade two BUG_ONs to WARN_ON_ONCE
8d0f56c2ed KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
c4d08791d9 Merge 5.10.87 into android12-5.10-lts
272aedd4a3 Linux 5.10.87
8dd559d53b arm: ioremap: don't abuse pfn_valid() to check if pfn is in RAM
65c578935b arm: extend pfn_valid to take into account freed memory map alignment
6e634c0e71 memblock: ensure there is no overflow in memblock_overlaps_region()
74551f13c6 memblock: align freed memory map on pageblock boundaries with SPARSEMEM
b4b54c7ba1 memblock: free_unused_memmap: use pageblock units instead of MAX_ORDER
b6a1cbd187 perf intel-pt: Fix error timestamp setting on the decoder error path
0612aa02c2 perf intel-pt: Fix missing 'instruction' events with 'q' option
71c795028b perf intel-pt: Fix next 'err' value, walking trace
02681dd178 perf intel-pt: Fix state setting when receiving overflow (OVF) packet
cbed09b44c perf intel-pt: Fix intel_pt_fup_event() assumptions about setting state type
3bb7fd4be8 perf intel-pt: Fix sync state when a PSB (synchronization) packet is found
731ff78841 perf intel-pt: Fix some PGE (packet generation enable/control flow packets) usage
b23f9252a4 perf inject: Fix itrace space allowed for new attributes
7c26da3be1 ethtool: do not perform operations on net devices being unregistered
6992d8c215 hwmon: (dell-smm) Fix warning on /proc/i8k creation error
c31470a30c fuse: make sure reclaim doesn't write the inode
613725436e bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
9099f35126 staging: most: dim2: use device release method
ac76adc87a KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req
6f0d9d3e74 tracing: Fix a kmemleak false positive in tracing_map
f35f7f04aa drm/amd/display: add connector type check for CRC source set
dd3cea3425 drm/amd/display: Fix for the no Audio bug with Tiled Displays
dadce61247 net: netlink: af_netlink: Prevent empty skb by adding a check on len.
bca6af4325 i2c: rk3x: Handle a spurious start completion interrupt flag
d6edec8a7b parisc/agp: Annotate parisc agp init functions with __init
cf520ccffd ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
701a07fd02 ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
6d22a96d12 net/mlx4_en: Update reported link modes for 1/10G
999069d8b0 Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
27f4ce02b3 s390/test_unwind: use raw opcode instead of invalid instruction
9eab949e2b KVM: arm64: Save PSTATE early on exit
990fd815ec drm/msm/dsi: set default num_data_lanes
c602863ad2 nfc: fix segfault in nfc_genl_dump_devices_done
4f0b8b90b8 Merge 5.10.86 into android12-5.10-lts
37050f17f2 Linux 5.10.86
3241449183 netfilter: selftest: conntrack_vrf.sh: fix file permission
afc997898e Merge 5.10.85 into android12-5.10-lts
e4f2aee661 Linux 5.10.85
47301c06f6 Documentation/Kbuild: Remove references to gcc-plugin.sh
af5ba49cf7 MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal
ad13421fd2 doc: gcc-plugins: update gcc-plugins.rst
9fc17c3af5 kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
d428e54774 bpf: Add selftests to cover packet access corner cases
0ec0eda3f3 misc: fastrpc: fix improper packet size calculation
261d45a4c2 irqchip: nvic: Fix offset for Interrupt Priority Offsets
cd946f0ebe irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
e1c6611f82 irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
8f3ed9deaa irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
d530e9943d irqchip/aspeed-scu: Replace update_bits with write_bits.
014c2fa5dc csky: fix typo of fpu config macro
ee86d0bad8 iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
c10c53419d iio: ad7768-1: Call iio_trigger_notify_done() on error
0f86c9e818 iio: adc: axp20x_adc: fix charging current reporting on AXP22x
af7fbb8c0b iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
fff92f3712 iio: at91-sama5d2: Fix incorrect sign extension
a2545b147d iio: dln2: Check return value of devm_iio_trigger_register()
69ae78c1ab iio: dln2-adc: Fix lockdep complaint
416383999c iio: itg3200: Call iio_trigger_notify_done() on error
bc4d8367ed iio: kxsd9: Don't return error code in trigger handler
28ea539a31 iio: ltr501: Don't return error code in trigger handler
db12d95085 iio: mma8452: Fix trigger reference couting
4e78529110 iio: stk3310: Don't return error code in interrupt handler
5c4a0f307f iio: trigger: stm32-timer: fix MODULE_ALIAS
5de9c5b130 iio: trigger: Fix reference counting
cbc04c0c9a iio: gyro: adxrs290: fix data signedness
fee8be5bde xhci: avoid race between disable slot command and host runtime suspend
1b43c9b65f usb: core: config: using bit mask instead of individual bits
74b6a6a239 xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending
ef284f086d usb: core: config: fix validation of wMaxPacketValue entries
e4de8ca013 USB: gadget: zero allocate endpoint 0 buffers
7193ad3e50 USB: gadget: detect too-big endpoint 0 requests
63fc70bffa selftests/fib_tests: Rework fib_rp_filter_test()
126d1897cb net/qla3xxx: fix an error code in ql_adapter_up()
5e663bcd9a net, neigh: clear whole pneigh_entry at alloc time
ae67383208 net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
83b16b9c44 net: altera: set a couple error code in probe()
385ffd31eb net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
47322fddb4 tools build: Remove needless libpython-version feature check that breaks test-all fast path
42bea3a1b7 dt-bindings: net: Reintroduce PHY no lane swap binding
3f57215f74 Documentation/locking/locktypes: Update migrate_disable() bits.
77d255d28b perf tools: Fix SMT detection fast read path
391ca20ea1 Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
e5b7fb2198 i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
347cc9b4d9 mtd: rawnand: fsmc: Fix timing computation
0b2e1fccdf mtd: rawnand: fsmc: Take instruction delay into account
57f290572f i40e: Fix pre-set max number of queues for VF
eb87117c27 i40e: Fix failed opcode appearing if handling messages from VF
82ed3829c9 clk: imx: use module_platform_driver
4d12546cf9 RDMA/hns: Do not destroy QP resources in the hw resetting phase
33f320c35d RDMA/hns: Do not halt commands during reset until later
4458938b29 ASoC: codecs: wcd934x: return correct value from mixer put
1089dac26c ASoC: codecs: wcd934x: handle channel mappping list correctly
83dae68fc0 ASoC: codecs: wsa881x: fix return values from kcontrol put
62e4dc5e13 ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
2f4764fe36 ASoC: rt5682: Fix crash due to out of scope stack vars
bdd8129c66 PM: runtime: Fix pm_runtime_active() kerneldoc comment
661c4412c5 qede: validate non LSO skb length
c4d2d7c935 scsi: scsi_debug: Fix buffer size of REPORT ZONES command
1e434d2687 scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
5dfe611474 block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
5f1f94c26b tracefs: Set all files to the same group ownership as the mount option
2ba0738f71 net: mvpp2: fix XDP rx queues registering
47ffefd88a aio: fix use-after-free due to missing POLLFREE handling
e4d19740bc aio: keep poll requests on waitqueue until completed
fc2f636ffc signalfd: use wake_up_pollfree()
9f3acee7ea binder: use wake_up_pollfree()
8e04c8397b wait: add wake_up_pollfree()
2f8eb4c4c8 libata: add horkage for ASMedia 1092
f76580d82c can: m_can: Disable and ignore ELO interrupt
703dde1120 can: pch_can: pch_can_rx_normal: fix use after free
2737d0bc21 drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
17edb38e76 clk: qcom: regmap-mux: fix parent clock lookup
172a982244 mmc: renesas_sdhi: initialize variable properly when tuning
33204825cc tracefs: Have new files inherit the ownership of their parent
c520943a00 nfsd: Fix nsfd startup race (again)
eeb0711801 nfsd: fix use-after-free due to delegation race
8b4264c27b md: fix update super 1.0 on rdev size change
caf9b352dc btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
41b3cc57d6 btrfs: clear extent buffer uptodate when we fail to write it
75490bcbd0 scsi: qla2xxx: Format log strings only if needed
07977a3f3d ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
ad45babf78 ALSA: pcm: oss: Limit the period size to 16MB
02b2b691b7 ALSA: pcm: oss: Fix negative period/buffer sizes
6760e6ddeb ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
7fe903d354 ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
3063ee5164 ALSA: ctl: Fix copy of updated id with element read/write
c581090228 mm: bdi: initialize bdi_min_ratio when bdi is unregistered
06368922f3 KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall
2a51edaf5c net/sched: fq_pie: prevent dismantle issue
4b7e90672a devlink: fix netns refcount leak in devlink_nl_cmd_reload()
9d683d14f6 IB/hfi1: Correct guard on eager buffer deallocation
2e2edebb5d iavf: Fix reporting when setting descriptor count
aada0b3f33 iavf: restore MSI state on reset
32a329b731 netfilter: conntrack: annotate data-races around ct->timeout
5e39de85b7 udp: using datalen to cap max gso segments
666521b385 seg6: fix the iif in the IPv6 socket control block
484069b5de nfp: Fix memory leak in nfp_cpp_area_cache_add()
b1830ede16 bonding: make tx_rebalance_counter an atomic
a59df4ea71 ice: ignore dropped packets during init
349e83c0cf bpf: Fix the off-by-two error in range markings
f26951db84 bpf, x86: Fix "no previous prototype" warning
74685aaece vrf: don't run conntrack on vrf with !dflt qdisc
d5cf399a6d selftests: netfilter: add a vrf+conntrack testcase
83ea620a1b nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
f3d9114ac9 drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
7508a9aa65 drm/amdgpu: init iommu after amdkfd device init
ac9db04ee3 drm/amdgpu: move iommu_resume before ip init/resume
fe9dca7dda drm/amdgpu: add amdgpu_amdkfd_resume_iommu
5d191b0976 drm/amdkfd: separate kfd_iommu_resume from kfd_resume
46dcf66d6e drm/amd/amdkfd: adjust dummy functions' placement
dded8d76a7 x86/sme: Explicitly map new EFI memmap table as encrypted
923f4dc5df can: sja1000: fix use after free in ems_pcmcia_add_card()
819251da71 can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter
854a2bede1 can: kvaser_usb: get CAN clock frequency from device
2c08271f4e IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
d87c10607b IB/hfi1: Fix early init panic
d60dd3685d IB/hfi1: Insure use of smp_processor_id() is preempt disabled
05eb0e4a12 nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
89f3edc98f HID: check for valid USB device for many HID drivers
889c39113f HID: wacom: fix problems when device is not a valid USB device
6272b17001 HID: bigbenff: prevent null pointer dereference
d877651afd HID: add USB_HID dependancy on some USB HID drivers
a7e9c5ddf5 HID: add USB_HID dependancy to hid-chicony
28989ed4d7 HID: add USB_HID dependancy to hid-prodikeys
6114432960 HID: add hid_is_usb() function to make it simpler for USB detection
2298d5edd8 HID: google: add eel USB id
12362cd3a4 HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
cc97d73215 gcc-plugins: fix gcc 11 indigestion with plugins...
1eee36a552 gcc-plugins: simplify GCC plugin-dev capability test
518c3f98e5 usb: gadget: uvc: fix multiple opens
e2aed161fc ANDROID: GKI: fix up abi breakage in fib_rules.h
1b71a028a2 Merge 5.10.84 into android12-5.10-lts
a0582e24d3 Linux 5.10.84
e6edaf2677 ipmi: msghandler: Make symbol 'remove_work_wq' static
a8d18fb4d1 net/tls: Fix authentication failure in CCM mode
dbe73dace9 parisc: Mark cr16 CPU clocksource unstable on all SMP machines
01300d2150 iwlwifi: mvm: retry init flow if failed
a5d0a72b80 serial: 8250: Fix RTS modem control while in rs485 mode
f9802d7049 serial: 8250_pci: rewrite pericom_do_set_divisor()
50b06889c8 serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
e1722acf4f serial: core: fix transmit-buffer reset and memleak
bda142bbeb serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30
901f7e0aa4 serial: pl011: Add ACPI SBSA UART match id
946ded2287 tty: serial: msm_serial: Deactivate RX DMA for polling support
67d08450a0 x86/64/mm: Map all kernel memory into trampoline_pgd
b3a519b5a5 x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
1ed4a8fd36 x86/tsc: Add a timer to make sure TSC_adjust is always checked
a92f044a9f usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
6d8c191bf4 USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
90c915051c xhci: Fix commad ring abort, write all 64 bits to CRCR register.
1235485c63 vgacon: Propagate console boot parameters before calling `vc_resize'
92b9113c6d parisc: Fix "make install" on newer debian releases
c27a548d3f parisc: Fix KBUILD_IMAGE for self-extracting kernel
92f309c838 x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
4bbbc9c4f3 x86/pv: Switch SWAPGS to ALTERNATIVE
4d42b7bcf0 sched/uclamp: Fix rq->uclamp_max not set on first enqueue
2015ffa3a4 x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
8b9279cad2 x86/entry: Use the correct fence macro after swapgs in kernel CR3
c8e3411918 x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
64ca109bf8 KVM: VMX: Set failure code in prepare_vmcs02()
60ce9a7540 KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
cfebd5a277 atlantic: Remove warn trace message.
95f6fae9a0 atlantic: Fix statistics logic for production hardware
695d9c6bc6 Remove Half duplex mode speed capabilities.
0c67e7b98f atlantic: Add missing DIDs and fix 115c.
ca350298bc atlantic: Fix to display FW bundle version instead of FW mac version.
93a4f3f4fd atlatnic: enable Nbase-t speeds with base-t
44812111a3 atlantic: Increase delay for fw transactions
13f290d5aa drm/msm: Do hw_init() before capturing GPU state
d646856a60 drm/msm/a6xx: Allocate enough space for GMU registers
a792b3d564 net/smc: Keep smc_close_final rc during active close
e226180acc net/rds: correct socket tunable error in rds_tcp_tune()
77731fede2 net/smc: fix wrong list_del in smc_lgr_cleanup_early
9a40a1e0eb ipv4: convert fib_num_tclassid_users to atomic_t
fa973bf5fd net: annotate data-races on txq->xmit_lock_owner
e26dab79e1 dpaa2-eth: destroy workqueue at the end of remove function
dde240695d net: marvell: mvpp2: Fix the computation of shared CPUs
3260b8d120 net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available
acef1c2b15 ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
60f0b9c42c rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
35b40f724c rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
4afb32090a ASoC: tegra: Fix kcontrol put callback in AHUB
fe4eb5297a ASoC: tegra: Fix kcontrol put callback in DSPK
256aa15aac ASoC: tegra: Fix kcontrol put callback in DMIC
1cf1f9a1f3 ASoC: tegra: Fix kcontrol put callback in I2S
0ee53a1d88 ASoC: tegra: Fix kcontrol put callback in ADMAIF
e6fb4c3fd3 ASoC: tegra: Fix wrong value type in DSPK
0265ef0dff ASoC: tegra: Fix wrong value type in DMIC
e66e75fb22 ASoC: tegra: Fix wrong value type in I2S
6b54c0d845 ASoC: tegra: Fix wrong value type in ADMAIF
932b338f4e mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
a0335cda6d selftests: net: Correct case name
f1d43efa59 net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
59d2dc7710 arm64: ftrace: add missing BTIs
ef55f0f8af siphash: use _unaligned version by default
fd52e1f8c0 net: mpls: Fix notifications when deleting a device
15fa12c119 net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
c6f340a331 tcp: fix page frag corruption on page fault
aa6c393a3c natsemi: xtensa: fix section mismatch warnings
289ee320b5 i2c: cbus-gpio: set atomic transfer callback
58d5c53f25 i2c: stm32f7: stop dma transfer in case of NACK
c221244917 i2c: stm32f7: recover the bus on access timeout
8de6ea757c i2c: stm32f7: flush TX FIFO upon transfer errors
1c75779dd9 wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
cb2d7c1992 wireguard: receive: drop handshakes if queue lock is contended
8a29a50dbd wireguard: receive: use ring buffer for incoming handshakes
e3be118327 wireguard: device: reset peer src endpoint when netns exits
f7b6672fab wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
0584bf51c3 wireguard: selftests: actually test for routing loops
3d1dc3c677 wireguard: allowedips: add missing __rcu annotation to satisfy sparse
4caf965f6c wireguard: selftests: increase default dmesg log size
3d73021f8d tracing/histograms: String compares should not care about signed values
d4af6d9749 KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
c71b5f37b5 KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
5f33887a36 KVM: x86: Use a stable condition around all VT-d PI paths
7722e88505 KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
6a44f200f1 KVM: Disallow user memslot with size that exceeds "unsigned long"
775191dd4c drm/amd/display: Allow DSC on supported MST branch devices
209d35ee34 ipv6: fix memory leak in fib6_rule_suppress
16c242b091 sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
4a46b2f5dc sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
4baba6ba56 fget: check that the fd still exists after getting a ref to it
80bfed369b s390/pci: move pseudo-MMIO to prevent MIO overlap
92283c2728 cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
f717f29e84 ipmi: Move remove_work to dedicated workqueue
de4f5eb02c rt2x00: do not mark device gone on EPROTO errors during start
c200721f8e kprobes: Limit max data_size of the kretprobe instances
2a74c13dfe vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
136cabf157 ACPI: Add stubs for wakeup handler functions
cc443ac5bb net/smc: Avoid warning of possible recursive locking
ff061b5bda perf report: Fix memory leaks around perf_tip()
a4c17ebdd6 perf hist: Fix memory leak of a perf_hpp_fmt
d9b72274f3 perf inject: Fix ARM SPE handling
2c15d2a6ba net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
f059fa40f0 net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
4d5968ea06 ipv6: check return value of ipv6_skip_exthdr
22519eff7d ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
9a32d3c08d ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
c746945fb6 drm/amd/amdgpu: fix potential memleak
74aafe99ef drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
f0c9f49b0c scsi: iscsi: Unblock session then wake up error handler
bc8c423a28 thermal: core: Reset previous low and high trip during thermal zone init
8e4d2ac434 btrfs: check-integrity: fix a warning on write caching disabled disk
0395722905 s390/setup: avoid using memblock_enforce_memory_limit
fd1e70ef65 platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
226b21ad01 platform/x86: thinkpad_acpi: Add support for dual fan control
3fc88660ed net: return correct error code
2c514d2500 atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
ff6eeb6278 net/smc: Transfer remaining wait queue entries during fallback
e1a165599a mac80211: do not access the IV when it was stripped
c386d7aa59 drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
57e36973fa powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory"
7b2b7e03e8 gfs2: Fix length of holes reported at end-of-file
664cceab6f gfs2: release iopen glock early in evict
bcce010f92 ovl: fix deadlock in splice write
dca4f9a581 ovl: simplify file splice
7774dd934a can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
60ae63ef19 NFSv42: Fix pagecache invalidation after COPY/CLONE
6e6898e23c ANDROID: GKI: update abi_gki_aarch64.xml due to bpf changes in 5.10.83
cd1062d64e Revert "net: ipv6: add fib6_nh_release_dsts stub"
0bf59ac0b2 Revert "net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group"
65836a68d9 Revert "mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB"
249dae115a Merge 5.10.83 into android-5.10
bc8ae0e2af Merge branch 'android12-5.10' into `android12-5.10-lts`
a324ad7945 Linux 5.10.83
45b42cd053 drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
98b02755d5 net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP
a15261d2a1 shm: extend forced shm destroy to support objects from several IPC nses
aa20e966d8 s390/mm: validate VMA in PGSTE manipulation functions
a94e4a7b77 tty: hvc: replace BUG_ON() with negative return value
1c5f722a8f xen/netfront: don't trust the backend response data blindly
334b0f2787 xen/netfront: disentangle tx_skb_freelist
e17ee047ee xen/netfront: don't read data from request on the ring page
f5e4937098 xen/netfront: read response from backend only once
1ffb20f052 xen/blkfront: don't trust the backend response data blindly
8e147855fc xen/blkfront: don't take local copy of a request from the ring page
273f04d5d1 xen/blkfront: read response from backend only once
b98284aa3f xen: sync include/xen/interface/io/ring.h with Xen's newest version
406f2d5fe3 tracing: Check pid filtering when creating events
4fd0ad08ee vhost/vsock: fix incorrect used length reported to the guest
fbc0514e1a iommu/amd: Clarify AMD IOMMUv2 initialization messages
5655b8bccb smb3: do not error on fsync when readonly
c380062d08 ceph: properly handle statfs on multifs setups
22423c966e f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
e6ee7abd6b sched/scs: Reset task stack state in bringup_cpu()
71e38a0c7c tcp: correctly handle increased zerocopy args struct size
72f2117e45 net: mscc: ocelot: correctly report the timestamping RX filters in ethtool
73115a2b38 net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP
62343dadbb net: hns3: fix VF RSS failed problem after PF enable multi-TCs
215167df45 net/smc: Don't call clcsock shutdown twice when smc shutdown
6e800ee432 net: vlan: fix underflow for the real_dev refcnt
ae2659d2c6 net/sched: sch_ets: don't peek at classes beyond 'nbands'
e3509feb46 tls: fix replacing proto_ops
22156242b1 tls: splice_read: fix record type check
3b6c71c097 MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
a6a5d853f1 MIPS: loongson64: fix FTLB configuration
5e823dbee2 igb: fix netpoll exit with traffic
f2a58ff3e3 nvmet: use IOCB_NOWAIT only if the filesystem supports it
12ceb52f2c net/smc: Fix loop in smc_listen
c94cbd262b net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
3d4937c6a3 net: phylink: Force retrigger in case of latched link-fail indicator
50162ff3c8 net: phylink: Force link down and retrigger resolve on interface change
95ba8f0d57 lan743x: fix deadlock in lan743x_phy_link_status_change()
c5e4316d9c tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows
3187623096 drm/amd/display: Set plane update flags for all planes in reset
f634c755a0 PM: hibernate: use correct mode for swsusp_close()
440bd9faad net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
ac88cb3c44 nvmet-tcp: fix incomplete data digest send
8889ff80fd net: marvell: mvpp2: increase MTU limit when XDP enabled
90d0736876 mlxsw: spectrum: Protect driver from buggy firmware
33d89128a9 mlxsw: Verify the accessed index doesn't exceed the array length
29e1b57347 net/smc: Ensure the active closing peer first closes clcsock
77d9c2efa8 erofs: fix deadlock when shrink erofs slab
9f540c7ffb scsi: scsi_debug: Zero clear zones at reset write pointer
725ba12895 scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
e65a8707b4 ice: avoid bpf_prog refcount underflow
1eb5395add ice: fix vsi->txq_map sizing
26ed13d064 net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
3c40584595 net: ipv6: add fib6_nh_release_dsts stub
dc2f7e9d8d net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
79068e6b1c net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume
cc301ad312 nfp: checking parameter process for rx-usecs/tx-usecs is invalid
9b44cb67d3 ipv6: fix typos in __ip6_finish_output()
6d9e8dabd4 firmware: smccc: Fix check for ARCH_SOC_ID not implemented
bbd1683e79 mptcp: fix delack timer
061542815a ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec
f5af2def7e iavf: Prevent changing static ITR values if adaptive moderation is on
5dca8eff46 net: marvell: prestera: fix double free issue on err path
b33c5c8281 drm/vc4: fix error code in vc4_create_object()
2bf9c5a503 scsi: mpt3sas: Fix kernel panic during drive powercycle test
29ecb4c0f0 drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
0effb7f51b ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
86c5adc780 NFSv42: Don't fail clone() unless the OP_CLONE operation failed
c9ba7864d3 firmware: arm_scmi: pm: Propagate return value to caller
8730a679c3 net: ieee802154: handle iftypes as u32
2925aadd1f ASoC: codecs: wcd934x: return error code correctly from hw_params
3a25def06d ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
4a4f900e04 ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling
9196a68581 ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer
2be17eca48 ARM: dts: bcm2711: Fix PCIe interrupts
9db1d4a3c2 ARM: dts: BCM5301X: Add interrupt properties to GPIO node
b2cd6fdcbe ARM: dts: BCM5301X: Fix I2C controller interrupt
b7ef25e8c2 netfilter: flowtable: fix IPv6 tunnel addr match
d689176e0e netfilter: ipvs: Fix reuse connection if RS weight is 0
994065f6ef netfilter: ctnetlink: do not erase error code with EINVAL
a3d829e5f3 netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
a8a917058f proc/vmcore: fix clearing user buffer by properly using clear_user()
1f520a0d78 PCI: aardvark: Fix link training
aec0751f61 PCI: aardvark: Simplify initialization of rootcap on virtual bridge
df57480988 PCI: aardvark: Implement re-issuing config requests on CRS response
e7f2e2c758 PCI: aardvark: Update comment about disabling link training
2b7bc1c4b2 PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
dfe906da9a powerpc/32: Fix hardlockup on vmap stack overflow
bf00edd9e6 mdio: aspeed: Fix "Link is Down" issue
14c3ce30dd mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
63195705b3 mmc: sdhci-esdhc-imx: disable CMDQ support
092a58f0d9 tracing: Fix pid filtering when triggers are attached
68fa6bf7f1 tracing/uprobe: Fix uprobe_perf_open probes iteration
b777c866aa KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
bfed9c2f2f xen: detect uninitialized xenbus in xenbus_init
e1d492c275 xen: don't continue xenstore initialization in case of errors
8f4d0719f3 fuse: release pipe buf after last use
8d0163cec7 staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
0bfed81b2c staging: greybus: Add missing rwsem around snd_ctl_remove() calls
146283f16b staging/fbtft: Fix backlight
8fc5e3c7ca HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
6ca32e2e77 Revert "parisc: Fix backtrace to always include init funtion names"
3a4aeb37a7 media: cec: copy sequence field for the reply
3798218a1a ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
60274e248e ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
172167bc8d ALSA: ctxfi: Fix out-of-range access
4402cf0402 binder: fix test regression due to sender_euid change
aea184ae64 usb: hub: Fix locking issues with address0_mutex
5bf3a0c778 usb: hub: Fix usb enumeration issue due to address0 race
00f1038c72 usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
56fbab4937 usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
b70ff391de net: nexthop: fix null pointer dereference when IPv6 is not enabled
0755f3f322 usb: dwc3: gadget: Fix null pointer exception
140e2df472 usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
3abf746e80 usb: dwc3: gadget: Ignore NoStream after End Transfer
2b7ab82f51 usb: dwc2: hcd_queue: Fix use of floating point literal
4b18ccad96 usb: dwc2: gadget: Fix ISOC flow for elapsed frames
16f1cac8f7 USB: serial: option: add Fibocom FM101-GL variants
ff72128636 USB: serial: option: add Telit LE910S1 0x9200 composition
854c14b2a1 ACPI: Get acpi_device's parent from the parent field
33fe044f6a bpf: Fix toctou on read-only map's constant scalar tracking
8d21bcc704 Merge 5.10.82 into android12-5.10-lts
d5259a9ba6 Linux 5.10.82
d35250ec5a Revert "perf: Rework perf_event_exit_event()"
6718f79c40 ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign()
f751fb54f2 ALSA: hda: hdac_ext_stream: fix potential locking issues
b3ef5051a7 x86/Kconfig: Fix an unused variable error in dell-smm-hwmon
2ec78af152 btrfs: update device path inode time instead of bd_inode
9febc9d8d2 fs: export an inode_update_time helper
cade5d7a28 ice: Delete always true check of PF pointer
fe65cecd27 usb: max-3421: Use driver data instead of maintaining a list of bound devices
6186c7b9bd ASoC: DAPM: Cover regression by kctl change notification fix
b17dd53cac selinux: fix NULL-pointer dereference when hashtab allocation fails
1ae0d59c4f RDMA/netlink: Add __maybe_unused to static inline in C file
40bc831ab5 hugetlbfs: flush TLBs correctly after huge_pmd_unshare
86ab0f8ff0 scsi: ufs: core: Fix task management completion timeout race
ddd4e46cff scsi: ufs: core: Fix task management completion
04c586a601 drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
47901b77bf drm/i915/dp: Ensure sink rate values are always valid
82de15ca6b drm/nouveau: clean up all clients on device removal
c81c90fbf5 drm/nouveau: use drm_dev_unplug() during device removal
9221aff33e drm/nouveau: Add a dedicated mutex for the clients list
65517975cb drm/udl: fix control-message timeout
3d68d6ee83 drm/amd/display: Update swizzle mode enums
7b97b5776d cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
1ab297809d parisc/sticon: fix reverse colors
6adbc07ebc btrfs: fix memory ordering between normal and ordered work functions
6289b494b3 net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform
5875f87e2f udf: Fix crash after seekdir
6b43cf113a KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load
cc73242889 block: Check ADMIN before NICE for IOPRIO_CLASS_RT
63e2f34abc s390/kexec: fix memory leak of ipl report buffer
b1cf0d2fc4 scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
08fd6df8ea powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX
9c177eee11 x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
b2e2fb6407 mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
99032adf7d ipc: WARN if trying to remove ipc object which is absent
a7d9162586 tipc: check for null after calling kmemdup
f5995fcb75 hexagon: clean up timer-regs.h
0854c9ff21 hexagon: export raw I/O routines for modules
528971af64 tun: fix bonding active backup with arp monitoring
af1d3c437e arm64: vdso32: suppress error message for 'make mrproper'
97653ba562 net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices
4cebe23c03 s390/kexec: fix return code handling
d4fb80ae98 perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
175135a5ea perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
84f64c7c52 pinctrl: qcom: sdm845: Enable dual edge errata
a8230fb74b KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr()
4e6cce20fb e100: fix device suspend/resume
34e54703fb NFC: add NCI_UNREG flag to eliminate the race
b2a60b4a01 net: nfc: nci: Change the NCI close sequence
73a0d12114 NFC: reorder the logic in nfc_{un,}register_device
cb14b196d9 NFC: reorganize the functions in nci_request
41dc8dcb49 i40e: Fix display error code in dmesg
028ea7b090 i40e: Fix creation of first queue by omitting it if is not power of two
69868d7a88 i40e: Fix warning message and call stack during rmmod i40e driver
20645482d1 i40e: Fix ping is lost after configuring ADq on VF
6d64743045 i40e: Fix changing previously set num_queue_pairs for PFs
f866513ead i40e: Fix NULL ptr dereference on VSI filter sync
0719488565 i40e: Fix correct max_pkt_size on VF RX queue
8e6bae950d net: virtio_net_hdr_to_skb: count transport header in UFO
1c4099dc0d net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
381a30f7e3 net: sched: act_mirred: drop dst for the direction from egress to ingress
a792e0128d scsi: core: sysfs: Fix hang when device state is set via sysfs
4b4302a02b net/mlx5: E-Switch, return error if encap isn't supported
68748ea4d1 net/mlx5: E-Switch, Change mode lock from mutex to rw semaphore
6190e1a2d4 net/mlx5: Lag, update tracker when state change event received
471c492890 net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
d1f8f1e04a platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
da16f907cb mips: lantiq: add support for clk_get_parent()
17dfbe1b2f mips: bcm63xx: add support for clk_get_parent()
34284b3a2f MIPS: generic/yamon-dt: fix uninitialized variable error
a61f90b216 iavf: Fix for setting queues to 0
a8a1e601c2 iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
77f5ae5441 iavf: validate pointers
ddcc185baa iavf: prevent accidental free of filter structure
a420b26128 iavf: Fix failure to exit out from last all-multicast mode
78638b4713 iavf: free q_vectors before queues in iavf_disable_vf
84a13bfe27 iavf: check for null in iavf_fix_features
1555d83ddb iavf: Fix return of set the new channel count
09decd0a10 net/smc: Make sure the link_id is unique
437e21e2c9 sock: fix /proc/net/sockstat underflow in sk_clone_lock()
4da14ddad1 net: reduce indentation level in sk_clone_lock()
9c3c2ef6ca tipc: only accept encrypted MSG_CRYPTO msgs
3d59416647 bnxt_en: reject indirect blk offload when hw-tc-offload is off
4fc060abaa net: bnx2x: fix variable dereferenced before check
3ae75cc38a net: ipa: disable HOLB drop when updating timer
3984876f91 tracing: Add length protection to histogram string copies
900ea2f628 tcp: Fix uninitialized access in skb frags array for Rx 0cp.
d1a6150ca6 net-zerocopy: Refactor skb frag fast-forward op.
5f7aadf03f net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy.
8da80ec6d4 drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
aa31e3fda6 perf tests: Remove bash construct from record+zstd_comp_decomp.sh
2ada5c0877 perf bench futex: Fix memory leak of perf_cpu_map__new()
11589d3144 perf bpf: Avoid memory leak from perf_env__insert_btf()
5b2f2cbbc9 tracing/histogram: Do not copy the fixed-size char array field over the field size
1d61255327 blkcg: Remove extra blkcg_bio_issue_init
dadcc935f4 perf/x86/vlbr: Add c->flags to vlbr event constraints
68fcb52b61 sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
91191d47af mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
fbe27d0e1d clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
9b3d3b72be clk/ast2600: Fix soc revision for AHB
03bc8ea0ae clk: ingenic: Fix bugs with divided dividers
7a5439474e f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
0a17fff6f0 f2fs: compress: disallow disabling compress on non-empty compressed file
4ce685cc9a sh: define __BIG_ENDIAN for math-emu
73383f670d sh: math-emu: drop unused functions
f44defd569 sh: fix kconfig unmet dependency warning for FRAME_POINTER
3d7c5d08a4 f2fs: fix to use WHINT_MODE
e8bd5e3305 f2fs: fix up f2fs_lookup tracepoints
5d5bf899e5 maple: fix wrong return value of maple_bus_init().
8748f08a2f sh: check return code of request_irq
29b742690a powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST
bc4bc07fb4 powerpc/dcr: Use cmplwi instead of 3-argument cmpli
1ac6cd87d8 ALSA: gus: fix null pointer dereference on pointer block
850416bead ARM: dts: qcom: fix memory and mdio nodes naming for RB3011
8c4d9764e7 powerpc/5200: dts: fix memory node unit name
833ad27927 iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
e0fef1c8cd scsi: target: Fix alua_tg_pt_gps_count tracking
8176441373 scsi: target: Fix ordered tag handling
8440377e1a scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
3e20cb0726 scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
9635581aa9 MIPS: sni: Fix the build
77e9fed330 tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
da82a207c4 ALSA: ISA: not for M68K
c788ac4750 ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash
cbba09f869 ARM: dts: ls1021a: move thermal-zones node out of soc/
2474eb7fc3 usb: host: ohci-tmio: check return value after calling platform_get_resource()
02d9ebe0cc ARM: dts: omap: fix gpmc,mux-add-data type
c6c9bbe7fa firmware_loader: fix pre-allocated buf built-in firmware use
02a22911ed ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec
055eced3ed scsi: advansys: Fix kernel pointer leak
97f3cbb57b ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
ae2207a078 clk: imx: imx6ul: Move csi_sel mux to correct base register
0c6daf4799 ASoC: SOF: Intel: hda-dai: fix potential locking issue
19d193c576 arm64: dts: freescale: fix arm,sp805 compatible string
36446a094a arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property
e52fecdd0c arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
568d94c5c9 ARM: BCM53016: Specify switch ports for Meraki MR32
3a53d9ad9b staging: rtl8723bs: remove possible deadlock when disconnect (v2)
3544c33879 ARM: dts: ux500: Skomer regulator fixes
eff8b76284 usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
679eee466d usb: musb: tusb6010: check return value after calling platform_get_resource()
2492de6f5e bus: ti-sysc: Use context lost quirk for otg
5eca1c8412 bus: ti-sysc: Add quirk handling for reinit on context lost
dcd6eefcee RDMA/bnxt_re: Check if the vlan is valid before reporting
4e5bc9fb23 arm64: dts: hisilicon: fix arm,sp805 compatible string
109a63bb07 arm64: dts: rockchip: Disable CDN DP on Pinebook Pro
c097bd5a59 scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
db90c50783 ARM: dts: NSP: Fix mpcore, mmc node names
5010df76ab staging: wfx: ensure IRQ is ready before enabling it
2651d06e46 arm64: dts: allwinner: a100: Fix thermal zone node name
fa98ac472e arm64: dts: allwinner: h5: Fix GPU thermal zone node name
aed195558f ARM: dts: sunxi: Fix OPPs node name
e2e1056312 arm64: zynqmp: Fix serial compatible string
48f154e8b9 arm64: zynqmp: Do not duplicate flash partition label property
Some minor ABI signatures have changed due to internal structures
changing. All of these have been pre-approved already:
Leaf changes summary: 3 artifacts changed
Changed leaf types summary: 3 leaf types changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
'struct bpf_map at bpf.h:146:1' changed:
type size hasn't changed
there are data member changes:
type 'typedef u64' of 'bpf_map::writecnt' changed:
typedef name changed from u64 to atomic64_t at types.h:175:1
underlying type 'typedef __u64' at int-ll64.h:31:1 changed:
entity changed from 'typedef __u64' to 'struct {s64 counter;}' at types.h:173:1
type size hasn't changed
4790 impacted interfaces
'struct bpf_offloaded_map at bpf.h:229:1' changed (indirectly):
type size hasn't changed
there are data member changes:
type 'struct bpf_map' of 'bpf_offloaded_map::map' changed, as reported earlier
4790 impacted interfaces
'struct fib_rules_ops at fib_rules.h:60:1' changed:
type size hasn't changed
there are data member changes:
type 'typedef bool (fib_rule*, fib_lookup_arg*)*' of 'fib_rules_ops::suppress' changed:
pointer type changed from: 'typedef bool (fib_rule*, fib_lookup_arg*)*' to: 'typedef bool (fib_rule*, int, fib_lookup_arg*)*'
4790 impacted interfaces
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id7f25c9e0edb30698178b138cc1b15a82ca5ef48
trace_android_vh_binder_proc_transaction_entry:
We need change binder thread so that this work can be added in
proc->todo, if we found the binder thread, skip native logic.
trace_android_vh_binder_select_worklist_ilocked:
we need this because we can't change list point in ”trace_android_vh_binder_thread_read“,
otherwise, If a work has beed added in our own defined list before,
current may goto retry and loop again and again.
Bug: 219898723
Change-Id: Ifdb3429c9ddac521bc75c1d21740ee7cc4b8f143
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
This reverts commit cb7e10d31b.
The hook android_vh_binder_proc_transaction_finish is not used by any
vendor, so remove it to help with merge issues with future LTS releases.
If this is needed by any real user, it can easily be reverted to add it
back and then the symbol should be added to the abi list at the same
time to prevent it from being removed again later.
Bug: 203756332
Bug: 208910215
Cc: Liujie Xie <xieliujie@oppo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I19c6660c138dc88e554e62d309484d75ec24dc6c
We need pointers to proc and t, the current hooks in binder_proc_transaction
are unable to use.
Bug: 208910215
Change-Id: I730964f965a015e5f5a3e237d9b3bd084b5bd0d0
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
Changes in 5.10.94
KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
HID: uhid: Fix worker destroying device without any protection
HID: wacom: Reset expected and received contact counts at the same time
HID: wacom: Ignore the confidence flag when a touch is removed
HID: wacom: Avoid using stale array indicies to read contact count
f2fs: fix to do sanity check in is_alive()
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
mtd: Fixed breaking list in __mtd_del_partition.
mtd: rawnand: davinci: Don't calculate ECC when reading page
mtd: rawnand: davinci: Avoid duplicated page read
mtd: rawnand: davinci: Rewrite function description
x86/gpu: Reserve stolen memory for first integrated Intel GPU
tools/nolibc: x86-64: Fix startup code bug
tools/nolibc: i386: fix initial stack alignment
tools/nolibc: fix incorrect truncation of exit code
rtc: cmos: take rtc_lock while reading from CMOS
media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
media: flexcop-usb: fix control-message timeouts
media: mceusb: fix control-message timeouts
media: em28xx: fix control-message timeouts
media: cpia2: fix control-message timeouts
media: s2255: fix control-message timeouts
media: dib0700: fix undefined behavior in tuner shutdown
media: redrat3: fix control-message timeouts
media: pvrusb2: fix control-message timeouts
media: stk1160: fix control-message timeouts
media: cec-pin: fix interrupt en/disable handling
can: softing_cs: softingcs_probe(): fix memleak on registration failure
iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
gpu: host1x: Add back arm_iommu_detach_device()
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
mm_zone: add function to check if managed dma zone exists
dma/pool: create dma atomic pool only if dma zone has managed pages
mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
drm/ttm: Put BO in its memory manager's lru list
Bluetooth: L2CAP: Fix not initializing sk_peer_pid
drm/bridge: display-connector: fix an uninitialized pointer in probe()
drm: fix null-ptr-deref in drm_dev_init_release()
drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
drm/panel: innolux-p079zca: Delete panel on attach() failure
drm/rockchip: dsi: Fix unbalanced clock on probe error
drm/rockchip: dsi: Hold pm-runtime across bind/unbind
drm/rockchip: dsi: Disable PLL clock on bind error
drm/rockchip: dsi: Reconfigure hardware on resume()
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
clk: bcm-2835: Pick the closest clock rate
clk: bcm-2835: Remove rounding up the dividers
drm/vc4: hdmi: Set a default HSM rate
wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
wcn36xx: Fix DMA channel enable/disable cycle
wcn36xx: Release DMA channel descriptor allocations
wcn36xx: Put DXE block into reset before freeing memory
wcn36xx: populate band before determining rate on RX
wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
media: videobuf2: Fix the size printk format
media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
media: atomisp: fix inverted logic in buffers_needed()
media: atomisp: do not use err var when checking port validity for ISP2400
media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
media: atomisp: fix ifdefs in sh_css.c
media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c
media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
media: atomisp: fix enum formats logic
media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
media: aspeed: fix mode-detect always time out at 2nd run
media: em28xx: fix memory leak in em28xx_init_dev
media: aspeed: Update signal status immediately to ensure sane hw state
arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
fs: dlm: use sk->sk_socket instead of con->sock
fs: dlm: don't call kernel_getpeername() in error_report()
memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
Bluetooth: stop proccessing malicious adv data
ath11k: Fix ETSI regd with weather radar overlap
ath11k: clear the keys properly via DISABLE_KEY
ath11k: reset RSN/WPA present state for open BSS
tee: fix put order in teedev_close_context()
fs: dlm: fix build with CONFIG_IPV6 disabled
drm/vboxvideo: fix a NULL vs IS_ERR() check
arm64: dts: renesas: cat875: Add rx/tx delays
media: dmxdev: fix UAF when dvb_register_device() fails
crypto: qce - fix uaf on qce_ahash_register_one
crypto: qce - fix uaf on qce_skcipher_register_one
mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
crypto: qat - fix spelling mistake: "messge" -> "message"
crypto: qat - remove unnecessary collision prevention step in PFVF
crypto: qat - make pfvf send message direction agnostic
crypto: qat - fix undetected PFVF timeout in ACK loop
ath11k: Use host CE parameters for CE interrupts configuration
arm64: dts: ti: k3-j721e: correct cache-sets info
tty: serial: atmel: Check return code of dmaengine_submit()
tty: serial: atmel: Call dma_async_issue_pending()
mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
mfd: atmel-flexcom: Use .resume_noirq
media: rcar-csi2: Correct the selection of hsfreqrange
media: imx-pxp: Initialize the spinlock prior to using it
media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
media: coda: fix CODA960 JPEG encoder buffer overflow
media: venus: pm_helpers: Control core power domain manually
media: venus: core, venc, vdec: Fix probe dependency error
media: venus: core: Fix a potential NULL pointer dereference in an error handling path
media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
thermal/drivers/imx: Implement runtime PM support
netfilter: bridge: add support for pppoe filtering
arm64: dts: qcom: msm8916: fix MMC controller aliases
cgroup: Trace event cgroup id fields should be u64
ACPI: EC: Rework flushing of EC work while suspended to idle
thermal/drivers/imx8mm: Enable ADC when enabling monitor
drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
arm64: dts: ti: k3-j7200: Fix the L2 cache sets
arm64: dts: ti: k3-j721e: Fix the L2 cache sets
arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
tty: serial: uartlite: allow 64 bit address
serial: amba-pl011: do not request memory region twice
floppy: Fix hang in watchdog when disk is ejected
staging: rtl8192e: return error code from rtllib_softmac_init()
staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
Bluetooth: btmtksdio: fix resume failure
sched/fair: Fix detection of per-CPU kthreads waking a task
sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
bpf: Adjust BTF log size limit.
bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
bpf: Remove config check to enable bpf support for branch records
arm64: lib: Annotate {clear, copy}_page() as position-independent
arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
media: dib8000: Fix a memleak in dib8000_init()
media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
media: si2157: Fix "warm" tuner state detection
wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
sched/rt: Try to restart rt period timer when rt runtime exceeded
drm/msm/dp: displayPort driver need algorithm rational
rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
mwifiex: Fix possible ABBA deadlock
xfrm: fix a small bug in xfrm_sa_len()
x86/uaccess: Move variable into switch case statement
selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST
selftests: harness: avoid false negatives if test has no ASSERTs
crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter
crypto: stm32/cryp - fix CTR counter carry
crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
crypto: stm32/cryp - check early input data
crypto: stm32/cryp - fix double pm exit
crypto: stm32/cryp - fix lrw chaining mode
crypto: stm32/cryp - fix bugs and crash in tests
crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
ath11k: Fix deleting uninitialized kernel timer during fragment cache flush
ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
media: dw2102: Fix use after free
media: msi001: fix possible null-ptr-deref in msi001_probe()
media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
arm64: dts: qcom: c630: Fix soundcard setup
arm64: dts: qcom: ipq6018: Fix gpio-ranges property
drm/msm/dpu: fix safe status debugfs file
drm/bridge: ti-sn65dsi86: Set max register for regmap
drm/tegra: vic: Fix DMA API misuse
media: hantro: Fix probe func error path
xfrm: interface with if_id 0 should return error
xfrm: state and policy should fail if XFRMA_IF_ID 0
ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
usb: ftdi-elan: fix memory leak on device disconnect
arm64: dts: marvell: cn9130: add GPIO and SPI aliases
arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
ARM: dts: armada-38x: Add generic compatible to UART nodes
iwlwifi: mvm: fix 32-bit build in FTM
iwlwifi: mvm: test roc running status bits before removing the sta
mmc: meson-mx-sdhc: add IRQ check
mmc: meson-mx-sdio: add IRQ check
selinux: fix potential memleak in selinux_add_opt()
um: fix ndelay/udelay defines
um: virtio_uml: Fix time-travel external time propagation
Bluetooth: L2CAP: Fix using wrong mode
bpftool: Enable line buffering for stdout
backlight: qcom-wled: Validate enabled string indices in DT
backlight: qcom-wled: Pass number of elements to read to read_u32_array
backlight: qcom-wled: Fix off-by-one maximum with default num_strings
backlight: qcom-wled: Override default length with qcom,enabled-strings
backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion
backlight: qcom-wled: Respect enabled-strings in set_brightness
software node: fix wrong node passed to find nargs_prop
Bluetooth: hci_qca: Stop IBS timer during BT OFF
x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS
hwmon: (mr75203) fix wrong power-up delay value
x86/mce/inject: Avoid out-of-bounds write when setting flags
ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
power: reset: mt6397: Check for null res pointer
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
bpf: Don't promote bogus looking registers after null check.
bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
ppp: ensure minimum packet size in ppp_write()
rocker: fix a sleeping in atomic bug
staging: greybus: audio: Check null pointer
fsl/fman: Check for null pointer after calling devm_ioremap
Bluetooth: hci_bcm: Check for error irq
Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
debugfs: lockdown: Allow reading debugfs files that are not world readable
net/mlx5e: Fix page DMA map/unmap attributes
net/mlx5e: Don't block routes with nexthop objects in SW
Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
net/mlx5: Set command entry semaphore up once got index free
lib/mpi: Add the return value check of kcalloc()
Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
ax25: uninitialized variable in ax25_setsockopt()
netrom: fix api breakage in nr_setsockopt()
regmap: Call regmap_debugfs_exit() prior to _init()
can: mcp251xfd: add missing newline to printed strings
tpm: add request_locality before write TPM_INT_ENABLE
tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
can: softing: softing_startstop(): fix set but not used variable warning
can: xilinx_can: xcan_probe(): check for error irq
pcmcia: fix setting of kthread task states
iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
net: mcs7830: handle usb read errors properly
ext4: avoid trim error on fs with small groups
ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit"
RDMA/hns: Validate the pkey index
scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
clk: imx8mn: Fix imx8mn_clko1_sels
powerpc/prom_init: Fix improper check of prom_getprop()
ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
dt-bindings: thermal: Fix definition of cooling-maps contribution property
powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C
powerpc/perf: MMCR0 control for PMU registers under PMCC=00
powerpc/perf: move perf irq/nmi handling details into traps.c
powerpc/irq: Add helper to set regs->softe
powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC
powerpc/32s: Fix shift-out-of-bounds in KASAN init
clocksource: Reduce clocksource-skew threshold
clocksource: Avoid accidental unstable marking of clocksources
ALSA: oss: fix compile error when OSS_DEBUG is enabled
ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
char/mwave: Adjust io port register size
binder: fix handling of error during copy
openrisc: Add clone3 ABI wrapper
iommu/io-pgtable-arm: Fix table descriptor paddr formatting
scsi: ufs: Fix race conditions related to driver data
RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
powerpc/powermac: Add additional missing lockdep_register_key()
RDMA/core: Let ib_find_gid() continue search even after empty entry
RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
ASoC: rt5663: Handle device_property_read_u32_array error codes
of: unittest: fix warning on PowerPC frame size warning
of: unittest: 64 bit dma address test requires arch support
clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell
mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support
mips: fix Kconfig reference to PHYS_ADDR_T_64BIT
dmaengine: pxa/mmp: stop referencing config->slave_id
iommu/amd: Remove iommu_init_ga()
iommu/amd: Restore GA log/tail pointer on host resume
ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
iommu/iova: Fix race between FQ timeout and teardown
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
ASoC: mediatek: Check for error clk pointer
ASoC: samsung: idma: Check of ioremap return value
misc: lattice-ecp3-config: Fix task hung when firmware load failed
counter: stm32-lptimer-cnt: remove iio counter abi
arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering
arm64: tegra: Remove non existent Tegra194 reset
mips: lantiq: add support for clk_set_parent()
mips: bcm63xx: add support for clk_set_parent()
powerpc/xive: Add missing null check after calling kmalloc
ASoC: fsl_mqs: fix MODULE_ALIAS
RDMA/cxgb4: Set queue pair state when being queried
ASoC: fsl_asrc: refine the check of available clock divider
clk: bm1880: remove kfrees on static allocations
of: base: Fix phandle argument length mismatch error message
ARM: dts: omap3-n900: Fix lp5523 for multi color
Bluetooth: Fix debugfs entry leak in hci_register_dev()
fs: dlm: filter user dlm messages for kernel locks
drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
selftests/bpf: Fix bpf_object leak in skb_ctx selftest
ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR
drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
media: atomisp: fix try_fmt logic
media: atomisp: set per-device's default mode
media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure
ARM: shmobile: rcar-gen2: Add missing of_node_put()
batman-adv: allow netlink usage in unprivileged containers
media: atomisp: handle errors at sh_css_create_isp_params()
ath11k: Fix crash caused by uninitialized TX ring
usb: gadget: f_fs: Use stream_open() for endpoint files
drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
HID: apple: Do not reset quirks when the Fn key is not found
media: b2c2: Add missing check in flexcop_pci_isr:
EDAC/synopsys: Use the quirk for version instead of ddr version
ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
drm/amd/display: check top_pipe_to_program pointer
drm/amdgpu/display: set vblank_disable_immediate for DC
soc: ti: pruss: fix referenced node in error message
mlxsw: pci: Add shutdown method in PCI driver
drm/bridge: megachips: Ensure both bridges are probed before registration
tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
HSI: core: Fix return freed object in hsi_new_client
crypto: jitter - consider 32 LSB for APT
mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
rsi: Fix use-after-free in rsi_rx_done_handler()
rsi: Fix out-of-bounds read in rsi_read_pkt()
ath11k: Avoid NULL ptr access during mgmt tx cleanup
media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions
ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table
ACPI: Change acpi_device_always_present() into acpi_device_override_status()
ACPI / x86: Allow specifying acpi_device_override_status() quirks by path
ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win
arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
usb: uhci: add aspeed ast2600 uhci support
floppy: Add max size check for user space request
x86/mm: Flush global TLB when switching to trampoline page-table
drm: rcar-du: Fix CRTC timings when CMM is used
media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
media: rcar-vin: Update format alignment constraints
media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
media: m920x: don't use stack on USB reads
thunderbolt: Runtime PM activate both ends of the device link
iwlwifi: mvm: synchronize with FW after multicast commands
iwlwifi: mvm: avoid clearing a just saved session protection id
ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
ath10k: Fix tx hanging
net-sysfs: update the queue counts in the unregistration path
net: phy: prefer 1000baseT over 1000baseKX
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
selftests/ftrace: make kprobe profile testcase description unique
ath11k: Avoid false DEADLOCK warning reported by lockdep
x86/mce: Allow instrumentation during task work queueing
x86/mce: Mark mce_panic() noinstr
x86/mce: Mark mce_end() noinstr
x86/mce: Mark mce_read_aux() noinstr
net: bonding: debug: avoid printing debug logs when bond is not notifying peers
bpf: Do not WARN in bpf_warn_invalid_xdp_action()
HID: quirks: Allow inverting the absolute X/Y values
media: igorplugusb: receiver overflow should be reported
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
audit: ensure userspace is penalized the same as the kernel when under pressure
arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
arm64: tegra: Adjust length of CCPLEX cluster MMIO region
PM: runtime: Add safety net to supplier device release
cpufreq: Fix initialization of min and max frequency QoS requests
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
rtw88: 8822c: update rx settings to prevent potential hw deadlock
PM: AVS: qcom-cpr: Use div64_ul instead of do_div
iwlwifi: fix leaks/bad data after failed firmware load
iwlwifi: remove module loading failure message
iwlwifi: mvm: Fix calculation of frame length
iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
um: registers: Rename function names to avoid conflicts and build problems
ath11k: Fix napi related hang
Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
xfrm: rate limit SA mapping change message to user space
drm/etnaviv: consider completed fence seqno in hang check
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
ACPICA: Utilities: Avoid deleting the same object twice in a row
ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
ACPICA: Fix wrong interpretation of PCC address
ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
drm/amdgpu: fixup bad vram size on gmc v8
amdgpu/pm: Make sysfs pm attributes as read-only for VFs
ACPI: battery: Add the ThinkPad "Not Charging" quirk
btrfs: remove BUG_ON() in find_parent_nodes()
btrfs: remove BUG_ON(!eie) in find_parent_nodes
net: mdio: Demote probed message to debug print
mac80211: allow non-standard VHT MCS-10/11
dm btree: add a defensive bounds check to insert_at()
dm space map common: add bounds check to sm_ll_lookup_bitmap()
mlxsw: pci: Avoid flow control for EMAD packets
net: phy: marvell: configure RGMII delays for 88E1118
net: gemini: allow any RGMII interface mode
regulator: qcom_smd: Align probe function with rpmh-regulator
serial: pl010: Drop CR register reset on set_termios
serial: core: Keep mctrl register state and cached copy in sync
random: do not throw away excess input to crng_fast_load
parisc: Avoid calling faulthandler_disabled() twice
x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs
powerpc/6xx: add missing of_node_put
powerpc/powernv: add missing of_node_put
powerpc/cell: add missing of_node_put
powerpc/btext: add missing of_node_put
powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
i2c: i801: Don't silently correct invalid transfer size
powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
i2c: mpc: Correct I2C reset procedure
clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
powerpc/powermac: Add missing lockdep_register_key()
KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots
KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
w1: Misuse of get_user()/put_user() reported by sparse
nvmem: core: set size for sysfs bin file
dm: fix alloc_dax error handling in alloc_dev
scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
ALSA: seq: Set upper limit of processed events
MIPS: Loongson64: Use three arguments for slti
powerpc/40x: Map 32Mbytes of memory at startup
selftests/powerpc/spectre_v2: Return skip code when miss_percent is high
powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic
udf: Fix error handling in udf_new_inode()
MIPS: OCTEON: add put_device() after of_find_device_by_node()
irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
MIPS: Octeon: Fix build errors using clang
scsi: sr: Don't use GFP_DMA
ASoC: mediatek: mt8173: fix device_node leak
ASoC: mediatek: mt8183: fix device_node leak
phy: mediatek: Fix missing check in mtk_mipi_tx_probe
rpmsg: core: Clean up resources on announce_create failure.
crypto: omap-aes - Fix broken pm_runtime_and_get() usage
crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
tpm: fix NPE on probe for missing device
spi: uniphier: Fix a bug that doesn't point to private data correctly
xen/gntdev: fix unmap notification order
fuse: Pass correct lend value to filemap_write_and_wait_range()
serial: Fix incorrect rs485 polarity on uart open
cputime, cpuacct: Include guest time in user time in cpuacct.stat
tracing/kprobes: 'nmissed' not showed correctly for kretprobe
iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
s390/mm: fix 2KB pgtable release race
device property: Fix fwnode_graph_devcon_match() fwnode leak
drm/etnaviv: limit submit sizes
drm/nouveau/kms/nv04: use vzalloc for nv04_display
drm/bridge: analogix_dp: Make PSR-exit block less
parisc: Fix lpa and lpa_user defines
powerpc/64s/radix: Fix huge vmap false positive
PCI: xgene: Fix IB window setup
PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only
PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
PCI: pci-bridge-emul: Fix definitions of reserved bits
PCI: pci-bridge-emul: Correctly set PCIe capabilities
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
xfrm: fix policy lookup for ipv6 gre packets
btrfs: fix deadlock between quota enable and other quota operations
btrfs: check the root node for uptodate before returning it
btrfs: respect the max size in the header when activating swap file
ext4: make sure to reset inode lockdep class when quota enabling fails
ext4: make sure quota gets properly shutdown on error
ext4: fix a possible ABBA deadlock due to busy PA
ext4: initialize err_blk before calling __ext4_get_inode_loc
ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
ext4: set csum seed in tmp inode while migrating to extents
ext4: Fix BUG_ON in ext4_bread when write quota data
ext4: use ext4_ext_remove_space() for fast commit replay delete range
ext4: fast commit may miss tracking unwritten range during ftruncate
ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
ext4: don't use the orphan list when migrating an inode
drm/radeon: fix error handling in radeon_driver_open_kms
of: base: Improve argument length mismatch error
firmware: Update Kconfig help text for Google firmware
can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message
media: rcar-csi2: Optimize the selection PHTW register
drm/vc4: hdmi: Make sure the device is powered with CEC
media: correct MEDIA_TEST_SUPPORT help text
Documentation: dmaengine: Correctly describe dmatest with channel unset
Documentation: ACPI: Fix data node reference documentation
Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
Documentation: fix firewire.rst ABI file path error
Bluetooth: hci_sync: Fix not setting adv set duration
scsi: core: Show SCMD_LAST in text form
dmaengine: uniphier-xdmac: Fix type of address variables
RDMA/hns: Modify the mapping attribute of doorbell to device
RDMA/rxe: Fix a typo in opcode name
dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
powerpc/cell: Fix clang -Wimplicit-fallthrough warning
powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
block: Fix fsync always failed if once failed
bpftool: Remove inclusion of utilities.mak from Makefiles
xdp: check prog type before updating BPF link
perf evsel: Override attr->sample_period for non-libpfm4 events
ipv4: update fib_info_cnt under spinlock protection
ipv4: avoid quadratic behavior in netns dismantle
net/fsl: xgmac_mdio: Add workaround for erratum A-009885
net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
f2fs: compress: fix potential deadlock of compress file
f2fs: fix to reserve space for IO align feature
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
clk: Emit a stern warning with writable debugfs enabled
clk: si5341: Fix clock HW provider cleanup
net/smc: Fix hung_task when removing SMC-R devices
net: axienet: increase reset timeout
net: axienet: Wait for PhyRstCmplt after core reset
net: axienet: reset core on initialization prior to MDIO access
net: axienet: add missing memory barriers
net: axienet: limit minimum TX ring size
net: axienet: Fix TX ring slot available check
net: axienet: fix number of TX ring slots for available check
net: axienet: fix for TX busy handling
net: axienet: increase default TX ring size to 128
HID: vivaldi: fix handling devices not using numbered reports
rtc: pxa: fix null pointer dereference
vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
virtio_ring: mark ring unused on error
taskstats: Cleanup the use of task->exit_code
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
netns: add schedule point in ops_exit_list()
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
perf script: Fix hex dump character output
dmaengine: at_xdmac: Don't start transactions at tx_submit level
dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
dmaengine: at_xdmac: Print debug message after realeasing the lock
dmaengine: at_xdmac: Fix concurrency over xfers_list
dmaengine: at_xdmac: Fix lld view setting
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
perf probe: Fix ppc64 'perf probe add events failed' case
devlink: Remove misleading internal_flags from health reporter dump
arm64: dts: qcom: msm8996: drop not documented adreno properties
net: bonding: fix bond_xmit_broadcast return value error bug
net_sched: restore "mpu xxx" handling
bcmgenet: add WOL IRQ check
net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
net: sfp: fix high power modules without diagnostic monitoring
net: mscc: ocelot: fix using match before it is set
dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
scripts/dtc: dtx_diff: remove broken example from help text
lib82596: Fix IRQ check in sni_82596_probe
mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
mtd: nand: bbt: Fix corner case in bad block table handling
ath10k: Fix the MTU size on QCA9377 SDIO
scripts: sphinx-pre-install: add required ctex dependency
scripts: sphinx-pre-install: Fix ctex support on Debian
Linux 5.10.94
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I857f2417c899508815a1ba13d1285fd400a1f133
[ Upstream commit fe6b1869243f23a485a106c214bcfdc7aa0ed593 ]
If a memory copy function fails to copy the whole buffer,
a positive integar with the remaining bytes is returned.
In binder_translate_fd_array() this can result in an fd being
skipped due to the failed copy, but the loop continues
processing fds since the early return condition expects a
negative integer on error.
Fix by returning "ret > 0 ? -EINVAL : ret" to handle this case.
Fixes: bb4a2e48d5 ("binder: return errors from buffer copy functions")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-2-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
We want to add some hooks in the binder module so that we can reduce
block time until binder thread is available
Here are what new hooks do for:
1、android_vh_binder_looper_state_registered: choose a binder thread(do proc work) as a low-level thread.Only this thread has power to excute background binder transaction.
2、android_vh_binder_thread_read: let binder thread do works which come from
our list.
3、android_vh_binder_free_proc: free some pointers and variable.
4、android_vh_binder_thread_release: free the list that we create before.
5、android_vh_binder_has_work_ilocked: to check if our list has work.
6、android_vh_binder_read_done: because of we add hook in binder_has_work_ilocked,
binder_has_work_ilocked may return true, so we try to wake up low-level thread immediately.
Bug: 212483521
Change-Id: Ic40f452cc4dcf8fc85422e23e6f1a7ad77547309
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
Changes in 5.10.85
usb: gadget: uvc: fix multiple opens
gcc-plugins: simplify GCC plugin-dev capability test
gcc-plugins: fix gcc 11 indigestion with plugins...
HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
HID: google: add eel USB id
HID: add hid_is_usb() function to make it simpler for USB detection
HID: add USB_HID dependancy to hid-prodikeys
HID: add USB_HID dependancy to hid-chicony
HID: add USB_HID dependancy on some USB HID drivers
HID: bigbenff: prevent null pointer dereference
HID: wacom: fix problems when device is not a valid USB device
HID: check for valid USB device for many HID drivers
nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
IB/hfi1: Insure use of smp_processor_id() is preempt disabled
IB/hfi1: Fix early init panic
IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
can: kvaser_usb: get CAN clock frequency from device
can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter
can: sja1000: fix use after free in ems_pcmcia_add_card()
x86/sme: Explicitly map new EFI memmap table as encrypted
drm/amd/amdkfd: adjust dummy functions' placement
drm/amdkfd: separate kfd_iommu_resume from kfd_resume
drm/amdgpu: add amdgpu_amdkfd_resume_iommu
drm/amdgpu: move iommu_resume before ip init/resume
drm/amdgpu: init iommu after amdkfd device init
drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
selftests: netfilter: add a vrf+conntrack testcase
vrf: don't run conntrack on vrf with !dflt qdisc
bpf, x86: Fix "no previous prototype" warning
bpf: Fix the off-by-two error in range markings
ice: ignore dropped packets during init
bonding: make tx_rebalance_counter an atomic
nfp: Fix memory leak in nfp_cpp_area_cache_add()
seg6: fix the iif in the IPv6 socket control block
udp: using datalen to cap max gso segments
netfilter: conntrack: annotate data-races around ct->timeout
iavf: restore MSI state on reset
iavf: Fix reporting when setting descriptor count
IB/hfi1: Correct guard on eager buffer deallocation
devlink: fix netns refcount leak in devlink_nl_cmd_reload()
net/sched: fq_pie: prevent dismantle issue
KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall
mm: bdi: initialize bdi_min_ratio when bdi is unregistered
ALSA: ctl: Fix copy of updated id with element read/write
ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
ALSA: pcm: oss: Fix negative period/buffer sizes
ALSA: pcm: oss: Limit the period size to 16MB
ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
scsi: qla2xxx: Format log strings only if needed
btrfs: clear extent buffer uptodate when we fail to write it
btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
md: fix update super 1.0 on rdev size change
nfsd: fix use-after-free due to delegation race
nfsd: Fix nsfd startup race (again)
tracefs: Have new files inherit the ownership of their parent
mmc: renesas_sdhi: initialize variable properly when tuning
clk: qcom: regmap-mux: fix parent clock lookup
drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
can: pch_can: pch_can_rx_normal: fix use after free
can: m_can: Disable and ignore ELO interrupt
libata: add horkage for ASMedia 1092
wait: add wake_up_pollfree()
binder: use wake_up_pollfree()
signalfd: use wake_up_pollfree()
aio: keep poll requests on waitqueue until completed
aio: fix use-after-free due to missing POLLFREE handling
net: mvpp2: fix XDP rx queues registering
tracefs: Set all files to the same group ownership as the mount option
block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
scsi: scsi_debug: Fix buffer size of REPORT ZONES command
qede: validate non LSO skb length
PM: runtime: Fix pm_runtime_active() kerneldoc comment
ASoC: rt5682: Fix crash due to out of scope stack vars
ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
ASoC: codecs: wsa881x: fix return values from kcontrol put
ASoC: codecs: wcd934x: handle channel mappping list correctly
ASoC: codecs: wcd934x: return correct value from mixer put
RDMA/hns: Do not halt commands during reset until later
RDMA/hns: Do not destroy QP resources in the hw resetting phase
clk: imx: use module_platform_driver
i40e: Fix failed opcode appearing if handling messages from VF
i40e: Fix pre-set max number of queues for VF
mtd: rawnand: fsmc: Take instruction delay into account
mtd: rawnand: fsmc: Fix timing computation
i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
perf tools: Fix SMT detection fast read path
Documentation/locking/locktypes: Update migrate_disable() bits.
dt-bindings: net: Reintroduce PHY no lane swap binding
tools build: Remove needless libpython-version feature check that breaks test-all fast path
net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
net: altera: set a couple error code in probe()
net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
net, neigh: clear whole pneigh_entry at alloc time
net/qla3xxx: fix an error code in ql_adapter_up()
selftests/fib_tests: Rework fib_rp_filter_test()
USB: gadget: detect too-big endpoint 0 requests
USB: gadget: zero allocate endpoint 0 buffers
usb: core: config: fix validation of wMaxPacketValue entries
xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending
usb: core: config: using bit mask instead of individual bits
xhci: avoid race between disable slot command and host runtime suspend
iio: gyro: adxrs290: fix data signedness
iio: trigger: Fix reference counting
iio: trigger: stm32-timer: fix MODULE_ALIAS
iio: stk3310: Don't return error code in interrupt handler
iio: mma8452: Fix trigger reference couting
iio: ltr501: Don't return error code in trigger handler
iio: kxsd9: Don't return error code in trigger handler
iio: itg3200: Call iio_trigger_notify_done() on error
iio: dln2-adc: Fix lockdep complaint
iio: dln2: Check return value of devm_iio_trigger_register()
iio: at91-sama5d2: Fix incorrect sign extension
iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
iio: adc: axp20x_adc: fix charging current reporting on AXP22x
iio: ad7768-1: Call iio_trigger_notify_done() on error
iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
csky: fix typo of fpu config macro
irqchip/aspeed-scu: Replace update_bits with write_bits.
irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
irqchip: nvic: Fix offset for Interrupt Priority Offsets
misc: fastrpc: fix improper packet size calculation
bpf: Add selftests to cover packet access corner cases
kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
doc: gcc-plugins: update gcc-plugins.rst
MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal
Documentation/Kbuild: Remove references to gcc-plugin.sh
Linux 5.10.85
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I351da1b00f30a370b021125180a48b1c1ecb97ce
commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream.
wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up
all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll
and aio poll are fortunately not affected by this, but it's very
fragile. Thus, the new function wake_up_pollfree() has been introduced.
Convert binder to use wake_up_pollfree().
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 185125206
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8354c40ed73a7d88132a74a388704f0eb307a618
Greg Kroah-Hartman