PD#SWPL-94239
Problem:
dump register and pfn
Solution:
dump register and pfn
Verify:
on PXP
Signed-off-by: Lei Zhang <lei.zhang@amlogic.com>
Change-Id: I9acbabb63e4647b8619c29f822d54ade9abcb1ba
PD#SWPL-178341
Problem:
5.15 accommodate common drivers dir moved out from 6.6
make config setting for extra drivers
Solution:
add config setting
Verify:
local
Change-Id: I64e3bfa9100d642e10472f4159c2a0556efad9af
Signed-off-by: Dezhen Wang <dezhen.wang@amlogic.com>
PD#SWPL-112151
Problem:
support use bazel tool to build
Solution:
support use bazel tool to build
Verify:
sc2
Change-Id: I96e80b97ed481f32239955748ffa52e7d40a85aa
Signed-off-by: Wanwei Jiang <wanwei.jiang@amlogic.com>
PD#SWPL-109858
Problem:
Initialize the building framework of androidu-5.15 for amlogic
Solution:
Initialize the building framework of androidu-5.15 for amlogic
Verify:
sc2
Change-Id: Icfbc29709af1545b802ed7794808a2ab560ed08a
Signed-off-by: Wanwei Jiang <wanwei.jiang@amlogic.com>
GCC builds of fips140.ko all fail with these errors. This causes
allmodconfig builds to fail in kernelci.
aarch64-linux-gnu-objcopy: crypto/fips140.ko:
can't dump section '.rela.rodata'
- it does not exist: file format not recognized
Since the Android use-cases for fips140 are clang only, suppress
fips140.ko builds for GCC
Bug: 350087876
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I742d19bc5172d43a19acd48a248bc2a194f67ca2
Apparently despite it being marked inline, the compiler
may not inline __down_write_common() which makes it difficult
to identify the cause of lock contention, as the wchan of the
blocked function will always be listed as __down_write_common().
So add __always_inline annotation to the common function (as
well as the inlined helper callers) to force it to be inlined
so a more useful blocking function will be listed (via wchan).
This mirrors commit 92cc5d00a4 ("locking/rwsem: Add
__always_inline annotation to __down_read_common() and inlined
callers") which did the same for __down_read_common.
I sort of worry that I'm playing wack-a-mole here, and talking
with compiler people, they tell me inline means nothing, which
makes me want to cry a little. So I'm wondering if we need to
replace all the inlines with __always_inline, or remove them
because either we mean something by it, or not.
Cc: Tim Murray <timmurray@google.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Will Deacon <will@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: kernel-team@android.com
Fixes: c995e638cc ("locking/rwsem: Fold __down_{read,write}*()")
Reported-by: Tim Murray <timmurray@google.com>
Acked-by: Waiman Long <longman@redhat.com>
Change-Id: I72b273149577b8125ea3a5053befbd5cf66bf8ad
Signed-off-by: John Stultz <jstultz@google.com>
Link: https://lore.kernel.org/lkml/20240620174204.1802235-1-jstultz@google.com/
Bug: 332722989
---
v2:
* Add ack tags & minor tweaks to commit message
gcc segfaults when compiling fips140-module.c because it doesn't like
__attribute__((__no_sanitize__("cfi"))) on fips140_init(). This
attribute is needed for clang. However this attribute is already
included in __init when the compiler is clang. Therefore, remove this
redundant attribute. (Later kernel branches have also switched to kcfi,
which doesn't need to be disabled here anyway.)
For futureproofing also use initcall_t from <linux/init.h>.
Bug: 349612732
Change-Id: Ic5cfaef177b58abf21f1737579d75b4df4d0d09c
Signed-off-by: Eric Biggers <ebiggers@google.com>
wlan vendor propose a feature to check the refcnt of netdev when
interface register/unregister. Add `netdev_refcnt_read` into symbol
list.
Adding the following symbols:
- netdev_refcnt_read
Bug: 340118509
Change-Id: I6a2ad4bbfa13d01011729b764dfe92f4945a829e
Signed-off-by: Hsiu-Chang Chen <hsiuchangchen@google.com>
Allow drivers to register mm_page_free hooks when free pages.
This helps to get page info when free pages exit.
Bug: 348514795
Change-Id: I1f2e1844aa24836367da65e8bfe11f79e22713d4
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
Add hooks for support lookaround in migrate_page.
When migrating pages, we need hook functions to
get the page information.
- android_vh_look_around_migrate_page
Bug: 348532035
Change-Id: I7a48d7b1c7a0f42ea39e8ec4c6bb0ae1eeb44443
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
[ Upstream commit 22dd70eb2c3d754862964377a75abafd3167346b ]
Currently, we can read OOB data without MSG_OOB by using MSG_PEEK
when OOB data is sitting on the front row, which is apparently
wrong.
>>> from socket import *
>>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
>>> c1.send(b'a', MSG_OOB)
1
>>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
b'a'
If manage_oob() is called when no data has been copied, we only
check if the socket enables SO_OOBINLINE or MSG_PEEK is not used.
Otherwise, the skb is returned as is.
However, here we should return NULL if MSG_PEEK is set and no data
has been copied.
Also, in such a case, we should not jump to the redo label because
we will be caught in the loop and hog the CPU until normal data
comes in.
Then, we need to handle skb == NULL case with the if-clause below
the manage_oob() block.
With this patch:
>>> from socket import *
>>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
>>> c1.send(b'a', MSG_OOB)
1
>>> c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
BlockingIOError: [Errno 11] Resource temporarily unavailable
Bug: 342490466
Fixes: 314001f0bf ("af_unix: Add OOB support")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240410171016.7621-3-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 022d81a709)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4728977f8f908c19dfa5c861c7381a50499b7fe0
[ Upstream commit b46f4eaa4f0ec38909fb0072eea3aeddb32f954e ]
syzkaller started to report deadlock of unix_gc_lock after commit
4090fa373f0e ("af_unix: Replace garbage collection algorithm."), but
it just uncovers the bug that has been there since commit 314001f0bf
("af_unix: Add OOB support").
The repro basically does the following.
from socket import *
from array import array
c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)
c1.sendmsg([b'a'], [(SOL_SOCKET, SCM_RIGHTS, array("i", [c2.fileno()]))], MSG_OOB)
c2.recv(1) # blocked as no normal data in recv queue
c2.close() # done async and unblock recv()
c1.close() # done async and trigger GC
A socket sends its file descriptor to itself as OOB data and tries to
receive normal data, but finally recv() fails due to async close().
The problem here is wrong handling of OOB skb in manage_oob(). When
recvmsg() is called without MSG_OOB, manage_oob() is called to check
if the peeked skb is OOB skb. In such a case, manage_oob() pops it
out of the receive queue but does not clear unix_sock(sk)->oob_skb.
This is wrong in terms of uAPI.
Let's say we send "hello" with MSG_OOB, and "world" without MSG_OOB.
The 'o' is handled as OOB data. When recv() is called twice without
MSG_OOB, the OOB data should be lost.
>>> from socket import *
>>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM, 0)
>>> c1.send(b'hello', MSG_OOB) # 'o' is OOB data
5
>>> c1.send(b'world')
5
>>> c2.recv(5) # OOB data is not received
b'hell'
>>> c2.recv(5) # OOB date is skipped
b'world'
>>> c2.recv(5, MSG_OOB) # This should return an error
b'o'
In the same situation, TCP actually returns -EINVAL for the last
recv().
Also, if we do not clear unix_sk(sk)->oob_skb, unix_poll() always set
EPOLLPRI even though the data has passed through by previous recv().
To avoid these issues, we must clear unix_sk(sk)->oob_skb when dequeuing
it from recv queue.
The reason why the old GC did not trigger the deadlock is because the
old GC relied on the receive queue to detect the loop.
When it is triggered, the socket with OOB data is marked as GC candidate
because file refcount == inflight count (1). However, after traversing
all inflight sockets, the socket still has a positive inflight count (1),
thus the socket is excluded from candidates. Then, the old GC lose the
chance to garbage-collect the socket.
With the old GC, the repro continues to create true garbage that will
never be freed nor detected by kmemleak as it's linked to the global
inflight list. That's why we couldn't even notice the issue.
Bug: 342490466
Fixes: 314001f0bf ("af_unix: Add OOB support")
Reported-by: syzbot+7f7f201cc2668a8fd169@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7f7f201cc2668a8fd169
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240405221057.2406-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 601a89ea24)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ib4a11eed6b5710d9934d4f31cd29dfd4c7b3658f
The correct fragment is the one in build/kernel,
enabled by --page_size or kernel_build.page_size.
This fragment:
- Does not correctly enable incremental FS
- Does not correctly clear LOCALVERSION that
has 4k for the 4k build.
Bug: 347036722
Bug: 340631213
Bug: 338659380
Change-Id: I31cb004ca639d8ec3dd6201112391c7214971eba
Signed-off-by: Yifan Hong <elsk@google.com>
Depending on the platform binary being executed, the linker
(interpreter) requested can be one of:
1) /system/bin/bootstrap/linker64
2) /system/bin/linker64
3) /apex/com.android.runtime/bin/linker64
Relax the check to the basename (linker64), instead of the path.
Bug: 330767927
Bug: 335584973
Change-Id: I4a1f95b7cecd126f85ad8cefd9ff10d272947f9e
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
This introduces a new environment variable, KCPPFLAGS_COMPAT.
One use-case is to ensure -ffile-prefix-map is passed to the arm32
compiler to normalise compilation directory and make the ELF build ID
reproducible.
Bug: 345452375
Change-Id: I6ae1df58172f4dadeac1dbbee2e3241b704a9256
Signed-off-by: Giuliano Procida <gprocida@google.com>
Pixel MM Metrics:
add the missing symbol 'seq_put_decimal_ll' and re-do update list
Bug: 299190787
Test: local build
Change-Id: I005ccfa15cee8252bc51242460bbab9b7d0eb2ab
Signed-off-by: Robin Hsu <robinhsu@google.com>
For GKI targets with kmi_symbol_list set,
also set rewrite_absolute_paths_in_config to True
so that CONFIG_UNUSED_KSYMS_WHITELIST is not an
absolute path any more, increasing reproducibility
on different machines.
This is made possible with d94e16579b
"Revert^2 "BACKPORT: FROMGIT: module: allow UNUSED_KSYMS_WHITELIST to be relative against objtree.""
so that Kbuild recognizes relative paths by searching
$(objtree) first.
This does not change x86 builds because it
doesn't have kmi_symbol_list set.
This change does not affect device builds like
db845c, rockpi and fips140. Adding the attribute
to these targets would be okay, but it is not
covered by this change.
Bug: 333769605
Bug: 342390208
Change-Id: I844c251979bae5277474837eaa055f1346b0afa2
Signed-off-by: Yifan Hong <elsk@google.com>
udc device and gadget device are tightly coupled, yet there's no good
way to corelate the two. Add a sysfs link in udc that points to the
corresponding gadget device.
An example use case: userspace configures a f_midi configfs driver and
bind the udc device, then it tries to locate the corresponding midi
device, which is a child device of the gadget device. The gadget device
that's associated to the udc device has to be identified in order to
index the midi device. Having a sysfs link would make things much
easier.
Signed-off-by: Roy Luo <royluo@google.com>
Link: https://lore.kernel.org/r/20240307030922.3573161-1-royluo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 333778731
Change-Id: I9e3f782543eba5e026a65031aaae754daafb69ab
(cherry picked from commit 0ef40f399aa2be8c04aee9b7430705612c104ce5)
[royluo: Resolved conflict in drivers/usb/gadget/udc/core.c ]
Signed-off-by: Roy Luo <royluo@google.com>
In commit 92f1655aa2b2 ("net: fix __dst_negative_advice() race") the
struct dst_ops callback negative_advice is callback changes function
parameters. But as this pointer is part of a structure that is tracked
in the ABI checker, the tool triggers when this is changed.
However, the callback pointer is internal to the networking stack, so
changing the function type is safe, so needing to preserve this is not
required. To do so, switch the function pointer type back to the old
one so that the checking tools pass, AND then do a hard cast of the
function pointer to the new type when assigning and calling the
function.
Bug: 343727534
Fixes: 92f1655aa2b2 ("net: fix __dst_negative_advice() race")
Change-Id: I48d4ab4bbd29f8edc8fbd7923828b7f78a23e12e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).
Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.
Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.
Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
Bug: 343727534
Fixes: a87cb3e48e ("net: Facility to report route quality of connected sockets")
Reported-by: Clement Lecigne <clecigne@google.com>
Diagnosed-by: Clement Lecigne <clecigne@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e)
[Lee: Trivial/unrelated conflict - no change to the patch]
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I293734dca1b81fcb712e1de294f51e96a405f7e4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit b7d4cf60e7.
Reason for revert: relanding change that should be safe to go in on its own. Below is the original commit message.
BACKPORT: FROMGIT: module: allow UNUSED_KSYMS_WHITELIST to be relative against objtree.
If UNUSED_KSYMS_WHITELIST is a file generated
before Kbuild runs, and the source tree is in
a read-only filesystem, the developer must put
the file somewhere and specify an absolute
path to UNUSED_KSYMS_WHITELIST. This worked,
but if IKCONFIG=y, an absolute path is embedded
into .config and eventually into vmlinux, causing
the build to be less reproducible when building
on a different machine.
This patch makes the handling of
UNUSED_KSYMS_WHITELIST to be similar to
MODULE_SIG_KEY.
First, check if UNUSED_KSYMS_WHITELIST is an
absolute path, just as before this patch. If so,
use the path as is.
If it is a relative path, use wildcard to check
the existence of the file below objtree first.
If it does not exist, fall back to the original
behavior of adding $(srctree)/ before the value.
After this patch, the developer can put the generated
file in objtree, then use a relative path against
objtree in .config, eradicating any absolute paths
that may be evaluated differently on different machines.
Signed-off-by: Yifan Hong <elsk@google.com>
Reviewed-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
(cherry picked from commit a2e3c811938b4902725e259c03b2d6c539613992
https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git modules-next)
Bug: 333769605
Change-Id: Ibf3f09dc8559e92023811abaabb33fd6b4ed8fa5
[elsk: apply change to gen_autoksyms.sh instead because
CONFIG_UNUSED_KSYMS_WHITELIST is parsed there. Revert change
to Makefile.modpost.]
Bug: 342390208
Signed-off-by: Yifan Hong <elsk@google.com>
[ Upstream commit 076361362122a6d8a4c45f172ced5576b2d4a50d ]
The struct adjtimex freq field takes a signed value who's units are in
shifted (<<16) parts-per-million.
Unfortunately for negative adjustments, the straightforward use of:
freq = ppm << 16 trips undefined behavior warnings with clang:
valid-adjtimex.c:66:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
-499<<16,
~~~~^
valid-adjtimex.c:67:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
-450<<16,
~~~~^
..
Fix it by using a multiply by (1 << 16) instead of shifting negative values
in the valid-adjtimex test case. Align the values for better readability.
Bug: 339526723
Reported-by: Lee Jones <joneslee@google.com>
Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Change-Id: Ied611c13a802acf9c7a2427f0a61eb358b571a3d
Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Link: https://lore.kernel.org/r/20240409202222.2830476-1-jstultz@google.com
Link: https://lore.kernel.org/lkml/0c6d4f0d-2064-4444-986b-1d1ed782135f@collabora.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 1f3484dec9)
Signed-off-by: Edward Liaw <edliaw@google.com>
__netlink_dump_start() releases nlk->cb_mutex right before
calling netlink_dump() which grabs it again.
This seems dangerous, even if KASAN did not bother yet.
Add a @lock_taken parameter to netlink_dump() to let it
grab the mutex if called from netlink_recvmsg() only.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit b5590270068c4324dac4a2b5a4a156e02e21339f)
Bug: 339546075
Change-Id: I29a711ea804794b556674011cbd23c5bf9a03ab6
Signed-off-by: yenchia.chen <yenchia.chen@mediatek.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
If UNUSED_KSYMS_WHITELIST is a file generated
before Kbuild runs, and the source tree is in
a read-only filesystem, the developer must put
the file somewhere and specify an absolute
path to UNUSED_KSYMS_WHITELIST. This worked,
but if IKCONFIG=y, an absolute path is embedded
into .config and eventually into vmlinux, causing
the build to be less reproducible when building
on a different machine.
This patch makes the handling of
UNUSED_KSYMS_WHITELIST to be similar to
MODULE_SIG_KEY.
First, check if UNUSED_KSYMS_WHITELIST is an
absolute path, just as before this patch. If so,
use the path as is.
If it is a relative path, use wildcard to check
the existence of the file below objtree first.
If it does not exist, fall back to the original
behavior of adding $(srctree)/ before the value.
After this patch, the developer can put the generated
file in objtree, then use a relative path against
objtree in .config, eradicating any absolute paths
that may be evaluated differently on different machines.
Signed-off-by: Yifan Hong <elsk@google.com>
Reviewed-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
(cherry picked from commit a2e3c811938b4902725e259c03b2d6c539613992
https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git modules-next)
Bug: 333769605
Change-Id: I0696ac8f686329795034ada5a4587af4ecbb774f
[elsk: apply change to gen_autoksyms.sh instead because
CONFIG_UNUSED_KSYMS_WHITELIST is parsed there. Revert change
to Makefile.modpost. Edit init/Kconfig instead of kernel/module/Kconfig
because UNUSED_KSYMS_WHITELIST is defined there.]
Bug: 342390208
Signed-off-by: Yifan Hong <elsk@google.com>
export function for sysfs node formating
Bug: 299190787
Change-Id: I71e6a0815efa8df99d036bf457b8a0081999f3de
Signed-off-by: Robin Hsu <robinhsu@google.com>
In commit d909d381c3 ("io_uring: drop any code related to
SCM_RIGHTS"), the internal struct io_ring_ctx structure was changed.
Due to some symbol leakage, the .stg abi checking wants to track this
structure, but it is safe to change as it is limited to the internal
io_uring code only.
INFO: type 'struct io_ring_ctx' changed
member 'struct { struct io_wq_hash* hash_map; struct user_struct* user; struct mm_struct* mm_account; struct llist_head fallback_llist; struct delayed_work fallback_work; struct work_struct exit_work; struct list_head tctx_list; struct completion ref_comp; u32 iowq_limits[2]; bool iowq_limits_set; }' was added
member 'struct { struct socket* ring_sock; struct io_wq_hash* hash_map; struct user_struct* user; struct mm_struct* mm_account; struct llist_head fallback_llist; struct delayed_work fallback_work; struct work_struct exit_work; struct list_head tctx_list; struct completion ref_comp; u32 iowq_limits[2]; bool iowq_limits_set; }' was removed
Fixes: d909d381c3 ("io_uring: drop any code related to SCM_RIGHTS")
Change-Id: I3cebbb3f9649519326a7c78e40297c735c6c5cfa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
In commit d951cf510f ("cpufreq: brcmstb-avs-cpufreq: add check for
cpufreq_cpu_get's return value"), a check is made in a way that causes a
build warning, which in Android systems, breaks the build. Fix this up
by moving the definition of the variable above the check to remove the
warning.
Fixes: d951cf510f ("cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value")
Change-Id: I8477905e3447eb4eabf3aa0899534c06a0cca125
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 37d98fb9c3 which is
commit 876673364161da50eed6b472d746ef88242b2368 upstream.
It breaks the build as other previous commits that were reverted for ABI
issues are not in the tree here.
Bug: 161946584
Change-Id: I6f30910efb8877d024e8e0866f2e62e3b25e0959
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 5.15.153
io_uring/unix: drop usage of io_uring socket
io_uring: drop any code related to SCM_RIGHTS
rcu-tasks: Provide rcu_trace_implies_rcu_gp()
bpf: Defer the free of inner map when necessary
selftests: tls: use exact comparison in recv_partial
ASoC: rt5645: Make LattePanda board DMI match more precise
x86/xen: Add some null pointer checking to smp.c
MIPS: Clear Cause.BD in instruction_pointer_set
HID: multitouch: Add required quirk for Synaptics 0xcddc device
gen_compile_commands: fix invalid escape sequence warning
RDMA/mlx5: Fix fortify source warning while accessing Eth segment
RDMA/mlx5: Relax DEVX access upon modify commands
riscv: dts: sifive: add missing #interrupt-cells to pmic
x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
net/iucv: fix the allocation size of iucv_path_table array
parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
block: sed-opal: handle empty atoms when parsing response
dm-verity, dm-crypt: align "struct bvec_iter" correctly
scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
firewire: core: use long bus reset on gap count error
ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
Input: gpio_keys_polled - suppress deferred probe error for gpio
ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
s390/dasd: put block allocation in separate function
s390/dasd: add query PPRC function
s390/dasd: add copy pair setup
s390/dasd: add autoquiesce feature
s390/dasd: Use dev_*() for device log messages
s390/dasd: fix double module refcount decrement
nbd: null check for nla_nest_start
fs/select: rework stack allocation hack for clang
md: Don't clear MD_CLOSING when the raid is about to stop
lib/cmdline: Fix an invalid format specifier in an assertion msg
time: test: Fix incorrect format specifier
rtc: test: Fix invalid format specifier.
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
timekeeping: Fix cross-timestamp interpolation on counter wrap
timekeeping: Fix cross-timestamp interpolation corner case decision
timekeeping: Fix cross-timestamp interpolation for non-x86
sched/fair: Take the scheduling domain into account in select_idle_core()
wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
wifi: b43: Stop correct queue in DMA worker when QoS is disabled
wifi: b43: Disable QoS for bcm4331
wifi: wilc1000: fix declarations ordering
wifi: wilc1000: fix RCU usage in connect path
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
wifi: wilc1000: fix multi-vif management when deleting a vif
wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
cpufreq: Explicitly include correct DT includes
cpufreq: mediatek-hw: Wait for CPU supplies before probing
sock_diag: annotate data-races around sock_diag_handlers[family]
inet_diag: annotate data-races around inet_diag_table[]
bpftool: Silence build warning about calloc()
af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
cpufreq: mediatek-hw: Don't error out if supply is not found
arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL board
arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on SD card
arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card IO voltage
arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board
wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
wifi: iwlwifi: mvm: report beacon protection failures
wifi: iwlwifi: dbg-tlv: ensure NUL termination
wifi: iwlwifi: fix EWRD table validity check
arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
pwm: atmel-hlcdc: Convert to platform remove callback returning void
pwm: atmel-hlcdc: Use consistent variable naming
pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
net: blackhole_dev: fix build warning for ethh set but not used
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
pwm: sti: Implement .apply() callback
pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
wifi: iwlwifi: mvm: don't set replay counters to 0xff
s390/vdso: drop '-fPIC' from LDFLAGS
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
arm64: dts: mt8183: kukui: Add Type C node
arm64: dts: mt8183: kukui: Split out keyboard node and describe detachables
arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
wireless: Remove redundant 'flush_workqueue()' calls
wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
bus: tegra-aconnect: Update dependency to ARCH_TEGRA
iommu/amd: Mark interrupt as managed
wifi: brcmsmac: avoid function pointer casts
net: ena: Remove ena_select_queue
ARM: dts: arm: realview: Fix development chip ROM compatible value
arm64: dts: renesas: r8a779a0: Update to R-Car Gen4 compatible values
arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
ARM: dts: imx6dl-yapp4: Move phy reset into switch node
ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
ACPI: resource: Do IRQ override on Lunnen Ground laptops
ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
ACPI: scan: Fix device check notification handling
x86, relocs: Ignore relocations in .notes section
SUNRPC: fix some memleaks in gssx_dec_option_array
mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
wifi: rtw88: 8821c: Fix false alarm count
PCI: Make pci_dev_is_disconnected() helper public for other drivers
iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
igb: move PEROUT and EXTTS isr logic to separate functions
igb: Fix missing time sync events
Bluetooth: Remove superfluous call to hci_conn_check_pending()
Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855
Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
Bluetooth: hci_core: Fix possible buffer overflow
sr9800: Add check for usbnet_get_endpoints
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
bpf: Fix hashtab overflow check on 32-bit arches
bpf: Fix stackmap overflow check on 32-bit arches
ipv6: fib6_rules: flush route cache when rule is changed
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
net: phy: fix phy_get_internal_delay accessing an empty array
net: hns3: fix kernel crash when 1588 is received on HIP08 devices
net: hns3: fix port duplex configure error in IMP reset
net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
net: phy: dp83822: Fix RGMII TX delay configuration
OPP: debugfs: Fix warning around icc_get_name()
tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
bpf: net: Change sk_getsockopt() to take the sockptr_t argument
bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
nfp: flower: handle acti_netdevs allocation failure
dm raid: fix false positive for requeue needed during reshape
dm: call the resume method on internal suspend
drm/tegra: dsi: Add missing check for of_find_device_by_node
drm/tegra: dpaux: Populate AUX bus
drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
drm/tegra: dsi: Make use of the helper function dev_err_probe()
drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
drm/tegra: dc: rgb: Allow changing PLLD rate on Tegra30+
drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe()
drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
drm/rockchip: inno_hdmi: Fix video timing
drm: Don't treat 0 as -1 in drm_fixp2int_ceil
drm/ttm: add ttm_resource_fini v2
drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
drm/rockchip: lvds: do not overwrite error code
drm/rockchip: lvds: do not print scary message when probing defer
drm/lima: fix a memleak in lima_heap_alloc
dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
media: tc358743: register v4l2 async device only after successful setup
PCI/DPC: Print all TLP Prefixes, not just the first
perf record: Fix possible incorrect free in record__switch_output()
HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
clk: meson: Add missing clocks to axg_clk_regmaps
media: em28xx: annotate unchecked call to media_device_register()
media: v4l2-tpg: fix some memleaks in tpg_alloc
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
media: edia: dvbdev: fix a use-after-free
pinctrl: mediatek: Drop bogus slew rate register range for MT8192
clk: qcom: reset: Commonize the de/assert functions
clk: qcom: reset: Ensure write completion on reset de/assertion
quota: simplify drop_dquot_ref()
quota: Fix potential NULL pointer dereference
quota: Fix rcu annotations of inode dquot pointers
PCI/P2PDMA: Fix a sleeping issue in a RCU read section
PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
crypto: xilinx - call finalize with bh disabled
perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
ALSA: seq: fix function cast warnings
perf stat: Avoid metric-only segv
ASoC: meson: Use dev_err_probe() helper
ASoC: meson: aiu: fix function pointer type mismatch
ASoC: meson: t9015: fix function pointer type mismatch
powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
PCI: endpoint: Support NTB transfer between RC and EP
NTB: EPF: fix possible memory leak in pci_vntb_probe()
NTB: fix possible name leak in ntb_register_device()
media: sun8i-di: Fix coefficient writes
media: sun8i-di: Fix power on/off sequences
media: sun8i-di: Fix chroma difference threshold
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
media: go7007: add check of return value of go7007_read_addr()
media: pvrusb2: remove redundant NULL check
media: pvrusb2: fix pvr2_stream_callback casts
clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
drm/tegra: put drm_gem_object ref on error in tegra_fb_create
mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
crypto: arm/sha - fix function cast warnings
drm/tidss: Fix initial plane zpos values
mtd: maps: physmap-core: fix flash size larger than 32-bit
mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
ASoC: meson: axg-tdm-interface: add frame rate constraint
HID: amd_sfh: Update HPD sensor structure elements
drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
media: pvrusb2: fix uaf in pvr2_context_set_notify
media: dvb-frontends: avoid stack overflow warnings with clang
media: go7007: fix a memleak in go7007_load_encoder
media: ttpci: fix two memleaks in budget_av_attach
media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
drm/msm/dpu: add division of drm_display_mode's hskew parameter
module: Add support for default value for module async_probe
modules: wait do_free_init correctly
powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
leds: aw2013: Unlock mutex before destroying it
leds: sgm3140: Add missing timer cleanup and flash gpio control
backlight: lm3630a: Initialize backlight_properties on init
backlight: lm3630a: Don't set bl->props.brightness in get_brightness
backlight: da9052: Fully initialize backlight_properties during probe
backlight: lm3639: Fully initialize backlight_properties during probe
backlight: lp8788: Fully initialize backlight_properties during probe
sparc32: Fix section mismatch in leon_pci_grpci
clk: Fix clk_core_get NULL dereference
clk: zynq: Prevent null pointer dereference caused by kmalloc failure
ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
RDMA/srpt: Do not register event handler until srpt device is fully setup
f2fs: multidevice: support direct IO
f2fs: invalidate META_MAPPING before IPU/DIO write
f2fs: replace congestion_wait() calls with io_schedule_timeout()
f2fs: fix to invalidate META_MAPPING before DIO write
f2fs: invalidate meta pages only for post_read required inode
f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
f2fs: compress: fix to cover normal cluster write with cp_rwsem
f2fs: compress: fix to check unreleased compressed cluster
scsi: csiostor: Avoid function pointer casts
RDMA/device: Fix a race between mad_client and cm_client init
RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
NFSv4.2: fix listxattr maximum XDR buffer size
watchdog: stm32_iwdg: initialize default timeout
NFS: Fix an off by one in root_nfs_cat()
f2fs: compress: fix reserve_cblocks counting error when out of space
afs: Revert "afs: Hide silly-rename files from userspace"
comedi: comedi_test: Prevent timers rescheduling during deletion
remoteproc: stm32: use correct format strings on 64-bit
remoteproc: stm32: Fix incorrect type in assignment for va
remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
tty: vt: fix 20 vs 0x20 typo in EScsiignore
serial: max310x: fix syntax error in IRQ error message
tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
kconfig: fix infinite loop when expanding a macro at the end of file
rtc: mt6397: select IRQ_DOMAIN instead of depending on it
serial: 8250_exar: Don't remove GPIO device on suspend
staging: greybus: fix get_channel_from_mode() failure path
usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
io_uring: don't save/restore iowait state
nouveau: reset the bo resource bus info after an eviction
octeontx2-af: Use matching wake_up API variant in CGX command interface
s390/vtime: fix average steal time calculation
soc: fsl: dpio: fix kcalloc() argument order
hsr: Fix uninit-value access in hsr_get_node()
net: mtk_eth_soc: move MAC_MCR setting to mac_finish()
net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
net: ethernet: mtk_eth_soc: fix PPE hanging issue
packet: annotate data-races around ignore_outgoing
net: veth: do not manipulate GRO when using XDP
net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
vdpa/mlx5: Allow CVQ size changes
wireguard: receive: annotate data-race around receiving_counter.counter
rds: introduce acquire/release ordering in acquire/release_in_xmit()
hsr: Handle failures in module init
net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
net/bnx2x: Prevent access to a freed page in page_pool
octeontx2-af: Use separate handlers for interrupts
netfilter: nft_set_pipapo: release elements in clone only from destroy path
netfilter: nf_tables: do not compare internal table flags on updates
rcu: add a helper to report consolidated flavor QS
net: report RCU QS on threaded NAPI repolling
bpf: report RCU QS in cpumap kthread
net: dsa: mt7530: fix handling of LLDP frames
net: dsa: mt7530: fix handling of 802.1X PAE frames
net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
net: dsa: mt7530: fix handling of all link-local frames
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
regmap: Add missing map->bus check
remoteproc: stm32: fix incorrect optional pointers
Linux 5.15.153
Change-Id: I760851fdde75cb1b3683364f0a8f2ab63899ce6d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
qiankun.wang