Commit Graph

1162553 Commits

Author SHA1 Message Date
huangshaobo1
09ab235661 ANDROID: vendor_hooks: export shrink_slab
Export shrink_slab to module for do shrink-memory action.

Bug: 363907036

Change-Id: Ia96e6595186927c1fe31a6504675b8762154c0a6
Signed-off-by: huangshaobo1 <huangshaobo1@xiaomi.corp-partner.google.com>
2024-09-03 21:42:49 +00:00
Gao Xiang
8a0fa49a77 UPSTREAM: erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
If z_erofs_gbuf_growsize() partially fails on a global buffer due to
memory allocation failure or fault injection (as reported by syzbot [1]),
new pages need to be freed by comparing to the existing pages to avoid
memory leaks.

However, the old gbuf->pages[] array may not be large enough, which can
lead to null-ptr-deref or out-of-bound access.

Fix this by checking against gbuf->nrpages in advance.

[1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com

Bug: 361157912
Reported-by: syzbot+242ee56aaa9585553766@syzkaller.appspotmail.com
Fixes: d6db47e571dc ("erofs: do not use pagepool in z_erofs_gbuf_growsize()")
Cc: <stable@vger.kernel.org> # 6.10+
Reviewed-by: Chunhai Guo <guochunhai@vivo.com>
Reviewed-by: Sandeep Dhavale <dhavale@google.com>
Change-Id: I5d6c8f63959db4a7e5bbf14da9b4c9ba04322c8c
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240820085619.1375963-1-hsiangkao@linux.alibaba.com
(cherry picked from commit 0005e01e1e875c5e27130c5e2ed0189749d1e08a)
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
2024-09-03 19:40:13 +00:00
Jozsef Kadlecsik
7c5c6b6397 UPSTREAM: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
[ Upstream commit 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10 ]

Lion Ackermann reported that there is a race condition between namespace cleanup
in ipset and the garbage collection of the list:set type. The namespace
cleanup can destroy the list:set type of sets while the gc of the set type is
waiting to run in rcu cleanup. The latter uses data from the destroyed set which
thus leads use after free. The patch contains the following parts:

- When destroying all sets, first remove the garbage collectors, then wait
  if needed and then destroy the sets.
- Fix the badly ordered "wait then remove gc" for the destroy a single set
  case.
- Fix the missing rcu locking in the list:set type in the userspace test
  case.
- Use proper RCU list handlings in the list:set type.

The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).

Bug: 347636817
Fixes: 97f7cf1cd80e (netfilter: ipset: fix performance regression in swap operation)
Reported-by: Lion Ackermann <nnamrec@gmail.com>
Tested-by: Lion Ackermann <nnamrec@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 390b353d1a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I92a8681d8a0f475aa20c34c17daa222d02cf7935
2024-09-03 09:01:02 +01:00
Aran Dalton
a1895da8bd ANDROID: GKI: Add initial sunxi symbol list
Add initial symbol list for sunxi.

Bug: 363322588
Signed-off-by: Aran Dalton <arda@allwinnertech.com>
Change-Id: I1f9ab11c8d583b6905bf55420c6bc7d22be67346
2024-09-02 15:26:30 +00:00
Greg Kroah-Hartman
b5e374dda9 FROMLIST: usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"
In commit cfcd544a99 ("usb: typec: tcpm: unregister existing source
caps before re-registration"), quilt, and git, applied the diff to the
incorrect function, which would cause bad problems if exercised in a
device with these capabilities.

Fix this all up to be in the correct function.

Fixes: cfcd544a99 ("usb: typec: tcpm: unregister existing source caps before re-registration")
Reported-by: Charles Yo <charlesyo@google.com>
Cc: Kyle Tso <kyletso@google.com>
Cc: Amit Sunil Dhamne <amitsd@google.com>
Cc: Ondrej Jirman <megi@xff.cz>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/linux-usb/2024083008-granddad-unmoving-828c@gregkh/
Bug: 363121994
[ note, only 1/3 of the upstream commit is needed here due to half
  already being present due to manual UPSTREAM changes made to the tree,
  and a second follow-up fix not being merged from LTS here yet - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I33b07fcb8d1e64e7f0424b9a7b7d056aa9e44b2f
2024-08-30 14:20:07 +00:00
Hangyu Hua
841cae8810 UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
[ Upstream commit affc18fdc694190ca7575b9a86632a73b9fe043d ]

q->bands will be assigned to qopt->bands to execute subsequent code logic
after kmalloc. So the old q->bands should not be used in kmalloc.
Otherwise, an out-of-bounds write will occur.

Bug: 349777785
Fixes: c2999f7fb0 ("net: sched: multiq: don't call qdisc_put() while holding tree lock")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Acked-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 0f208fad86)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iec8413c39878596795420ae58bbe6974890cf2de
2024-08-30 09:08:15 +00:00
Venkata Rao Kakani
3bb5a64ae9 ANDROID: Update the ABI symbol list
Adding the following symbols:
 - arch_invalidate_pmem

Bug: 361447064
Change-Id: Iaa479a803f695da5196b935c6ace261187d60816
Signed-off-by: Venkata Rao Kakani <quic_vkakani@quicinc.com>
2024-08-27 21:56:17 +00:00
Rick Yiu
6cbdf0e239 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - thermal_cooling_device_register
  - __traceiter_android_vh_set_task_comm
  - __tracepoint_android_vh_set_task_comm

Bug: 357956265
Change-Id: I05890339903e11e23743b94ab81c669e0774860a
Signed-off-by: Rick Yiu <rickyiu@google.com>
2024-08-27 18:43:18 +00:00
Seiya Wang
25641a61ba ANDROID: GKI: Update symbol list for mtk
2 function symbol(s) added
  'int devm_rproc_add(struct device*, struct rproc*)'
  'struct rproc* devm_rproc_alloc(struct device*, const char*, const struct rproc_ops*, const char*, int)'

Bug: 361691226
Change-Id: Ifc5f86d8443f0495dd576c654b9fd9936bd449f7
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
2024-08-27 18:03:20 +00:00
Will Deacon
82b9eb64eb FROMGIT: KVM: arm64: Ensure TLBI uses correct VMID after changing context
When the target context passed to enter_vmid_context() matches the
current running context, the function returns early without manipulating
the registers of the stage-2 MMU. This can result in a stale VMID due to
the lack of an ISB instruction in exit_vmid_context() after writing the
VTTBR when ARM64_WORKAROUND_SPECULATIVE_AT is not enabled.

For example, with pKVM enabled:

	// Initially running in host context
	enter_vmid_context(guest);
		-> __load_stage2(guest); isb	// Writes VTCR & VTTBR
	exit_vmid_context(guest);
		-> __load_stage2(host);		// Restores VTCR & VTTBR

	enter_vmid_context(host);
		-> Returns early as we're already in host context
	tlbi vmalls12e1is	// !!! Can use the stale VMID as we
				// haven't performed context
				// synchronisation since restoring
				// VTTBR.VMID

Add an unconditional ISB instruction to exit_vmid_context() after
restoring the VTTBR. This already existed for the
ARM64_WORKAROUND_SPECULATIVE_AT path, so we can simply hoist that onto
the common path.

Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oliver.upton@linux.dev>
Cc: Fuad Tabba <tabba@google.com>
Fixes: 58f3b0fc3b87 ("KVM: arm64: Support TLB invalidation in guest context")
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20240814123429.20457-3-will@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
(cherry picked from commit ed49fe5a6fb9c1a1bbbf4b5b648c7d34a756cb6d
 kvmarm/next)
Bug: 311571169
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I1612ebdc5625e44694897f2c5b26fe38cdaa3179
2024-08-27 11:59:44 +00:00
Will Deacon
9920d2584e FROMGIT: KVM: arm64: Invalidate EL1&0 TLB entries for all VMIDs in nvhe hyp init
When initialising the nVHE hypervisor, we invalidate potentially stale
TLB entries for the EL1&0 regime using a 'vmalls12e1' invalidation.
However, this invalidation operation applies only to the active VMID
and therefore we could proceed with stale TLB entries for other VMIDs.

Replace the operation with an 'alle1' which applies to all entries for
the EL1&0 regime, regardless of the VMID.

Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oliver.upton@linux.dev>
Fixes: 1025c8c0c6 ("KVM: arm64: Wrap the host with a stage 2")
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20240814123429.20457-2-will@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
(cherry picked from commit dc0dddb1d66de88c571cf1a5bc3b484521a578af
 kvmarm/next)
Bug: 311571169
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: Ib116a4b3b08501e84340ce63ea6cded67824c7aa
2024-08-27 11:59:44 +00:00
Will Deacon
1a48a88fcb FROMGIT: BACKPORT: KVM: arm64: Don't pass a TLBI level hint when zapping table entries
commit 36e008323926036650299cfbb2dca704c7aba849 upstream.

The TLBI level hints are for leaf entries only, so take care not to pass
them incorrectly after clearing a table entry.

Cc: Gavin Shan <gshan@redhat.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Quentin Perret <qperret@google.com>
Fixes: 82bb02445d ("KVM: arm64: Implement kvm_pgtable_hyp_unmap() at EL2")
Fixes: 6d9d2115c4 ("KVM: arm64: Add support for stage-2 map()/unmap() in generic page-table")
Reviewed-by: Shaoqin Huang <shahuang@redhat.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240327124853.11206-3-will@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Cc: <stable@vger.kernel.org> # 6.1.y only
[will@: Use '0' instead of TLBI_TTL_UNKNOWN_to indicate "no level". Force
        level to 0 in stage2_put_pte() if we're clearing a table entry.]
Signed-off-by: Will Deacon <will@kernel.org>
(cherry picked from commit 298e875b36
 stable/linux-6.1.y)
Bug: 311571169
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: Icefe7099ccf03c4ba96e395dfc225f0015e3fccc
2024-08-27 11:59:44 +00:00
Greg Kroah-Hartman
02fcfc12fc Merge tag 'android14-6.1.93_r00' into android14-6.1
This merges up to the 6.1.93 LTS release into android14-6.1.  Included
in here are the following commits:

* 9d37e2aae7 ANDROID: add __module_get to db854c symbol list.
* 5ccfb1bf19 Revert "drm/mipi-dsi: use correct return type for the DSC functions"
* d201efdaa4 Revert "media: cec: core: avoid recursive cec_claim_log_addrs"
* dcb51feb27 Revert "Bluetooth: compute LE flow credits based on recvbuf space"
*   a4d90a8f3c Merge 6.1.93 into android14-6.1-lts
|\
| * ae9f2a70d6 Linux 6.1.93
| * ec5c95f0e7 net: ena: Fix DMA syncing in XDP path when SWIOTLB is on
| * ceab795a67 ALSA: timer: Set lower bound of start tick time
| * ea22d4195c riscv: prevent pt_regs corruption for secondary idle threads
| * b2c98bec4d hwmon: (shtc1) Fix property misspelling
| * 786d1639db powerpc/pseries/lparcfg: drop error message from guest name lookup
| * cb53706a34 ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
| * f694cc31e7 net: ena: Fix redundant device NUMA node override
| * 3bb51b20dd net: ena: Reduce lines with longer column width boundary
| * d230da7d5d net: ena: Add dynamic recycling mechanism for rx buffers
| * 852035aba3 net: dsa: microchip: fix RGMII error in KSZ DSA driver
| * 0e355a3ce2 spi: stm32: Don't warn about spurious interrupts
| * 0713e0d191 drm/i915/guc: avoid FIELD_PREP warning
| * 4b338844af kconfig: fix comparison to constant symbols, 'm', 'n'
| * c98af7fd2f netfilter: nft_fib: allow from forward/input without iif selector
| * caf3a8afb5 netfilter: tproxy: bail out if IP has been disabled on the device
| * e017b87660 netfilter: nft_payload: skbuff vlan metadata mangle support
| * cffee0b578 netfilter: nft_payload: rebuild vlan header on h_proto access
| * 96f261d56c netfilter: nft_payload: rebuild vlan header when needed
| * de47cbfc86 netfilter: nft_payload: move struct nft_payload_set definition where it belongs
| * 07cbc55120 ice: fix accounting if a VLAN already exists
| * 50bb204a6b net:fec: Add fec_enet_deinit()
| * 6693b172f0 bpf: Allow delete from sockmap/sockhash only if update is allowed
| * f52bb074e4 net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
| * ba61b44379 af_unix: Read sk->sk_hash under bindlock during bind().
| * 7077c22f84 enic: Validate length of nl attributes in enic_set_vf_port
| * ce913fd361 ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
| * 995f447cd3 ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
| * ac35c81bcb ALSA: hda/realtek: Add quirk for ASUS ROG G634Z
| * 1834922d44 ALSA: core: Remove debugfs at disconnection
| * a8dda2c105 ALSA: jack: Use guard() for locking
| * 105624d7f6 bpf: Fix potential integer overflow in resolve_btfids
| * 242b304668 dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
| * 42c79364df net/mlx5e: Fix UDP GSO for encapsulated packets
| * 3aa5734570 net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
| * 1b4ab44129 net/mlx5e: Fix IPsec tunnel mode offload feature check
| * 666e19a247 net/mlx5: Lag, do bond only if slaves agree on roce state
| * 25222a9899 net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
| * ca7ad37b60 nvmet: fix ns enable/disable possible hang
| * 8e1ba9df9a dma-mapping: benchmark: handle NUMA_NO_NODE correctly
| * c57874265a dma-mapping: benchmark: fix node id validation
| * 729fdbfc18 spi: Don't mark message DMA mapped when no transfer in it is
| * 8dfcd7780d netfilter: nft_payload: restore vlan q-in-q match support
| * 68f40354a3 netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
| * 5ef3a27c61 ice: Interpret .set_channels() input differently
| * 5d626f2b87 drivers/xen: Improve the late XenStore init protocol
| * 8d65890c94 nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
| * 20c4691a06 nfc: nci: Fix kcov check in nci_rx_work()
| * c09ddc6058 net: relax socket state check at accept time.
| * e1e80e7ff2 inet: factor out locked section of inet_accept() in a new helper
| * 335c8f1566 tls: fix missing memory barrier in tls_init
| * 4f11834e6b net: fec: avoid lock evasion when reading pps_enable
| * eeae2526e8 Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
| * 2ae3749f37 riscv: stacktrace: fixed walk_stackframe()
| * 62bcc5c9f5 riscv: stacktrace: Make walk_stackframe cross pt_regs frame
| * abf001651a virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
| * e63c10851f rv: Update rv_en(dis)able_monitor doc to match kernel-doc
| * 3fd487ffaa arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
| * b4ff9af8e7 openvswitch: Set the skbuff pkt_type for proper pmtud support.
| * 1d20ba6017 pNFS/filelayout: fixup pNfs allocation modes
| * e65d13ec00 tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
| * 599a565421 ipv6: sr: fix memleak in seg6_hmac_init_algo
| * 4bf6964451 af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
| * cdc0234964 rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
| * 3c92f3a59d sunrpc: fix NFSACL RPC retry on soft mount
| * 99530e42e1 nfs: keep server info for remounts
| * b72a3a25c2 NFSv4: Fixup smatch warning for ambiguous return
| * 7995b66f4f ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
| * e8c8e0d0d2 nfc: nci: Fix uninit-value in nci_rx_work
| * 47c5707d44 selftests: net: kill smcrouted in the cleanup logic in amt.sh
| * 8f1fc3b86e ipv6: sr: fix missing sk_buff release in seg6_input_core
| * d2223fd3dd net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
| * fde26c4ae3 x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
| * f23f182baa perf/arm-dmc620: Fix lockdep assert in ->event_init()
| * e9774d1531 regulator: bd71828: Don't overwrite runtime voltages
| * 60c406bb08 ASoC: mediatek: mt8192: fix register configuration for tdm
| * 191dc1b2ff ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
| * 1056e52028 null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
| * 247849eeb3 drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
| * 7904aee9cc drm/msm: Enable clamp_to_idle for 7c3
| * ac9de7b29e Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
| * 3f56c18a39 media: cec: core: avoid confusing "transmit timed out" message
| * 302077d270 media: cec: core: avoid recursive cec_claim_log_addrs
| * 6d6ddabcec media: cec: cec-api: add locking in cec_release()
| * 1e1e7a6ec2 media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
| * a19d05e18d media: sunxi: a83-mips-csi2: also select GENERIC_PHY
| * 1ffee510fa um: Fix the declaration of kasan_map_memory
| * 68bc383a75 um: Fix the -Wmissing-prototypes warning for get_thread_reg
| * b6eda6dee3 um: Fix the -Wmissing-prototypes warning for __switch_mm
| * 1d168e682c powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
| * 64c0cbc5a5 media: flexcop-usb: fix sanity check of bNumEndpoints
| * 9400caf566 Input: cyapa - add missing input core locking to suspend/resume functions
| * 4693aea93c scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
| * b504518a39 media: stk1160: fix bounds checking in stk1160_copy_video()
| * fe1d4a8a60 drm/bridge: tc358775: fix support for jeida-18 and jeida-24
| * 3839a9b19a fs/ntfs3: Use variable length array instead of fixed size
| * 98db3155b5 fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
| * 42c5571981 um: vector: fix bpfflash parameter evaluation
| * 0c02d425a2 um: Add winch to winch_handlers before registering winch IRQ
| * a62a85b29c um: Fix return value in ubd_init()
| * a9ef192c48 drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
| * 93ac25c29f drm/mediatek: dp: Add support for embedded DisplayPort aux-bus
| * a5bd618458 drm/mediatek: dp: Move PHY registration to new function
| * 0f2c694d69 drm/msm/dpu: Always flush the slave INTF on the CTL
| * 5e3aa39154 drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
| * ce0503f825 Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
| * a8951a036b mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
| * 2251a6af08 mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
| * 3465401e7e mmc: sdhci_am654: Add OTAP/ITAP delay enable
| * 9b8590cb9f mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
| * 3eb2922ba9 mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
| * 3c436cc8ab mmc: sdhci_am654: Add tuning algorithm for delay chain
| * f172f4fa22 Input: ioc3kbd - add device table
| * 767daf9c71 Input: ioc3kbd - convert to platform remove callback returning void
| * df9ce976d6 Input: ims-pcu - fix printf string overflow
| * 0a88433d60 s390/boot: Remove alt_stfle_fac_list from decompressor
| * 34ab36f9f3 s390/ipl: Fix incorrect initialization of nvme dump block
| * a88e11b97b s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
| * a9e6068190 s390/vdso: Use standard stack frame layout
| * 8a598bf5ac s390/vdso: Generate unwind information for C modules
| * c7a162b3ae s390/vdso64: filter out munaligned-symbols flag for vdso
| * 926f7fea26 s390/vdso: filter out mno-pic-data-is-text-relative cflag
| * 886f9ee3c5 LoongArch: Fix callchain parse error with kernel tracepoint events again
| * 2477cc49c8 perf stat: Don't display metric header for non-leader uncore events
| * 4b3d568d40 f2fs: fix to add missing iput() in gc_data_segment()
| * 14cdd01c7b perf daemon: Fix file leak in daemon_session__control
| * f192396d5b libsubcmd: Fix parse-options memory leak
| * 3cb6516b84 serial: sh-sci: protect invalidating RXDMA on shutdown
| * 3ccf5210dc f2fs: compress: don't allow unaligned truncation on released compress inode
| * a61d0d6648 f2fs: fix to release node block count in error path of f2fs_new_node_page()
| * 5d47d63883 f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
| * ea394c8698 f2fs: compress: fix to update i_compr_blocks correctly
| * d939659ef9 perf report: Avoid SEGV in report__setup_sample_type()
| * 8641d8d39d perf ui browser: Avoid SEGV on title
| * afb634b085 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
| * bdfaba14d8 PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
| * 01f7e5732f extcon: max8997: select IRQ_DOMAIN instead of depending on it
| * 598eb7d520 perf ui browser: Don't save pointer to stack memory
| * b84c5140fd perf bench internals inject-build-id: Fix trap divide when collecting just one DSO
| * df9329247d ppdev: Add an error check in register_device
| * 27181d7119 ppdev: Remove usage of the deprecated ida_simple_xx() API
| * 4bfd48bb6e stm class: Fix a double free in stm_register_device()
| * 469f34d984 usb: gadget: u_audio: Clear uac pointer when freed.
| * 89e6680968 usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
| * 5aae3129c3 watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
| * 1c991befa1 watchdog: bd9576: Drop "always-running" property
| * d2bfc8ee11 dt-bindings: pinctrl: mediatek: mt7622: fix array properties
| * 91bc100044 VMCI: Fix an error handling path in vmci_guest_probe_device()
| * 049680a943 ovl: remove upper umask handling from ovl_create_upper()
| * a65ca8a943 perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
| * 1c4ce8d08f microblaze: Remove early printk call from cpuinfo-static.c
| * 1cd87f3854 microblaze: Remove gcc flag for non existing early_printk.c file
| * 75a001914a fpga: region: add owner module and take its refcount
| * 44dccf7eb4 coresight: etm4x: Fix access to resource selector registers
| * 3a8a24cbdd coresight: etm4x: Safe access for TRCQCLTR
| * cf9a077ab5 coresight: etm4x: Do not save/restore Data trace control registers
| * ecbfb465f5 coresight: etm4x: Do not hardcode IOMEM access for register restore
| * d3ea59a95d iio: pressure: dps310: support negative temperature values
| * 08ccc5d4d1 perf docs: Document bpf event modifier
| * 4df97442a0 coresight: etm4x: Fix unbalanced pm_runtime_enable()
| * b6eb572f38 iio: adc: stm32: Fixing err code to not indicate success
| * d52358d6da f2fs: fix to check pinfile flag in f2fs_move_file_range()
| * 89548270b0 f2fs: fix to relocate check condition in f2fs_fallocate()
| * aaeab70ad2 f2fs: fix typos in comments
| * 0661153777 f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file()
| * 3192c383f3 f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
| * b8f7a95d23 dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
| * b9a1acadd0 dt-bindings: PCI: rcar-pci-host: Add optional regulators
| * e80cc8298e perf tests: Make "test data symbol" more robust on Neoverse N1
| * da665815cf perf test: Add 'datasym' test workload
| * 587edbeab8 perf test: Add 'brstack' test workload
| * 33b33bd5b7 perf test: Add 'sqrtloop' test workload
| * a80152003a perf test: Add 'leafloop' test workload
| * ee9d68456c perf test: Add 'thloop' test workload
| * e46035c226 perf test: Add -w/--workload option
| * 338656b35f arm64: dts: meson: fix S4 power-controller node
| * 66a7e9aade interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
| * 3c080bd43b serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
| * 905ec77eda PCI: tegra194: Fix probe path for Endpoint mode
| * b54f3b1682 greybus: arche-ctrl: move device table to its right location
| * cb3cc5e92a serial: max3100: Fix bitwise types
| * b6eb7aff23 serial: max3100: Update uart_driver_registered on driver removal
| * 8296bb9e59 serial: max3100: Lock port->lock when calling uart_handle_cts_change()
| * 758c5d1451 firmware: dmi-id: add a release callback function
| * 1aceff5b77 dmaengine: idma64: Add check for dma_set_max_seg_size
| * 2ebcaa0e5d soundwire: cadence: fix invalid PDI offset
| * 03bf7d260f perf annotate: Get rid of duplicate --group option item
| * d9b7185811 counter: linux/counter.h: fix Excess kernel-doc description warning
| * 49642cc366 f2fs: fix to wait on page writeback in __clone_blkaddrs()
| * 1a9225fdd0 f2fs: multidev: fix to recognize valid zero block address
| * 9b41a9b9c8 greybus: lights: check return of get_channel_from_mode
| * 77eec3e2fa iio: core: Leave private pointer NULL when no private data supplied
| * 416b6aad33 perf probe: Add missing libgen.h header needed for using basename()
| * 4086a7af96 perf record: Delete session after stopping sideband thread
| * 3f9e48b104 scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
| * be6e713226 sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write()
| * e72a3ebf80 sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
| * 04e907c4ae af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
| * 3db2fc45d1 netrom: fix possible dead-lock in nr_rt_ioctl()
| * e448d1bad7 net: qrtr: ns: Fix module refcnt
| * 8ca9a750fc net: bridge: mst: fix vlan use-after-free
| * f3ffa269a4 selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval
| * 28126b83f8 net: bridge: xmit: make sure we have at least eth header len bytes
| * ce83060743 net: add pskb_may_pull_reason() helper
| * 43504dae4d RDMA/IPoIB: Fix format truncation compilation errors
| * f5f95901a3 selftests/kcmp: remove unused open mode
| * 879fe60fcc SUNRPC: Fix gss_free_in_token_pages()
| * 7504fb57af ext4: fix potential unnitialized variable
| * 332f8c289b ext4: remove unused parameter from ext4_mb_new_blocks_simple()
| * 910ce50de7 ext4: try all groups in ext4_mb_new_blocks_simple
| * 227a4fa4a0 ext4: fix unit mismatch in ext4_mb_new_blocks_simple
| * 0d82a01cfa ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
| * 00b079e990 sunrpc: removed redundant procp check
| * afeb0e6962 drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
| * 96256f749a virt: acrn: stop using follow_pfn
| * 68b41ff1d8 ext4: avoid excessive credit estimate in ext4_tmpfile()
| * c884b2f721 x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
| * c88a803ed3 x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
| * b4825f5d21 clk: qcom: mmcc-msm8998: fix venus clock issue
| * b8bf481f58 clk: qcom: dispcc-sm6350: fix DisplayPort clocks
| * 49e7685aba clk: qcom: dispcc-sm8450: fix DisplayPort clocks
| * 1a21fdeea5 lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
| * 5582914f2b clk: renesas: r9a07g043: Add clock and reset entry for PLIC
| * 1b6bd01c33 clk: renesas: r8a779a0: Fix CANFD parent clock
| * 9f41ba1dff IB/mlx5: Use __iowrite64_copy() for write combining stores
| * de144d4522 RDMA/rxe: Fix incorrect rxe_put in error path
| * 4c0d0a653a RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c
| * faa8d0ecf6 RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
| * 8f50d295dd clk: rs9: fix wrong default value for clock amplitude
| * 0dd8a16724 clk: mediatek: mt8365-mm: fix DPI0 parent
| * 17f3741c65 RDMA/hns: Modify the print level of CQE error
| * b767e511ce RDMA/hns: Use complete parentheses in macros
| * e88f5ea8db RDMA/hns: Fix GMV table pagesize
| * 763780ef03 RDMA/hns: Fix UAF for cq async event
| * 756ddbe665 RDMA/hns: Fix deadlock on SRQ async events.
| * 755b313811 RDMA/hns: Fix return value in hns_roce_map_mr_sg
| * ad35e397e4 RDMA/mlx5: Adding remote atomic access flag to updatable flags
| * 9302afe52d clk: samsung: exynosautov9: fix wrong pll clock id value
| * e08f0cc0af drm/rockchip: vop2: Do not divide height twice for YUV
| * 26f73934ee drm/mipi-dsi: use correct return type for the DSC functions
| * 2dd1b312b4 drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
| * ed9713f81e drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
| * f0d232de73 drm/bridge: dpc3433: Don't log an error when DSI host can't be found
| * 6eb119ab4f drm/bridge: tc358775: Don't log an error when DSI host can't be found
| * b121737428 drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
| * 9cc53e34a9 drm/bridge: lt9611: Don't log an error when DSI host can't be found
| * 59176fbabe drm/bridge: lt8912b: Don't log an error when DSI host can't be found
| * 195760a41e drm/bridge: icn6211: Don't log an error when DSI host can't be found
| * 9ce1954f80 drm/bridge: anx7625: Don't log an error when DSI host can't be found
| * bf16f6e5ea ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
| * 80431ea363 drm: vc4: Fix possible null pointer dereference
| * e4b52d4938 drm/arm/malidp: fix a possible null pointer dereference
| * a1ab99dcc8 media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
| * ba8b4180f0 fbdev: sh7760fb: allow modular build
| * 673a409b6b media: dt-bindings: ovti,ov2680: Fix the power supply names
| * a6f2f5f762 media: ipu3-cio2: Request IRQ earlier
| * d57bc62491 drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
| * 3ede49a75a drm/msm/dp: Return IRQ_NONE for unhandled interrupts
| * 24e810b9b1 drm/msm/dp: allow voltage swing / pre emphasis of 3
| * ca53b7efd4 drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
| * d33fbb62fb media: radio-shark2: Avoid led_names truncations
| * ff29277c3e media: rcar-vin: work around -Wenum-compare-conditional warning
| * 62fd155f2a media: ngene: Add dvb_ca_en50221_init return value check
| * 1ca59f0a20 ASoC: Intel: avs: Fix potential integer overflow
| * 3e35eb8449 ASoC: Intel: avs: Fix ASRC module initialization
| * c923f05b01 fbdev: sisfb: hide unused variables
| * f9974f9035 powerpc/fsl-soc: hide unused const variable
| * 13562c2d48 drm/mediatek: Add 0 size check to mtk_drm_gem_obj
| * 96e47f2b2f drm/meson: vclk: fix calculation of 59.94 fractional rates
| * de9987cec6 ASoC: kirkwood: Fix potential NULL dereference
| * 55dd7caeeb fbdev: shmobile: fix snprintf truncation
| * 3115fb2cc5 mtd: rawnand: hynix: fixed typo
| * 534fd7770b mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()
| * a4b95e6681 ASoC: Intel: avs: ssm4567: Do not ignore route checks
| * e9fe6e6671 ASoC: Intel: Disable route checks for Skylake boards
| * 98b8a6bfd3 drm/amd/display: Fix potential index out of bounds in color transformation function
| * 743ce5a1f2 drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert
| * 90bd113e65 drm/dp: Don't attempt AUX transfers when eDP panels are not powered
| * 083f305020 drm/panel-samsung-atna33xc20: Use ktime_get_boottime for delays
| * 9843feb28f drm/lcdif: Do not disable clocks on already suspended hardware
| * e48c88d08e dev_printk: Add and use dev_no_printk()
| * 87436e6919 printk: Let no_printk() use _printk()
| * fc61bce6ec drm/bridge: Fix improper bridge init order with pre_enable_prev_first
| * e0c379bd58 Bluetooth: qca: Fix error code in qca_read_fw_build_info()
| * 632b63f127 Bluetooth: compute LE flow credits based on recvbuf space
| * 1cfc3ab941 Bluetooth: Consolidate code around sk_alloc into a helper function
| * 80dea5ae7c mptcp: SO_KEEPALIVE: fix getsockopt support
| * 3ec437f9bb ax25: Fix reference count leak issue of net_device
| * ae467750a3 ax25: Fix reference count leak issues of ax25_dev
| * 46cdb2bee4 ax25: Use kernel universal linked list to implement ax25_dev_list
| * 01fdc6a9d1 riscv, bpf: make some atomic operations fully ordered
| * 913ad7113f s390/bpf: Emit a barrier for BPF_FETCH instructions
| * bf8aaf0ae0 net/mlx5: Discard command completions in internal error
| * 4baae687a2 net/mlx5: Add a timeout to acquire the command queue semaphore
| * e77a3ec7ad ipv6: sr: fix invalid unregister error path
| * e82d8b708c ipv6: sr: fix incorrect unregister order
| * f08ce703af ipv6: sr: add missing seg6_local_exit
| * 9ec8b0ccad net: openvswitch: fix overwriting ct original tuple for ICMPv6
| * 517e64bcc9 net: usb: smsc95xx: stop lying about skb->truesize
| * 8299e4d778 af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
| * 63470d2044 net: ethernet: cortina: Locking fixes
| * 4e3d60b618 selftests: net: move amt to socat for better compatibility
| * 476adb3bbb eth: sungem: remove .ndo_poll_controller to avoid deadlocks
| * 6758bf27a7 net: ipv6: fix wrong start position when receive hop-by-hop fragment
| * 2ceac7eac0 m68k: mac: Fix reboot hang on Mac IIci
| * 0d9ae12535 m68k: Fix spinlock race in kernel thread creation
| * 3e3f283c0b net: usb: sr9700: stop lying about skb->truesize
| * 439d2db44d usb: aqc111: stop lying about skb->truesize
| * decf64daf4 HID: amd_sfh: Handle "no sensors" in PM operations
| * a9f11a226b wifi: mwl8k: initialize cmd->addr[] properly
| * 3869da766b x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
| * e39d630be9 kernel/numa.c: Move logging out of numa.h
| * 888c05a172 scsi: qla2xxx: Fix debugfs output for fw_resource_count
| * d93318f19d scsi: qedf: Ensure the copied buf is NUL terminated
| * 7d3e694c4f scsi: bfa: Ensure the copied buf is NUL terminated
| * 3848c9f889 HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
| * 1f2ebd3758 kunit: Fix kthread reference
| * b48efc18de selftests: default to host arch for LLVM builds
| * 9118e77618 selftests/resctrl: fix clang build failure: use LOCAL_HDRS
| * 63e48e33ea selftests/binderfs: use the Makefile's rules, not Make's implicit rules
| * fa6b979c86 libbpf: Fix error message in attach_kprobe_multi
| * 48e88dc8b0 wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
| * e091545b16 Revert "sh: Handle calling csum_partial with misaligned data"
| * 1b682bd726 sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
| * 34f7ebff1b wifi: ar5523: enable proper endpoint verification
| * 265c3cda47 wifi: carl9170: add a proper sanity check for endpoints
| * 787fb79efc macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
| * c74b33b4f5 net: give more chances to rcu in netdev_wait_allrefs_any()
| * 1491a01ef5 drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
| * 3669baf308 drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
| * 3d1face00e drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
| * 10e9ecf9dd pwm: sti: Simplify probe function using devm functions
| * e07184f033 pwm: sti: Prepare removing pwm_chip from driver data
| * e173bd3ca0 pwm: sti: Convert to platform remove callback returning void
| * 131490afa2 tcp: avoid premature drops in tcp_add_backlog()
| * 3616b4e1f1 net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches
| * be16a7fd4b net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers
| * f81c15d86b wifi: ath10k: populate board data for WCN3990
| * 540fe85ed8 selftests/bpf: Fix a fd leak in error paths in open_netns
| * 16e4d6b72c wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
| * 11c731386e thermal/drivers/tsens: Fix null pointer dereference
| * c8d23a7e9b x86/purgatory: Switch to the position-independent small code model
| * cf36b66875 scsi: hpsa: Fix allocation size for Scsi_Host private data
| * c0fcc7838b scsi: libsas: Fix the failure of adding phy with zero-address to port
| * 769c4f355b cppc_cpufreq: Fix possible null pointer dereference
| * 606dc69d6f udp: Avoid call to compute_score on multiple sites
| * 789afa3e00 net: remove duplicate reuseport_lookup functions
| * 1191892924 net: export inet_lookup_reuseport and inet6_lookup_reuseport
| * 0f67a567be x86/pat: Fix W^X violation false-positives when running as Xen PV guest
| * 66109531c1 x86/pat: Restructure _lookup_address_cpa()
| * 1ed308ba7b x86/pat: Introduce lookup_address_in_pgd_attr()
| * 8bc9546805 cpufreq: exit() callback is optional
| * ce087f5088 selftests/bpf: Fix umount cgroup2 error in test_sockmap
| * e2ce84ae6e x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
| * 15b1f35a11 gfs2: Fix "ignore unlock failures after withdraw"
| * 4b10a59fb6 gfs2: Don't forget to complete delayed withdraw
| * 39a12a9ba8 ACPI: disable -Wstringop-truncation
| * 3eecd40d13 irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
| * 10a52dc487 irqchip/alpine-msi: Fix off-by-one in allocation error path
| * 4ade4cfe23 ACPI: LPSS: Advertise number of chip selects via property
| * 6eae7a54cc scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
| * 00e7b0eb92 scsi: ufs: core: Perform read back after disabling interrupts
| * 5ec91312a5 scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
| * ec6be64a14 scsi: ufs: qcom: Perform read back after writing CGC enable
| * 44db6b5888 scsi: ufs: qcom: Perform read back after writing unipro mode
| * 9c4e9090af scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
| * 1e33175a8c scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
| * b52ce65b46 scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
| * bfda254ceb scsi: ufs: qcom: Perform read back after writing reset bit
| * 90098f0a16 bpf: Pack struct bpf_fib_lookup
| * 1385768312 wifi: carl9170: re-fix fortified-memset warning
| * a353cd9ff7 bitops: add missing prototype check
| * 542598a559 mlx5: stop warning for 64KB pages
| * f3141f00f3 net/mlx5e: Fail with messages when params are not valid for XSK
| * 82bb344ff3 qed: avoid truncating work queue length
| * b752f7fc15 ACPI: Fix Generic Initiator Affinity _OSC bit
| * 94833a31d7 sched/fair: Add EAS checks before updating root_domain::overutilized
| * 388eb05c27 x86/boot: Ignore relocations in .notes sections in walk_relocs() too
| * 75d015f2f1 bpftool: Fix missing pids during link show
| * 4d753cf502 wifi: ath11k: don't force enable power save on non-running vdevs
| * 0eb2c0528e wifi: brcmfmac: pcie: handle randbuf allocation failure
| * 0c94d93b5d wifi: ath10k: poll service ready message before failing
| * 9a97008dbf block: support to account io_ticks precisely
| * 56aacead05 block: open code __blk_account_io_done()
| * 4e4c9bf71a block: open code __blk_account_io_start()
| * 71e8e4f288 md: fix resync softlockup when bitmap size is less than array size
| * 8b5405bf0d null_blk: Fix missing mutex_destroy() at module removal
| * 3603c03acd soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
| * f06969df2e jffs2: prevent xattr node from overflowing the eraseblock
| * 36840a727c ARM: configs: sunxi: Enable DRM_DW_HDMI
| * e2228ed3fe rcu: Fix buffer overflow in print_cpu_stall_info()
| * 08186d0c5f rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
| * 91f1edfa38 io_uring: use the right type for work_llist empty check
| * 0c9ce8f239 io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of task_work
| * 007a23d38a s390/cio: fix tracepoint subchannel type field
| * 891b2c9d39 crypto: x86/sha512-avx2 - add missing vzeroupper
| * f8daeb40b4 crypto: x86/sha256-avx2 - add missing vzeroupper
| * c38667181b crypto: x86/nh-avx2 - add missing vzeroupper
| * eeaf1f604f crypto: ccp - drop platform ifdef checks
| * ecebbacac1 parisc: add missing export of __cmpxchg_u8()
| * 6f48c67414 nilfs2: fix out-of-range warning
| * 0d0f8ba042 ecryptfs: Fix buffer size for tag 66 packet
| * a89bece5a6 firmware: raspberrypi: Use correct device for DMA mappings
| * 4d8e9c2aa6 mm/slub, kunit: Use inverted data to corrupt kmem cache
| * 49833a8da6 crypto: bcm - Fix pointer arithmetic
| * 24119acfc7 openpromfs: finish conversion to the new mount API
| * de9bf32eab nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
| * 559214eb4e epoll: be better about file lifetimes
| * ae63c25cb0 nvmet: fix nvme status code when namespace is disabled
| * 11f62e1818 nvmet-tcp: fix possible memory leak when tearing down a controller
| * 8244dfd22c nvmet-auth: replace pr_debug() with pr_err() to report an error.
| * 068095539a nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
| * 226a12bf62 nvme: find numa distance only if controller has valid numa id
| * e8b799f42a x86/mm: Remove broken vsyscall emulation code from the page fault code
| * 6ce4f190f0 drm/amdkfd: Flush the process wq before creating a kfd_process
| * 6170ef8490 drm/amd/display: Add VCO speed parameter for DCN31 FPU
| * 3fa799b54a drm/amd/display: Add dtbclk access to dcn315
| * 68195bb960 ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
| * 32b4a8888f ASoC: da7219-aad: fix usage of device_get_named_child_node()
| * 805ef55a82 softirq: Fix suspicious RCU usage in __do_softirq()
| * 1572a4a3b8 fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
| * e9c96d01d5 genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
| * 117e7a43cd KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
| * b8938d6f57 efi: libstub: only free priv.runtime_map when allocated
| * 6f9881cb4d x86/efistub: Omit physical KASLR when memory reservations exist
| * ce4e200f37 KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
| * b3c8774eb2 ASoC: rt715-sdca: volume step modification
| * ac6c005a55 ASoC: rt715: add vendor clear control register
| * ee8363381f regulator: vqmmc-ipq4019: fix module autoloading
| * 7341c2c685 ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
| * b26f1c63e6 ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
| * d611f95f97 regulator: irq_helpers: duplicate IRQ name
| * ff6e684326 ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
| * e3decad6ab sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
| * e477e2e426 selftests: sud_test: return correct emulated syscall value on RISC-V
| * 1c4ee6acdb LoongArch: Lately init pmu after smp is online
| * 70b1bf6d9e drm/amdgpu/mes: fix use-after-free issue
| * 4e68e749a8 drm/amdgpu: Fix the ring buffer size for queue VM flush
| * 3bec2fc83b drm/amdgpu: Update BO eviction priorities
| * 85a37f59d7 drm/amd/display: Set color_mgmt_changed to true on unsuspend
| * b7dd8659df net: usb: qmi_wwan: add Telit FN920C04 compositions
| * e032c4cfb1 dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
| * ac260a819a wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
| * f5273fe5f6 wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field
| * 79b1584879 wifi: mac80211: don't use rate mask for scanning
| * 2f01314049 KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
| * c2fb439f4f ALSA: Fix deadlocks with kctl removals at disconnection
| * e007476725 ALSA: core: Fix NULL module pointer assignment at card init
| * c0d7ab900c ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
| * a734ec0654 ksmbd: ignore trailing slashes in share paths
| * 14bcd802aa ksmbd: avoid to send duplicate oplock break notifications
| * 8f54c5f3c6 fs/ntfs3: Break dir enumeration if directory contents error
| * c494fe4ccd fs/ntfs3: Fix case when index is reused during tree transformation
| * df40783dc3 fs/ntfs3: Taking DOS names into account during link counting
| * 1c29c6287a fs/ntfs3: Remove max link count info display during driver init
| * 1c3844c5f4 nilfs2: fix potential hang in nilfs_detach_log_writer()
| * 61196139d7 nilfs2: fix unexpected freezing of nilfs_segctor_sync()
| * 35471c0ff1 net: smc91x: Fix m68k kernel compilation for ColdFire CPU
| * 5996b2b2da tools/nolibc/stdlib: fix memory error in realloc()
| * b7a0a5cf9e tools/latency-collector: Fix -Wformat-security compile warns
| * 54c64967ba ring-buffer: Fix a race between readers and resize checks
| * 0c48185a95 r8169: Fix possible ring buffer corruption on fragmented Tx packets.
| * 69ed8fc12b Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already"
| * 0db279c7c2 io_uring: fail NOP if non-zero op flags is passed in
| * 28cbe126ce serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
| * 78a933a618 serial: 8250_bcm7271: use default_mux_rate if possible
| * 3726f75a1c speakup: Fix sizeof() vs ARRAY_SIZE() bug
| * 8a6e6b1644 tty: n_gsm: fix missing receive state reset after mode switch
| * 46f52c89a7 tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
| * dbff5f0bfb ftrace: Fix possible use-after-free issue in ftrace_location()
| * af542630b7 x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
| * f9977e4e0c SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
* | 2061a20382 Revert "xfs: use iomap_valid method to detect stale cached iomaps"
* | ca48ea3afb Revert "iomap: write iomap validity checks"
* | c1eefaf65b Revert "binder: fix max_thread type inconsistency"
* | e4ceb55393 Merge 6.1.92 into android14-6.1-lts
|\|
| * 88690811da Linux 6.1.92
| * b1c74dad43 docs: kernel_include.py: Cope with docutils 0.21
| * cd82e9620e admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
| * 681935009f KEYS: trusted: Do not use WARN when encode fails
| * 1d9e2de245 remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
| * a6b9c5de4a serial: kgdboc: Fix NMI-safety problems from keyboard reset code
| * 3f4be9dbef usb: typec: tipd: fix event checking for tps6598x
| * f099b8127d usb: typec: ucsi: displayport: Fix potential deadlock
| * 17466488ae net: usb: ax88179_178a: fix link status when link is set to down/up
| * 341eb08dbc usb: dwc3: Wait unconditionally after issuing EndXfer command
| * e78531e8ca binder: fix max_thread type inconsistency
| * 92cb363d16 drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
| * a94cf76604 arm64: atomics: lse: remove stale dependency on JUMP_LABEL
| * d9a85a8d82 xfs: short circuit xfs_growfs_data_private() if delta is zero
| * fbdf080691 xfs: get root inode correctly at bulkstat
| * 7430ff84c2 xfs: fix log recovery when unknown rocompat bits are set
| * 4db0e08ef9 xfs: allow inode inactivation during a ro mount log recovery
| * 2cc027623e xfs: invalidate xfs_bufs when allocating cow extents
| * 537baedb3e xfs: estimate post-merge refcounts correctly
| * 131a854c09 xfs: hoist refcount record merge predicates
| * 0d889ae85f xfs: fix super block buf log item UAF during force shutdown
| * 2f1eb71ae8 xfs: wait iclog complete before tearing down AIL
| * e62c784a56 xfs: attach dquots to inode before reading data/cow fork mappings
| * 5465403341 xfs: invalidate block device page cache during unmount
| * 781f80e519 xfs: fix incorrect i_nlink caused by inode racing
| * 42163ff6c6 xfs: fix sb write verify for lazysbcount
| * 77d31f0c70 xfs: fix incorrect error-out in xfs_remove
| * e2ae64993c xfs: fix off-by-one-block in xfs_discard_folio()
| * e811fec51c xfs: drop write error injection is unfixable, remove it
| * ea67e73129 xfs: use iomap_valid method to detect stale cached iomaps
| * 54a37e5d07 iomap: write iomap validity checks
| * 580f40b4c9 xfs: xfs_bmap_punch_delalloc_range() should take a byte range
| * 38be53c3fd iomap: buffered write failure should not truncate the page cache
| * 12339ec6fe xfs,iomap: move delalloc punching to iomap
| * 8b6afad39b xfs: use byte ranges for write cleanup ranges
| * 142eafd24d xfs: punching delalloc extents on write failure is racy
| * 495e934c66 xfs: write page faults in iomap are not buffered writes
| * 493a8172e5 mmc: core: Add HS400 tuning in HS400es initialization
| * 5d91238b59 KEYS: trusted: Fix memory leak in tpm2_key_encode()
| * 104ef3d8cd nfsd: don't allow nfsd threads to be signalled.
| * cf8e6ae857 mfd: stpmic1: Fix swapped mask/unmask in irq chip
| * 026caf92c6 pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()
| * 90cbd4c081 ice: remove unnecessary duplicate checks for VF VSI ID
| * 59161a21ca ice: pass VSI pointer into ice_vc_isvalid_q_id
| * 8a94fc9d20 net: ks8851: Fix another TX stall caused by wrong ISR flag handling
| * 91402e0e5d drm/amd/display: Fix division by zero in setup_dsc_config
* | 6b10c7f4b9 ANDROID: GKI: add wait_for_completion_interruptible_timeout to db845c symbol list
* | e757b335e0 Revert "Reapply "timers: Rename del_timer_sync() to timer_delete_sync()""
* | 2587385ace Revert "timers: Rename del_timer() to timer_delete()"
* | 38eb9de84b Revert "Bluetooth: qca: add support for QCA2066"
* | 0bf7f66897 Revert "spi: introduce new helpers with using modern naming"
* | 6971d8bfbd Revert "spi: axi-spi-engine: Convert to platform remove callback returning void"
* | 31e3fe5faa Revert "spi: spi-axi-spi-engine: switch to use modern name"
* | 97cb39500a Revert "spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()"
* | b0e59b447d Revert "spi: axi-spi-engine: simplify driver data allocation"
* | 948d41cbb2 Revert "spi: axi-spi-engine: use devm_spi_alloc_host()"
* | 3a5b2c1e21 Revert "spi: axi-spi-engine: move msg state to new struct"
* | 44b32d88b0 Revert "spi: axi-spi-engine: use common AXI macros"
* | af6c59d699 Revert "spi: axi-spi-engine: fix version format string"
* | f66f5edf10 Revert "spi: Merge spi_controller.{slave,target}_abort()"
* | c313757fce Revert "mm/hugetlb: add folio support to hugetlb specific flag macros"
* | 323d7963f9 Revert "mm: add private field of first tail to struct page and struct folio"
* | edd74f93c0 Revert "mm/hugetlb: add hugetlb_folio_subpool() helpers"
* | 366b3a6494 Revert "mm/hugetlb: add folio_hstate()"
* | 6d38b404ee Revert "mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios"
* | d1bebbc8ed Revert "mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios"
* | 563a9907e2 Revert "mm/hugetlb: convert free_huge_page to folios"
* | dd84aa68cd Revert "mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios"
* | 00ebd8ec69 Revert "mm/hugetlb: fix missing hugetlb_lock for resv uncharge"
* | 0010b838db Merge 6.1.91 into android14-6.1-lts
|\|
| * 4078fa637f Linux 6.1.91
| * 8064a711c4 net: bcmgenet: synchronize UMAC_CMD access
| * 9ed299be99 net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
| * 714e053565 net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
| * ed804e9d8b net: bcmgenet: Clear RGMII_LINK upon link down
| * beaf11969f md: fix kmemleak of rdev->serial
| * ea92809e29 mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
| * 2effe407f7 mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
| * 0391c9085a btrfs: do not wait for short bulk allocation
| * e4519a0166 keys: Fix overwrite of key expiration on instantiation
| * 5056d23893 dmaengine: idxd: add a write() method for applications to submit work
| * 3e4368832e dmaengine: idxd: add a new security check to deal with a hardware erratum
| * 9ff3c42aa3 VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
| * 064688d70c Bluetooth: qca: fix firmware check error path
| * 57062aa13e Bluetooth: qca: fix info leak when fetching fw build id
| * bcccdc947d Bluetooth: qca: fix info leak when fetching board id
| * 29a475688a Bluetooth: qca: fix NVM configuration parsing
| * 1caceadfb5 Bluetooth: qca: add missing firmware sanity checks
| * 94eb9f83a4 ksmbd: do not grant v2 lease if parent lease key and epoch are not set
| * 3ae4f87ac2 ksmbd: avoid to send duplicate lease break notifications
| * a86743458b ksmbd: off ipv6only for both ipv4/ipv6 binding
| * 4e73c01b61 spi: microchip-core-qspi: fix setting spi bus clock rate
| * 07b933a1b6 regulator: core: fix debugfs creation regression
| * 7629ef6dda mm: use memalloc_nofs_save() in page_cache_ra_order()
| * a2740fe937 hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
| * 2d60ff5874 net: fix out-of-bounds access in ops_init
| * ce740545c0 drm/amd/display: Handle Y carry-over in VCP X.Y calculation
| * d8cdbd0f6c drm/i915/bios: Fix parsing backlight BDB data
| * 0dbfc73670 drm/vmwgfx: Fix invalid reads in fence signaled events
| * 89fffbdf53 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
| * c42a8c6baa mei: me: add lunar lake point M DID
| * eedaabee28 slimbus: qcom-ngd-ctrl: Add timeout for wait operation
| * a66c869b17 dyndbg: fix old BUG_ON in >control parser
| * 0b47bbc91f ASoC: ti: davinci-mcasp: Fix race condition during probe
| * 9c301fd3b0 ASoC: tegra: Fix DSPK 16-bit playback
| * 21ea04aad8 tipc: fix UAF in error path
| * 50a436d05f kmsan: compiler_types: declare __no_sanitize_or_inline
| * b56d4991cf iio: accel: mxc4005: Interrupt handling fixes
| * 50fa09df1a iio:imu: adis16475: Fix sync mode setting
| * 4b71dbe482 dt-bindings: iio: health: maxim,max30102: fix compatible check
| * 39ca83ed73 mptcp: ensure snd_nxt is properly initialized on connect
| * 9f6eb0ab4f mm/slab: make __free(kfree) accept error pointers
| * 25090e9bb0 btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
| * f0c6aae9e4 ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
| * d56d2ca03c usb: typec: tcpm: Check for port partner validity before consuming it
| * cfcd544a99 usb: typec: tcpm: unregister existing source caps before re-registration
| * d9efd3c899 usb: dwc3: core: Prevent phy suspend during init
| * bf3b0ab6fb usb: xhci-plat: Don't include xhci.h
| * 4e2ae9ff79 usb: gadget: f_fs: Fix a race condition when processing setup packets.
| * 9dac7678e1 usb: gadget: composite: fix OS descriptors w_value logic
| * 5f1d68ef5d USB: core: Fix access violation during port device removal
| * 3e7bbab8bb usb: ohci: Prevent missed ohci interrupts
| * 32a22b9f6c usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
| * 85e6aa4f6e usb: typec: ucsi: Fix connector check on init
| * 91a7af8cb3 usb: typec: ucsi: Check for notifications after init
| * 398248fc45 rust: macros: fix soundness issue in `module!` macro
| * ca99731c13 rust: module: place generated init_module() function in .init.text
| * 15eb8edb09 btf, scripts: rust: drop is_rust_module.sh
| * 0a0464cd41 rust: fix regexp in scripts/is_rust_module.sh
| * 8762bf944a rust: error: Rename to_kernel_errno() -> to_errno()
| * b548c53bc3 Reapply "drm/qxl: simplify qxl_fence_wait"
| * 4ee0941da1 firewire: nosy: ensure user_length is taken into account when fetching packet contents
| * 53f2bfce46 btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
| * 5c25b169f9 drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
| * f82f7220af MAINTAINERS: add leah to 6.1 MAINTAINERS file
| * 02f5300f68 drm/amd/display: Atom Integrated System Info v2_2 for DCN35
| * 1a51e24404 gpiolib: cdev: fix uninitialised kfifo
| * 9ed256d294 gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
| * a35ebde68c gpiolib: cdev: Add missing header(s)
| * 12bb8b6a2e dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users
| * 58cf43f758 drm/connector: Add \n to message about demoting connector force-probes
| * 35c614caea drm/meson: dw-hdmi: add bandgap setting for g12
| * be9b56b034 drm/meson: dw-hdmi: power up phy on device init
| * 72ede790f5 net: hns3: fix kernel crash when devlink reload during initialization
| * fa2c7e7646 net: hns3: fix port vlan filter not disabled issue
| * 98987f7808 net: hns3: use appropriate barrier function after setting a bit value
| * 0bb8751de1 net: hns3: release PTP resources if pf initialization failed
| * 549a2179de net: hns3: change type of numa_node_mask as nodemask_t
| * 5daf064afe net: hns3: direct return when receive a unknown mailbox message
| * 7d90032f7c net: hns3: using user configure after hardware reset
| * d5a466ab6e net/smc: fix neighbour and rtable leak in smc_ib_find_route()
| * ea0cb87402 ipv6: prevent NULL dereference in ip6_output()
| * d7ae8e8502 ipv6: annotate data-races around cnf.disable_ipv6
| * 5136ea7fa5 hsr: Simplify code for announcing HSR nodes timer setup
| * ca4e781f15 net-sysfs: convert dev->operstate reads to lockless ones
| * b086d1e82f timers: Rename del_timer() to timer_delete()
| * e2591243ce timers: Get rid of del_singleshot_timer_sync()
| * 7e3242c139 ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
| * bd78696348 net: bridge: fix corrupted ethernet header on multicast-to-unicast
| * 728a83160f phonet: fix rtm_phonet_notify() skb allocation
| * 544895ba02 hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
| * a6c70251c9 hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
| * 95c5fc8835 hwmon: (corsair-cpro) Use a separate buffer for sending commands
| * 6e4c719395 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
| * 8a3ff43dcb net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
| * 8960ff650a Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
| * e3880b531b Bluetooth: msft: fix slab-use-after-free in msft_do_close()
| * bfab2c1f79 Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
| * 13ed7cdf07 tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
| * 3fe4ef0568 tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
| * ad702338fe ARM: 9381/1: kasan: clear stale stack poison
| * 179db49d7e xfrm: Preserve vlan tags for transport mode software GRO
| * bd8f78c71d qibfs: fix dentry leak
| * f269a8ce52 perf unwind-libdw: Handle JIT-generated DSOs properly
| * cf731a5dce perf unwind-libunwind: Fix base address for .eh_frame
| * 2f5e8322cd spi: Merge spi_controller.{slave,target}_abort()
| * 53ce433a6d kbuild: rust: avoid creating temporary files
| * 56633a5e15 net:usb:qmi_wwan: support Rolling modules
| * 04fa2cfc26 drm/nouveau/dp: Don't probe eDP ports twice harder
| * ba2adb4422 fs/9p: drop inodes immediately on non-.L too
| * d063d13af7 clk: Don't hold prepare_lock when calling kref_put()
| * e4e82ef35a gpio: crystalcove: Use -ENOTSUPP consistently
| * 8ebcd16238 gpio: wcove: Use -ENOTSUPP consistently
| * f3b0226fc9 9p: explicitly deny setlease attempts
| * 5d74f4d80a fs/9p: translate O_TRUNC into OTRUNC
| * ca9b5c81f0 fs/9p: only translate RWX permissions for plain 9P2000
| * 3aba6c4ec5 iommu: mtk: fix module autoloading
| * 2f622008bf Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
| * dabf12bf99 uio_hv_generic: Don't free decrypted memory
| * 1999644d95 Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
| * 1f3484dec9 selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
| * 45289683c7 drm/amdgpu: Refine IB schedule error logging
| * a513ccd915 tools/power/turbostat: Fix uncore frequency file string
| * b002a1b321 MIPS: scall: Save thread_info.syscall unconditionally on entry
| * df541b658d gpu: host1x: Do not setup DMA for virtual devices
| * f6add0a6f7 blk-iocost: avoid out of bounds shift
| * 62b8582d93 scsi: target: Fix SELinux error when systemd-modules loads the target module
| * d38ca15be1 memblock tests: fix undefined reference to `BIT'
| * 223550f0e9 memblock tests: fix undefined reference to `panic'
| * 701248485b memblock tests: fix undefined reference to `early_pfn_to_nid'
| * e04539f513 btrfs: always clear PERTRANS metadata during commit
| * 66619d8ad3 btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
| * bc40c15851 tools/power turbostat: Fix Bzy_MHz documentation typo
| * fcdeb34d14 tools/power turbostat: Increase the limit for fd opened
| * 768b167281 tools/power turbostat: Fix added raw MSR output
| * 6fafe36617 firewire: ohci: mask bus reset interrupts between ISR and bottom half
| * 337f84a0ef ata: sata_gemini: Check clk_enable() result
| * 9c08b9a943 net: bcmgenet: Reset RBUF on first open
| * 8a26198186 block: fix overflow in blk_ioctl_discard()
| * 07e72fe943 ALSA: line6: Zero-initialize message buffers
| * c30a4ca93d scsi: ufs: core: WLUN suspend dev/link state error recovery
| * 7ec2581823 kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
| * fa6995eeb6 bpf: Check bloom filter map value size
| * 681fb3c25d btrfs: return accurate error code on open failure in open_fs_devices()
| * 1150606d47 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
| * 5f0266044d scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
| * 2a1dc2e942 net: mark racy access on sk->sk_rcvbuf
| * d6275e1028 wifi: cfg80211: fix rdev_dump_mpp() arguments order
| * ec9727406e wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
| * 5f1d833429 gfs2: Fix invalid metadata access in punch_hole
| * 6503c39398 scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
| * e25dca8db0 scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
| * 645b6a5e02 scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
| * 0936809d96 scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
| * 3a5b0378ac KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
| * a2184f533f KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
| * 7fb5793c53 powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
| * 15e1f8425f powerpc/pseries: make max polling consistent for longer H_CALLs
| * 0b59ae6b5f powerpc/pseries: Move PLPKS constants to header file
| * 5aa59e14ec powerpc/pseries: replace kmalloc with kzalloc in PLPKS driver
| * 70f64cb290 clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
| * 463c15af49 net: gro: add flush check in udp_gro_receive_segment
| * 3a1ea8a265 drm/panel: ili9341: Use predefined error codes
| * f51181ac91 drm/panel: ili9341: Respect deferred probe
| * 10cb803aff s390/qeth: Fix kernel panic after setting hsuid
| * 51ad57c9b0 vxlan: Pull inner IP header in vxlan_rcv().
| * d03a82f4f8 tipc: fix a possible memleak in tipc_buf_append
| * 989bf6fd1e net: core: reject skb_copy(_expand) for fraglist GSO skbs
| * cd37a5a08c net: bridge: fix multicast-to-unicast with fraglist GSO
| * e005d6754e spi: fix null pointer dereference within spi_sync
| * 7e52c09c28 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
| * 3636dcdafb cxgb4: Properly lock TX queue for the selftest.
| * 10452edd17 s390/cio: Ensure the copied buf is NUL terminated
| * 722d33c442 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
| * 21d458ecf4 ASoC: meson: cards: select SND_DYNAMIC_MINORS
| * 46071eeb0b ASoC: meson: axg-tdm-interface: manage formatters in trigger
| * f0f8ec97ac ASoC: meson: axg-card: make links nonatomic
| * d41a1d5c45 ASoC: meson: axg-fifo: use threaded irq to check periods
| * 821b719884 ASoC: meson: axg-fifo: use FIELD helpers
| * 52f6ac8639 net: qede: use return from qede_parse_actions()
| * 3f4a70e2ff net: qede: use return from qede_parse_flow_attr() for flow_spec
| * de5f3a63a9 net: qede: use return from qede_parse_flow_attr() for flower
| * 3b588a16ac net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
| * 160e19b95b s390/vdso: Add CFI for RA register to asm macro vdso_func
| * 39a055e607 net l2tp: drop flow hash on forward
| * 37ed6f244e nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
| * 8f11fe3ea3 octeontx2-af: avoid off-by-one read from userspace
| * 06cb37e2ba bna: ensure the copied buf is NUL terminated
| * 272bfb019f xdp: use flags field to disambiguate broadcast redirect
| * a4b30f548a s390/mm: Fix clearing storage keys for huge pages
| * 5dbc158805 s390/mm: Fix storage key clearing for guest huge pages
| * 67a8dbe10b bpf, arm64: Fix incorrect runtime stats
| * d97e7ab8c8 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
| * 5d6e336b9e spi: axi-spi-engine: fix version format string
| * 0308cf64a1 spi: axi-spi-engine: use common AXI macros
| * cde20c4150 spi: axi-spi-engine: move msg state to new struct
| * 657f211713 spi: axi-spi-engine: use devm_spi_alloc_host()
| * be632e909c spi: axi-spi-engine: simplify driver data allocation
| * aec8b34ec0 spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
| * d8309051f7 spi: spi-axi-spi-engine: switch to use modern name
| * 4a680d305e spi: axi-spi-engine: Convert to platform remove callback returning void
| * 1a8183ccf0 spi: introduce new helpers with using modern naming
| * 77fe00227f bpf: Fix a verifier verbose message
| * 264327b716 nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
| * 39dc9e1442 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
| * a81bcc6abf bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
| * a4a645d96b regulator: change devm_regulator_get_enable_optional() stub to return Ok
| * 2ec0e92dc5 regulator: change stubbed devm_regulator_get_enable to return Ok
| * ed6877bce6 regulator: mt6360: De-capitalize devicetree regulator subnodes
| * 518d5ddafe pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
| * 22975a1eb6 power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
| * 030017a83d power: rt9455: hide unused rt9455_boost_voltage_values
| * 39460d43df pinctrl: baytrail: Fix selecting gpio pinctrl state
| * 91a0840a3c pinctrl: intel: Make use of struct pinfunction and PINCTRL_PINFUNCTION()
| * 6322e368f0 pinctrl: Introduce struct pinfunction and PINCTRL_PINFUNCTION() macro
| * 8ae63bd858 nfs: Handle error of rpc_proc_register() in nfs_net_init().
| * 2b7f2d663a nfs: make the rpc_stat per net namespace
| * 9dd86e9d34 nfs: expose /proc/net/sunrpc/nfs in net namespaces
| * 5720cd5264 sunrpc: add a struct rpc_stats arg to rpc_create_args
| * 8a6c8f2876 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
| * 4880cc2233 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
| * ac7d657958 pinctrl: core: delete incorrect free in pinctrl_enable()
| * 8d93303fd0 pinctrl/meson: fix typo in PDM's pin name
| * ee2b22d388 pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
| * 98c7ed29cd smb3: missing lock when picking channel
| * ff03a8b422 cifs: use the least loaded channel for sending requests
| * fe73628b30 kbuild: specify output names separately for each emission type from rustc
| * d73ba54dad kbuild: refactor host*_flags
| * 4c806333ef mm/hugetlb: fix missing hugetlb_lock for resv uncharge
| * cc8f0d90ba mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios
| * 10de76f4cd mm/hugetlb: convert free_huge_page to folios
| * fc50e09b8b mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios
| * 8080591648 mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios
| * 6b27a1f253 mm/hugetlb: add folio_hstate()
| * 6a8af731a1 mm/hugetlb: add hugetlb_folio_subpool() helpers
| * 271227f13f mm: add private field of first tail to struct page and struct folio
| * 3283a9894d mm/hugetlb: add folio support to hugetlb specific flag macros
| * ad643241d4 Bluetooth: qca: add support for QCA2066
| * c43e5028f5 eeprom: at24: fix memory corruption race condition
| * 8a9ae7e741 eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
| * 7b05bb82ac eeprom: at24: Use dev_err_probe for nvmem register failure
| * e26c2fadef rust: kernel: require `Send` for `Module` implementations
| * b0db4caa10 wifi: nl80211: don't free NULL coalescing rule
| * c376f7ab28 dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
| * 24369172a0 dmaengine: pl330: issue_pending waits until WFP state
* f35d32242b Reapply "timers: Rename del_timer_sync() to timer_delete_sync()"
* 5b7c58806e Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
* 2b896ed3a2 Merge branch 'android14-6.1' into branch 'android14-6.1-lts'

Change-Id: I0ccb668b0bd397871bf4cdf9b68176edb682cd7a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-08-27 11:55:58 +00:00
Rick Yiu
42515e9246 ANDROID: sched: Add android_vh_set_task_comm
Vendor may have specific actions after task renamed.

Bug: 357956265
Change-Id: I78263dc023af6fd1ee2db03eee4ccb3ca3ebb278
Signed-off-by: Rick Yiu <rickyiu@google.com>
2024-08-26 19:43:55 +00:00
John Stultz
0f23336b97 BACKPORT: UPSTREAM: sched: Move psi_account_irqtime() out of update_rq_clock_task() hotpath
It was reported that in moving to 6.1, a larger then 10%
regression was seen in the performance of
clock_gettime(CLOCK_THREAD_CPUTIME_ID,...).

Using a simple reproducer, I found:
5.10:
100000000 calls in 24345994193 ns => 243.460 ns per call
100000000 calls in 24288172050 ns => 242.882 ns per call
100000000 calls in 24289135225 ns => 242.891 ns per call

6.1:
100000000 calls in 28248646742 ns => 282.486 ns per call
100000000 calls in 28227055067 ns => 282.271 ns per call
100000000 calls in 28177471287 ns => 281.775 ns per call

The cause of this was finally narrowed down to the addition of
psi_account_irqtime() in update_rq_clock_task(), in commit
52b1364ba0 ("sched/psi: Add PSI_IRQ to track IRQ/SOFTIRQ
pressure").

In my initial attempt to resolve this, I leaned towards moving
all accounting work out of the clock_gettime() call path, but it
wasn't very pretty, so it will have to wait for a later deeper
rework. Instead, Peter shared this approach:

Rework psi_account_irqtime() to use its own psi_irq_time base
for accounting, and move it out of the hotpath, calling it
instead from sched_tick() and __schedule().

In testing this, we found the importance of ensuring
psi_account_irqtime() is run under the rq_lock, which Johannes
Weiner helpfully explained, so also add some lockdep annotations
to make that requirement clear.

With this change the performance is back in-line with 5.10:
6.1+fix:
100000000 calls in 24297324597 ns => 242.973 ns per call
100000000 calls in 24318869234 ns => 243.189 ns per call
100000000 calls in 24291564588 ns => 242.916 ns per call

Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ben Segall <bsegall@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Chengming Zhou <zhouchengming@bytedance.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: Qais Yousef <qyousef@layalina.io>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: kernel-team@android.com

Reported-by: Jimmy Shiu <jimmyshiu@google.com>
Originally-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Chengming Zhou <chengming.zhou@linux.dev>
Reviewed-by: Qais Yousef <qyousef@layalina.io>
Link: https://lore.kernel.org/r/20240618215909.4099720-1-jstultz@google.com
Change-Id: I5c4f04d047ca0aa11fccaec9a034dfe60dbeb295
Bug: 343748421
(cherry picked from commit ddae0ca2a8fe12d0e24ab10ba759c3fbd755ada8)
[jstultz: Backported and reworked to use per-cpu values instead of
 adding a field to the struct rq]
Signed-off-by: John Stultz <jstultz@google.com>
2024-08-26 17:50:58 +00:00
Carlos Llamas
370ea8bc2e FROMLIST: binder: fix UAF caused by offsets overwrite
Binder objects are processed and copied individually into the target
buffer during transactions. Any raw data in-between these objects is
copied as well. However, this raw data copy lacks an out-of-bounds
check. If the raw data exceeds the data section size then the copy
overwrites the offsets section. This eventually triggers an error that
attempts to unwind the processed objects. However, at this point the
offsets used to index these objects are now corrupted.

Unwinding with corrupted offsets can result in decrements of arbitrary
nodes and lead to their premature release. Other users of such nodes are
left with a dangling pointer triggering a use-after-free. This issue is
made evident by the following KASAN report (trimmed):

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743

  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_free_buf+0x128/0x434
   binder_thread_write+0x8a4/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Allocated by task 743:
   __kmalloc_cache_noprof+0x110/0x270
   binder_new_node+0x50/0x700
   binder_transaction+0x413c/0x6da8
   binder_thread_write+0x978/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Freed by task 745:
   kfree+0xbc/0x208
   binder_thread_read+0x1c5c/0x37d4
   binder_ioctl+0x16d8/0x258c
  [...]
  ==================================================================

To avoid this issue, let's check that the raw data copy is within the
boundaries of the data section.

Fixes: 6d98eb95b4 ("binder: avoid potential data leakage when copying txn")
Cc: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 352520660
Link: https://lore.kernel.org/all/20240822182353.2129600-1-cmllamas@google.com/
Change-Id: I1b2dd8403b63e5eeb58904558b7b542141c83fc2
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-08-26 16:41:49 +00:00
Carlos Llamas
f8f9a197f4 ANDROID: binder: fix KMI-break due to proc->dmap
Add 'struct binder_proc_wrap' to support the addition of new members in
'struct binder_proc' without breaking the KMI. In this case, proc->dmap
was backported from upstream and needs to be migrated into this wrapper.

Avoids the following KMI issue:

  function symbol 'int __traceiter_binder_transaction_received(void*, struct binder_transaction*)' changed
    CRC changed from 0x74e9c98b to 0x7af6cf5a

  type 'struct binder_proc' changed
    byte size changed from 584 to 600
    member 'struct dbitmap dmap' was added
    16 members ('struct list_head todo' .. 'u64 android_oem_data1') changed
      offset changed by 128

Bug: 298520209
Change-Id: Icbbee14a8f16d0881faf8d5673582e785f98e8cf
Signed-off-by: Carlos Llamas <cmllamas@google.com>
(cherry picked from commit af55892f201c8f709725d75d306b1cdd20984b97)
[cmllamas: merge binder_proc_wrap_entry() with new proc_wrapper()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-08-23 16:56:13 +00:00
Carlos Llamas
a55053f3a8 UPSTREAM: binder: fix descriptor lookup for context manager
In commit 15d9da3f818c ("binder: use bitmap for faster descriptor
lookup"), it was incorrectly assumed that references to the context
manager node should always get descriptor zero assigned to them.

However, if the context manager dies and a new process takes its place,
then assigning descriptor zero to the new context manager might lead to
collisions, as there could still be references to the older node. This
issue was reported by syzbot with the following trace:

  kernel BUG at drivers/android/binder.c:1173!
  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 1 PID: 447 Comm: binder-util Not tainted 6.10.0-rc6-00348-g31643d84b8c3 #10
  Hardware name: linux,dummy-virt (DT)
  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  pc : binder_inc_ref_for_node+0x500/0x544
  lr : binder_inc_ref_for_node+0x1e4/0x544
  sp : ffff80008112b940
  x29: ffff80008112b940 x28: ffff0e0e40310780 x27: 0000000000000000
  x26: 0000000000000001 x25: ffff0e0e40310738 x24: ffff0e0e4089ba34
  x23: ffff0e0e40310b00 x22: ffff80008112bb50 x21: ffffaf7b8f246970
  x20: ffffaf7b8f773f08 x19: ffff0e0e4089b800 x18: 0000000000000000
  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002de4aa60
  x14: 0000000000000000 x13: 2de4acf000000000 x12: 0000000000000020
  x11: 0000000000000018 x10: 0000000000000020 x9 : ffffaf7b90601000
  x8 : ffff0e0e48739140 x7 : 0000000000000000 x6 : 000000000000003f
  x5 : ffff0e0e40310b28 x4 : 0000000000000000 x3 : ffff0e0e40310720
  x2 : ffff0e0e40310728 x1 : 0000000000000000 x0 : ffff0e0e40310710
  Call trace:
   binder_inc_ref_for_node+0x500/0x544
   binder_transaction+0xf68/0x2620
   binder_thread_write+0x5bc/0x139c
   binder_ioctl+0xef4/0x10c8
  [...]

This patch adds back the previous behavior of assigning the next
non-zero descriptor if references to previous context managers still
exist. It amends both strategies, the newer dbitmap code and also the
legacy slow_desc_lookup_olocked(), by allowing them to start looking
for available descriptors at a given offset.

Fixes: 15d9da3f818c ("binder: use bitmap for faster descriptor lookup")
Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+3dae065ca76952a67257@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000c1c0a0061d1e6979@google.com/
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240722150512.4192473-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 298520209
Change-Id: I5b888c138163eff263239ebcc85c59cd7f26d64f
(cherry picked from commit 11512c197d387b59569d3a93af93de204d3bdaa6)
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-08-23 16:56:03 +00:00
Carlos Llamas
c5f1e68340 BACKPORT: binder: use bitmap for faster descriptor lookup
When creating new binder references, the driver assigns a descriptor id
that is shared with userspace. Regrettably, the driver needs to keep the
descriptors small enough to accommodate userspace potentially using them
as Vector indexes. Currently, the driver performs a linear search on the
rb-tree of references to find the smallest available descriptor id. This
approach, however, scales poorly as the number of references grows.

This patch introduces the usage of bitmaps to boost the performance of
descriptor assignments. This optimization results in notable performance
gains, particularly in processes with a large number of references. The
following benchmark with 100,000 references showcases the difference in
latency between the dbitmap implementation and the legacy approach:

  [  587.145098] get_ref_desc_olocked: 15us (dbitmap on)
  [  602.788623] get_ref_desc_olocked: 47343us (dbitmap off)

Note the bitmap size is dynamically adjusted in line with the number of
references, ensuring efficient memory usage. In cases where growing the
bitmap is not possible, the driver falls back to the slow legacy method.

A previous attempt to solve this issue was proposed in [1]. However,
such method involved adding new ioctls which isn't great, plus older
userspace code would not have benefited from the optimizations either.

Link: https://lore.kernel.org/all/20240417191418.1341988-1-cmllamas@google.com/ [1]
Cc: Tim Murray <timmurray@google.com>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Martijn Coenen <maco@android.com>
Cc: Todd Kjos <tkjos@android.com>
Cc: John Stultz <jstultz@google.com>
Cc: Steven Moreland <smoreland@google.com>
Suggested-by: Nick Chen <chenjia3@oppo.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240612042535.1556708-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 298520209
Change-Id: Iaf32794ab7786c603706f6806cabec9d031559a2
(cherry picked from commit 15d9da3f818cae676f822a04407d3c17b53357d2)
[cmllamas: fixed trivial conflicts with KMI work-around]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-08-23 16:55:46 +00:00
Peter Zijlstra
514bdc80b9 UPSTREAM: perf/core: Fix potential NULL deref
Smatch is awesome.

BUG: 361274701
(cherry picked from commit a71ef31485)
Fixes: 32671e3799 ("perf: Disallow mis-matched inherited group reads")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Change-Id: I7691e0aaaee70f1d0db3d1e33983d7236f72ed0c
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: 杨辉 <yanghui10@xiaomi.corp-partner.google.com>
2024-08-22 17:25:38 +00:00
Peter Wang
faf32723dc BACKPORT: scsi: ufs: core: Fix ufshcd_abort_one racing issue
When ufshcd_abort_one is racing with the completion ISR, the completed tag
of the request's mq_hctx pointer will be set to NULL by ISR.  Return
success when request is completed by ISR because ufshcd_abort_one does not
need to do anything.

The racing flow is:

Thread A
ufshcd_err_handler					step 1
	...
	ufshcd_abort_one
		ufshcd_try_to_abort_task
			ufshcd_cmd_inflight(true)	step 3
		ufshcd_mcq_req_to_hwq
			blk_mq_unique_tag
				rq->mq_hctx->queue_num	step 5

Thread B
ufs_mtk_mcq_intr(cq complete ISR)			step 2
	scsi_done
		...
		__blk_mq_free_request
			rq->mq_hctx = NULL;		step 4

Below is KE back trace.
  ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.
  ufshcd_try_to_abort_task: cmd at tag=41 is cleared.
  Aborting tag 41 / CDB 0x28 succeeded
  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
  pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14
  lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]
   do_mem_abort+0x58/0x118
   el1_abort+0x3c/0x5c
   el1h_64_sync_handler+0x54/0x90
   el1h_64_sync+0x68/0x6c
   blk_mq_unique_tag+0x8/0x14
   ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]
   process_one_work+0x208/0x4fc
   worker_thread+0x228/0x438
   kthread+0x104/0x1d4
   ret_from_fork+0x10/0x20

Bug: 361140026

Fixes: 93e6c0e19d5b ("scsi: ufs: core: Clear cmd if abort succeeds in MCQ mode")
Suggested-by: Bart Van Assche <bvanassche@acm.org>
Change-Id: I42f9b93dae33eac8cf41ac3085858b6adf0ee9ee
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20240628070030.30929-3-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 74736103fb4123c71bf11fb7a6abe7c884c5269e)
[ Resolved minor conflict in drivers/ufs/core/ufshcd.c ]
2024-08-21 18:22:23 +00:00
Peter Wang
4d735ca7bb BACKPORT: scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
When ufshcd_clear_cmd is racing with the completion ISR, the completed tag
of the request's mq_hctx pointer will be set to NULL by the ISR.  And
ufshcd_clear_cmd's call to ufshcd_mcq_req_to_hwq will get NULL pointer KE.
Return success when the request is completed by ISR because sq does not
need cleanup.

The racing flow is:

Thread A
ufshcd_err_handler					step 1
	ufshcd_try_to_abort_task
		ufshcd_cmd_inflight(true)		step 3
		ufshcd_clear_cmd
			...
			ufshcd_mcq_req_to_hwq
			blk_mq_unique_tag
				rq->mq_hctx->queue_num	step 5

Thread B
ufs_mtk_mcq_intr(cq complete ISR)			step 2
	scsi_done
		...
		__blk_mq_free_request
			rq->mq_hctx = NULL;		step 4

Below is KE back trace:

  ufshcd_try_to_abort_task: cmd pending in the device. tag = 6
  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
   pc : [0xffffffd589679bf8] blk_mq_unique_tag+0x8/0x14
   lr : [0xffffffd5862f95b4] ufshcd_mcq_sq_cleanup+0x6c/0x1cc [ufs_mediatek_mod_ise]
   Workqueue: ufs_eh_wq_0 ufshcd_err_handler [ufs_mediatek_mod_ise]
   Call trace:
    dump_backtrace+0xf8/0x148
    show_stack+0x18/0x24
    dump_stack_lvl+0x60/0x7c
    dump_stack+0x18/0x3c
    mrdump_common_die+0x24c/0x398 [mrdump]
    ipanic_die+0x20/0x34 [mrdump]
    notify_die+0x80/0xd8
    die+0x94/0x2b8
    __do_kernel_fault+0x264/0x298
    do_page_fault+0xa4/0x4b8
    do_translation_fault+0x38/0x54
    do_mem_abort+0x58/0x118
    el1_abort+0x3c/0x5c
    el1h_64_sync_handler+0x54/0x90
    el1h_64_sync+0x68/0x6c
    blk_mq_unique_tag+0x8/0x14
    ufshcd_clear_cmd+0x34/0x118 [ufs_mediatek_mod_ise]
    ufshcd_try_to_abort_task+0x2c8/0x5b4 [ufs_mediatek_mod_ise]
    ufshcd_err_handler+0xa7c/0xfa8 [ufs_mediatek_mod_ise]
    process_one_work+0x208/0x4fc
    worker_thread+0x228/0x438
    kthread+0x104/0x1d4
    ret_from_fork+0x10/0x20

Bug: 361140026

Fixes: 8d72903489 ("scsi: ufs: mcq: Add supporting functions for MCQ abort")
Suggested-by: Bart Van Assche <bvanassche@acm.org>
Change-Id: I59fc0a8246d2fc2421e38c42b619b2393d2b22e6
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20240628070030.30929-2-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 9307a998cb9846a2557fdca286997430bee36a2a)
[ Resolved minor conflict in drivers/ufs/core/ufshcd.c ]
2024-08-21 18:22:23 +00:00
Dongli Zhang
edca080b95 BACKPORT: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of
interrupt affinity reconfiguration via procfs. Instead, the change is
deferred until the next instance of the interrupt being triggered on the
original CPU.

When the interrupt next triggers on the original CPU, the new affinity is
enforced within __irq_move_irq(). A vector is allocated from the new CPU,
but the old vector on the original CPU remains and is not immediately
reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming
process is delayed until the next trigger of the interrupt on the new CPU.

Upon the subsequent triggering of the interrupt on the new CPU,
irq_complete_move() adds a task to the old CPU's vector_cleanup list if it
remains online. Subsequently, the timer on the old CPU iterates over its
vector_cleanup list, reclaiming old vectors.

However, a rare scenario arises if the old CPU is outgoing before the
interrupt triggers again on the new CPU.

In that case irq_force_complete_move() is not invoked on the outgoing CPU
to reclaim the old apicd->prev_vector because the interrupt isn't currently
affine to the outgoing CPU, and irq_needs_fixup() returns false. Even
though __vector_schedule_cleanup() is later called on the new CPU, it
doesn't reclaim apicd->prev_vector; instead, it simply resets both
apicd->move_in_progress and apicd->prev_vector to 0.

As a result, the vector remains unreclaimed in vector_matrix, leading to a
CPU vector leak.

To address this issue, move the invocation of irq_force_complete_move()
before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the
interrupt is currently or used to be affine to the outgoing CPU.

Additionally, reclaim the vector in __vector_schedule_cleanup() as well,
following a warning message, although theoretically it should never see
apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.

Fixes: f0383c24b4 ("genirq/cpuhotplug: Add support for cleaning up move in progress")
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240522220218.162423-1-dongli.zhang@oracle.com
Bug: 359158960
Change-Id: Ib9a564add4cd1c90ec725ab7f0bdc0db505ae29f
(cherry picked from commit a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2024-08-19 10:46:46 -07:00
Dongli Zhang
a339e02cde UPSTREAM: genirq/cpuhotplug: Retry with cpu_online_mask when migration fails
When a CPU goes offline, the interrupts affine to that CPU are
re-configured.

Managed interrupts undergo either migration to other CPUs or shutdown if
all CPUs listed in the affinity are offline. The migration of managed
interrupts is guaranteed on x86 because there are interrupt vectors
reserved.

Regular interrupts are migrated to a still online CPU in the affinity mask
or if there is no online CPU to any online CPU.

This works as long as the still online CPUs in the affinity mask have
interrupt vectors available, but in case that none of those CPUs has a
vector available the migration fails and the device interrupt becomes
stale.

This is not any different from the case where the affinity mask does not
contain any online CPU, but there is no fallback operation for this.

Instead of giving up, retry the migration attempt with the online CPU mask
if the interrupt is not managed, as managed interrupts cannot be affected
by this problem.

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20240423073413.79625-1-dongli.zhang@oracle.com
Bug: 359158960
Change-Id: I3e8acfe0598b0cb94389115d680d2216833d6a0c
(cherry picked from commit 88d724e2301a69c1ab805cd74fc27aa36ae529e0)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2024-08-19 10:32:18 -07:00
David Stevens
bd59305571 UPSTREAM: genirq/cpuhotplug: Skip suspended interrupts when restoring affinity
irq_restore_affinity_of_irq() restarts managed interrupts unconditionally
when the first CPU in the affinity mask comes online. That's correct during
normal hotplug operations, but not when resuming from S3 because the
drivers are not resumed yet and interrupt delivery is not expected by them.

Skip the startup of suspended interrupts and let resume_device_irqs() deal
with restoring them. This ensures that irqs are not delivered to drivers
during the noirq phase of resuming from S3, after non-boot CPUs are brought
back online.

Signed-off-by: David Stevens <stevensd@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20240424090341.72236-1-stevensd@chromium.org
Bug: 359158960
Change-Id: Ie5610f7dffe05a141e6db1a8b6b067845c910b4a
(cherry picked from commit a60dd06af674d3bb76b40da5d722e4a0ecefe650)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2024-08-19 10:32:12 -07:00
Andrew Halaney
d6a513a784 UPSTREAM: scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H
Currently, the UTP_TASK_REQ_LIST_BASE_L/UTP_TASK_REQ_LIST_BASE_H regs are
written to and then completed with an mb().

mb() ensures that the write completes, but completion doesn't mean that it
isn't stored in a buffer somewhere. The recommendation for ensuring these
bits have taken effect on the device is to perform a read back to force it
to make it all the way to the device. This is documented in device-io.rst
and a talk by Will Deacon on this can be seen over here:

    https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678

Let's do that to ensure the bits hit the device. Because the mb()'s purpose
wasn't to add extra ordering (on top of the ordering guaranteed by
writel()/readl()), it can safely be removed.

Bug: 254441685
Fixes: 88441a8d35 ("scsi: ufs: core: Add hibernation callbacks")
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Can Guo <quic_cang@quicinc.com>
Signed-off-by: Andrew Halaney <ahalaney@redhat.com>
Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-7-181252004586@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 408e28086f1c7a6423efc79926a43d7001902fae)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iadf1f45aebea54393365a5387d35440aa5df3e00
2024-08-15 13:50:18 +00:00
Ryan Roberts
64b0e0b285 UPSTREAM: mm/userfaultfd: UFFDIO_MOVE implementation should use ptep_get()
Commit c33c794828 ("mm: ptep_get() conversion") converted all (non-arch)
call sites to use ptep_get() instead of doing a direct dereference of the
pte.  Full rationale can be found in that commit's log.

Since then, UFFDIO_MOVE has been implemented which does 7 direct pte
dereferences.  Let's fix those up to use ptep_get().

I've asserted in the past that there is no reliable automated mechanism to
catch these; I'm relying on a combination of Coccinelle (which throws up a
lot of false positives) and some compiler magic to force a compiler error
on dereference.  But given the frequency with which new issues are coming
up, I'll add it to my todo list to try to find an automated solution.

Bug: 254441685
Link: https://lkml.kernel.org/r/20240123141755.3836179-1-ryan.roberts@arm.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 56ae10cf628b02279980d17439c6241a643959c2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I0573208f1c7ad5085e0f7e82d484199074a5f6ef
2024-08-14 18:12:47 +00:00
Wenjie Qi
5fc3f5b48a UPSTREAM: f2fs: fix NULL pointer dereference in f2fs_submit_page_write()
BUG: kernel NULL pointer dereference, address: 0000000000000014
RIP: 0010:f2fs_submit_page_write+0x6cf/0x780 [f2fs]
Call Trace:
<TASK>
? show_regs+0x6e/0x80
? __die+0x29/0x70
? page_fault_oops+0x154/0x4a0
? prb_read_valid+0x20/0x30
? __irq_work_queue_local+0x39/0xd0
? irq_work_queue+0x36/0x70
? do_user_addr_fault+0x314/0x6c0
? exc_page_fault+0x7d/0x190
? asm_exc_page_fault+0x2b/0x30
? f2fs_submit_page_write+0x6cf/0x780 [f2fs]
? f2fs_submit_page_write+0x736/0x780 [f2fs]
do_write_page+0x50/0x170 [f2fs]
f2fs_outplace_write_data+0x61/0xb0 [f2fs]
f2fs_do_write_data_page+0x3f8/0x660 [f2fs]
f2fs_write_single_data_page+0x5bb/0x7a0 [f2fs]
f2fs_write_cache_pages+0x3da/0xbe0 [f2fs]
...
It is possible that other threads have added this fio to io->bio
and submitted the io->bio before entering f2fs_submit_page_write().
At this point io->bio = NULL.
If is_end_zone_blkaddr(sbi, fio->new_blkaddr) of this fio is true,
then an NULL pointer dereference error occurs at bio_get(io->bio).
The original code for determining zone end was after "out:",
which would have missed some fio who is zone end. I've moved
 this code before "skip:" to make sure it's done for each fio.

Bug: 254441685
Fixes: e067dc3c6b ("f2fs: maintain six open zones for zoned devices")
Signed-off-by: Wenjie Qi <qwjhust@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit c2034ef6192a65a986a45c2aa2ed05824fdc0e9f)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I98714afbda136a8932eaa417fff129bd4db61b26
2024-08-14 18:12:47 +00:00
Chao Yu
a8e77a7072 UPSTREAM: f2fs: zone: fix to wait completion of last bio in zone correctly
It needs to check last zone_pending_bio and wait IO completion before
traverse next fio in io->io_list, otherwise, bio in next zone may be
submitted before all IO completion in current zone.

Bug: 254441685
Fixes: e067dc3c6b ("f2fs: maintain six open zones for zoned devices")
Cc: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Reviewed-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 536af8211586af09c5bea1c15ad28ddec5f66a97)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ifefc2c6fbda3aae00cef3650cafe48b496da65ca
2024-08-14 18:12:47 +00:00
Ashish Mhetre
66e0c14580 UPSTREAM: iommu: Don't reserve 0-length IOVA region
When the bootloader/firmware doesn't setup the framebuffers, their
address and size are 0 in "iommu-addresses" property. If IOVA region is
reserved with 0 length, then it ends up corrupting the IOVA rbtree with
an entry which has pfn_hi < pfn_lo.
If we intend to use display driver in kernel without framebuffer then
it's causing the display IOMMU mappings to fail as entire valid IOVA
space is reserved when address and length are passed as 0.
An ideal solution would be firmware removing the "iommu-addresses"
property and corresponding "memory-region" if display is not present.
But the kernel should be able to handle this by checking for size of
IOVA region and skipping the IOVA reservation if size is 0. Also, add
a warning if firmware is requesting 0-length IOVA region reservation.

Bug: 254441685
Fixes: a5bf3cfce8 ("iommu: Implement of_iommu_get_resv_regions()")
Signed-off-by: Ashish Mhetre <amhetre@nvidia.com>
Acked-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20231205065656.9544-1-amhetre@nvidia.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit bb57f6705960bebeb832142ce9abf43220c3eab1)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I2484452356e69ecafc006246313d5c92fe9f1509
2024-08-14 18:09:08 +00:00
Daniel Mentz
793280fe93 UPSTREAM: iommu: Fix printk arg in of_iommu_get_resv_regions()
The variable phys is defined as (struct resource *) which aligns with
the printk format specifier %pr. Taking the address of it results in a
value of type (struct resource **) which is incompatible with the format
specifier %pr. Therefore, remove the address of operator (&).

Bug: 254441685
Fixes: a5bf3cfce8 ("iommu: Implement of_iommu_get_resv_regions()")
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20231108062226.928985-1-danielmentz@google.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit c2183b3dcc9dd41b768569ea88bededa58cceebb)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I36e8878d09f8cb3ff12280fbb535bfb8df682055
2024-08-14 18:09:08 +00:00
Laurentiu Tudor
f3d71968c1 UPSTREAM: iommu: Map reserved memory as cacheable if device is coherent
Check if the device is marked as DMA coherent in the DT and if so,
map its reserved memory as cacheable in the IOMMU.
This fixes the recently added IOMMU reserved memory support which
uses IOMMU_RESV_DIRECT without properly building the PROT for the
mapping.

Bug: 254441685
Fixes: a5bf3cfce8 ("iommu: Implement of_iommu_get_resv_regions()")
Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230926152600.8749-1-laurentiu.tudor@nxp.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit f1aad9df93f39267e890836a28d22511f23474e1)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic6738822da32e134af9dd3ed5737e611dffe85c9
2024-08-14 18:09:08 +00:00
Jens Axboe
7d59065aa4 BACKPORT: io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval
A previous commit added a trylock for getting the SQPOLL thread info via
fdinfo, but this introduced a regression where we often fail to get it if
the thread is busy. For that case, we end up not printing the current CPU
and PID info.

Rather than rely on this lock, just print the pid we already stored in
the io_sq_data struct, and ensure we update the current CPU every time
we've slept or potentially rescheduled. The latter won't potentially be
100% accurate, but that wasn't the case before either as the task can
get migrated at any time unless it has been pinned at creation time.

We retain keeping the io_sq_data dereference inside the ctx->uring_lock,
as it has always been, as destruction of the thread and data happen below
that. We could make this RCU safe, but there's little point in doing that.

With this, we always print the last valid information we had, rather than
have spurious outputs with missing information.

Bug: 254441685
Fixes: 7644b1a1c9 ("io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit a0d45c3f596be53c1bd8822a1984532d14fdcea9)
[Lee: PF_NO_SETAFFINITY has been removed upstream causing surrounding diff to change]
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iab4aeffb443ed5140b33dd7274fee57c36f40f9e
2024-08-14 18:09:08 +00:00
Johannes Berg
30c4764908 UPSTREAM: wifi: cfg80211: fix assoc response warning on failed links
The warning here shouldn't be done before we even set the
bss field (or should've used the input data). Move the
assignment before the warning to fix it.

We noticed this now because of Wen's bugfix, where the bug
fixed there had previously hidden this other bug.

Bug: 254441685
Fixes: 53ad07e982 ("wifi: cfg80211: support reporting failed links")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit c434b2be2d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ibc3b59e9c61b74a9dbc25ddb2ee75f220bd0f5ae
2024-08-14 18:09:08 +00:00
Badhri Jagan Sridharan
7f2d1a477c UPSTREAM: usb: typec: tcpm: Add additional checks for contaminant
When transitioning from SNK_DEBOUNCED to unattached, its worthwhile to
check for contaminant to mitigate wakeups.

```
[81334.219571] Start toggling
[81334.228220] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
[81334.305147] CC1: 0 -> 0, CC2: 0 -> 3 [state TOGGLING, polarity 0, connected]
[81334.305162] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS]
[81334.305187] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS]
[81334.475515] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms]
[81334.486480] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_DEBOUNCED, polarity 0, disconnected]
[81334.486495] state change SNK_DEBOUNCED -> SNK_DEBOUNCED [rev3 NONE_AMS]
[81334.486515] pending state change SNK_DEBOUNCED -> SNK_UNATTACHED @ 20 ms [rev3 NONE_AMS]
[81334.506621] state change SNK_DEBOUNCED -> SNK_UNATTACHED [delayed 20 ms]
[81334.506640] Start toggling
[81334.516972] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
[81334.592759] CC1: 0 -> 0, CC2: 0 -> 3 [state TOGGLING, polarity 0, connected]
[81334.592773] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS]
[81334.592792] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS]
[81334.762940] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms]
[81334.773557] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_DEBOUNCED, polarity 0, disconnected]
[81334.773570] state change SNK_DEBOUNCED -> SNK_DEBOUNCED [rev3 NONE_AMS]
[81334.773588] pending state change SNK_DEBOUNCED -> SNK_UNATTACHED @ 20 ms [rev3 NONE_AMS]
[81334.793672] state change SNK_DEBOUNCED -> SNK_UNATTACHED [delayed 20 ms]
[81334.793681] Start toggling
[81334.801840] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
[81334.878655] CC1: 0 -> 0, CC2: 0 -> 3 [state TOGGLING, polarity 0, connected]
[81334.878672] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS]
[81334.878696] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS]
[81335.048968] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms]
[81335.060684] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_DEBOUNCED, polarity 0, disconnected]
[81335.060754] state change SNK_DEBOUNCED -> SNK_DEBOUNCED [rev3 NONE_AMS]
[81335.060775] pending state change SNK_DEBOUNCED -> SNK_UNATTACHED @ 20 ms [rev3 NONE_AMS]
[81335.080884] state change SNK_DEBOUNCED -> SNK_UNATTACHED [delayed 20 ms]
[81335.080900] Start toggling
```

Bug: 254441685
Cc: stable@vger.kernel.org
Fixes: 599f008c25 ("usb: typec: tcpm: Add callbacks to mitigate wakeups due to contaminant")
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231015053108.2349570-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1a4a2df07c1f087704c24282cebe882268e38146)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I6251bd1c032515d96385744a751f792af54b2a31
2024-08-14 18:09:08 +00:00
Xiu Jianfeng
8dabbe8363 UPSTREAM: mm: remove duplicated vma->vm_flags check when expanding stack
expand_upwards() and expand_downwards() will return -EFAULT if VM_GROWSUP
or VM_GROWSDOWN is not correctly set in vma->vm_flags, however in
!CONFIG_STACK_GROWSUP case, expand_stack_locked() returns -EINVAL first if
!(vma->vm_flags & VM_GROWSDOWN) before calling expand_downwards(), to keep
the consistency with CONFIG_STACK_GROWSUP case, remove this check.

The usages of this function are as below:

A:fs/exec.c
ret = expand_stack_locked(vma, stack_base);
if (ret)
	ret = -EFAULT;

or

B:mm/memory.c mm/mmap.c
if (expand_stack_locked(vma, addr))
	return NULL;

which means the return value will not propagate to other places, so I
believe there is no user-visible effects of this change, and it's
unnecessary to backport to earlier versions.

Bug: 254441685
Link: https://lkml.kernel.org/r/20230906103312.645712-1-xiujianfeng@huaweicloud.com
Fixes: f440fa1ac9 ("mm: make find_extend_vma() fail if write lock not held")
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Cc: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 7fa38d0ea00ffe2cd3c95c96c85221b8ae221875)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ibb98909a9f9f07b64e339a55cb583b357f9d964b
2024-08-14 18:09:08 +00:00
Minchan Kim
ab384f79d4 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - bitmap_find_free_region
  - bitmap_release_region
  - of_graph_get_endpoint_by_regs
  - __traceiter_android_rvh_mapping_shrinkable
  - __traceiter_android_rvh_util_est_update
  - __tracepoint_android_rvh_mapping_shrinkable
  - __tracepoint_android_rvh_util_est_update

Bug: 347958166
Change-Id: I4feadf95bf24da1a1554a828e181d4ec65cc9a32
Signed-off-by: Minchan Kim <minchan@google.com>
2024-08-13 20:24:01 +00:00
Minchan Kim
bbf690e531 ANDROID: add vendor hook for mapping_shrinkable
To control inode memory reclaim, add restricted vendor hook.

Bug: 347958166
Change-Id: Iefb9ef66c9fd5abae99adb1200263e4642f991cc
Signed-off-by: Minchan Kim <minchan@google.com>
2024-08-13 20:23:47 +00:00
Bart Van Assche
660e1a2695 FROMLIST: sd: Retry START STOP UNIT commands
During system resume, sd_start_stop_device() submits a START STOP UNIT
command to the SCSI device that is being resumed. That command is not
retried in case of a unit attention and hence may fail. An example:

[16575.983359] sd 0:0:0:3: [sdd] Starting disk
[16575.983693] sd 0:0:0:3: [sdd] Start/Stop Unit failed: Result: hostbyte=0x00 driverbyte=DRIVER_OK
[16575.983712] sd 0:0:0:3: [sdd] Sense Key : 0x6
[16575.983730] sd 0:0:0:3: [sdd] ASC=0x29 ASCQ=0x0
[16575.983738] sd 0:0:0:3: PM: dpm_run_callback(): scsi_bus_resume+0x0/0xa0 returns -5
[16575.983783] sd 0:0:0:3: PM: failed to resume async: error -5

Make the SCSI core retry the START STOP UNIT command if a retryable
error is encountered.

Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Mike Christie <michael.christie@oracle.com>
Change-Id: Ic8e0859c4455d93fcabee42f1598858571f5f3d1
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 348341595
Link: https://lore.kernel.org/linux-scsi/yq17ccp1i4b.fsf@ca-mkp.ca.oracle.com/T/#m52a26a50649b1d537cb129e5653f723509d6bde7
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2024-08-13 19:10:55 +00:00
Bart Van Assche
4ab8dafa79 FROMLIST: scsi: core: Retry passthrough commands if SCMD_RETRY_PASSTHROUGH is set
The SCSI core does not retry passthrough commands even if the SCSI device
reports a retryable unit attention condition. Support retrying in this case
by introducing the SCMD_RETRY_PASSTHROUGH flag.

Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Bug: 348341595
Link: https://lore.kernel.org/linux-scsi/yq17ccp1i4b.fsf@ca-mkp.ca.oracle.com/T/#mfdb1a3a0d6d4803afe1098bdafc12fd4168e30e0
Change-Id: I44092a0d8853fd61bf619e5bae6d65eaaddad780
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2024-08-13 19:10:55 +00:00
Seiya Wang
8288de8306 ANDROID: GKI: Update symbol list for mtk
1 function symbol(s) added
  'struct snd_kcontrol* snd_soc_cnew(const struct snd_kcontrol_new*, void*, const char*, const char*)'

Bug: 359437271
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
Change-Id: I53d2771c95cabfc6931a83eb43e1499b9de8bc8b
2024-08-13 09:48:27 +00:00
Greg Kroah-Hartman
9d37e2aae7 ANDROID: add __module_get to db854c symbol list.
In commit e448d1bad7 ("net: qrtr: ns: Fix module refcnt"), a bug was
fixed with regards to reference counting, so now this build target needs
acces to the __module_get symbol (it's already part of the normal
supported list, just not for this target.)

Fixes: e448d1bad7 ("net: qrtr: ns: Fix module refcnt")
Change-Id: Iba1a30ba306340318e88120bd87f7e318554f095
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-08-12 16:32:49 +00:00
Greg Kroah-Hartman
5ccfb1bf19 Revert "drm/mipi-dsi: use correct return type for the DSC functions"
This reverts commit 26f73934ee which is
commit de1c705c50326acaceaf1f02bc5bf6f267c572bd upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ib7f794ccd2b16db0b8958640ad7bd8f4e5c7296a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-08-12 15:34:33 +00:00
Greg Kroah-Hartman
d201efdaa4 Revert "media: cec: core: avoid recursive cec_claim_log_addrs"
This reverts commit 302077d270 which is
commit 47c82aac10a6954d68f29f10d9758d016e8e5af1 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I8c6b68d3db780285be19b84004758f46be37048b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-08-12 13:28:28 +00:00
Greg Kroah-Hartman
dcb51feb27 Revert "Bluetooth: compute LE flow credits based on recvbuf space"
This reverts commit 632b63f127 which is
commit ce60b9231b66710b6ee24042ded26efee120ecfc upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I6685f67d86c6def437924a4e4bc2bdb88d55024c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-08-12 13:26:37 +00:00
Greg Kroah-Hartman
a4d90a8f3c Merge 6.1.93 into android14-6.1-lts
Changes in 6.1.93
	SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
	x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
	ftrace: Fix possible use-after-free issue in ftrace_location()
	tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
	tty: n_gsm: fix missing receive state reset after mode switch
	speakup: Fix sizeof() vs ARRAY_SIZE() bug
	serial: 8250_bcm7271: use default_mux_rate if possible
	serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
	io_uring: fail NOP if non-zero op flags is passed in
	Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already"
	r8169: Fix possible ring buffer corruption on fragmented Tx packets.
	ring-buffer: Fix a race between readers and resize checks
	tools/latency-collector: Fix -Wformat-security compile warns
	tools/nolibc/stdlib: fix memory error in realloc()
	net: smc91x: Fix m68k kernel compilation for ColdFire CPU
	nilfs2: fix unexpected freezing of nilfs_segctor_sync()
	nilfs2: fix potential hang in nilfs_detach_log_writer()
	fs/ntfs3: Remove max link count info display during driver init
	fs/ntfs3: Taking DOS names into account during link counting
	fs/ntfs3: Fix case when index is reused during tree transformation
	fs/ntfs3: Break dir enumeration if directory contents error
	ksmbd: avoid to send duplicate oplock break notifications
	ksmbd: ignore trailing slashes in share paths
	ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
	ALSA: core: Fix NULL module pointer assignment at card init
	ALSA: Fix deadlocks with kctl removals at disconnection
	KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
	wifi: mac80211: don't use rate mask for scanning
	wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field
	wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
	dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
	net: usb: qmi_wwan: add Telit FN920C04 compositions
	drm/amd/display: Set color_mgmt_changed to true on unsuspend
	drm/amdgpu: Update BO eviction priorities
	drm/amdgpu: Fix the ring buffer size for queue VM flush
	drm/amdgpu/mes: fix use-after-free issue
	LoongArch: Lately init pmu after smp is online
	selftests: sud_test: return correct emulated syscall value on RISC-V
	sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
	ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
	regulator: irq_helpers: duplicate IRQ name
	ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
	ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
	regulator: vqmmc-ipq4019: fix module autoloading
	ASoC: rt715: add vendor clear control register
	ASoC: rt715-sdca: volume step modification
	KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
	x86/efistub: Omit physical KASLR when memory reservations exist
	efi: libstub: only free priv.runtime_map when allocated
	KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
	genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
	fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
	softirq: Fix suspicious RCU usage in __do_softirq()
	ASoC: da7219-aad: fix usage of device_get_named_child_node()
	ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
	drm/amd/display: Add dtbclk access to dcn315
	drm/amd/display: Add VCO speed parameter for DCN31 FPU
	drm/amdkfd: Flush the process wq before creating a kfd_process
	x86/mm: Remove broken vsyscall emulation code from the page fault code
	nvme: find numa distance only if controller has valid numa id
	nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
	nvmet-auth: replace pr_debug() with pr_err() to report an error.
	nvmet-tcp: fix possible memory leak when tearing down a controller
	nvmet: fix nvme status code when namespace is disabled
	epoll: be better about file lifetimes
	nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
	openpromfs: finish conversion to the new mount API
	crypto: bcm - Fix pointer arithmetic
	mm/slub, kunit: Use inverted data to corrupt kmem cache
	firmware: raspberrypi: Use correct device for DMA mappings
	ecryptfs: Fix buffer size for tag 66 packet
	nilfs2: fix out-of-range warning
	parisc: add missing export of __cmpxchg_u8()
	crypto: ccp - drop platform ifdef checks
	crypto: x86/nh-avx2 - add missing vzeroupper
	crypto: x86/sha256-avx2 - add missing vzeroupper
	crypto: x86/sha512-avx2 - add missing vzeroupper
	s390/cio: fix tracepoint subchannel type field
	io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of task_work
	io_uring: use the right type for work_llist empty check
	rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
	rcu: Fix buffer overflow in print_cpu_stall_info()
	ARM: configs: sunxi: Enable DRM_DW_HDMI
	jffs2: prevent xattr node from overflowing the eraseblock
	soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
	null_blk: Fix missing mutex_destroy() at module removal
	md: fix resync softlockup when bitmap size is less than array size
	block: open code __blk_account_io_start()
	block: open code __blk_account_io_done()
	block: support to account io_ticks precisely
	wifi: ath10k: poll service ready message before failing
	wifi: brcmfmac: pcie: handle randbuf allocation failure
	wifi: ath11k: don't force enable power save on non-running vdevs
	bpftool: Fix missing pids during link show
	x86/boot: Ignore relocations in .notes sections in walk_relocs() too
	sched/fair: Add EAS checks before updating root_domain::overutilized
	ACPI: Fix Generic Initiator Affinity _OSC bit
	qed: avoid truncating work queue length
	net/mlx5e: Fail with messages when params are not valid for XSK
	mlx5: stop warning for 64KB pages
	bitops: add missing prototype check
	wifi: carl9170: re-fix fortified-memset warning
	bpf: Pack struct bpf_fib_lookup
	scsi: ufs: qcom: Perform read back after writing reset bit
	scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
	scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
	scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
	scsi: ufs: qcom: Perform read back after writing unipro mode
	scsi: ufs: qcom: Perform read back after writing CGC enable
	scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
	scsi: ufs: core: Perform read back after disabling interrupts
	scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
	ACPI: LPSS: Advertise number of chip selects via property
	irqchip/alpine-msi: Fix off-by-one in allocation error path
	irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
	ACPI: disable -Wstringop-truncation
	gfs2: Don't forget to complete delayed withdraw
	gfs2: Fix "ignore unlock failures after withdraw"
	x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
	selftests/bpf: Fix umount cgroup2 error in test_sockmap
	cpufreq: exit() callback is optional
	x86/pat: Introduce lookup_address_in_pgd_attr()
	x86/pat: Restructure _lookup_address_cpa()
	x86/pat: Fix W^X violation false-positives when running as Xen PV guest
	net: export inet_lookup_reuseport and inet6_lookup_reuseport
	net: remove duplicate reuseport_lookup functions
	udp: Avoid call to compute_score on multiple sites
	cppc_cpufreq: Fix possible null pointer dereference
	scsi: libsas: Fix the failure of adding phy with zero-address to port
	scsi: hpsa: Fix allocation size for Scsi_Host private data
	x86/purgatory: Switch to the position-independent small code model
	thermal/drivers/tsens: Fix null pointer dereference
	wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
	selftests/bpf: Fix a fd leak in error paths in open_netns
	wifi: ath10k: populate board data for WCN3990
	net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers
	net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches
	tcp: avoid premature drops in tcp_add_backlog()
	pwm: sti: Convert to platform remove callback returning void
	pwm: sti: Prepare removing pwm_chip from driver data
	pwm: sti: Simplify probe function using devm functions
	drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
	drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
	drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
	net: give more chances to rcu in netdev_wait_allrefs_any()
	macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
	wifi: carl9170: add a proper sanity check for endpoints
	wifi: ar5523: enable proper endpoint verification
	sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
	Revert "sh: Handle calling csum_partial with misaligned data"
	wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
	libbpf: Fix error message in attach_kprobe_multi
	selftests/binderfs: use the Makefile's rules, not Make's implicit rules
	selftests/resctrl: fix clang build failure: use LOCAL_HDRS
	selftests: default to host arch for LLVM builds
	kunit: Fix kthread reference
	HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
	scsi: bfa: Ensure the copied buf is NUL terminated
	scsi: qedf: Ensure the copied buf is NUL terminated
	scsi: qla2xxx: Fix debugfs output for fw_resource_count
	kernel/numa.c: Move logging out of numa.h
	x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
	wifi: mwl8k: initialize cmd->addr[] properly
	HID: amd_sfh: Handle "no sensors" in PM operations
	usb: aqc111: stop lying about skb->truesize
	net: usb: sr9700: stop lying about skb->truesize
	m68k: Fix spinlock race in kernel thread creation
	m68k: mac: Fix reboot hang on Mac IIci
	net: ipv6: fix wrong start position when receive hop-by-hop fragment
	eth: sungem: remove .ndo_poll_controller to avoid deadlocks
	selftests: net: move amt to socat for better compatibility
	net: ethernet: cortina: Locking fixes
	af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
	net: usb: smsc95xx: stop lying about skb->truesize
	net: openvswitch: fix overwriting ct original tuple for ICMPv6
	ipv6: sr: add missing seg6_local_exit
	ipv6: sr: fix incorrect unregister order
	ipv6: sr: fix invalid unregister error path
	net/mlx5: Add a timeout to acquire the command queue semaphore
	net/mlx5: Discard command completions in internal error
	s390/bpf: Emit a barrier for BPF_FETCH instructions
	riscv, bpf: make some atomic operations fully ordered
	ax25: Use kernel universal linked list to implement ax25_dev_list
	ax25: Fix reference count leak issues of ax25_dev
	ax25: Fix reference count leak issue of net_device
	mptcp: SO_KEEPALIVE: fix getsockopt support
	Bluetooth: Consolidate code around sk_alloc into a helper function
	Bluetooth: compute LE flow credits based on recvbuf space
	Bluetooth: qca: Fix error code in qca_read_fw_build_info()
	drm/bridge: Fix improper bridge init order with pre_enable_prev_first
	printk: Let no_printk() use _printk()
	dev_printk: Add and use dev_no_printk()
	drm/lcdif: Do not disable clocks on already suspended hardware
	drm/panel-samsung-atna33xc20: Use ktime_get_boottime for delays
	drm/dp: Don't attempt AUX transfers when eDP panels are not powered
	drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert
	drm/amd/display: Fix potential index out of bounds in color transformation function
	ASoC: Intel: Disable route checks for Skylake boards
	ASoC: Intel: avs: ssm4567: Do not ignore route checks
	mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()
	mtd: rawnand: hynix: fixed typo
	fbdev: shmobile: fix snprintf truncation
	ASoC: kirkwood: Fix potential NULL dereference
	drm/meson: vclk: fix calculation of 59.94 fractional rates
	drm/mediatek: Add 0 size check to mtk_drm_gem_obj
	powerpc/fsl-soc: hide unused const variable
	fbdev: sisfb: hide unused variables
	ASoC: Intel: avs: Fix ASRC module initialization
	ASoC: Intel: avs: Fix potential integer overflow
	media: ngene: Add dvb_ca_en50221_init return value check
	media: rcar-vin: work around -Wenum-compare-conditional warning
	media: radio-shark2: Avoid led_names truncations
	drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
	drm/msm/dp: allow voltage swing / pre emphasis of 3
	drm/msm/dp: Return IRQ_NONE for unhandled interrupts
	drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
	media: ipu3-cio2: Request IRQ earlier
	media: dt-bindings: ovti,ov2680: Fix the power supply names
	fbdev: sh7760fb: allow modular build
	media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
	drm/arm/malidp: fix a possible null pointer dereference
	drm: vc4: Fix possible null pointer dereference
	ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
	drm/bridge: anx7625: Don't log an error when DSI host can't be found
	drm/bridge: icn6211: Don't log an error when DSI host can't be found
	drm/bridge: lt8912b: Don't log an error when DSI host can't be found
	drm/bridge: lt9611: Don't log an error when DSI host can't be found
	drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
	drm/bridge: tc358775: Don't log an error when DSI host can't be found
	drm/bridge: dpc3433: Don't log an error when DSI host can't be found
	drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
	drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
	drm/mipi-dsi: use correct return type for the DSC functions
	drm/rockchip: vop2: Do not divide height twice for YUV
	clk: samsung: exynosautov9: fix wrong pll clock id value
	RDMA/mlx5: Adding remote atomic access flag to updatable flags
	RDMA/hns: Fix return value in hns_roce_map_mr_sg
	RDMA/hns: Fix deadlock on SRQ async events.
	RDMA/hns: Fix UAF for cq async event
	RDMA/hns: Fix GMV table pagesize
	RDMA/hns: Use complete parentheses in macros
	RDMA/hns: Modify the print level of CQE error
	clk: mediatek: mt8365-mm: fix DPI0 parent
	clk: rs9: fix wrong default value for clock amplitude
	RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
	RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c
	RDMA/rxe: Fix incorrect rxe_put in error path
	IB/mlx5: Use __iowrite64_copy() for write combining stores
	clk: renesas: r8a779a0: Fix CANFD parent clock
	clk: renesas: r9a07g043: Add clock and reset entry for PLIC
	lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
	clk: qcom: dispcc-sm8450: fix DisplayPort clocks
	clk: qcom: dispcc-sm6350: fix DisplayPort clocks
	clk: qcom: mmcc-msm8998: fix venus clock issue
	x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
	x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
	ext4: avoid excessive credit estimate in ext4_tmpfile()
	virt: acrn: stop using follow_pfn
	drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
	sunrpc: removed redundant procp check
	ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
	ext4: fix unit mismatch in ext4_mb_new_blocks_simple
	ext4: try all groups in ext4_mb_new_blocks_simple
	ext4: remove unused parameter from ext4_mb_new_blocks_simple()
	ext4: fix potential unnitialized variable
	SUNRPC: Fix gss_free_in_token_pages()
	selftests/kcmp: remove unused open mode
	RDMA/IPoIB: Fix format truncation compilation errors
	net: add pskb_may_pull_reason() helper
	net: bridge: xmit: make sure we have at least eth header len bytes
	selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval
	net: bridge: mst: fix vlan use-after-free
	net: qrtr: ns: Fix module refcnt
	netrom: fix possible dead-lock in nr_rt_ioctl()
	af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
	sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
	sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write()
	scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
	perf record: Delete session after stopping sideband thread
	perf probe: Add missing libgen.h header needed for using basename()
	iio: core: Leave private pointer NULL when no private data supplied
	greybus: lights: check return of get_channel_from_mode
	f2fs: multidev: fix to recognize valid zero block address
	f2fs: fix to wait on page writeback in __clone_blkaddrs()
	counter: linux/counter.h: fix Excess kernel-doc description warning
	perf annotate: Get rid of duplicate --group option item
	soundwire: cadence: fix invalid PDI offset
	dmaengine: idma64: Add check for dma_set_max_seg_size
	firmware: dmi-id: add a release callback function
	serial: max3100: Lock port->lock when calling uart_handle_cts_change()
	serial: max3100: Update uart_driver_registered on driver removal
	serial: max3100: Fix bitwise types
	greybus: arche-ctrl: move device table to its right location
	PCI: tegra194: Fix probe path for Endpoint mode
	serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
	interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
	arm64: dts: meson: fix S4 power-controller node
	perf test: Add -w/--workload option
	perf test: Add 'thloop' test workload
	perf test: Add 'leafloop' test workload
	perf test: Add 'sqrtloop' test workload
	perf test: Add 'brstack' test workload
	perf test: Add 'datasym' test workload
	perf tests: Make "test data symbol" more robust on Neoverse N1
	dt-bindings: PCI: rcar-pci-host: Add optional regulators
	dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
	f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
	f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file()
	f2fs: fix typos in comments
	f2fs: fix to relocate check condition in f2fs_fallocate()
	f2fs: fix to check pinfile flag in f2fs_move_file_range()
	iio: adc: stm32: Fixing err code to not indicate success
	coresight: etm4x: Fix unbalanced pm_runtime_enable()
	perf docs: Document bpf event modifier
	iio: pressure: dps310: support negative temperature values
	coresight: etm4x: Do not hardcode IOMEM access for register restore
	coresight: etm4x: Do not save/restore Data trace control registers
	coresight: etm4x: Safe access for TRCQCLTR
	coresight: etm4x: Fix access to resource selector registers
	fpga: region: add owner module and take its refcount
	microblaze: Remove gcc flag for non existing early_printk.c file
	microblaze: Remove early printk call from cpuinfo-static.c
	perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
	ovl: remove upper umask handling from ovl_create_upper()
	VMCI: Fix an error handling path in vmci_guest_probe_device()
	dt-bindings: pinctrl: mediatek: mt7622: fix array properties
	watchdog: bd9576: Drop "always-running" property
	watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
	usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
	usb: gadget: u_audio: Clear uac pointer when freed.
	stm class: Fix a double free in stm_register_device()
	ppdev: Remove usage of the deprecated ida_simple_xx() API
	ppdev: Add an error check in register_device
	perf bench internals inject-build-id: Fix trap divide when collecting just one DSO
	perf ui browser: Don't save pointer to stack memory
	extcon: max8997: select IRQ_DOMAIN instead of depending on it
	PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
	PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
	perf ui browser: Avoid SEGV on title
	perf report: Avoid SEGV in report__setup_sample_type()
	f2fs: compress: fix to update i_compr_blocks correctly
	f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
	f2fs: fix to release node block count in error path of f2fs_new_node_page()
	f2fs: compress: don't allow unaligned truncation on released compress inode
	serial: sh-sci: protect invalidating RXDMA on shutdown
	libsubcmd: Fix parse-options memory leak
	perf daemon: Fix file leak in daemon_session__control
	f2fs: fix to add missing iput() in gc_data_segment()
	perf stat: Don't display metric header for non-leader uncore events
	LoongArch: Fix callchain parse error with kernel tracepoint events again
	s390/vdso: filter out mno-pic-data-is-text-relative cflag
	s390/vdso64: filter out munaligned-symbols flag for vdso
	s390/vdso: Generate unwind information for C modules
	s390/vdso: Use standard stack frame layout
	s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
	s390/ipl: Fix incorrect initialization of nvme dump block
	s390/boot: Remove alt_stfle_fac_list from decompressor
	Input: ims-pcu - fix printf string overflow
	Input: ioc3kbd - convert to platform remove callback returning void
	Input: ioc3kbd - add device table
	mmc: sdhci_am654: Add tuning algorithm for delay chain
	mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
	mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
	mmc: sdhci_am654: Add OTAP/ITAP delay enable
	mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
	mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
	Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
	drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
	drm/msm/dpu: Always flush the slave INTF on the CTL
	drm/mediatek: dp: Move PHY registration to new function
	drm/mediatek: dp: Add support for embedded DisplayPort aux-bus
	drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
	um: Fix return value in ubd_init()
	um: Add winch to winch_handlers before registering winch IRQ
	um: vector: fix bpfflash parameter evaluation
	fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
	fs/ntfs3: Use variable length array instead of fixed size
	drm/bridge: tc358775: fix support for jeida-18 and jeida-24
	media: stk1160: fix bounds checking in stk1160_copy_video()
	scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
	Input: cyapa - add missing input core locking to suspend/resume functions
	media: flexcop-usb: fix sanity check of bNumEndpoints
	powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
	um: Fix the -Wmissing-prototypes warning for __switch_mm
	um: Fix the -Wmissing-prototypes warning for get_thread_reg
	um: Fix the declaration of kasan_map_memory
	media: sunxi: a83-mips-csi2: also select GENERIC_PHY
	media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
	media: cec: cec-api: add locking in cec_release()
	media: cec: core: avoid recursive cec_claim_log_addrs
	media: cec: core: avoid confusing "transmit timed out" message
	Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
	drm/msm: Enable clamp_to_idle for 7c3
	drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
	null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
	ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
	ASoC: mediatek: mt8192: fix register configuration for tdm
	regulator: bd71828: Don't overwrite runtime voltages
	perf/arm-dmc620: Fix lockdep assert in ->event_init()
	x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
	net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
	ipv6: sr: fix missing sk_buff release in seg6_input_core
	selftests: net: kill smcrouted in the cleanup logic in amt.sh
	nfc: nci: Fix uninit-value in nci_rx_work
	ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
	NFSv4: Fixup smatch warning for ambiguous return
	nfs: keep server info for remounts
	sunrpc: fix NFSACL RPC retry on soft mount
	rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
	af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
	ipv6: sr: fix memleak in seg6_hmac_init_algo
	tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
	pNFS/filelayout: fixup pNfs allocation modes
	openvswitch: Set the skbuff pkt_type for proper pmtud support.
	arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
	rv: Update rv_en(dis)able_monitor doc to match kernel-doc
	virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
	riscv: stacktrace: Make walk_stackframe cross pt_regs frame
	riscv: stacktrace: fixed walk_stackframe()
	Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
	net: fec: avoid lock evasion when reading pps_enable
	tls: fix missing memory barrier in tls_init
	inet: factor out locked section of inet_accept() in a new helper
	net: relax socket state check at accept time.
	nfc: nci: Fix kcov check in nci_rx_work()
	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
	drivers/xen: Improve the late XenStore init protocol
	ice: Interpret .set_channels() input differently
	netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
	netfilter: nft_payload: restore vlan q-in-q match support
	spi: Don't mark message DMA mapped when no transfer in it is
	dma-mapping: benchmark: fix node id validation
	dma-mapping: benchmark: handle NUMA_NO_NODE correctly
	nvmet: fix ns enable/disable possible hang
	net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
	net/mlx5: Lag, do bond only if slaves agree on roce state
	net/mlx5e: Fix IPsec tunnel mode offload feature check
	net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
	net/mlx5e: Fix UDP GSO for encapsulated packets
	dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
	bpf: Fix potential integer overflow in resolve_btfids
	ALSA: jack: Use guard() for locking
	ALSA: core: Remove debugfs at disconnection
	ALSA: hda/realtek: Add quirk for ASUS ROG G634Z
	ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
	ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
	enic: Validate length of nl attributes in enic_set_vf_port
	af_unix: Read sk->sk_hash under bindlock during bind().
	net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
	bpf: Allow delete from sockmap/sockhash only if update is allowed
	net:fec: Add fec_enet_deinit()
	ice: fix accounting if a VLAN already exists
	netfilter: nft_payload: move struct nft_payload_set definition where it belongs
	netfilter: nft_payload: rebuild vlan header when needed
	netfilter: nft_payload: rebuild vlan header on h_proto access
	netfilter: nft_payload: skbuff vlan metadata mangle support
	netfilter: tproxy: bail out if IP has been disabled on the device
	netfilter: nft_fib: allow from forward/input without iif selector
	kconfig: fix comparison to constant symbols, 'm', 'n'
	drm/i915/guc: avoid FIELD_PREP warning
	spi: stm32: Don't warn about spurious interrupts
	net: dsa: microchip: fix RGMII error in KSZ DSA driver
	net: ena: Add dynamic recycling mechanism for rx buffers
	net: ena: Reduce lines with longer column width boundary
	net: ena: Fix redundant device NUMA node override
	ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
	powerpc/pseries/lparcfg: drop error message from guest name lookup
	hwmon: (shtc1) Fix property misspelling
	riscv: prevent pt_regs corruption for secondary idle threads
	ALSA: timer: Set lower bound of start tick time
	net: ena: Fix DMA syncing in XDP path when SWIOTLB is on
	Linux 6.1.93

Change-Id: I15fdbacdaee5a6d68347a7fd5218929488d594af
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-08-12 08:40:51 +00:00
Vamsidhar reddy Gaddam
79436849ef ANDROID: Update the ABI symbol list
Adding the following symbols:
  - vm_unmapped_area

Bug: 344489121
Change-Id: I1798b662e81283e1f8e8f2091e5e4b6d2d4fe2c0
Signed-off-by: Vamsidhar reddy Gaddam <gvamsi@google.com>
2024-08-09 17:37:44 +00:00
Sukjin Kong
be8ff39d2e ANDROID: GKI: add symbol list for telechips
Add symbol list file abi_gki_aarch64_telechips

INFO: 18 function symbol(s) added
  'int devm_clk_hw_register_clkdev(struct device*, struct clk_hw*, const char*, const char*)'
  'struct fwnode_handle* fwnode_get_next_parent(struct fwnode_handle*)'
  'struct fwnode_handle* fwnode_get_parent(const struct fwnode_handle*)'
  'int linear_range_get_value_array(const struct linear_range*, int, unsigned int, unsigned int*)'
  'int media_device_register_entity(struct media_device*, struct media_entity*)'
  'struct media_link* media_entity_find_link(struct media_pad*, struct media_pad*)'
  'void* of_fdt_unflatten_tree(const unsigned long*, struct device_node*, struct device_node**)'
  'int regmap_irq_chip_get_base(struct regmap_irq_chip_data*)'
  'int regulator_mode_to_status(unsigned int)'
  'int regulator_set_soft_start_regmap(struct regulator_dev*)'
  'int snd_pcm_hw_constraint_pow2(struct snd_pcm_runtime*, unsigned int, snd_pcm_hw_param_t)'
  'int snd_soc_dai_set_clkdiv(struct snd_soc_dai*, int, int)'
  'void symbol_put_addr(void*)'
  'int trace_define_field(struct trace_event_call*, const char*, const char*, int, int, int, int)'
  'int uart_parse_earlycon(char*, unsigned char*, resource_size_t*, char**)'
  'int v4l2_fill_pixfmt_mp(struct v4l2_pix_format_mplane*, u32, u32, u32)'
  'int vfs_fsync(struct file*, int)'
  'int vsscanf(const char*, const char*, va_list)'

1 variable symbol(s) added
  'const struct kernel_param_ops param_ops_short'

Bug: 358151308
Signed-off-by: Sukjin Kong <sj.kong@telechips.com>
Change-Id: I13cefc3999f4e8a0b748c126cb179ac5f6c61e22
2024-08-08 17:19:37 +00:00
Peter Wang
7003f6b36a UPSTREAM: ufs: core: bypass quick recovery if need force reset
If force_reset is true, bypass quick recovery.
This will shorten error recovery time.

Bug: 356536706

Change-Id: I86ce0e8ac79b61e203a8fdad5369d540ae873cc0
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20240712094506.11284-1-peter.wang@mediatek.com
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 022587d8aec3da1d1698ddae9fb8cfe35f3ad49c)
2024-08-08 16:53:10 +00:00
nischaljain
99d09135c4 ANDROID: Update the ABI symbol list
Adding the `devfreq_get_devfreq_by_phandle` symbol.

Bug: 336947817
Change-Id: I5db1e6c7ba5a845f2116aa0e5438e7f8fece4a65
Signed-off-by: nischaljain <nischaljain@google.com>
2024-08-08 05:09:57 +00:00