mirror of
https://github.com/hardkernel/linux.git
synced 2026-06-05 18:41:58 +09:00
0cf5cecba66e91b69268fd87ded20e755bee1938
1160973 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
|
0cf5cecba6 |
Revert "crypto: api - Disallow identical driver names"
This reverts commit
|
||
|
|
1dca1fead9 |
Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
This catches the android14-6.1-lts branch up to date with recent changes in the android14-6.1 branch, including symbol additions which are required for us to track in the LTS branch. Included in here are the following commits: * |
||
|
|
0a5aada71c |
ANDROID: GKI: Update symbol list for mtk
3 function symbol(s) added 'int dev_pm_opp_register_notifier(struct device*, struct notifier_block*)' 'int dev_pm_opp_unregister_notifier(struct device*, struct notifier_block*)' 'int snd_soc_suspend(struct device*)' Bug: 341821144 Change-Id: Iafcfaede99a35e10d9162e0298a7e3feb43cec73 Signed-off-by: Seiya Wang <seiya.wang@mediatek.com> |
||
|
|
b98ce0fe28 |
ANDROID: GKI: update the abi for tracing changes in 6.1.84
In 6.1.84, a number of internal tracing structures changed. Those
structures are not used outside of the core kernel, but due to opaque
pointers being carried into some abi signatures, they are tracked by the
.stg file.
Update the .stg file to handle these changes, as they are safe to modify
at this point in time.
The changes are:
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: type 'struct trace_buffer' changed
byte size changed from 224 to 216
2 members ('bool time_stamp_abs' .. 'struct ring_buffer_ext_cb* ext_cb') changed
offset changed by -64
type 'struct ring_buffer_per_cpu' changed
byte size changed from 496 to 488
type 'struct rb_irq_work' changed
byte size changed from 96 to 88
member 'long wait_index' was removed
3 members ('bool waiters_pending' .. 'bool wakeup_full') changed
offset changed by -64
Fixes:
|
||
|
|
5f29666f69 |
Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
This reverts commit |
||
|
|
501c229a8a |
Revert "media: mc: Add num_links flag to media_pad"
This reverts commit
|
||
|
|
2b84f5edda |
Revert "media: mc: Expand MUST_CONNECT flag to always require an enabled link"
This reverts commit
|
||
|
|
34a15d3507 |
UPSTREAM: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
It is observed sometimes when tethering is used over NCM with Windows 11
as host, at some instances, the gadget_giveback has one byte appended at
the end of a proper NTB. When the NTB is parsed, unwrap call looks for
any leftover bytes in SKB provided by u_ether and if there are any pending
bytes, it treats them as a separate NTB and parses it. But in case the
second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that
were parsed properly in the first NTB and saved in rx_list are dropped.
Adding a few custom traces showed the following:
[002] d..1 7828.532866: dwc3_gadget_giveback: ep1out:
req 000000003868811a length 1025/16384 zsI ==> 0
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10
[002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames
In this case, the giveback is of 1025 bytes and block length is 1024.
The rest 1 byte (which is 0x00) won't be parsed resulting in drop of
all datagrams in rx_list.
Same is case with packets of size 2048:
[002] d..1 7828.557948: dwc3_gadget_giveback: ep1out:
req 0000000011dfd96e length 2049/16384 zsI ==> 0
[002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800
Lecroy shows one byte coming in extra confirming that the byte is coming
in from PC:
Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590)
- Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)
--- Packet 4063861
Data(1024 bytes)
Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)
--- Packet 4063863
Data(1 byte)
Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)
According to Windows driver, no ZLP is needed if wBlockLength is non-zero,
because the non-zero wBlockLength has already told the function side the
size of transfer to be expected. However, there are in-market NCM devices
that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.
To deal with such devices, it pads an extra 0 at end so the transfer is no
longer multiple of wMaxPacketSize.
Cc: <stable@vger.kernel.org>
Fixes:
|
||
|
|
bd552fcbbd |
ANDROID: GKI: Update rockchip symbols to add iova APIs
INFO: 2 function symbol(s) added 'struct iova* alloc_iova(struct iova_domain*, unsigned long, unsigned long, bool)' 'void free_iova(struct iova_domain*, unsigned long)' Bug: 300024866 Change-Id: Iccdadf2b516343411871f1df0f46299af9b51c97 Signed-off-by: Kever Yang <kever.yang@rock-chips.com> |
||
|
|
4ed706c20a |
FROMLIST: sched/pi: Reweight fair_policy() tasks when inheriting prio
For fair tasks inheriting the priority (nice) without reweighting is a NOP as the task's share won't change. This is visible when running with PTHREAD_PRIO_INHERIT where fair tasks with low priority values are susceptible to starvation leading to PI like impact on lock contention. The logic in rt_mutex will reset these low priority fair tasks into nice 0, but without the additional reweight operation to actually update the weights, it doesn't have the desired impact of boosting them to allow them to run sooner/longer to release the lock. Apply the reweight for fair_policy() tasks to achieve the desired boost for those low nice values tasks. Note that boost here means resetting their nice to 0; as this is what the current logic does for fair tasks. We need to re-instate ordering fair tasks by their priority order on the waiter tree to ensure we inherit the top_waiter properly. Handling of idle_policy() requires more code refactoring and is not handled yet. idle_policy() are treated specially and only run when the CPU is idle and get a hardcoded low weight value. Changing weights won't be enough without a promotion first to SCHED_OTHER. Tested with a test program that creates three threads. 1. main thread that spawns high prio and low prio task and busy loops 2. low priority thread that holds a pthread_mutex() with PTHREAD_PRIO_INHERIT protocol. Runs at nice +10. Busy loops after holding the lock. 3. high priority thread that holds a pthread_mutex() with PTHREADPTHREAD_PRIO_INHERIT, but made to start after the low priority thread. Runs at nice 0. Should remain blocked by the low priority thread. All tasks are pinned to CPU0. Without the patch I can see the low priority thread running only for ~10% of the time which is what expected without it being boosted. With the patch the low priority thread runs for ~50% which is what expected if it gets boosted to nice 0. I modified the test program logic afterwards to ensure that after releasing the lock the low priority thread goes back to running for 10% of the time, and it does. Bug: 263876335 Link: https://lore.kernel.org/lkml/20240514160711.hpdg64grdwc43ux7@airbuntu/ Reported-by: Yabin Cui <yabinc@google.com> Signed-off-by: Qais Yousef <qyousef@layalina.io> [Fix trivial conflict with vendor hook] Signed-off-by: Qais Yousef <qyousef@google.com> Change-Id: Ia954ee528495b5cf5c3a2157c68b4a757cef1f83 (cherry picked from commit 23ac35ed8fc6220e4e498a21d22a9dbe67e7da9b) Signed-off-by: Qais Yousef <qyousef@google.com> |
||
|
|
b1e11ffd90 |
ANDROID: Update the ABI symbol list
Adding the following symbols: - __traceiter_android_rvh_do_read_fault - __tracepoint_android_rvh_do_read_fault Bug: 336873696 Change-Id: I7ff2b064942826dcadc949595c9d7df917123986 Signed-off-by: liangjlee <liangjlee@google.com> |
||
|
|
29a00abe43 |
ANDROID: mm: Add restricted vendor hook in do_read_fault()
This patch add a restricted vendor hook in do_read_fault() for tracking which file and offsets are faulted. Bug: 336736235 Change-Id: I425690e58550c4ac44912daa10b5eac0728bfb4e Signed-off-by: liangjlee <liangjlee@google.com> |
||
|
|
51c421385e |
ANDROID: abi_gki_aarch64_qcom: Update symbol list
The commit
|
||
|
|
a9dca663a7 |
ANDROID: Update the ABI symbol list
3 function symbol(s) added 'int __traceiter_android_rvh_madvise_pageout_end(void*, void*, struct list_head*)' 'int __traceiter_android_rvh_madvise_pageout_begin(void*, void**)' 'int __traceiter_android_rvh_reclaim_folio_list(void*, struct list_head*, void*)' 3 variable symbol(s) added 'struct tracepoint __tracepoint_android_rvh_madvise_pageout_end' 'struct tracepoint __tracepoint_android_rvh_madvise_pageout_begin' 'struct tracepoint __tracepoint_android_rvh_reclaim_folio_list' Bug: 326662423 Change-Id: Ie5805e48060f9e91b87c739ad8a01977b38c2f08 Signed-off-by: Minchan Kim <minchan@google.com> |
||
|
|
6316af1012 |
ANDROID: add vendor hooks and expoert reclaim_pages to reclaim memory
Add vendor hooks to reclaim MADV_PAGEOUT memory for asynchrnous device. It also exports reclaim_pages to reclaim memory. Bug: 326662423 Change-Id: Ic2516c64a9dbd53173a3bfb19b6cd21636916c27 Signed-off-by: Minchan Kim <minchan@google.com> |
||
|
|
2b530e8f5d |
Merge 6.1.84 into android14-6.1-lts
Changes in 6.1.84
x86/cpu: Support AMD Automatic IBRS
x86/bugs: Use sysfs_emit()
KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs
KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace
KVM: x86: Use a switch statement and macros in __feature_translate()
timers: Update kernel-doc for various functions
timers: Use del_timer_sync() even on UP
timers: Rename del_timer_sync() to timer_delete_sync()
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
arm64: dts: qcom: sc7280: Add additional MSI interrupts
remoteproc: virtio: Fix wdg cannot recovery remote processor
clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
serial: max310x: fix NULL pointer dereference in I2C instantiation
pci_iounmap(): Fix MMIO mapping leak
media: xc4000: Fix atomicity violation in xc4000_get_frequency
media: mc: Add local pad to pipeline regardless of the link state
media: mc: Fix flags handling when creating pad links
media: mc: Add num_links flag to media_pad
media: mc: Rename pad variable to clarify intent
media: mc: Expand MUST_CONNECT flag to always require an enabled link
KVM: Always flush async #PF workqueue when vCPU is being destroyed
cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()
powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core
powerpc/smp: Increase nr_cpu_ids to include the boot CPU
sparc64: NMI watchdog: fix return value of __setup handler
sparc: vDSO: fix return value of __setup handler
crypto: qat - fix double free during reset
crypto: qat - resolve race condition during AER recovery
selftests/mqueue: Set timeout to 180 seconds
ext4: correct best extent lstart adjustment logic
block: Clear zone limits for a non-zoned stacked queue
kasan/test: avoid gcc warning for intentional overflow
bounds: support non-power-of-two CONFIG_NR_CPUS
fat: fix uninitialized field in nostale filehandles
ubifs: Set page uptodate in the correct place
ubi: Check for too small LEB size in VTBL code
ubi: correct the calculation of fastmap size
mtd: rawnand: meson: fix scrambling mode value in command macro
parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros
parisc: Fix ip_fast_csum
parisc: Fix csum_ipv6_magic on 32-bit systems
parisc: Fix csum_ipv6_magic on 64-bit systems
parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
md/raid5: fix atomicity violation in raid5_cache_count
cpufreq: Limit resolving a frequency to policy min/max
PM: suspend: Set mem_sleep_current during kernel command line setup
clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
usb: xhci: Add error handling in xhci_map_urb_for_dma
powerpc/fsl: Fix mfpmr build errors with newer binutils
USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
USB: serial: add device ID for VeriFone adapter
USB: serial: cp210x: add ID for MGP Instruments PDS100
USB: serial: option: add MeiG Smart SLM320 product
KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
PM: sleep: wakeirq: fix wake irq warning in system suspend
mmc: tmio: avoid concurrent runs of mmc_request_done()
fuse: fix root lookup with nonzero generation
fuse: don't unhash root
usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
serial: Lock console when calling into driver before registration
btrfs: qgroup: always free reserved space for extent records
btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
PCI/PM: Drain runtime-idle callbacks before driver removal
PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
dm-raid: fix lockdep waring in "pers->hot_add_disk"
powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
mac802154: fix llsec key resources release in mac802154_llsec_key_del
swap: comments get_swap_device() with usage rule
mm: swap: fix race between free_swap_and_cache() and swapoff()
mmc: core: Fix switch on gp3 partition
drm/etnaviv: Restore some id values
landlock: Warn once if a Landlock action is requested while disabled
hwmon: (amc6821) add of_match table
ext4: fix corruption during on-line resize
nvmem: meson-efuse: fix function pointer type mismatch
slimbus: core: Remove usage of the deprecated ida_simple_xx() API
phy: tegra: xusb: Add API to retrieve the port number of phy
usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
speakup: Fix 8bit characters from direct synth
PCI/AER: Block runtime suspend when handling errors
io_uring/net: correctly handle multishot recvmsg retry setup
sparc: Explicitly include correct DT includes
sparc32: Fix parport build with sparc32
nfs: fix UAF in direct writes
kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
PCI: qcom: Rename qcom_pcie_config_sid_sm8250() to reflect IP version
PCI: qcom: Enable BDF to SID translation properly
PCI: dwc: endpoint: Fix advertised resizable BAR size
PCI: hv: Fix ring buffer size calculation
vfio: Use GFP_KERNEL_ACCOUNT for userspace persistent allocations
vfio/pci: Consolidate irq cleanup on MSI/MSI-X disable
vfio/pci: Remove negative check on unsigned vector
vfio/pci: Lock external INTx masking ops
vfio/platform: Disable virqfds on cleanup
ksmbd: retrieve number of blocks using vfs_getattr in set_file_allocation_info
ring-buffer: Fix waking up ring buffer readers
ring-buffer: Do not set shortest_full when full target is hit
ring-buffer: Fix resetting of shortest_full
ring-buffer: Fix full_waiters_pending in poll
ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
soc: fsl: qbman: Always disable interrupts when taking cgr_lock
soc: fsl: qbman: Use raw spinlock for cgr_lock
s390/zcrypt: fix reference counting on zcrypt card objects
drm/probe-helper: warn about negative .get_modes()
drm/panel: do not return negative error codes from drm_panel_get_modes()
drm/exynos: do not return negative values from .get_modes()
drm/imx/ipuv3: do not return negative values from .get_modes()
drm/vc4: hdmi: do not return negative values from .get_modes()
memtest: use {READ,WRITE}_ONCE in memory scanning
Revert "block/mq-deadline: use correct way to throttling write requests"
f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
f2fs: truncate page cache before clearing flags when aborting atomic write
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
nilfs2: prevent kernel bug at submit_bh_wbc()
cifs: open_cached_dir(): add FILE_READ_EA to desired access
cpufreq: dt: always allocate zeroed cpumask
x86/CPU/AMD: Update the Zenbleed microcode revisions
NFSD: Fix nfsd_clid_class use of __string_len() macro
net: hns3: tracing: fix hclgevf trace event strings
LoongArch: Change __my_cpu_offset definition to avoid mis-optimization
LoongArch: Define the __io_aw() hook as mmiowb()
wireguard: netlink: check for dangling peer via is_dead instead of empty list
wireguard: netlink: access device through ctx instead of peer
ahci: asm1064: correct count of reported ports
ahci: asm1064: asm1166: don't limit reported ports
drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
drm/amd/display: Return the correct HDCP error code
drm/amd/display: Fix noise issue on HDMI AV mute
dm snapshot: fix lockup in dm_exception_table_exit
x86/pm: Work around false positive kmemleak report in msr_build_context()
cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return value"
platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR
tls: fix race between tx work scheduling and socket close
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
netfilter: nf_tables: disallow anonymous set with timeout flag
netfilter: nf_tables: reject constant set with timeout
Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory
xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
init/Kconfig: lower GCC version check for -Warray-bounds
KVM: x86: Mark target gfn of emulated atomic instruction as dirty
KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
tracing: Use .flush() call to wake up readers
drm/amdgpu/pm: Fix the error of pwm1_enable setting
drm/i915: Check before removing mm notifier
ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
usb: gadget: ncm: Fix handling of zero block length packets
usb: port: Don't try to peer unused USB ports based on location
tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume
mei: me: add arrow lake point S DID
mei: me: add arrow lake point H DID
vt: fix unicode buffer corruption when deleting characters
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
ALSA: hda/realtek - Add Headset Mic supported Acer NB platform
ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook
tee: optee: Fix kernel panic caused by incorrect error handling
mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
iio: accel: adxl367: fix DEVID read after reset
iio: accel: adxl367: fix I2C FIFO data register
i2c: i801: Avoid potential double call to gpiod_remove_lookup_table
drm/amd/display: handle range offsets in VRR ranges
x86/efistub: Call mixed mode boot services on the firmware's stack
net: tls: handle backlogging of crypto requests
ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
iommu: Avoid races around default domain allocations
clocksource/drivers/arm_global_timer: Fix maximum prescaler value
entry: Respect changes to system call number by trace_sys_enter()
minmax: add umin(a, b) and umax(a, b)
swiotlb: Fix alignment checks when both allocation and DMA masks are present
iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
printk: Update @console_may_schedule in console_trylock_spinning()
irqchip/renesas-rzg2l: Implement restriction when writing ISCR register
irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index
irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type
kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or higher address
x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
efi: fix panic in kdump kernel
pwm: img: fix pwm clock lookup
tty: serial: imx: Fix broken RS485
block: Fix page refcounts for unaligned buffers in __bio_release_pages()
blk-mq: release scheduler resource when request completes
selftests: mptcp: diag: return KSFT_FAIL not test_cnt
vfio/pci: Disable auto-enable of exclusive INTx IRQ
vfio: Introduce interface to flush virqfd inject workqueue
vfio/pci: Create persistent INTx handler
vfio/platform: Create persistent IRQ handlers
vfio/fsl-mc: Block calling interrupt handler without trigger
x86/coco: Export cc_vendor
x86/coco: Get rid of accessor functions
x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
x86/sev: Fix position dependent variable references in startup code
mm/migrate: set swap entry values of THP tail pages properly.
init: open /initrd.image with O_LARGEFILE
x86/efistub: Add missing boot_params for mixed mode compat entry
efi/libstub: Cast away type warning in use of max()
btrfs: zoned: don't skip block groups with 100% zone unusable
btrfs: zoned: use zone aware sb location for scrub
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
wifi: iwlwifi: fw: don't always use FW dump trig
exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
hexagon: vmlinux.lds.S: handle attributes section
mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode
mmc: core: Initialize mmc_blk_ioc_data
mmc: core: Avoid negative index with array access
block: Do not force full zone append completion in req_bio_endio()
thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
nouveau/dmem: handle kcalloc() allocation failure
net: ll_temac: platform_get_resource replaced by wrong function
drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()
drm/i915/gt: Reset queue_priority_hint on parking
Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
Revert "usb: phy: generic: Get the vbus supply"
usb: cdc-wdm: close race between read and workqueue
USB: UAS: return ENODEV when submit urbs fail with device not attached
usb: dwc3-am62: Rename private data
usb: dwc3-am62: fix module unload/reload behavior
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
scsi: core: Fix unremoved procfs host directory regression
staging: vc04_services: changen strncpy() to strscpy_pad()
staging: vc04_services: fix information leak in create_component()
USB: core: Add hub_get() and hub_put() routines
USB: core: Fix deadlock in port "disable" sysfs attribute
scsi: sd: Fix TCG OPAL unlock on system resume
usb: dwc2: host: Fix remote wakeup from hibernation
usb: dwc2: host: Fix hibernation flow
usb: dwc2: host: Fix ISOC flow in DDMA mode
usb: dwc2: gadget: Fix exiting from clock gating
usb: dwc2: gadget: LPM flow fix
usb: udc: remove warning when queue disabled ep
usb: typec: Return size of buffer if pd_set operation succeeds
usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
usb: typec: ucsi: Ack unsupported commands
usb: typec: ucsi_acpi: Refactor and fix DELL quirk
usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
scsi: qla2xxx: Prevent command send on chip reset
scsi: qla2xxx: Fix N2N stuck connection
scsi: qla2xxx: Split FCE|EFT trace control
scsi: qla2xxx: Update manufacturer detail
scsi: qla2xxx: NVME|FCP prefer flag not being honored
scsi: qla2xxx: Fix command flush on cable pull
scsi: qla2xxx: Fix double free of fcport
scsi: qla2xxx: Change debug message during driver unload
scsi: qla2xxx: Delay I/O Abort on PCI error
x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
tls: fix use-after-free on failed backlog decryption
scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
scsi: lpfc: Correct size for wqe for memset()
scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
scsi: libsas: Fix disk not being scanned in after being removed
x86/sev: Skip ROM range scans and validation for SEV-SNP guests
USB: core: Fix deadlock in usb_deauthorize_interface()
tools/resolve_btfids: fix build with musl libc
Linux 6.1.84
Change-Id: I2aa458588d512ce908a9b087cdc66b345cef83a9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
|
1d241d978d |
FROMGIT: usb: dwc3: Wait unconditionally after issuing EndXfer command
Currently all controller IP/revisions except DWC3_usb3 >= 310a
wait 1ms unconditionally for ENDXFER completion when IOC is not
set. This is because DWC_usb3 controller revisions >= 3.10a
supports GUCTL2[14: Rst_actbitlater] bit which allows polling
CMDACT bit to know whether ENDXFER command is completed.
Consider a case where an IN request was queued, and parallelly
soft_disconnect was called (due to ffs_epfile_release). This
eventually calls stop_active_transfer with IOC cleared, hence
send_gadget_ep_cmd() skips waiting for CMDACT cleared during
EndXfer. For DWC3 controllers with revisions >= 310a, we don't
forcefully wait for 1ms either, and we proceed by unmapping the
requests. If ENDXFER didn't complete by this time, it leads to
SMMU faults since the controller would still be accessing those
requests.
Fix this by ensuring ENDXFER completion by adding 1ms delay in
__dwc3_stop_active_transfer() unconditionally.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
|
f9ca61c8d8 |
ANDROID: ABI: Update honor symbol list
1 function symbol(s) added 'int __traceiter_android_vh_tune_fault_around_bytes(unsigned long *)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_tune_fault_around_bytes' with this vendor_hook, oem can dynamically adjust fault_around_bytes to balance memory usage and performance Bug: 340749845 Change-Id: I0ec6c5cc0b021dd7e7854dbe13f13c3f6b488b64 Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com> |
||
|
|
c7fcb9bf9a |
ANDROID: add vendor hook in do_read_fault to tune fault_around_bytes
with this vendor_hook, oem can dynamically adjust fault_around_bytes to balance memory usage and performance Bug: 340749845 Change-Id: I429f4302caf44a769696ccec84e9cc13ea8892ea Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com> |
||
|
|
23f2a9f5f1 |
ANDROID: usb: Optimize the problem of slow transfer rate in USB accessory mode
The data transfer rate using Google Restore in USB3.2 mode is slower, only about 140MB/s at 5Gbps. The bMaxBurst is not set, and num_fifos in dwc3_gadget_resize_tx_fifosis 1, which results in only 131btye of dwc3 ram space being allocated to ep. Modify bMaxBurst to 6. The 5Gbps rate increases from 140MB/s to 350MB/s. The 10Gbps rate is increased from 220MB/s to 500MB/s. Bug: 340049583 Change-Id: I5710af32c72d0b57afaecc00c4f0909af4b9a299 Signed-off-by: Lianqin Hu <hulianqin@vivo.corp-partner.google.com> Signed-off-by: Lianqin Hu <hulianqin@vivo.com> |
||
|
|
81cc178d7c |
Revert "io_uring: drop any code related to SCM_RIGHTS"
This reverts commit
|
||
|
|
229c1b5f61 |
Revert "Bluetooth: hci_conn: Consolidate code for aborting connections"
This reverts commit |
||
|
|
50619421ea |
Revert "Bluetooth: hci_core: Cancel request on command timeout"
This reverts commit
|
||
|
|
6a3d68af9c |
ANDROID: Zap kernel/sched/android.h stubs
Long ago with android-mainline, kernel/sched/android.h was added to include stub functions for out-of-tree logic that we wanted to remove from android-mainline without breaking vendor drivers that relied on these stubs. Unfortunately, when the android release branches (android14-6.1 and android15-6.6) forked from android-mainline, the stubs were kept. In some cases, the functionality dropped was re-added to the release branches, but using new function names. Drivers that continued to use the old names, would then end up using the stub impelementations, likely without noticing. Lets try to clean this up by removing the stub header. This should not affect the GKI KABI, and pre-existing modules should continue to work, but when modules are re-build, they may run into build issues and will need tweaks to remove the old stub functions. Bug: 332588830 Change-Id: I516913f2e4c36e6edbffb3c12b633a158ba04287 Signed-off-by: John Stultz <jstultz@google.com> |
||
|
|
6147e04a86 |
Revert "Bluetooth: hci_sync: Fix overwriting request callback"
This reverts commit
|
||
|
|
c0dded0f8b |
Revert "Bluetooth: fix use-after-free in accessing skb after sending it"
This reverts commit
|
||
|
|
7386876ffd |
Revert "Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH"
This reverts commit |
||
|
|
0ba60e394b |
Revert "Bluetooth: Fix eir name length"
This reverts commit
|
||
|
|
ff903561b7 |
UPSTREAM: tools/resolve_btfids: fix build with musl libc
commit 62248b22d01e96a4d669cde0d7005bd51ebf9e76 upstream.
Include the header that defines u32.
This fixes build of 6.6.23 and 6.1.83 kernels for Alpine Linux, which
uses musl libc. I assume that GNU libc indirecly pulls in linux/types.h.
Fixes: 9707ac4fe2f5 ("tools/resolve_btfids: Refactor set sorting with types from btf_ids.h")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218647
Cc: stable@vger.kernel.org
Change-Id: I34cd9d80bc1623c0caa1c2f894710e6640b4c0bc
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Tested-by: Greg Thelen <gthelen@google.com>
Link: https://lore.kernel.org/r/20240328110103.28734-1-ncopa@alpinelinux.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit
|
||
|
|
0328f7d241 |
Merge 6.1.83 into android14-6.1-lts
Changes in 6.1.83
md: fix data corruption for raid456 when reshape restart while grow up
md/raid10: prevent soft lockup while flush writes
io_uring/unix: drop usage of io_uring socket
io_uring: drop any code related to SCM_RIGHTS
nfsd: allow nfsd_file_get to sanely handle a NULL pointer
nfsd: don't open-code clear_and_wake_up_bit
nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
nfsd: don't kill nfsd_files because of lease break error
nfsd: add some comments to nfsd_file_do_acquire
nfsd: don't take/put an extra reference when putting a file
nfsd: update comment over __nfsd_file_cache_purge
nfsd: allow reaping files still under writeback
NFSD: Convert filecache to rhltable
nfsd: simplify the delayed disposal list code
NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
NFSD: Add an nfsd4_encode_nfstime4() helper
nfsd: Fix creation time serialization order
media: rkisp1: Fix IRQ handling due to shared interrupts
perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child count)
selftests: tls: use exact comparison in recv_partial
ASoC: rt5645: Make LattePanda board DMI match more precise
ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU
x86/xen: Add some null pointer checking to smp.c
MIPS: Clear Cause.BD in instruction_pointer_set
HID: multitouch: Add required quirk for Synaptics 0xcddc device
gen_compile_commands: fix invalid escape sequence warning
arm64/sve: Lower the maximum allocation for the SVE ptrace regset
soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt
RDMA/mlx5: Fix fortify source warning while accessing Eth segment
RDMA/mlx5: Relax DEVX access upon modify commands
riscv: dts: sifive: add missing #interrupt-cells to pmic
x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
net/iucv: fix the allocation size of iucv_path_table array
parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
block: sed-opal: handle empty atoms when parsing response
dm-verity, dm-crypt: align "struct bvec_iter" correctly
arm64: dts: Fix dtc interrupt_provider warnings
btrfs: fix data races when accessing the reserved amount of block reserves
btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
net: smsc95xx: add support for SYS TEC USB-SPEmodule1
wifi: mac80211: only call drv_sta_rc_update for uploaded stations
ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table
scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
Bluetooth: mgmt: Fix limited discoverable off timeout
firewire: core: use long bus reset on gap count error
arm64: tegra: Set the correct PHY mode for MGBE
ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
Input: gpio_keys_polled - suppress deferred probe error for gpio
ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
fs: Fix rw_hint validation
s390/dasd: add autoquiesce feature
s390/dasd: Use dev_*() for device log messages
s390/dasd: fix double module refcount decrement
rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure recovery
rcu/exp: Handle RCU expedited grace period kworker allocation failure
nbd: null check for nla_nest_start
fs/select: rework stack allocation hack for clang
md: Don't clear MD_CLOSING when the raid is about to stop
lib/cmdline: Fix an invalid format specifier in an assertion msg
lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
time: test: Fix incorrect format specifier
rtc: test: Fix invalid format specifier.
io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
io_uring/net: move receive multishot out of the generic msghdr path
io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
x86/resctrl: Implement new mba_MBps throttling heuristic
x86/sme: Fix memory encryption setting if enabled by default and not overridden
timekeeping: Fix cross-timestamp interpolation on counter wrap
timekeeping: Fix cross-timestamp interpolation corner case decision
timekeeping: Fix cross-timestamp interpolation for non-x86
sched/fair: Take the scheduling domain into account in select_idle_smt()
sched/fair: Take the scheduling domain into account in select_idle_core()
wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
wifi: b43: Stop correct queue in DMA worker when QoS is disabled
wifi: b43: Disable QoS for bcm4331
wifi: wilc1000: fix declarations ordering
wifi: wilc1000: fix RCU usage in connect path
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
wifi: wilc1000: do not realloc workqueue everytime an interface is added
wifi: wilc1000: fix multi-vif management when deleting a vif
wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
cpufreq: Explicitly include correct DT includes
cpufreq: mediatek-hw: Wait for CPU supplies before probing
sock_diag: annotate data-races around sock_diag_handlers[family]
inet_diag: annotate data-races around inet_diag_table[]
bpftool: Silence build warning about calloc()
libbpf: Apply map_set_def_max_entries() for inner_maps on creation
selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values
af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
cpufreq: mediatek-hw: Don't error out if supply is not found
libbpf: Fix faccessat() usage on Android
pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM
arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL OSM-S board
arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL board
arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL OSM-S board
arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board
arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
wifi: iwlwifi: mvm: report beacon protection failures
wifi: iwlwifi: dbg-tlv: ensure NUL termination
wifi: iwlwifi: fix EWRD table validity check
gpio: vf610: allow disabling the vf610 driver
arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
pwm: atmel-hlcdc: Convert to platform remove callback returning void
pwm: atmel-hlcdc: Use consistent variable naming
pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
net: blackhole_dev: fix build warning for ethh set but not used
wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
wifi: wfx: fix memory leak when starting AP
printk: Disable passing console lock owner completely during panic()
pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
tools/resolve_btfids: Fix cross-compilation to non-host endianness
wifi: iwlwifi: mvm: don't set replay counters to 0xff
s390/pai: fix attr_event_free upper limit for pai device drivers
s390/vdso: drop '-fPIC' from LDFLAGS
selftests: forwarding: Add missing config entries
selftests: forwarding: Add missing multicast routing config entries
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
arm64: dts: mt8183: kukui: Split out keyboard node and describe detachables
arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
arm64: dts: mediatek: mt8192: fix vencoder clock name
arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
ARM: dts: qcom: msm8974: correct qfprom node size
wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
bus: tegra-aconnect: Update dependency to ARCH_TEGRA
iommu/amd: Mark interrupt as managed
wifi: brcmsmac: avoid function pointer casts
arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
arm64: dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs
arm64: dts: qcom: sm8150: correct PCIe wake-gpios
powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
net: ena: Remove ena_select_queue
arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
firmware: arm_scmi: Fix double free in SMC transport cleanup path
wifi: wilc1000: revert reset line logic flip
ARM: dts: arm: realview: Fix development chip ROM compatible value
arm64: dts: renesas: r9a07g043: Split out RZ/G2UL SoC specific parts
arm64: dts: renesas: r9a07g043u: Add IRQC node
arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
arm64: dts: renesas: r8a779a0: Update to R-Car Gen4 compatible values
arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
net: mctp: copy skb ext data when fragmenting
pstore: inode: Convert mutex usage to guard(mutex)
pstore: inode: Only d_invalidate() is needed
arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
ARM: dts: imx6dl-yapp4: Move phy reset into switch node
ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
ACPI: resource: Do IRQ override on Lunnen Ground laptops
ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
ACPI: scan: Fix device check notification handling
arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
x86, relocs: Ignore relocations in .notes section
SUNRPC: fix some memleaks in gssx_dec_option_array
mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
wifi: rtw88: 8821c: Fix beacon loss and disconnect
wifi: rtw88: 8821c: Fix false alarm count
PCI: Make pci_dev_is_disconnected() helper public for other drivers
iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
igb: Fix missing time sync events
Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
Bluetooth: mgmt: Remove leftover queuing of power_off work
Bluetooth: Remove superfluous call to hci_conn_check_pending()
Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
Bluetooth: Cancel sync command before suspend and power off
Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running
Bluetooth: hci_conn: Consolidate code for aborting connections
Bluetooth: hci_core: Cancel request on command timeout
Bluetooth: hci_sync: Fix overwriting request callback
Bluetooth: hci_core: Fix possible buffer overflow
Bluetooth: af_bluetooth: Fix deadlock
Bluetooth: fix use-after-free in accessing skb after sending it
sr9800: Add check for usbnet_get_endpoints
s390/cache: prevent rebuild of shared_cpu_list
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
bpf: Fix hashtab overflow check on 32-bit arches
bpf: Fix stackmap overflow check on 32-bit arches
iommu/vt-d: Retrieve IOMMU perfmon capability information
iommu: Fix compilation without CONFIG_IOMMU_INTEL
ipv6: fib6_rules: flush route cache when rule is changed
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
net: phy: fix phy_get_internal_delay accessing an empty array
net: hns3: fix wrong judgment condition issue
net: hns3: fix kernel crash when 1588 is received on HIP08 devices
net: hns3: fix port duplex configure error in IMP reset
Bluetooth: MGMT: Fix always using HCI_MAX_AD_LENGTH
Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH
Bluetooth: Fix eir name length
net: phy: dp83822: Fix RGMII TX delay configuration
OPP: debugfs: Fix warning around icc_get_name()
tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
nfp: flower: handle acti_netdevs allocation failure
bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
dm raid: fix false positive for requeue needed during reshape
dm: call the resume method on internal suspend
drm/tegra: dsi: Add missing check for of_find_device_by_node
drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
drm/tegra: dsi: Make use of the helper function dev_err_probe()
drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
drm/tegra: hdmi: Convert to devm_platform_ioremap_resource()
drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe()
drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
drm/rockchip: inno_hdmi: Fix video timing
drm: Don't treat 0 as -1 in drm_fixp2int_ceil
drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
drm/rockchip: lvds: do not overwrite error code
drm/rockchip: lvds: do not print scary message when probing defer
drm/panel-edp: use put_sync in unprepare
drm/lima: fix a memleak in lima_heap_alloc
ASoC: amd: acp: Add missing error handling in sof-mach
dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
media: tc358743: register v4l2 async device only after successful setup
PCI/DPC: Print all TLP Prefixes, not just the first
perf record: Fix possible incorrect free in record__switch_output()
HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
pinctrl: renesas: r8a779g0: Add Audio SSI pins, groups, and functions
pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
clk: samsung: exynos850: Propagate SPI IPCLK rate change
perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
clk: meson: Add missing clocks to axg_clk_regmaps
media: em28xx: annotate unchecked call to media_device_register()
media: v4l2-tpg: fix some memleaks in tpg_alloc
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
media: edia: dvbdev: fix a use-after-free
pinctrl: mediatek: Drop bogus slew rate register range for MT8186
pinctrl: mediatek: Drop bogus slew rate register range for MT8192
clk: qcom: reset: Commonize the de/assert functions
clk: qcom: reset: Ensure write completion on reset de/assertion
quota: simplify drop_dquot_ref()
quota: Fix potential NULL pointer dereference
quota: Fix rcu annotations of inode dquot pointers
PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
crypto: xilinx - call finalize with bh disabled
perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
clk: renesas: r8a779g0: Add CMT clocks
clk: renesas: r8a779g0: Add Audio clocks
clk: renesas: r8a779g0: Add thermal clock
clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
ALSA: seq: fix function cast warnings
perf stat: Avoid metric-only segv
ASoC: meson: aiu: fix function pointer type mismatch
ASoC: meson: t9015: fix function pointer type mismatch
powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
ASoC: SOF: Introduce container struct for SOF firmware
ASoC: SOF: Add some bounds checking to firmware data
NTB: EPF: fix possible memory leak in pci_vntb_probe()
NTB: fix possible name leak in ntb_register_device()
media: cedrus: h265: Associate mv col buffers with buffer
media: cedrus: h265: Fix configuring bitstream size
media: sun8i-di: Fix coefficient writes
media: sun8i-di: Fix power on/off sequences
media: sun8i-di: Fix chroma difference threshold
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
media: go7007: add check of return value of go7007_read_addr()
media: pvrusb2: remove redundant NULL check
media: pvrusb2: fix pvr2_stream_callback casts
clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
drm/tegra: put drm_gem_object ref on error in tegra_fb_create
mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
crypto: arm/sha - fix function cast warnings
crypto: jitter - fix CRYPTO_JITTERENTROPY help text
drm/tidss: Fix initial plane zpos values
drm/tidss: Fix sync-lost issue with two displays
mtd: maps: physmap-core: fix flash size larger than 32-bit
mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
ASoC: meson: axg-tdm-interface: add frame rate constraint
HID: amd_sfh: Update HPD sensor structure elements
HID: amd_sfh: Avoid disabling the interrupt
drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
media: pvrusb2: fix uaf in pvr2_context_set_notify
media: dvb-frontends: avoid stack overflow warnings with clang
media: go7007: fix a memleak in go7007_load_encoder
media: ttpci: fix two memleaks in budget_av_attach
media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
gpio: nomadik: fix offset bug in nmk_pmx_set()
drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
powerpc/pseries: Fix potential memleak in papr_get_attr()
powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
drm/msm/dpu: add division of drm_display_mode's hskew parameter
modules: wait do_free_init correctly
powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
leds: aw2013: Unlock mutex before destroying it
leds: sgm3140: Add missing timer cleanup and flash gpio control
backlight: lm3630a: Initialize backlight_properties on init
backlight: lm3630a: Don't set bl->props.brightness in get_brightness
backlight: da9052: Fully initialize backlight_properties during probe
backlight: lm3639: Fully initialize backlight_properties during probe
backlight: lp8788: Fully initialize backlight_properties during probe
sparc32: Fix section mismatch in leon_pci_grpci
clk: Fix clk_core_get NULL dereference
clk: zynq: Prevent null pointer dereference caused by kmalloc failure
ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
RDMA/irdma: Allow accurate reporting on QP max send/recv WR
RDMA/irdma: Remove duplicate assignment
RDMA/srpt: Do not register event handler until srpt device is fully setup
f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
f2fs: compress: fix to guarantee persisting compressed blocks by CP
f2fs: compress: fix to cover normal cluster write with cp_rwsem
f2fs: compress: fix to check unreleased compressed cluster
f2fs: simplify __allocate_data_block
f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN
f2fs: delete obsolete FI_DROP_CACHE
f2fs: introduce get_dnode_addr() to clean up codes
f2fs: update blkaddr in __set_data_blkaddr() for cleanup
f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
f2fs: fix to avoid potential panic during recovery
scsi: csiostor: Avoid function pointer casts
RDMA/hns: Fix mis-modifying default congestion control algorithm
RDMA/device: Fix a race between mad_client and cm_client init
RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
f2fs: compress: fix to check zstd compress level correctly in mount option
net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
NFSv4.2: fix listxattr maximum XDR buffer size
f2fs: compress: fix to check compress flag w/ .i_sem lock
f2fs: check number of blocks in a current section
watchdog: stm32_iwdg: initialize default timeout
f2fs: ro: compress: fix to avoid caching unaligned extent
NFS: Fix an off by one in root_nfs_cat()
f2fs: convert to use sbi directly
f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
f2fs: compress: fix reserve_cblocks counting error when out of space
perf/x86/amd/core: Avoid register reset when CPU is dead
afs: Revert "afs: Hide silly-rename files from userspace"
nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
io_uring/net: correct the type of variable
comedi: comedi_test: Prevent timers rescheduling during deletion
remoteproc: stm32: use correct format strings on 64-bit
remoteproc: stm32: Fix incorrect type in assignment for va
remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
usb: phy: generic: Get the vbus supply
tty: vt: fix 20 vs 0x20 typo in EScsiignore
serial: max310x: fix syntax error in IRQ error message
tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
kconfig: fix infinite loop when expanding a macro at the end of file
hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()
rtc: mt6397: select IRQ_DOMAIN instead of depending on it
serial: 8250_exar: Don't remove GPIO device on suspend
staging: greybus: fix get_channel_from_mode() failure path
usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
nouveau: reset the bo resource bus info after an eviction
tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
octeontx2-af: Use matching wake_up API variant in CGX command interface
s390/vtime: fix average steal time calculation
net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
soc: fsl: dpio: fix kcalloc() argument order
tcp: Fix refcnt handling in __inet_hash_connect().
hsr: Fix uninit-value access in hsr_get_node()
nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics controllers
nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set
nvme: fix reconnection fail due to reserved tag allocation
net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
net: ethernet: mtk_eth_soc: fix PPE hanging issue
packet: annotate data-races around ignore_outgoing
net: veth: do not manipulate GRO when using XDP
net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
drm: Fix drm_fixp2int_round() making it add 0.5
vdpa_sim: reset must not run
vdpa/mlx5: Allow CVQ size changes
wireguard: receive: annotate data-race around receiving_counter.counter
rds: introduce acquire/release ordering in acquire/release_in_xmit()
hsr: Handle failures in module init
ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
dm-integrity: fix a memory leak when rechecking the data
net/bnx2x: Prevent access to a freed page in page_pool
octeontx2-af: recover CPT engine when it gets fault
octeontx2-af: add mbox for CPT LF reset
octeontx2-af: optimize cpt pf identification
octeontx2-af: add mbox to return CPT_AF_FLT_INT info
octeontx2: Detect the mbox up or down message via register
net: octeontx2: Use alloc_ordered_workqueue() to create ordered workqueues
octeontx2-pf: Use default max_active works instead of one
octeontx2-pf: Send UP messages to VF only when VF is up.
octeontx2-af: Use separate handlers for interrupts
netfilter: nft_set_pipapo: release elements in clone only from destroy path
netfilter: nf_tables: do not compare internal table flags on updates
rcu: add a helper to report consolidated flavor QS
net: report RCU QS on threaded NAPI repolling
bpf: report RCU QS in cpumap kthread
net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
net: dsa: mt7530: fix handling of all link-local frames
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
selftests: forwarding: Fix ping failure due to short timeout
dm: address indent/space issues
dm io: Support IO priority
dm-integrity: align the outgoing bio in integrity_recheck
x86/efistub: Clear decompressor BSS in native EFI entrypoint
x86/efistub: Don't clear BSS twice in mixed mode
remoteproc: stm32: fix incorrect optional pointers
Linux 6.1.83
Change-Id: I621b271ff4a4603b0a348b64edc9c942bf050047
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
|
96cbfc5879 |
Merge 6.1.82 into android14-6.1-lts
Changes in 6.1.82
ceph: switch to corrected encoding of max_xattr_size in mdsmap
net: lan78xx: fix runtime PM count underflow on link stop
ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
i40e: disable NAPI right after disabling irqs when handling xsk_pool
ice: reorder disabling IRQ and NAPI in ice_qp_dis
tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
geneve: make sure to pull inner header in geneve_rx()
net: sparx5: Fix use after free inside sparx5_del_mact_entry
ice: virtchnl: stop pretending to support RSS over AQ or registers
net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
igc: avoid returning frame twice in XDP_REDIRECT
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
net: dsa: microchip: fix register write order in ksz8_ind_write8()
net/rds: fix WARNING in rds_conn_connect_if_down
netfilter: nft_ct: fix l3num expectations with inet pseudo family
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
erofs: apply proper VMA alignment for memory mapped files on THP
netrom: Fix a data-race around sysctl_netrom_default_path_quality
netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
netrom: Fix a data-race around sysctl_netrom_transport_timeout
netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
netrom: Fix a data-race around sysctl_netrom_routing_control
netrom: Fix a data-race around sysctl_netrom_link_fails_count
netrom: Fix data-races around sysctl_net_busy_read
KVM: s390: add stat counter for shadow gmap events
KVM: s390: vsie: fix race during shadow creation
ASoC: codecs: wcd938x: fix headphones volume controls
drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions
nfp: flower: add goto_chain_index for ct entry
nfp: flower: add hardware offload check for post ct entry
readahead: avoid multiple marked readahead pages
selftests/mm: switch to bash from sh
selftests: mm: fix map_hugetlb failure on 64K page size systems
xhci: process isoc TD properly when there was a transaction error mid TD.
xhci: handle isoc Babble and Buffer Overrun events properly
drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
Documentation/hw-vuln: Add documentation for RFDS
x86/rfds: Mitigate Register File Data Sampling (RFDS)
KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
selftests: mptcp: decrease BW in simult flows
drm/amd/display: Wrong colorimetry workaround
drm/amd/display: Fix MST Null Ptr for RV
getrusage: add the "signal_struct *sig" local variable
getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
getrusage: use __for_each_thread()
getrusage: use sig->stats_lock rather than lock_task_sighand()
fs/proc: do_task_stat: use __for_each_thread()
fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
Linux 6.1.82
Change-Id: I8d895a098144f39d40badf314fbb4a632c5ace49
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
|
274e3e9696 |
ANDROID: export one function for mm metrics
export function for sysfs node formating Bug: 299190787 Change-Id: I71e6a0815efa8df99d036bf457b8a0081999f3de Signed-off-by: Robin Hsu <robinhsu@google.com> |
||
|
|
117a941226 |
ANDROID: Update the ABI symbol list
Adding the following symbols: - drm_hdmi_avi_infoframe_from_display_mode - hdmi_avi_infoframe_pack - sysctl_sched_wakeup_granularity Bug: 337139487 Change-Id: I08ff1f4406e14fd42fee255d3eb49ccbd9c9b338 Signed-off-by: Qais Yousef <qyousef@google.com> |
||
|
|
0d080e01a2 |
ANDROID: Export sysctl_sched_wakeup_granularity to enable modifying it
The value is only available in debugfs. Export it to allow out of tree modules to modify it. Bug: 337139487 Signed-off-by: Qais Yousef <qyousef@google.com> Change-Id: I4b3a5aeeee0539b88756aacc97df6181f68d9d0d |
||
|
|
039d2a958c |
UPSTREAM: ALSA: virtio: use ack callback
This commit uses the ack() callback to determine when a buffer has been updated, then exposes it to guest. The current mechanism splits a dma buffer into descriptors that are exposed to the device. This dma buffer is shared with the user application. When the device consumes a buffer, the driver moves the request from the used ring to available ring. The driver exposes the buffer to the device without knowing if the content has been updated from the user. The section 2.8.21.1 of the virtio spec states that: "The device MAY access the descriptor chains the driver created and the memory they refer to immediately". If the device picks up buffers from the available ring just after it is notified, it happens that the content may be old. When the ack() callback is invoked, the driver exposes only the buffers that have already been updated, i.e., enqueued in the available ring. Thus, the device always picks up a buffer that is updated. For capturing, the driver starts by exposing all the available buffers to device. After device updates the content of a buffer, it enqueues it in the used ring. It is only after the ack() for capturing is issued that the driver re-enqueues the buffer in the available ring. Co-developed-by: Anton Yakovlev <anton.yakovlev@opensynergy.com> Signed-off-by: Anton Yakovlev <anton.yakovlev@opensynergy.com> Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com> Link: https://lore.kernel.org/r/ZTjkn1YAFz67yfqx@fedora Signed-off-by: Takashi Iwai <tiwai@suse.de> Bug: 331600622 Change-Id: If1269f1777432256eea0e0275b678d0d649753bb (cherry picked from commit fe981e67568c41de6caae25d70b5f203b94452cc) Signed-off-by: Brian Daniels <briandaniels@google.com> |
||
|
|
045f29a0bd |
Revert "usb: gadget: Properly configure the device for remote wakeup"
This reverts commit |
||
|
|
2e193db1b4 |
Revert "scsi: sd: usb_storage: uas: Access media prior to querying device properties"
This reverts commit
|
||
|
|
3011e898b2 |
Revert "Bluetooth: hci_qca: mark OF related data as maybe unused"
This reverts commit |
||
|
|
a3778f3e13 |
Revert "Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855"
This reverts commit |
||
|
|
d9340ec8dd |
Revert "Bluetooth: btqca: use le32_to_cpu for ver.soc_id"
This reverts commit |
||
|
|
b904eebfd4 |
Revert "Bluetooth: btqca: Add WCN3988 support"
This reverts commit |
||
|
|
55a316da31 |
Revert "Bluetooth: qca: use switch case for soc type behavior"
This reverts commit |
||
|
|
360b41bc65 |
Revert "Bluetooth: qca: add support for WCN7850"
This reverts commit |
||
|
|
e075d7f47a |
Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
This reverts commit
|
||
|
|
47dfe41d57 |
UPSTREAM: usb: typec: tcpm: clear pd_event queue in PORT_RESET
When a Fast Role Swap control message attempt results in a transition
to ERROR_RECOVERY, the TCPC can still queue a TCPM_SOURCING_VBUS event.
If the event is queued but processed after the tcpm_reset_port() call
in the PORT_RESET state, then the following occurs:
1. tcpm_reset_port() calls tcpm_init_vbus() to reset the vbus sourcing and
sinking state
2. tcpm_pd_event_handler() turns VBUS on before the port is in the default
state.
3. The port resolves as a sink. In the SNK_DISCOVERY state,
tcpm_set_charge() cannot set vbus to charge.
Clear pd events within PORT_RESET to get rid of non-applicable events.
Fixes:
|
||
|
|
93188d7732 |
BACKPORT: usb: typec: tcpm: enforce ready state when queueing alt mode vdm
Before sending Enter Mode for an Alt Mode, there is a gap between Discover
Modes and the Alt Mode driver queueing the Enter Mode VDM for the port
partner to send a message to the port.
If this message results in unregistering Alt Modes such as in a DR_SWAP,
then the following deadlock can occur with respect to the DisplayPort Alt
Mode driver:
1. The DR_SWAP state holds port->lock. Unregistering the Alt Mode driver
results in a cancel_work_sync() that waits for the current dp_altmode_work
to finish.
2. dp_altmode_work makes a call to tcpm_altmode_enter. The deadlock occurs
because tcpm_queue_vdm_unlock attempts to hold port->lock.
Before attempting to grab the lock, ensure that the port is in a state
vdm_run_state_machine can run in. Alt Mode unregistration will not occur
in these states.
Fixes:
|
||
|
|
4d55129aea |
UPSTREAM: crypto: x86/curve25519 - disable gcov
curve25519-x86_64.c fails to build when CONFIG_GCOV_KERNEL is enabled.
The error is "inline assembly requires more registers than available"
thrown from the `fsqr()` function. Therefore, excluding this file from
GCOV profiling until this issue is resolved. Thereby allowing
CONFIG_GCOV_PROFILE_ALL to be enabled for x86.
Change-Id: Icbb1ed0e1b99f1cb0a21ea7a2920b3edce70c38d
Signed-off-by: Joe Fradley <joefradley@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit
|
||
|
|
cf685d2b02 |
ANDROID: GKI: Update QCOM symbol list and ABI STG
Update QCOM symbol list in android/abi_gki_aarch64_qcom with following
symbols.
4 function symbol(s) added
'struct powercap_control_type* powercap_register_control_type(struct powercap_control_type*,
const char*, const struct powercap_control_type_ops*)'
'struct powercap_zone* powercap_register_zone(struct powercap_zone*,
struct powercap_control_type*, const char*, struct powercap_zone*,
const struct powercap_zone_ops*, int, const struct powercap_zone_constraint_ops*)'
'int powercap_unregister_control_type(struct powercap_control_type*)'
'int powercap_unregister_zone(struct powercap_control_type*, struct powercap_zone*)'
Bug: 338523446
Change-Id: Ie1305e6231532c824bd11bcc1e0abecdb55109aa
Signed-off-by: Priyansh Jain <quic_priyjain@quicinc.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
|
||
|
|
fae94bc4e7 |
ANDROID: GKI: update symbol list file for xiaomi
INFO: 68 function symbol(s) added 'int __break_lease(struct inode*, unsigned int, unsigned int)' 'void __d_lookup_unhash_wake(struct dentry*)' 'int __folio_lock_killable(struct folio*)' 'int add_swap_extent(struct swap_info_struct*, unsigned long, unsigned long, sector_t)' 'int asn1_ber_decoder(const struct asn1_decoder*, void*, const unsigned char*, size_t)' 'size_t copy_page_from_iter(struct page*, size_t, size_t, struct iov_iter*)' 'size_t copy_page_to_iter(struct page*, size_t, size_t, struct iov_iter*)' 'struct dentry* d_alloc_parallel(struct dentry*, const struct qstr*, wait_queue_head_t*)' 'void d_drop(struct dentry*)' 'struct dentry* d_hash_and_lookup(struct dentry*, struct qstr*)' 'void d_invalidate(struct dentry*)' 'void d_move(struct dentry*, struct dentry*)' 'void deactivate_super(struct super_block*)' 'int errseq_check(errseq_t*, errseq_t)' 'int file_modified(struct file*)' 'vm_fault_t filemap_map_pages(struct vm_fault*, unsigned long, unsigned long)' 'int finish_no_open(struct file*, struct dentry*)' 'int finish_open(struct file*, struct dentry*, int(*)(struct inode*, struct file*))' 'bool folio_clear_dirty_for_io(struct folio*)' 'void folio_wait_private_2(struct folio*)' 'int fs_param_is_bool(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)' 'int fs_param_is_u64(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)' 'void generate_random_uuid(unsigned char*)' 'ssize_t generic_copy_file_range(struct file*, loff_t, struct file*, loff_t, size_t, unsigned int)' 'ssize_t generic_file_write_iter(struct kiocb*, struct iov_iter*)' 'int generic_key_instantiate(struct key*, struct key_preparsed_payload*)' 'int generic_setlease(struct file*, long, struct file_lock**, void**)' 'int invalidate_inode_pages2(struct address_space*)' 'void iov_iter_bvec(struct iov_iter*, unsigned int, const struct bio_vec*, unsigned long, size_t)' 'void iov_iter_discard(struct iov_iter*, unsigned int, size_t)' 'ssize_t iov_iter_get_pages_alloc2(struct iov_iter*, struct page***, size_t, size_t*)' 'int iov_iter_npages(const struct iov_iter*, int)' 'void key_invalidate(struct key*)' 'void key_revoke(struct key*)' 'int key_validate(const struct key*)' 'void lock_two_nondirectories(struct inode*, struct inode*)' 'int locks_lock_inode_wait(struct inode*, struct file_lock*)' 'enum OID look_up_OID(const void*, size_t)' 'struct dentry* lookup_positive_unlocked(const char*, struct dentry*, int)' 'int out_of_line_wait_on_bit_lock(void*, int, wait_bit_action_f*, unsigned int)' 'const struct cred* override_creds(const struct cred*)' 'int posix_lock_file(struct file*, struct file_lock*, struct file_lock*)' 'void posix_test_lock(struct file*, struct file_lock*)' 'struct cred* prepare_kernel_cred(struct task_struct*)' 'int register_key_type(struct key_type*)' 'struct key* request_key_tag(struct key_type*, const char*, struct key_tag*, const char*)' 'void revert_creds(const struct cred*)' 'int security_sb_eat_lsm_opts(char*, void**)' 'void seq_escape_mem(struct seq_file*, const char*, size_t, unsigned int, const char*)' 'int set_anon_super(struct super_block*, void*)' 'struct super_block* sget(struct file_system_type*, int(*)(struct super_block*, void*), int(*)(struct super_block*, void*), int, void*)' 'int sock_sendmsg(struct socket*, struct msghdr*)' 'int sprint_oid(const void*, size_t, char*, size_t)' 'int super_setup_bdi(struct super_block*)' 'void tcp_sock_set_cork(struct sock*, bool)' 'void tcp_sock_set_nodelay(struct sock*)' 'void truncate_inode_pages_range(struct address_space*, loff_t, loff_t)' 'void truncate_pagecache_range(struct inode*, loff_t, loff_t)' 'void unlock_two_nondirectories(struct inode*, struct inode*)' 'void unregister_key_type(struct key_type*)' 'void user_describe(const struct key*, struct seq_file*)' 'void user_destroy(struct key*)' 'long user_read(const struct key*, char*, size_t)' 'void user_revoke(struct key*)' 'int utf8s_to_utf16s(const u8*, int, enum utf16_endian, wchar_t*, int)' 'int vfs_parse_fs_string(struct fs_context*, const char*, const char*, size_t)' 'loff_t vfs_setpos(struct file*, loff_t, loff_t)' 'void wait_on_page_writeback(struct page*)' 1 variable symbol(s) added 'struct key_type key_type_logon' Bug: 334801999 Change-Id: I89f2029bb73155ffd0dd4236de32a7c74d1a8f48 Signed-off-by: fengqi <fengqi@xiaomi.corp-partner.google.com> |
||
|
|
d5e04556d4 |
UPSTREAM: netfilter: nft_set_pipapo: do not free live element
[ Upstream commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc ]
Pablo reports a crash with large batches of elements with a
back-to-back add/remove pattern. Quoting Pablo:
add_elem("00000000") timeout 100 ms
...
add_elem("0000000X") timeout 100 ms
del_elem("0000000X") <---------------- delete one that was just added
...
add_elem("00005000") timeout 100 ms
1) nft_pipapo_remove() removes element 0000000X
Then, KASAN shows a splat.
Looking at the remove function there is a chance that we will drop a
rule that maps to a non-deactivated element.
Removal happens in two steps, first we do a lookup for key k and return the
to-be-removed element and mark it as inactive in the next generation.
Then, in a second step, the element gets removed from the set/map.
The _remove function does not work correctly if we have more than one
element that share the same key.
This can happen if we insert an element into a set when the set already
holds an element with same key, but the element mapping to the existing
key has timed out or is not active in the next generation.
In such case its possible that removal will unmap the wrong element.
If this happens, we will leak the non-deactivated element, it becomes
unreachable.
The element that got deactivated (and will be freed later) will
remain reachable in the set data structure, this can result in
a crash when such an element is retrieved during lookup (stale
pointer).
Add a check that the fully matching key does in fact map to the element
that we have marked as inactive in the deactivation step.
If not, we need to continue searching.
Add a bug/warn trap at the end of the function as well, the remove
function must not ever be called with an invisible/unreachable/non-existent
element.
v2: avoid uneeded temporary variable (Stefano)
Bug: 336735501
Fixes:
|