mirror of
https://github.com/hardkernel/linux.git
synced 2026-06-06 02:50:49 +09:00
0df5dc7d73d9060ce4f80bb694c3eea4aa327a80
1166314 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Greg Kroah-Hartman
|
0df5dc7d73 |
Merge bdbc96c231 ("fsdax: dax_unshare_iter needs to copy entire blocks") into android14-6.1-lts
Steps on the way to 6.1.116 Resolves merge conflicts in: fs/iomap/buffered-io.c Change-Id: Ibe7e7f5a94bee171200931351878cf40e37b8bbc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
a566b71fed |
Merge d321732352 ("netfilter: nft_payload: sanitize offset and length before calling skb_checksum()") into android14-6.1-lts
Steps on the way to 6.1.116 Change-Id: If62fadaf5fbd6d9663368509dd05b285a930f6d5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
bb558c55a5 |
Revert "genetlink: hold RCU in genlmsg_mcast()"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
c5efbe731b |
Revert "tty/serial: Make ->dcd_change()+uart_handle_dcd_change() status bool active"
This reverts commit |
||
|
Greg Kroah-Hartman
|
3aee75909f |
Revert "serial: Make uart_handle_cts_change() status param bool active"
This reverts commit |
||
|
Greg Kroah-Hartman
|
d82cacc625 |
Revert "serial: imx: Update mctrl old_status on RTSD interrupt"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
ca7ef58ce4 |
Revert "arm64:uprobe fix the uprobe SWBP_INSN in big-endian"
This reverts commit |
||
|
Greg Kroah-Hartman
|
bfff915c97 |
Revert "arm64: probes: Fix uprobes for big-endian kernels"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
535085db57 |
Revert "arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning"
This reverts commit |
||
|
Greg Kroah-Hartman
|
983df5e9ef |
Revert "usb: gadget: Add function wakeup support"
This reverts commit |
||
|
Greg Kroah-Hartman
|
56f28f2269 |
Revert "XHCI: Separate PORT and CAPs macros into dedicated file"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
fae9c0cd1a |
Revert "usb: dwc3: core: Fix system suspend on TI AM62 platforms"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
45a7ce8a2b |
ANDROID: GKI: fix up build break where timer_delete_sync() was used
We reverted the commit that renamed del_timer_sync() to timer_delete_sync() a long while back, but that broke the build when commit |
||
|
Greg Kroah-Hartman
|
a332a3d23d |
Merge 6.1.115 into android14-6.1-lts
Changes in 6.1.115
bpf: Use raw_spinlock_t in ringbuf
iio: accel: bma400: Fix uninitialized variable field_value in tap event handling.
bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
bpf: devmap: provide rxq after redirect
bpf: Fix memory leak in bpf_core_apply
RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
RDMA/bnxt_re: Add a check for memory allocation
x86/resctrl: Avoid overflow in MB settings in bw_validate()
ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
s390/pci: Handle PCI error codes other than 0x3a
bpf: fix kfunc btf caching for modules
iio: frequency: {admv4420,adrf6780}: format Kconfig entries
iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig
drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check
selftests/bpf: Fix cross-compiling urandom_read
ALSA: hda/cs8409: Fix possible NULL dereference
RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
RDMA/irdma: Fix misspelling of "accept*"
RDMA/srpt: Make slab cache names unique
ipv4: give an IPv4 dev to blackhole_netdev
RDMA/bnxt_re: Return more meaningful error
RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
drm/msm/dpu: make sure phys resources are properly initialized
drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
drm/msm: Allocate memory for disp snapshot with kvzalloc()
net: usb: usbnet: fix race in probe failure
octeontx2-af: Fix potential integer overflows on integer shifts
drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring
macsec: don't increment counters for an unrelated SA
netdevsim: use cond_resched() in nsim_dev_trap_report_work()
net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
net: xilinx: axienet: fix potential memory leak in axienet_start_xmit()
net: systemport: fix potential memory leak in bcm_sysport_xmit()
irqchip/renesas-rzg2l: Align struct member names to tabs
irqchip/renesas-rzg2l: Document structure members
irqchip/renesas-rzg2l: Add support for suspend to RAM
irqchip/renesas-rzg2l: Fix missing put_device
drm/msm/dpu: Wire up DSC mask for active CTL configuration
drm/msm/dpu: don't always program merge_3d block
tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
genetlink: hold RCU in genlmsg_mcast()
ravb: Remove setting of RX software timestamp
net: ravb: Only advertise Rx/Tx timestamps if hardware supports it
scsi: target: core: Fix null-ptr-deref in target_alloc_device()
smb: client: fix OOBs when building SMB2_IOCTL request
usb: typec: altmode should keep reference to parent
s390: Initialize psw mask in perf_arch_fetch_caller_regs()
Bluetooth: bnep: fix wild-memory-access in proto_unregister
net/mlx5: Remove redundant cmdif revision check
net/mlx5: split mlx5_cmd_init() to probe and reload routines
net/mlx5: Fix command bitmask initialization
net/mlx5: Unregister notifier on eswitch init failure
riscv, bpf: Make BPF_CMPXCHG fully ordered
bpf: Fix iter/task tid filtering
arm64:uprobe fix the uprobe SWBP_INSN in big-endian
arm64: probes: Fix uprobes for big-endian kernels
xhci: dbgtty: remove kfifo_out() wrapper
xhci: dbgtty: use kfifo from tty_port struct
xhci: dbc: honor usb transfer size boundaries.
usb: gadget: f_uac2: Replace snprintf() with the safer scnprintf() variant
usb: gadget: f_uac2: fix non-newline-terminated function name
usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store
usb: gadget: Add function wakeup support
XHCI: Separate PORT and CAPs macros into dedicated file
usb: dwc3: core: Fix system suspend on TI AM62 platforms
tty/serial: Make ->dcd_change()+uart_handle_dcd_change() status bool active
serial: Make uart_handle_cts_change() status param bool active
serial: imx: Update mctrl old_status on RTSD interrupt
block, bfq: fix procress reference leakage for bfqq in merge chain
exec: don't WARN for racy path_noexec check
fs/ntfs3: Add more attributes checks in mi_enum_attr()
drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values
ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
arm64: Force position-independent veneers
udf: refactor udf_current_aext() to handle error
udf: fix uninit-value use in udf_get_fileshortad
ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
platform/x86: dell-sysman: add support for alienware products
LoongArch: Add support to clone a time namespace
LoongArch: Don't crash in stack_top() for tasks without vDSO
jfs: Fix sanity check in dbMount
tracing: Consider the NULL character when validating the event length
xfrm: extract dst lookup parameters into a struct
xfrm: respect ip protocols rules criteria when performing dst lookups
net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
be2net: fix potential memory leak in be_xmit()
net: plip: fix break; causing plip to never transmit
octeon_ep: Implement helper for iterating packets in Rx queue
octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
netfilter: xtables: fix typo causing some targets not to load on IPv6
net: wwan: fix global oob in wwan_rtnl_policy
docs: net: reformat driver.rst from a list to sections
net: provide macros for commonly copied lockless queue stop/wake code
net/sched: adjust device watchdog timer to detect stopped queue at right time
net: fix races in netdev_tx_sent_queue()/dev_watchdog()
net: usb: usbnet: fix name regression
net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers
net: sched: fix use-after-free in taprio_change()
r8169: avoid unsolicited interrupts
posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
Bluetooth: SCO: Fix UAF on sco_sock_timeout
Bluetooth: ISO: Fix UAF on iso_sock_timeout
bpf,perf: Fix perf_event_detach_bpf_prog error handling
ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request()
ALSA: hda/realtek: Update default depop procedure
cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}()
cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item()
btrfs: zoned: fix zone unusable accounting for freed reserved extent
drm/amd: Guard against bad data for ATIF ACPI method
ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context
ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
nilfs2: fix kernel bug due to missing clearing of buffer delay flag
openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
KVM: arm64: Don't eagerly teardown the vgic on init error
ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
LoongArch: Get correct cores_per_package for SMT systems
xfrm: fix one more kernel-infoleak in algo dumping
hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too
selinux: improve error checking in sel_write_load()
serial: protect uart_port_dtr_rts() in uart_shutdown() too
net: phy: dp83822: Fix reset pin definitions
ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
platform/x86: dell-wmi: Ignore suspend notifications
ACPI: PRM: Clean up guid type in struct prm_handler_info
arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
Linux 6.1.115
Change-Id: I3348b13afe931340f904062b8a22d8d6c4a46d5c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Greg Kroah-Hartman
|
db64cb409e |
Revert "irqchip/gic-v4: Don't allow a VMOVP on a dying VPE"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
4d5ecb6e03 |
Merge 6.1.114 into android14-6.1-lts
Changes in 6.1.114 btrfs: fix uninitialized pointer free in add_inode_ref() btrfs: fix uninitialized pointer free on read_alloc_one_name() error ksmbd: fix user-after-free from session log off ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow udf: New directory iteration code udf: Convert udf_expand_dir_adinicb() to new directory iteration udf: Move udf_expand_dir_adinicb() to its callsite udf: Implement searching for directory entry using new iteration code udf: Provide function to mark entry as deleted using new directory iteration code udf: Convert udf_rename() to new directory iteration code udf: Convert udf_readdir() to new directory iteration udf: Convert udf_lookup() to use new directory iteration code udf: Convert udf_get_parent() to new directory iteration code udf: Convert empty_dir() to new directory iteration code udf: Convert udf_rmdir() to new directory iteration code udf: Convert udf_unlink() to new directory iteration code udf: Implement adding of dir entries using new iteration code udf: Convert udf_add_nondir() to new directory iteration udf: Convert udf_mkdir() to new directory iteration code udf: Convert udf_link() to new directory iteration code udf: Remove old directory iteration code udf: Handle error when expanding directory udf: Don't return bh from udf_expand_dir_adinicb() net: enetc: remove xdp_drops statistic from enetc_xdp_drop() net: enetc: add missing static descriptor and inline keyword posix-clock: Fix missing timespec64 check in pc_clock_settime() arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 fat: fix uninitialized variable mm/swapfile: skip HugeTLB pages for unuse_vma devlink: drop the filter argument from devlinks_xa_find_get devlink: bump the instance index directly when iterating maple_tree: correct tree corruption on spanning store drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices s390/sclp: Deactivate sclp after all its users s390/sclp_vt220: Convert newlines to CRLF instead of LFCR KVM: s390: gaccess: Check if guest address is in memslot KVM: s390: Change virtual to physical address access in diag 0x258 handler x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race io_uring/sqpoll: close race on waiting for sqring entries scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down drm/radeon: Fix encoder->possible_clones drm/vmwgfx: Handle surface check failure correctly drm/amdgpu/swsmu: Only force workload setup on init drm/amdgpu: prevent BO_HANDLES error from being overwritten iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: light: opt3001: add missing full-scale range value iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Bluetooth: Call iso_exit() on module unload Bluetooth: Remove debugfs directory on module init failure Bluetooth: ISO: Fix multiple init when debugfs is disabled Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 xhci: Fix incorrect stream context type macro xhci: Mitigate failed set dequeue pointer commands USB: serial: option: add support for Quectel EG916Q-GL USB: serial: option: add Telit FN920C04 MBIM compositions usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG parport: Proper fix for array out-of-bounds access x86/resctrl: Annotate get_mem_config() functions as __init x86/apic: Always explicitly disarm TSC-deadline timer x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return tty: n_gsm: Fix use-after-free in gsm_cleanup_mux pinctrl: ocelot: fix system hang on level based interrupts pinctrl: apple: check devm_kasprintf() returned value irqchip/gic-v4: Don't allow a VMOVP on a dying VPE irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() tcp: fix mptcp DSS corruption due to large pmtu xmit mptcp: prevent MPC handshake on port-based signal endpoints nilfs2: propagate directory read errors from nilfs_find_entry() powerpc/64: Add big-endian ELFv2 flavour to crypto VMX asm generation ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 udf: Allocate name buffer in directory iterator on heap udf: Avoid directory type conversion failure due to ENOMEM Linux 6.1.114 Change-Id: I02423f0d3a5feb145be5ce9aacc44ea4675e573b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
edae6e6e3d |
Merge 6.1.113 into android14-6.1-lts
Changes in 6.1.113
EDAC/synopsys: Fix ECC status and IRQ control race condition
EDAC/synopsys: Fix error injection on Zynq UltraScale+
wifi: rtw88: always wait for both firmware loading attempts
crypto: xor - fix template benchmarking
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
wifi: ath9k: fix parameter check in ath9k_init_debug()
wifi: ath9k: Remove error checks when creating debugfs entries
net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
wifi: rtw88: remove CPT execution branch never used
RISC-V: KVM: Fix sbiret init before forwarding to userspace
fs/namespace: fnic: Switch to use %ptTd
mount: handle OOM on mnt_warn_timestamp_expiry
kselftest/arm64: Don't pass headers to the compiler as source
kselftest/arm64: Verify simultaneous SSVE and ZA context generation
kselftest/arm64: Fix enumeration of systems without 128 bit SME for SSVE+ZA
kselftest/arm64: signal: fix/refactor SVE vector length enumeration
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
wifi: mac80211: don't use rate mask for offchannel TX either
wifi: iwlwifi: mvm: increase the time between ranging measurements
ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec
padata: Honor the caller's alignment in case of chunk_size 0
drivers/perf: hisi_pcie: Record hardware counts correctly
kselftest/arm64: Actually test SME vector length changes via sigreturn
can: j1939: use correct function name in comment
ACPI: CPPC: Fix MASK_VAL() usage
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
netfilter: nf_tables: reject element expiration with no timeout
netfilter: nf_tables: reject expiration higher than timeout
netfilter: nf_tables: remove annotation to access set timeout while holding lock
perf/arm-cmn: Rework DTC counters (again)
perf/arm-cmn: Improve debugfs pretty-printing for large configs
perf/arm-cmn: Refactor node ID handling. Again.
perf/arm-cmn: Ensure dtm_idx is big enough
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
x86/sgx: Fix deadlock in SGX NUMA node search
crypto: hisilicon/hpre - enable sva error interrupt event
crypto: hisilicon/hpre - mask cluster timeout error
crypto: hisilicon/qm - fix coding style issues
crypto: hisilicon/qm - reset device before enabling it
crypto: hisilicon/qm - inject error before stopping queue
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
wifi: mt76: mt7915: fix rx filter setting for bfee functionality
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
sock_map: Add a cond_resched() in sock_hash_free()
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
can: m_can: Remove repeated check for is_peripheral
can: m_can: enable NAPI before enabling interrupts
can: m_can: m_can_close(): stop clocks after device has been shut down
Bluetooth: btusb: Fix not handling ZPL/short-transfer
bareudp: Pull inner IP header in bareudp_udp_encap_recv().
bareudp: Pull inner IP header on xmit.
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
r8169: disable ALDPS per default for RTL8125
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
net: tipc: avoid possible garbage value
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
nbd: fix race between timeout and normal completion
block, bfq: fix possible UAF for bfqq->bic with merge chain
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
block, bfq: don't break merge chain in bfq_split_bfqq()
block: print symbolic error name instead of error code
block: fix potential invalid pointer dereference in blk_add_partition
spi: ppc4xx: handle irq_of_parse_and_map() errors
arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
firmware: arm_scmi: Fix double free in OPTEE transport
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
regulator: Return actual error in of_regulator_bulk_get_all()
arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
ARM: dts: microchip: sama7g5: Fix RTT clock
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
ARM: versatile: fix OF node leak in CPUs prepare
reset: berlin: fix OF node leak in probe() error path
reset: k210: fix OF node leak in probe() error path
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
ALSA: hda: cs35l41: fix module autoloading
m68k: Fix kernel_clone_args.flags in m68k_clone()
hwmon: (max16065) Fix overflows seen when writing limits
i2c: Add i2c_get_match_data()
hwmon: (max16065) Remove use of i2c_match_id()
hwmon: (max16065) Fix alarm attributes
mtd: slram: insert break after errors in parsing the map
hwmon: (ntc_thermistor) fix module autoloading
power: supply: axp20x_battery: Remove design from min and max voltage
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
iommu/amd: Do not set the D bit on AMD v2 table entries
mtd: powernv: Add check devm_kasprintf() returned value
rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
mtd: rawnand: mtk: Fix init error path
pmdomain: core: Harden inter-column space in debug summary
drm/stm: Fix an error handling path in stm_drm_platform_probe()
drm/stm: ltdc: check memory returned by devm_kzalloc()
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
drm/amdgpu: Replace one-element array with flexible-array member
drm/amdgpu: properly handle vbios fake edid sizing
drm/radeon: Replace one-element array with flexible-array member
drm/radeon: properly handle vbios fake edid sizing
scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
scsi: NCR5380: Check for phase match during PDMA fixup
drm/amd/amdgpu: Properly tune the size of struct
drm/rockchip: vop: Allow 4096px width scaling
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
powerpc/8xx: Fix initial memory mapping
powerpc/8xx: Fix kernel vs user address comparison
drm/msm: Fix incorrect file name output in adreno_request_fw()
drm/msm/a5xx: disable preemption in submits by default
drm/msm/a5xx: properly clear preemption records on resume
drm/msm/a5xx: fix races in preemption evaluation stage
drm/msm/a5xx: workaround early ring-buffer emptiness check
ipmi: docs: don't advertise deprecated sysfs entries
drm/msm: fix %s null argument error
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
xen: use correct end address of kernel for conflict checking
HID: wacom: Support sequence numbers smaller than 16-bit
HID: wacom: Do not warn about dropped packets for first packet
xen/swiotlb: add alignment check for dma buffers
xen/swiotlb: fix allocated size
tpm: Clean up TPM space after command failure
selftests/bpf: Add selftest deny_namespace to s390x deny list
selftests/bpf: Add tests for _opts variants of bpf_*_get_fd_by_id()
selftests/bpf: Workaround strict bpf_lsm return value check.
selftests/bpf: Use pid_t consistently in test_progs.c
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
selftests/bpf: Fix missing BUILD_BUG_ON() declaration
selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test
selftests/bpf: Refactor out some functions in ns_current_pid_tgid test
selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
selftests/bpf: Fix include of <sys/fcntl.h>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
selftests/bpf: Fix compiling core_reloc.c with musl-libc
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
selftests/bpf: Fix error compiling test_lru_map.c
selftests/bpf: Fix C++ compile error from missing _Bool type
selftests/bpf: Replace extract_build_id with read_build_id
selftests/bpf: Move test_progs helpers to testing_helpers object
selftests/bpf: Fix compile if backtrace support missing in libc
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
xz: cleanup CRC32 edits from 2018
kthread: fix task state in kthread worker if being frozen
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
ext4: avoid buffer_head leak in ext4_mark_inode_used()
ext4: avoid potential buffer_head leak in __ext4_new_inode()
ext4: avoid negative min_clusters in find_group_orlov()
ext4: return error on ext4_find_inline_entry
ext4: avoid OOB when system.data xattr changes underneath the filesystem
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
nilfs2: determine empty node blocks as corrupted
nilfs2: fix potential oob read in nilfs_btree_check_delete()
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
perf mem: Free the allocated sort string, fixing a leak
perf inject: Fix leader sampling inserting additional samples
perf sched timehist: Fix missing free of session in perf_sched__timehist()
perf stat: Display iostat headers correctly
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
perf time-utils: Fix 32-bit nsec parsing
clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite() after error detection
clk: imx: composite-8m: Enable gate clk with mcore_booted
clk: imx: composite-7ulp: Check the PCC present bit
clk: imx: fracn-gppll: support integer pll
clk: imx: fracn-gppll: fix fractional part of PLL getting lost
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
clk: imx: imx8qxp: Parent should be initialized earlier than the clock
remoteproc: imx_rproc: Correct ddr alias for i.MX8M
remoteproc: imx_rproc: Initialize workqueue earlier
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Input: ilitek_ts_i2c - avoid wrong input subsystem sync
Input: ilitek_ts_i2c - add report id message validation
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
PCI/PM: Increase wait time after resume
PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter
PCI: Wait for Link before restoring Downstream Buses
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
nvdimm: Fix devs leaks in scan_labels()
PCI: xilinx-nwl: Fix register misspelling
PCI: xilinx-nwl: Clean up clock on probe failure/removal
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
pinctrl: single: fix missing error code in pcs_probe()
RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
clk: ti: dra7-atl: Fix leak of of_nodes
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
nfsd: fix refcount leak when file is unhashed after being found
pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
IB/core: Fix ib_cache_setup_one error flow cleanup
PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
RDMA/erdma: Return QP state in erdma_query_qp
watchdog: imx_sc_wdt: Don't disable WDT in suspend
RDMA/hns: Don't modify rq next block addr in HIP09 QPC
RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
RDMA/hns: Optimize hem allocation performance
riscv: Fix fp alignment bug in perf_callchain_user()
RDMA/cxgb4: Added NULL check for lookup_atid
RDMA/irdma: fix error message in irdma_modify_qp_roce()
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
ntb_perf: Fix printk format
ntb: Force physically contiguous allocation of rx ring buffers
nfsd: call cache_put if xdr_reserve_space returns NULL
nfsd: return -EINVAL when namelen is 0
f2fs: fix to update i_ctime in __f2fs_setxattr()
f2fs: remove unneeded check condition in __f2fs_setxattr()
f2fs: reduce expensive checkpoint trigger frequency
f2fs: factor the read/write tracing logic into a helper
f2fs: fix to avoid racing in between read and OPU dio write
f2fs: fix to wait page writeback before setting gcing flag
f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
f2fs: clean up w/ dotdot_name
f2fs: get rid of online repaire on corrupted directory
spi: atmel-quadspi: Undo runtime PM changes at driver exit time
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
lib/sbitmap: define swap_lock as raw_spinlock_t
nvme-multipath: system fails to create generic nvme device
iio: adc: ad7606: fix oversampling gpio array
iio: adc: ad7606: fix standby gpio state to match the documentation
ABI: testing: fix admv8818 attr description
iio: chemical: bme680: Fix read/write ops to device by adding mutexes
iio: magnetometer: ak8975: Convert enum->pointer for data in the match tables
iio: magnetometer: ak8975: drop incorrect AK09116 compatible
dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
coresight: tmc: sg: Do not leak sg_table
cxl/pci: Break out range register decoding from cxl_hdm_decode_init()
cxl/pci: Fix to record only non-zero ranges
vdpa: Add eventfd for the vdpa callback
vhost_vdpa: assign irq bypass producer token correctly
ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
Revert "dm: requeue IO if mapping table not yet available"
net: xilinx: axienet: Schedule NAPI in two steps
net: xilinx: axienet: Fix packet counting
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
tcp: check skb is non-NULL in tcp_rto_delta_us()
net: qrtr: Update packets cloning when broadcasting
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
io_uring/sqpoll: do not allow pinning outside of cpuset
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
io_uring/io-wq: do not allow pinning outside of cpuset
io_uring/io-wq: inherit cpuset of cgroup in io worker
vfio/pci: fix potential memory leak in vfio_intx_enable()
selinux,smack: don't bypass permissions check in inode_setsecctx hook
drm/vmwgfx: Prevent unmapping active read buffers
io_uring/sqpoll: retain test for whether the CPU is valid
io_uring/sqpoll: do not put cpumask on stack
Remove *.orig pattern from .gitignore
PCI: imx6: Fix missing call to phy_power_off() in error handling
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
soc: versatile: integrator: fix OF node leak in probe() error path
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
Input: adp5588-keys - fix check on return code
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
drm/amd/display: Skip Recompute DSC Params if no Stream on Link
drm/amd/display: Round calculated vtotal
drm/amd/display: Validate backlight caps are sane
KEYS: prevent NULL pointer dereference in find_asymmetric_key()
fs: Create a generic is_dot_dotdot() utility
ksmbd: make __dir_empty() compatible with POSIX
ksmbd: allow write with FILE_APPEND_DATA
ksmbd: handle caseless file creation
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
scsi: mac_scsi: Refactor polling loop
scsi: mac_scsi: Disallow bus errors during PDMA send
usbnet: fix cyclical race on disconnect with work queue
arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
USB: appledisplay: close race between probe and completion handler
USB: misc: cypress_cy7c63: check for short transfer
USB: class: CDC-ACM: fix race between get_serial and set_serial
usb: cdnsp: Fix incorrect usb_request status
usb: dwc2: drd: fix clock gating on USB role switch
bus: integrator-lm: fix OF node leak in probe()
bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
firmware_loader: Block path traversal
tty: rp2: Fix reset with non forgiving PCIe host bridges
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
drbd: Fix atomicity violation in drbd_uuid_set_bm()
drbd: Add NULL check for net_conf to prevent dereference in state validation
ACPI: sysfs: validate return type of _STR method
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
perf/x86/intel/pt: Fix sampling synchronization
wifi: rtw88: 8822c: Fix reported RX band width
wifi: mt76: mt7615: check devm_kasprintf() returned value
debugobjects: Fix conditions in fill_pool()
f2fs: fix several potential integer overflows in file offsets
f2fs: prevent possible int overflow in dir_block_index()
f2fs: avoid potential int overflow in sanity_check_area_boundary()
f2fs: fix to check atomic_file in f2fs ioctl interfaces
hwrng: mtk - Use devm_pm_runtime_enable
hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
vfs: fix race between evice_inodes() and find_inode()&iput()
fs: Fix file_set_fowner LSM hook inconsistencies
nfs: fix memory leak in error path of nfs4_do_reclaim
EDAC/igen6: Fix conversion of system address to physical memory address
padata: use integer wrap around to prevent deadlock on seq_nr overflow
soc: versatile: realview: fix memory leak during device remove
soc: versatile: realview: fix soc_dev leak during device remove
powerpc/64: Option to build big-endian with ELFv2 ABI
powerpc/64: Add support to build with prefixed instructions
powerpc/atomic: Use YZ constraints for DS-form instructions
usb: yurex: Replace snprintf() with the safer scnprintf() variant
USB: misc: yurex: fix race between read and write
xhci: fix event ring segment table related masks and variables in header
xhci: remove xhci_test_trb_in_td_math early development check
xhci: Refactor interrupter code for initial multi interrupter support.
xhci: Preserve RsvdP bits in ERSTBA register correctly
xhci: Add a quirk for writing ERST in high-low order
usb: xhci: fix loss of data on Cadence xHC
pps: remove usage of the deprecated ida_simple_xx() API
pps: add an error check in parport_attach
x86/idtentry: Incorporate definitions/declarations of the FRED entries
x86/entry: Remove unwanted instrumentation in common_interrupt()
mm/filemap: return early if failed to allocate memory for split
lib/xarray: introduce a new helper xas_get_order
mm/filemap: optimize filemap folio adding
icmp: Add counters for rate limits
icmp: change the order of rate limits
bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
lockdep: fix deadlock issue between lockdep and rcu
mm: only enforce minimum stack gap size if it's sensible
module: Fix KCOV-ignored file name
mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu read lock
i2c: aspeed: Update the stop sw state when the bus recovery occurs
i2c: isch: Add missed 'else'
usb: yurex: Fix inconsistent locking bug in yurex_read()
perf/arm-cmn: Fail DTC counter allocation correctly
iio: magnetometer: ak8975: Fix 'Unexpected device' error
powerpc: Allow CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 with ld.lld 15+
PCI/PM: Mark devices disconnected if upstream PCIe link is down on resume
x86/tdx: Fix "in-kernel MMIO" check
wifi: mt76: do not run mt76_unregister_device() on unregistered hw
static_call: Handle module init failure correctly in static_call_del_module()
static_call: Replace pointless WARN_ON() in static_call_module_notify()
jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
jump_label: Fix static_key_slow_dec() yet again
scsi: pm8001: Do not overwrite PCI queue mapping
mailbox: rockchip: fix a typo in module autoloading
mailbox: bcm2835: Fix timeout during suspend mode
ceph: remove the incorrect Fw reference check when dirtying pages
ieee802154: Fix build error
net: sparx5: Fix invalid timestamps
net/mlx5: Fix error path in multi-packet WQE transmit
net/mlx5: Added cond_resched() to crdump collection
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
selftests: netfilter: Fix nft_audit.sh for newer nft binaries
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
net: ethernet: lantiq_etop: fix memory disclosure
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
net: add more sanity checks to qdisc_pkt_len_init()
net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
ppp: do not assume bh is held in ppp_channel_bridge_input()
fsdax,xfs: port unshare to fsdax
iomap: constrain the file range passed to iomap_file_unshare
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
i2c: xiic: improve error message when transfer fails to start
i2c: xiic: Try re-initialization on bus busy timeout
loop: don't set QUEUE_FLAG_NOMERGES
Bluetooth: hci_sock: Fix not validating setsockopt user input
media: usbtv: Remove useless locks in usbtv_video_free()
ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized
ALSA: mixer_oss: Remove some incorrect kfree_const() usages
ALSA: hda/realtek: Fix the push button function for the ALC257
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
f2fs: Require FMODE_WRITE for atomic write ioctls
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
wifi: iwlwifi: mvm: Fix a race in scan abort flow
wifi: cfg80211: Set correct chandef when starting CAC
net/xen-netback: prevent UAF in xenvif_flush_hash()
net: hisilicon: hip04: fix OF node leak in probe()
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
net: hisilicon: hns_mdio: fix OF node leak in probe()
ACPI: PAD: fix crash in exit_round_robin()
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
net: sched: consistently use rcu_replace_pointer() in taprio_change()
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
blk_iocost: fix more out of bound shifts
nvme-pci: qdepth 1 quirk
wifi: ath11k: fix array out-of-bound access in SoC stats
wifi: rtw88: select WANT_DEV_COREDUMP
ACPI: EC: Do not release locks during operation region accesses
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
tipc: guard against string buffer overrun
net: mvpp2: Increase size of queue_name buffer
bnxt_en: Extend maximum length of version string by 1 byte
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
wifi: rtw89: correct base HT rate mask for firmware
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
net: atlantic: Avoid warning about potential string truncation
crypto: simd - Do not call crypto_alloc_tfm during registration
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
wifi: mac80211: fix RCU list iterations
ACPICA: iasl: handle empty connection_node
proc: add config & param to block forcing mem writes
wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
ALSA: usb-audio: Add input value sanity checks for standard types
x86/ioapic: Handle allocation failures gracefully
ALSA: usb-audio: Define macros for quirk table entries
ALSA: usb-audio: Replace complex quirk lines with macros
ALSA: usb-audio: Add logitech Audio profile quirk
ASoC: codecs: wsa883x: Handle reading version failure
tools/x86/kcpuid: Protect against faulty "max subleaf" values
x86/kexec: Add EFI config table identity mapping for kexec kernel
ALSA: asihpi: Fix potential OOB array access
ALSA: hdsp: Break infinite MIDI input flush loop
selftests/nolibc: avoid passing NULL to printf("%s")
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
fbdev: pxafb: Fix possible use after free in pxafb_task()
rcuscale: Provide clear error when async specified without primitives
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
power: reset: brcmstb: Do not go into infinite loop if reset fails
iommu/vt-d: Always reserve a domain ID for identity setup
iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
drm/stm: Avoid use-after-free issues with crtc and plane
drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
ata: pata_serverworks: Do not use the term blacklist
ata: sata_sil: Rename sil_blacklist to sil_quirks
drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
drm/amd/display: Check null pointers before using dc->clk_mgr
drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)
jfs: UBSAN: shift-out-of-bounds in dbFindBits
jfs: Fix uaf in dbFreeBits
jfs: check if leafidx greater than num leaves per dmap tree
scsi: smartpqi: correct stream detection
jfs: Fix uninit-value access of new_ea in ea_buffer
drm/amdgpu: add raven1 gfxoff quirk
drm/amdgpu: enable gfxoff quirk on HP 705G4
drm/amdkfd: Fix resource leak in criu restore queue
HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
platform/x86: touchscreen_dmi: add nanote-next quirk
drm/stm: ltdc: reset plane transparency after plane disable
drm/amd/display: Check stream before comparing them
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
drm/amd/display: Fix index out of bounds in degamma hardware format translation
drm/amd/display: Fix index out of bounds in DCN30 color transformation
drm/amd/display: Initialize get_bytes_per_element's default to 1
drm/printer: Allow NULL data in devcoredump printer
perf,x86: avoid missing caller address in stack traces captured in uprobe
scsi: aacraid: Rearrange order of struct aac_srb_unit
scsi: lpfc: Update PRLO handling in direct attached topology
drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
drm/amd/pm: ensure the fw_info is not null before using it
of/irq: Refer to actual buffer size in of_irq_parse_one()
powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
ext4: ext4_search_dir should return a proper error
ext4: avoid use-after-free in ext4_ext_show_leaf()
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
blk-integrity: use sysfs_emit
blk-integrity: convert to struct device_attribute
blk-integrity: register sysfs attributes on struct device
spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
spi: s3c64xx: fix timeout counters in flush_fifo
selftests: breakpoints: use remaining time to check if suspend succeed
selftests: vDSO: fix vDSO name for powerpc
selftests: vDSO: fix vdso_config for powerpc
selftests: vDSO: fix vDSO symbols lookup for powerpc64
selftests/mm: fix charge_reserved_hugetlb.sh test
powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
selftests: vDSO: fix ELF hash table entry size for s390x
selftests: vDSO: fix vdso_config for s390
Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
media: i2c: ar0521: Use cansleep version of gpiod_set_value()
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
spi: bcm63xx: Fix module autoloading
power: supply: hwmon: Fix missing temp1_max_alarm attribute
perf/core: Fix small negative period being ignored
parisc: Fix itlb miss handler for 64-bit programs
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
ALSA: core: add isascii() check to card ID generator
ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
ALSA: usb-audio: Add native DSD support for Luxman D-08u
ALSA: line6: add hw monitor volume control to POD HD500X
ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
ext4: no need to continue when the number of entries is 1
ext4: correct encrypted dentry name hash when not casefolded
ext4: fix slab-use-after-free in ext4_split_extent_at()
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
ext4: dax: fix overflowing extents beyond inode size when partially writing
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
ext4: aovid use-after-free in ext4_ext_insert_extent()
ext4: fix double brelse() the buffer of the extents path
ext4: update orig_path in ext4_find_extent()
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
ext4: fix fast commit inode enqueueing during a full journal commit
ext4: use handle to mark fc as ineligible in __track_dentry_update()
ext4: mark fc as ineligible using an handle in ext4_xattr_set()
parisc: Fix 64-bit userspace syscall path
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
drm/rockchip: vop: clear DMA stop bit on RK3066
of/irq: Support #msi-cells=<0> in of_msi_get_domain
drm: omapdrm: Add missing check for alloc_ordered_workqueue
resource: fix region_intersects() vs add_memory_driver_managed()
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
mm: krealloc: consider spare memory for __GFP_ZERO
ocfs2: fix the la space leak when unmounting an ocfs2 volume
ocfs2: fix uninit-value in ocfs2_get_block()
ocfs2: reserve space for inline xattr before attaching reflink tree
ocfs2: cancel dqi_sync_work before freeing oinfo
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
ocfs2: fix null-ptr-deref when journal load failed.
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
riscv: define ILLEGAL_POINTER_VALUE for 64bit
exfat: fix memory leak in exfat_load_bitmap()
perf hist: Update hist symbol when updating maps
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
nfsd: map the EBADMSG to nfserr_io to avoid warning
NFSD: Fix NFSv4's PUTPUBFH operation
aoe: fix the potential use-after-free problem in more places
clk: rockchip: fix error for unknown clocks
remoteproc: k3-r5: Fix error handling when power-up failed
clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
media: sun4i_csi: Implement link validate for sun4i_csi subdev
clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
clk: qcom: clk-rpmh: Fix overflow in BCM vote
clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
media: venus: fix use after free bug in venus_remove due to race condition
clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
media: qcom: camss: Fix ordering of pm_runtime_enable
clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
smb: client: use actual path when queryfs
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
gso: fix udp gso fraglist segmentation after pull from frag_list
tomoyo: fallback to realpath if symlink's pathname does not exist
net: stmmac: Fix zero-division error when disabling tc cbs
rtc: at91sam9: fix OF node leak in probe() error path
Input: adp5589-keys - fix NULL pointer dereference
Input: adp5589-keys - fix adp5589_gpio_get_value()
cachefiles: fix dentry leak in cachefiles_open_file()
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
btrfs: send: fix invalid clone operation for file that got its size decreased
btrfs: wait for fixup workers before stopping cleaner kthread during umount
gpio: davinci: fix lazy disable
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
ceph: fix cap ref leak via netfs init_request
tracing/hwlat: Fix a race during cpuhp processing
tracing/timerlat: Fix a race during cpuhp processing
close_range(): fix the logics in descriptor table trimming
drm/i915/gem: fix bitwise and logical AND mixup
drm/sched: Add locking to drm_sched_entity_modify_sched
drm/amd/display: Fix system hang while resume with TBT monitor
cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
kconfig: qconf: fix buffer overflow in debug links
i2c: create debugfs entry per adapter
i2c: core: Lock address during client device instantiation
i2c: xiic: Use devm_clk_get_enabled()
i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
dt-bindings: clock: exynos7885: Fix duplicated binding
spi: bcm63xx: Fix missing pm_runtime_disable()
arm64: Add Cortex-715 CPU part definition
arm64: cputype: Add Neoverse-N3 definitions
arm64: errata: Expand speculative SSBS workaround once more
io_uring/net: harden multishot termination case for recv
uprobes: fix kernel info leak via "[uprobes]" vma
mm: z3fold: deprecate CONFIG_Z3FOLD
drm/amd/display: Allow backlight to go below `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT`
build-id: require program headers to be right after ELF header
lib/buildid: harden build ID parsing logic
docs/zh_CN: Update the translation of delay-accounting to 6.1-rc8
delayacct: improve the average delay precision of getdelay tool to microsecond
sched: psi: fix bogus pressure spikes from aggregation race
media: i2c: imx335: Enable regulator supplies
media: imx335: Fix reset-gpio handling
remoteproc: k3-r5: Acquire mailbox handle during probe routine
remoteproc: k3-r5: Delay notification of wakeup event
dt-bindings: clock: qcom: Add missing UFS QREF clocks
dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
clk: samsung: exynos7885: do not define number of clocks in bindings
clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
r8169: add tally counter fields added with RTL8125
clk: qcom: gcc-sc8180x: Add GPLL9 support
ACPI: battery: Simplify battery hook locking
ACPI: battery: Fix possible crash when unregistering a battery hook
Revert "arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings"
erofs: get rid of erofs_inode_datablocks()
erofs: get rid of z_erofs_do_map_blocks() forward declaration
erofs: avoid hardcoded blocksize for subpage block support
erofs: set block size to the on-disk block size
erofs: fix incorrect symlink detection in fast symlink
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
perf report: Fix segfault when 'sym' sort key is not used
fsdax: dax_unshare_iter() should return a valid length
fsdax: unshare: zero destination if srcmap is HOLE or UNWRITTEN
unicode: Don't special case ignorable code points
net: ethernet: cortina: Drop TSO support
tracing: Remove precision vsnprintf() check from print event
ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table
ALSA: hda/realtek: cs35l41: Fix device ID / model name
drm/crtc: fix uninitialized variable use even harder
tracing: Have saved_cmdlines arrays all in one allocation
bootconfig: Fix the kerneldoc of _xbc_exit()
perf lock: Dynamically allocate lockhash_table
perf sched: Avoid large stack allocations
perf sched: Move start_work_mutex and work_done_wait_mutex initialization to perf_sched__replay()
perf sched: Fix memory leak in perf_sched__map()
perf sched: Move curr_thread initialization to perf_sched__map()
perf sched: Move curr_pid and cpu_last_switched initialization to perf_sched__{lat|map|replay}()
libsubcmd: Don't free the usage string
selftests: net: Remove executable bits from library scripts
Bluetooth: Fix usage of __hci_cmd_sync_status
fs/ntfs3: Do not call file_modified if collapse range failed
fs/ntfs3: Fix sparse warning in ni_fiemap
fs/ntfs3: Refactor enum_rstbl to suppress static checker
virtio_console: fix misc probe bugs
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
bpf: Check percpu map value size first
s390/facility: Disable compile time optimization for decompressor code
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
bpf, x64: Fix a jit convergence issue
ext4: don't set SB_RDONLY after filesystem errors
ext4: nested locking for xattr inode
s390/cpum_sf: Remove WARN_ON_ONCE statements
ktest.pl: Avoid false positives with grub2 skip regex
RDMA/mad: Improve handling of timed out WRs of mad agent
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
RDMA/rtrs-srv: Avoid null pointer deref during path establishment
clk: bcm: bcm53573: fix OF node leak in init
PCI: Add ACS quirk for Qualcomm SA8775P
i2c: i801: Use a different adapter-name for IDF adapters
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
io_uring: check if we need to reschedule during overflow flush
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
usb: chipidea: udc: enable suspend interrupt after usb reset
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
comedi: ni_routing: tools: Check when the file could not be opened
LoongArch: Fix memleak in pci_acpi_scan_root()
netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
virtio_pmem: Check device status before requesting flush
tools/iio: Add memory allocation failure check for trigger_name
staging: vme_user: added bound check to geoid
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
drm/amd/display: Check null pointer before dereferencing se
fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
fbdev: sisfb: Fix strbuf array overflow
drm/rockchip: vop: limit maximum resolution to hardware capabilities
drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
NFSD: Mark filecache "down" if init fails
ice: fix VLAN replay after reset
SUNRPC: Fix integer overflow in decode_rc_list()
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
net: phy: dp83869: fix memory corruption when enabling fiber
tcp: fix to allow timestamp undo if no retransmits were sent
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
netfilter: br_netfilter: fix panic with metadata_dst skb
selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
net: phy: bcm84881: Fix some error handling paths
thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add
thermal: intel: int340x: processor: Fix warning during module unload
Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
net: dsa: b53: fix jumbo frame mtu check
net: dsa: b53: fix max MTU for 1g switches
net: dsa: b53: fix max MTU for BCM5325/BCM5365
net: dsa: b53: allow lower MTUs on BCM5325/5365
net: dsa: b53: fix jumbo frames on 10/100 ports
gpio: aspeed: Add the flush write to ensure the write complete.
gpio: aspeed: Use devm_clk api to manage clock source
ice: Fix netif_is_ice() in Safe Mode
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
igb: Do not bring the device up after non-fatal error
net/sched: accept TCA_STAB only for root qdisc
net: ibm: emac: mal: fix wrong goto
btrfs: zoned: fix missing RCU locking in error message when loading zone info
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
netfilter: fib: check correct rtable in vrf setups
net: ibm/emac: allocate dummy net_device dynamically
net: ibm: emac: mal: add dcr_unmap to _remove
rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
vxlan: Handle error of rtnl_register_module().
mctp: Handle error of rtnl_register_module().
ppp: fix ppp_async_encode() illegal access
slip: make slhc_remember() more robust against malicious packets
rust: macros: provide correct provenance when constructing THIS_MODULE
HID: multitouch: Add support for lenovo Y9000P Touchpad
net/mlx5: Always drain health in shutdown callback
wifi: mac80211: Avoid address calculations via out of bounds array indexing
hwmon: (tmp513) Add missing dependency on REGMAP_I2C
hwmon: (adm9240) Add missing dependency on REGMAP_I2C
hwmon: (adt7470) Add missing dependency on REGMAP_I2C
Revert "net: ibm/emac: allocate dummy net_device dynamically"
HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
HID: plantronics: Workaround for an unexcepted opposite volume key
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
usb: dwc3: core: Stop processing of pending events if controller is halted
usb: xhci: Fix problem with xhci resume from suspend
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
usb: gadget: core: force synchronous registration
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
drm/v3d: Stop the active perfmon before being destroyed
drm/vc4: Stop the active perfmon before being destroyed
scsi: wd33c93: Don't use stale scsi_pointer value
mptcp: fallback when MPTCP opts are dropped after 1st data
ata: libata: avoid superfluous disk spin down + spin up during hibernation
net: explicitly clear the sk pointer, when pf->create fails
net: Fix an unsafe loop on the list
net: dsa: lan9303: ensure chip reset and wait for READY status
mptcp: handle consistently DSS corruption
mptcp: pm: do not remove closing subflows
device-dax: correct pgoff align in dax_set_mapping()
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
kthread: unpark only parked kthread
secretmem: disable memfd_secret() if arch cannot set direct map
net: ethernet: cortina: Restore TSO support
perf lock: Don't pass an ERR_PTR() directly to perf_session__delete()
block, bfq: fix uaf for accessing waker_bfqq after splitting
Revert "iommu/vt-d: Retrieve IOMMU perfmon capability information"
Linux 6.1.113
Change-Id: Ibad3f07882dd1e60de8b7af941df9e1d887f588f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Pablo Neira Ayuso
|
70c5eb7f38 |
UPSTREAM: netfilter: xtables: fix typo causing some targets not to load on IPv6
[ Upstream commit 306ed1728e8438caed30332e1ab46b28c25fe3d8 ]
- There is no NFPROTO_IPV6 family for mark and NFLOG.
- TRACE is also missing module autoload with NFPROTO_IPV6.
This results in ip6tables failing to restore a ruleset. This issue has been
reported by several users providing incomplete patches.
Very similar to Ilya Katsnelson's patch including a missing chunk in the
TRACE extension.
Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
Reported-by: Ignat Korchagin <ignat@cloudflare.com>
Reported-by: Ilya Katsnelson <me@0upti.me>
Reported-by: Krzysztof Olędzki <ole@ans.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit
|
||
|
Greg Kroah-Hartman
|
ca877f130b |
Merge 8f5ad212f4 ("net: ibm: emac: mal: add dcr_unmap to _remove") into android14-6.1
Steps on the way to 6.1.113 Change-Id: I03a621f712ea5dbe45be6ab423169708b32cb6c0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
d90aa3b1e7 |
ANDROID: GKI: rexport __qdisc_calculate_pkt_len
The symbol __qdisc_calculate_pkt_len was removed from the .h file in |
||
|
Greg Kroah-Hartman
|
f27c9aabfc |
Merge 5de0b8ca7c ("sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start") into android14-6.1
Steps on the way to 6.1.113 Change-Id: I937c62c39fd745f3742241843985570249e63ac5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
4d9f717a6f |
Merge fc2f4a5a71 ("drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066") into android14-6.1
Steps on the way to 6.1.113 Change-Id: I7413c9d094d0a17b4c6901c73a556bf4959a1402 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
2a9237e80d |
Revert "perf,x86: avoid missing caller address in stack traces captured in uprobe"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
07d3db8105 |
Revert "i2c: create debugfs entry per adapter"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
a521ff2141 |
Revert "i2c: core: Lock address during client device instantiation"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
ff83a68a27 |
Merge beff507e9e ("s390/cpum_sf: Remove WARN_ON_ONCE statements") into android14-6.1-lts
Steps on the way to 6.1.113 Resolves merge conflicts in: fs/erofs/fscache.c fs/erofs/inode.c fs/erofs/zdata.c kernel/sched/psi.c Change-Id: Icbb83e1d8d4b65f380f36046a6e98e341c53d77d Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
0eefe2e6a1 |
Merge c6cbefd65a ("wifi: iwlwifi: mvm: Fix a race in scan abort flow") into android14-6.1-lts
Steps on the way to 6.1.113 Change-Id: I4cc09033acf2fb15352e1e61d5fe51107cd22bce Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
bf14675822 |
Merge 71446b65c0 ("scsi: pm8001: Do not overwrite PCI queue mapping") into android14-6.1-lts
Steps on the way to 6.1.113 Resolves merge conflicts in: kernel/jump_label.c Change-Id: Ibd4d6563350488956bd310e499467554ce495341 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
fbffc4367f |
Revert "icmp: Add counters for rate limits"
This reverts commit |
||
|
Greg Kroah-Hartman
|
da03308716 |
Revert "icmp: change the order of rate limits"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
d181caa76b |
Merge dffe86df26 ("wifi: mt76: do not run mt76_unregister_device() on unregistered hw") into android14-6.1-lts
Steps on the way to 6.1.113 Change-Id: I0d5bfdc8d4e5fe6d4c6e82cb762ce3818286e411 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
25281a36af |
Revert "Merge 71147efd68 ("usb: xhci: fix loss of data on Cadence xHC") into android14-6.1-lts"
This reverts commit |
||
|
Greg Kroah-Hartman
|
d2e4c7790d |
Merge 71147efd68 ("usb: xhci: fix loss of data on Cadence xHC") into android14-6.1-lts
Steps on the way to 6.1.113 Resolves merge conflicts in: drivers/usb/host/xhci-mem.c drivers/usb/host/xhci.h Change-Id: I423af7c6bba0aaeb56dacbed4059f2fc0d0e1de5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
27d626695a |
Merge 732413d5ae ("USB: misc: yurex: fix race between read and write") into android14-6.1-lts
Steps on the way to 6.1.113 Change-Id: Ie7950304b1c062afe32c9e4f87aaa2e77ede3ceb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
b7ad70d2c5 |
Merge b986ec200f ("soc: versatile: realview: fix soc_dev leak during device remove") into android14-6.1-lts
Steps on the way to 6.1.113 Change-Id: I8de726c0f7aac71a8b0b01802a95b0680ce31ecb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Darrick J. Wong
|
bdbc96c231 |
fsdax: dax_unshare_iter needs to copy entire blocks
[ Upstream commit 50793801fc7f6d08def48754fb0f0706b0cfc394 ]
The code that copies data from srcmap to iomap in dax_unshare_iter is
very very broken, which bfoster's recent fsx changes have exposed.
If the pos and len passed to dax_file_unshare are not aligned to an
fsblock boundary, the iter pos and length in the _iter function will
reflect this unalignment.
dax_iomap_direct_access always returns a pointer to the start of the
kmapped fsdax page, even if its pos argument is in the middle of that
page. This is catastrophic for data integrity when iter->pos is not
aligned to a page, because daddr/saddr do not point to the same byte in
the file as iter->pos. Hence we corrupt user data by copying it to the
wrong place.
If iter->pos + iomap_length() in the _iter function not aligned to a
page, then we fail to copy a full block, and only partially populate the
destination block. This is catastrophic for data confidentiality
because we expose stale pmem contents.
Fix both of these issues by aligning copy_pos/copy_len to a page
boundary (remember, this is fsdax so 1 fsblock == 1 base page) so that
we always copy full blocks.
We're not done yet -- there's no call to invalidate_inode_pages2_range,
so programs that have the file range mmap'd will continue accessing the
old memory mapping after the file metadata updates have completed.
Be careful with the return value -- if the unshare succeeds, we still
need to return the number of bytes that the iomap iter thinks we're
operating on.
Cc: ruansy.fnst@fujitsu.com
Fixes:
|
||
|
Pablo Neira Ayuso
|
d321732352 |
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
[ Upstream commit d5953d680f7e96208c29ce4139a0e38de87a57fe ]
If access to offset + length is larger than the skbuff length, then
skb_checksum() triggers BUG_ON().
skb_checksum() internally subtracts the length parameter while iterating
over skbuff, BUG_ON(len) at the end of it checks that the expected
length to be included in the checksum calculation is fully consumed.
Fixes:
|
||
|
Darrick J. Wong
|
a01987cd90 |
fsdax: remove zeroing code from dax_unshare_iter
[ Upstream commit 95472274b6fed8f2d30fbdda304e12174b3d4099 ]
Remove the code in dax_unshare_iter that zeroes the destination memory
because it's not necessary.
If srcmap is unwritten, we don't have to do anything because that
unwritten extent came from the regular file mapping, and unwritten
extents cannot be shared. The same applies to holes.
Furthermore, zeroing to unshare a mapping is just plain wrong because
unsharing means copy on write, and we should be copying data.
This is effectively a revert of commit
|
||
|
Ido Schimmel
|
d8f298eb66 |
mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
[ Upstream commit 12ae97c531fcd3bfd774d4dfeaeac23eafe24280 ]
The device stores IPv6 addresses that are used for encapsulation in
linear memory that is managed by the driver.
Changing the remote address of an ip6gre net device never worked
properly, but since cited commit the following reproducer [1] would
result in a warning [2] and a memory leak [3]. The problem is that the
new remote address is never added by the driver to its hash table (and
therefore the device) and the old address is never removed from it.
Fix by programming the new address when the configuration of the ip6gre
net device changes and removing the old one. If the address did not
change, then the above would result in increasing the reference count of
the address and then decreasing it.
[1]
# ip link add name bla up type ip6gre local 2001:db8:1::1 remote 2001:db8:2::1 tos inherit ttl inherit
# ip link set dev bla type ip6gre remote 2001:db8:3::1
# ip link del dev bla
# devlink dev reload pci/0000:01:00.0
[2]
WARNING: CPU: 0 PID: 1682 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3002 mlxsw_sp_ipv6_addr_put+0x140/0x1d0
Modules linked in:
CPU: 0 UID: 0 PID: 1682 Comm: ip Not tainted 6.12.0-rc3-custom-g86b5b55bc835 #151
Hardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023
RIP: 0010:mlxsw_sp_ipv6_addr_put+0x140/0x1d0
[...]
Call Trace:
<TASK>
mlxsw_sp_router_netdevice_event+0x55f/0x1240
notifier_call_chain+0x5a/0xd0
call_netdevice_notifiers_info+0x39/0x90
unregister_netdevice_many_notify+0x63e/0x9d0
rtnl_dellink+0x16b/0x3a0
rtnetlink_rcv_msg+0x142/0x3f0
netlink_rcv_skb+0x50/0x100
netlink_unicast+0x242/0x390
netlink_sendmsg+0x1de/0x420
____sys_sendmsg+0x2bd/0x320
___sys_sendmsg+0x9a/0xe0
__sys_sendmsg+0x7a/0xd0
do_syscall_64+0x9e/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[3]
unreferenced object 0xffff898081f597a0 (size 32):
comm "ip", pid 1626, jiffies 4294719324
hex dump (first 32 bytes):
20 01 0d b8 00 02 00 00 00 00 00 00 00 00 00 01 ...............
21 49 61 83 80 89 ff ff 00 00 00 00 01 00 00 00 !Ia.............
backtrace (crc fd9be911):
[<00000000df89c55d>] __kmalloc_cache_noprof+0x1da/0x260
[<00000000ff2a1ddb>] mlxsw_sp_ipv6_addr_kvdl_index_get+0x281/0x340
[<000000009ddd445d>] mlxsw_sp_router_netdevice_event+0x47b/0x1240
[<00000000743e7757>] notifier_call_chain+0x5a/0xd0
[<000000007c7b9e13>] call_netdevice_notifiers_info+0x39/0x90
[<000000002509645d>] register_netdevice+0x5f7/0x7a0
[<00000000c2e7d2a9>] ip6gre_newlink_common.isra.0+0x65/0x130
[<0000000087cd6d8d>] ip6gre_newlink+0x72/0x120
[<000000004df7c7cc>] rtnl_newlink+0x471/0xa20
[<0000000057ed632a>] rtnetlink_rcv_msg+0x142/0x3f0
[<0000000032e0d5b5>] netlink_rcv_skb+0x50/0x100
[<00000000908bca63>] netlink_unicast+0x242/0x390
[<00000000cdbe1c87>] netlink_sendmsg+0x1de/0x420
[<0000000011db153e>] ____sys_sendmsg+0x2bd/0x320
[<000000003b6d53eb>] ___sys_sendmsg+0x9a/0xe0
[<00000000cae27c62>] __sys_sendmsg+0x7a/0xd0
Fixes:
|
||
|
Darrick J. Wong
|
aa56ea3b7d |
iomap: share iomap_unshare_iter predicate code with fsdax
[ Upstream commit 6ef6a0e821d3dad6bf8a5d5508762dba9042c84b ]
The predicate code that iomap_unshare_iter uses to decide if it's really
needs to unshare a file range mapping should be shared with the fsdax
version, because right now they're opencoded and inconsistent.
Note that we simplify the predicate logic a bit -- we no longer allow
unsharing of inline data mappings, but there aren't any filesystems that
allow shared inline data currently.
This is a fix in the sense that it should have been ported to fsdax.
Fixes: b53fdb215d13 ("iomap: improve shared block detection in iomap_unshare_iter")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Link: https://lore.kernel.org/r/172796813294.1131942.15762084021076932620.stgit@frogsfrogsfrogs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 50793801fc7f ("fsdax: dax_unshare_iter needs to copy entire blocks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Ido Schimmel
|
637edb1156 |
mlxsw: spectrum_ipip: Rename Spectrum-2 ip6gre operations
[ Upstream commit
|
||
|
Darrick J. Wong
|
eb4c6fe20a |
iomap: don't bother unsharing delalloc extents
[ Upstream commit f7a4874d977bf4202ad575031222e78809a36292 ] If unshare encounters a delalloc reservation in the srcmap, that means that the file range isn't shared because delalloc reservations cannot be reflinked. Therefore, don't try to unshare them. Signed-off-by: Darrick J. Wong <djwong@kernel.org> Link: https://lore.kernel.org/r/20241002150040.GB21853@frogsfrogsfrogs Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Brian Foster <bfoster@redhat.com> Signed-off-by: Christian Brauner <brauner@kernel.org> Stable-dep-of: 50793801fc7f ("fsdax: dax_unshare_iter needs to copy entire blocks") Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Ido Schimmel
|
f068284cf1 |
mlxsw: spectrum_router: Add support for double entry RIFs
[ Upstream commit
|
||
|
Christoph Hellwig
|
50c2cffdcf |
iomap: improve shared block detection in iomap_unshare_iter
[ Upstream commit b53fdb215d13f8e9c29541434bf2d14dac8bcbdc ]
Currently iomap_unshare_iter relies on the IOMAP_F_SHARED flag to detect
blocks to unshare. This is reasonable, but IOMAP_F_SHARED is also useful
for the file system to do internal book keeping for out of place writes.
XFS used to that, until it got removed in commit
|
||
|
Amit Cohen
|
3067fd9c8a |
mlxsw: spectrum_ptp: Add missing verification before pushing Tx header
[ Upstream commit 0a66e5582b5102c4d7b866b977ff7c850c1174ce ]
Tx header should be pushed for each packet which is transmitted via
Spectrum ASICs. The cited commit moved the call to skb_cow_head() from
mlxsw_sp_port_xmit() to functions which handle Tx header.
In case that mlxsw_sp->ptp_ops->txhdr_construct() is used to handle Tx
header, and txhdr_construct() is mlxsw_sp_ptp_txhdr_construct(), there is
no call for skb_cow_head() before pushing Tx header size to SKB. This flow
is relevant for Spectrum-1 and Spectrum-4, for PTP packets.
Add the missing call to skb_cow_head() to make sure that there is both
enough room to push the Tx header and that the SKB header is not cloned and
can be modified.
An additional set will be sent to net-next to centralize the handling of
the Tx header by pushing it to every packet just before transmission.
Cc: Richard Cochran <richardcochran@gmail.com>
Fixes:
|
||
|
Darrick J. Wong
|
6dffd7067d |
iomap: convert iomap_unshare_iter to use large folios
[ Upstream commit
|
||
|
Benoît Monin
|
a84978a9cd |
net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
[ Upstream commit 04c20a9356f283da623903e81e7c6d5df7e4dc3c ]
As documented in skbuff.h, devices with NETIF_F_IPV6_CSUM capability
can only checksum TCP and UDP over IPv6 if the IP header does not
contains extension.
This is enforced for UDP packets emitted from user-space to an IPv6
address as they go through ip6_make_skb(), which calls
__ip6_append_data() where a check is done on the header size before
setting CHECKSUM_PARTIAL.
But the introduction of UDP encapsulation with fou6 added a code-path
where it is possible to get an skb with a partial UDP checksum and an
IPv6 header with extension:
* fou6 adds a UDP header with a partial checksum if the inner packet
does not contains a valid checksum.
* ip6_tunnel adds an IPv6 header with a destination option extension
header if encap_limit is non-zero (the default value is 4).
The thread linked below describes in more details how to reproduce the
problem with GRE-in-UDP tunnel.
Add a check on the network header size in skb_csum_hwoffload_help() to
make sure no IPv6 packet with extension header is handed to a network
device with NETIF_F_IPV6_CSUM capability.
Link: https://lore.kernel.org/netdev/26548921.1r3eYUQgxm@benoit.monin/T/#u
Fixes:
|
||
|
Sungwoo Kim
|
5d9054b9f7 |
Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
[ Upstream commit 1e67d8641813f1876a42eeb4f532487b8a7fb0a8 ]
Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes.
__hci_cmd_sync_sk() returns NULL if a command returns a status event.
However, it also returns NULL where an opcode doesn't exist in the
hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0]
for unknown opcodes.
This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as
there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes
status = skb->data[0].
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci7 hci_power_on
RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138
Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78
RSP: 0018:ffff888120bafac8 EFLAGS: 00010212
RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040
RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4
RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054
R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000
FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline]
hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline]
hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline]
hci_init_sync net/bluetooth/hci_sync.c:4742 [inline]
hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline]
hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994
hci_dev_do_open net/bluetooth/hci_core.c:483 [inline]
hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015
process_one_work kernel/workqueue.c:3267 [inline]
process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348
worker_thread+0x91f/0xe50 kernel/workqueue.c:3429
kthread+0x2cb/0x360 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Fixes:
|
||
|
Eric Dumazet
|
4f7b586aae |
netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
[ Upstream commit 4ed234fe793f27a3b151c43d2106df2ff0d81aac ]
I got a syzbot report without a repro [1] crashing in nf_send_reset6()
I think the issue is that dev->hard_header_len is zero, and we attempt
later to push an Ethernet header.
Use LL_MAX_HEADER, as other functions in net/ipv6/netfilter/nf_reject_ipv6.c.
[1]
skbuff: skb_under_panic: text:ffffffff89b1d008 len:74 put:14 head:ffff88803123aa00 data:ffff88803123a9f2 tail:0x3c end:0x140 dev:syz_tun
kernel BUG at net/core/skbuff.c:206 !
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 7373 Comm: syz.1.568 Not tainted 6.12.0-rc2-syzkaller-00631-g6d858708d465 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]
RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216
Code: 0d 8d 48 c7 c6 60 a6 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 ba 30 38 02 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
RSP: 0018:ffffc900045269b0 EFLAGS: 00010282
RAX: 0000000000000088 RBX: dffffc0000000000 RCX: cd66dacdc5d8e800
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffff88802d39a3d0 R08: ffffffff8174afec R09: 1ffff920008a4ccc
R10: dffffc0000000000 R11: fffff520008a4ccd R12: 0000000000000140
R13: ffff88803123aa00 R14: ffff88803123a9f2 R15: 000000000000003c
FS: 00007fdbee5ff6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000005d322000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
skb_push+0xe5/0x100 net/core/skbuff.c:2636
eth_header+0x38/0x1f0 net/ethernet/eth.c:83
dev_hard_header include/linux/netdevice.h:3208 [inline]
nf_send_reset6+0xce6/0x1270 net/ipv6/netfilter/nf_reject_ipv6.c:358
nft_reject_inet_eval+0x3b9/0x690 net/netfilter/nft_reject_inet.c:48
expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288
nft_do_chain_inet+0x418/0x6b0 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:269 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_nf_pre_routing_ipv6+0x63e/0x770 net/bridge/br_netfilter_ipv6.c:184
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
br_handle_frame+0x9fd/0x1530 net/bridge/br_input.c:424
__netif_receive_skb_core+0x13e8/0x4570 net/core/dev.c:5562
__netif_receive_skb_one_core net/core/dev.c:5666 [inline]
__netif_receive_skb+0x12f/0x650 net/core/dev.c:5781
netif_receive_skb_internal net/core/dev.c:5867 [inline]
netif_receive_skb+0x1e8/0x890 net/core/dev.c:5926
tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
tun_get_user+0x3056/0x47e0 drivers/net/tun.c:2007
tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xa6d/0xc90 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdbeeb7d1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48
RSP: 002b:00007fdbee5ff000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fdbeed36058 RCX: 00007fdbeeb7d1ff
RDX: 000000000000008e RSI: 0000000020000040 RDI: 00000000000000c8
RBP: 00007fdbeebf12be R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000008e R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fdbeed36058 R15: 00007ffc38de06e8
</TASK>
Fixes:
|
||
|
Dong Chenchen
|
cb7c388b59 |
netfilter: Fix use-after-free in get_info()
[ Upstream commit f48d258f0ac540f00fa617dac496c4c18b5dc2fa ]
ip6table_nat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80
Modules linked in: ip6table_nat(-)
CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:module_put+0x6f/0x80
Call Trace:
<TASK>
get_info+0x128/0x180
do_ip6t_get_ctl+0x6a/0x430
nf_getsockopt+0x46/0x80
ipv6_getsockopt+0xb9/0x100
rawv6_getsockopt+0x42/0x190
do_sock_getsockopt+0xaa/0x180
__sys_getsockopt+0x70/0xc0
__x64_sys_getsockopt+0x20/0x30
do_syscall_64+0xa2/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Concurrent execution of module unload and get_info() trigered the warning.
The root cause is as follows:
cpu0 cpu1
module_exit
//mod->state = MODULE_STATE_GOING
ip6table_nat_exit
xt_unregister_template
kfree(t)
//removed from templ_list
getinfo()
t = xt_find_table_lock
list_for_each_entry(tmpl, &xt_templates[af]...)
if (strcmp(tmpl->name, name))
continue; //table not found
try_module_get
list_for_each_entry(t, &xt_net->tables[af]...)
return t; //not get refcnt
module_put(t->me) //uaf
unregister_pernet_subsys
//remove table from xt_net list
While xt_table module was going away and has been removed from
xt_templates list, we couldnt get refcnt of xt_table->me. Check
module in xt_net->tables list re-traversal to fix it.
Fixes:
|