Commit Graph

1060790 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
4204bfff97 Merge 5.15.66 into android14-5.15
Changes in 5.15.66
	drm/msm/dsi: fix the inconsistent indenting
	drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4
	drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
	drm/msm/dsi: Fix number of regulators for SDM660
	platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
	iio: adc: mcp3911: make use of the sign bit
	skmsg: Fix wrong last sg check in sk_msg_recvmsg()
	bpf: Restrict bpf_sys_bpf to CAP_PERFMON
	bpf, cgroup: Fix kernel BUG in purge_effective_progs
	ieee802154/adf7242: defer destroy_workqueue call
	drm/i915/backlight: extract backlight code to a separate file
	drm/i915/display: avoid warnings when registering dual panel backlight
	ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg
	ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array
	wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
	Revert "xhci: turn off port power in shutdown"
	net: sparx5: fix handling uneven length packets in manual extraction
	net: smsc911x: Stop and start PHY during suspend and resume
	openvswitch: fix memory leak at failed datapath creation
	net: dsa: xrs700x: Use irqsave variant for u64 stats update
	net: sched: tbf: don't call qdisc_put() while holding tree lock
	net/sched: fix netdevice reference leaks in attach_default_qdiscs()
	ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
	mlxbf_gige: compute MDIO period based on i1clk
	kcm: fix strp_init() order and cleanup
	sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
	tcp: annotate data-race around challenge_timestamp
	Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
	net/smc: Remove redundant refcount increase
	soundwire: qcom: fix device status array range
	serial: fsl_lpuart: RS485 RTS polariy is inverse
	staging: rtl8712: fix use after free bugs
	staging: r8188eu: add firmware dependency
	powerpc: align syscall table for ppc32
	vt: Clear selection before changing the font
	musb: fix USB_MUSB_TUSB6010 dependency
	tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete
	Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
	iio: ad7292: Prevent regulator double disable
	iio: adc: mcp3911: use correct formula for AD conversion
	misc: fastrpc: fix memory corruption on probe
	misc: fastrpc: fix memory corruption on open
	USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
	mmc: core: Fix UHS-I SD 1.8V workaround branch
	mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure
	binder: fix UAF of ref->proc caused by race condition
	binder: fix alloc->vma_vm_mm null-ptr dereference
	cifs: fix small mempool leak in SMB2_negotiate()
	KVM: VMX: Heed the 'msr' argument in msr_write_intercepted()
	drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
	clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
	Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
	clk: core: Fix runtime PM sequence in clk_core_unprepare()
	Input: rk805-pwrkey - fix module autoloading
	clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
	clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc()
	clk: bcm: rpi: Prevent out-of-bounds access
	clk: bcm: rpi: Add missing newline
	hwmon: (gpio-fan) Fix array out of bounds access
	gpio: pca953x: Add mutex_lock for regcache sync in PM
	KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES
	xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
	mm: pagewalk: Fix race between unmap and page walker
	xen-blkback: Advertise feature-persistent as user requested
	xen-blkfront: Advertise feature-persistent as user requested
	xen-blkfront: Cache feature_persistent value before advertisement
	thunderbolt: Use the actual buffer in tb_async_error()
	usb: dwc3: pci: Add support for Intel Raptor Lake
	media: mceusb: Use new usb_control_msg_*() routines
	xhci: Add grace period after xHC start to prevent premature runtime suspend.
	USB: serial: cp210x: add Decagon UCA device id
	USB: serial: option: add support for OPPO R11 diag port
	USB: serial: option: add Quectel EM060K modem
	USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
	usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles
	usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device
	usb: typec: tcpm: Return ENOTSUPP for power supply prop writes
	usb: dwc2: fix wrong order of phy_power_on and phy_init
	usb: cdns3: fix issue with rearming ISO OUT endpoint
	usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer
	USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
	usb-storage: Add ignore-residue quirk for NXP PN7462AU
	s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
	s390: fix nospec table alignments
	USB: core: Prevent nested device-reset calls
	usb: xhci-mtk: relax TT periodic bandwidth allocation
	usb: xhci-mtk: fix bandwidth release issue
	usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
	driver core: Don't probe devices after bus_type.match() probe deferral
	wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
	wifi: mac80211: Fix UAF in ieee80211_scan_rx()
	ip: fix triggering of 'icmp redirect'
	net: Use u64_stats_fetch_begin_irq() for stats fetch.
	net: mac802154: Fix a condition in the receive path
	ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
	ALSA: seq: oss: Fix data-race for max_midi_devs access
	ALSA: seq: Fix data-race at module auto-loading
	drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
	drm/i915: Skip wm/ddb readout for disabled pipes
	tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
	kbuild: Unify options for BTF generation for vmlinux and modules
	kbuild: Add skip_encoding_btf_enum64 option to pahole
	usb: dwc3: fix PHY disable sequence
	usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
	usb: dwc3: disable USB core PHY management
	USB: serial: ch341: fix lost character on LCR updates
	USB: serial: ch341: fix disabled rx timer on older devices
	Linux 5.15.66

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I309eed59f20bde6cdb0b4debdb6a9c5909f620ee
2022-09-24 10:03:40 +02:00
Greg Kroah-Hartman
923f8ffad3 Merge 5.15.65 into android14-5.15
Changes in 5.15.65
	mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
	drm/bridge: Add stubs for devm_drm_of_get_bridge when OF is disabled
	ACPI: thermal: drop an always true check
	drm/vc4: hdmi: Rework power up
	drm/vc4: hdmi: Depends on CONFIG_PM
	firmware: tegra: bpmp: Do only aligned access to IPC memory area
	crypto: lib - remove unneeded selection of XOR_BLOCKS
	Drivers: hv: balloon: Support status report for larger page sizes
	mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte
	arm64: errata: Add Cortex-A510 to the repeat tlbi list
	io_uring: correct fill events helpers types
	io_uring: clean cqe filling functions
	io_uring: refactor poll update
	io_uring: move common poll bits
	io_uring: kill poll linking optimisation
	io_uring: inline io_poll_complete
	io_uring: poll rework
	io_uring: Remove unused function req_ref_put
	io_uring: remove poll entry from list when canceling all
	io_uring: bump poll refs to full 31-bits
	io_uring: fail links when poll fails
	io_uring: fix wrong arm_poll error handling
	io_uring: fix UAF due to missing POLLFREE handling
	kbuild: Fix include path in scripts/Makefile.modpost
	Bluetooth: L2CAP: Fix build errors in some archs
	Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()"
	HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
	udmabuf: Set the DMA mask for the udmabuf device (v2)
	media: pvrusb2: fix memory leak in pvr_probe
	HID: hidraw: fix memory leak in hidraw_release()
	net: fix refcount bug in sk_psock_get (2)
	fbdev: fb_pm2fb: Avoid potential divide by zero error
	ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
	bpf: Don't redirect packets with invalid pkt_len
	mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
	ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5
	HID: add Lenovo Yoga C630 battery quirk
	HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
	HID: asus: ROG NKey: Ignore portion of 0x5a report
	HID: thrustmaster: Add sparco wheel and fix array length
	drm/i915/gt: Skip TLB invalidations once wedged
	mmc: mtk-sd: Clear interrupts when cqe off/disable
	mmc: sdhci-of-dwcmshc: add reset call back for rockchip Socs
	mmc: sdhci-of-dwcmshc: rename rk3568 to rk35xx
	mmc: sdhci-of-dwcmshc: Re-enable support for the BlueField-3 SoC
	btrfs: remove root argument from btrfs_unlink_inode()
	btrfs: remove no longer needed logic for replaying directory deletes
	btrfs: add and use helper for unlinking inode during log replay
	btrfs: fix warning during log replay when bumping inode link count
	fs/ntfs3: Fix work with fragmented xattr
	ASoC: sh: rz-ssi: Improve error handling in rz_ssi_probe() error path
	drm/amd/display: Avoid MPC infinite loop
	drm/amd/display: Fix HDMI VSIF V3 incorrect issue
	drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
	drm/amd/display: clear optc underflow before turn off odm clock
	ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not configured
	neigh: fix possible DoS due to net iface start/stop loop
	s390/hypfs: avoid error message under KVM
	ksmbd: don't remove dos attribute xattr on O_TRUNC open
	drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
	drm/amd/display: Fix pixel clock programming
	drm/amdgpu: Increase tlb flush timeout for sriov
	drm/amd/display: avoid doing vm_init multiple time
	netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
	testing: selftests: nft_flowtable.sh: use random netns names
	btrfs: move lockdep class helpers to locking.c
	btrfs: fix lockdep splat with reloc root extent buffers
	btrfs: tree-checker: check for overlapping extent items
	kprobes: don't call disarm_kprobe() for disabled kprobes
	btrfs: fix space cache corruption and potential double allocations
	android: binder: fix lockdep check on clearing vma
	net/af_packet: check len when min_header_len equals to 0
	net: neigh: don't call kfree_skb() under spin_lock_irqsave()
	Linux 5.15.65

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5d29db64b8de0e14dbe991c50430c20bb36ecf59
2022-09-24 10:02:50 +02:00
Greg Kroah-Hartman
d32ea5d2c0 Merge 5.15.64 into android14-5.15
Changes in 5.15.64
	wifi: rtlwifi: remove always-true condition pointed out by GCC 12
	eth: sun: cassini: remove dead code
	audit: fix potential double free on error path from fsnotify_add_inode_mark
	cgroup: Fix race condition at rebind_subsystems()
	parisc: Make CONFIG_64BIT available for ARCH=parisc64 only
	parisc: Fix exception handler for fldw and fstw instructions
	kernel/sys_ni: add compat entry for fadvise64_64
	x86/entry: Move CLD to the start of the idtentry macro
	block: add a bdev_max_zone_append_sectors helper
	block: add bdev_max_segments() helper
	btrfs: zoned: revive max_zone_append_bytes
	btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size
	btrfs: convert count_max_extents() to use fs_info->max_extent_size
	Input: i8042 - move __initconst to fix code styling warning
	Input: i8042 - merge quirk tables
	Input: i8042 - add TUXEDO devices to i8042 quirk tables
	Input: i8042 - add additional TUXEDO devices to i8042 quirk tables
	drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist
	scsi: qla2xxx: Fix response queue handler reading stale packets
	scsi: qla2xxx: edif: Fix dropped IKE message
	btrfs: put initial index value of a directory in a constant
	btrfs: pass the dentry to btrfs_log_new_name() instead of the inode
	btrfs: remove unnecessary parameter delalloc_start for writepage_delalloc()
	riscv: lib: uaccess: fold fixups into body
	riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit
	xfrm: fix refcount leak in __xfrm_policy_check()
	xfrm: clone missing x->lastused in xfrm_do_migrate
	af_key: Do not call xfrm_probe_algs in parallel
	xfrm: policy: fix metadata dst->dev xmit null pointer dereference
	fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
	net: use eth_hw_addr_set() instead of ether_addr_copy()
	Revert "net: macsec: update SCI upon MAC address change."
	NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open()
	NFSv4.2 fix problems with __nfs42_ssc_open
	SUNRPC: RPC level errors should set task->tk_rpc_status
	mm/smaps: don't access young/dirty bit if pte unpresent
	ntfs: fix acl handling
	rose: check NULL rose_loopback_neigh->loopback
	r8152: fix the units of some registers for RTL8156A
	r8152: fix the RX FIFO settings when suspending
	nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
	ice: xsk: Force rings to be sized to power of 2
	ice: xsk: prohibit usage of non-balanced queue id
	net/mlx5e: Properly disable vlan strip on non-UL reps
	net/mlx5: Avoid false positive lockdep warning by adding lock_class_key
	net/mlx5e: Fix wrong application of the LRO state
	net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off
	net: ipa: don't assume SMEM is page-aligned
	net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume()
	net: moxa: get rid of asymmetry in DMA mapping/unmapping
	bonding: 802.3ad: fix no transmission of LACPDUs
	net: ipvtap - add __init/__exit annotations to module init/exit funcs
	netfilter: ebtables: reject blobs that don't provide all entry points
	bnxt_en: fix NQ resource accounting during vf creation on 57500 chips
	netfilter: nf_tables: disallow updates of implicit chain
	netfilter: nf_tables: make table handle allocation per-netns friendly
	netfilter: nft_payload: report ERANGE for too long offset and length
	netfilter: nft_payload: do not truncate csum_offset and csum_type
	netfilter: nf_tables: do not leave chain stats enabled on error
	netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
	netfilter: nft_tunnel: restrict it to netdev family
	netfilter: nf_tables: consolidate rule verdict trace call
	netfilter: nft_cmp: optimize comparison for 16-bytes
	netfilter: bitwise: improve error goto labels
	netfilter: nf_tables: upfront validation of data via nft_data_init()
	netfilter: nf_tables: disallow jump to implicit chain from set element
	netfilter: nf_tables: disallow binding to already bound chain
	netfilter: flowtable: add function to invoke garbage collection immediately
	netfilter: flowtable: fix stuck flows on cleanup due to pending work
	net: Fix data-races around sysctl_[rw]mem_(max|default).
	net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
	net: Fix data-races around netdev_max_backlog.
	net: Fix data-races around netdev_tstamp_prequeue.
	ratelimit: Fix data-races in ___ratelimit().
	net: Fix data-races around sysctl_optmem_max.
	net: Fix a data-race around sysctl_tstamp_allow_data.
	net: Fix a data-race around sysctl_net_busy_poll.
	net: Fix a data-race around sysctl_net_busy_read.
	net: Fix a data-race around netdev_budget.
	tcp: expose the tcp_mark_push() and tcp_skb_entail() helpers
	mptcp: stop relying on tcp_tx_skb_cache
	net: Fix data-races around sysctl_max_skb_frags.
	net: Fix a data-race around netdev_budget_usecs.
	net: Fix data-races around sysctl_fb_tunnels_only_for_init_net.
	net: Fix data-races around sysctl_devconf_inherit_init_net.
	net: Fix a data-race around sysctl_somaxconn.
	ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
	i40e: Fix incorrect address type for IPv6 flow rules
	rxrpc: Fix locking in rxrpc's sendmsg
	ionic: widen queue_lock use around lif init and deinit
	ionic: clear broken state on generation change
	ionic: fix up issues with handling EAGAIN on FW cmds
	ionic: VF initial random MAC address if no assigned mac
	net: stmmac: work around sporadic tx issue on link-up
	btrfs: fix silent failure when deleting root reference
	btrfs: replace: drop assert for suspended replace
	btrfs: add info when mount fails due to stale replace target
	btrfs: check if root is readonly while setting security xattr
	btrfs: fix possible memory leak in btrfs_get_dev_args_from_path()
	perf/x86/lbr: Enable the branch type for the Arch LBR by default
	x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
	x86/bugs: Add "unknown" reporting for MMIO Stale Data
	x86/nospec: Unwreck the RSB stuffing
	loop: Check for overflow while configuring loop
	writeback: avoid use-after-free after removing device
	asm-generic: sections: refactor memory_intersects
	mm/damon/dbgfs: avoid duplicate context directory creation
	s390/mm: do not trigger write fault when vma does not allow VM_WRITE
	bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem
	s390: fix double free of GS and RI CBs on fork() failure
	fbdev: fbcon: Properly revert changes when vc_resize() failed
	Revert "memcg: cleanup racy sum avoidance code"
	ACPI: processor: Remove freq Qos request for all CPUs
	nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
	smb3: missing inode locks in punch hole
	xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
	riscv: traps: add missing prototype
	io_uring: fix issue with io_write() not always undoing sb_start_write()
	Revert "usbnet: smsc95xx: Fix deadlock on runtime resume"
	Revert "usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling"
	mm/hugetlb: fix hugetlb not supporting softdirty tracking
	Revert "md-raid: destroy the bitmap after destroying the thread"
	md: call __md_stop_writes in md_stop
	mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb
	arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76
	binder_alloc: add missing mmap_lock calls when using the VMA
	x86/nospec: Fix i386 RSB stuffing
	Documentation/ABI: Mention retbleed vulnerability info file for sysfs
	blk-mq: fix io hung due to missing commit_rqs
	perf python: Fix build when PYTHON_CONFIG is user supplied
	perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU
	perf/x86/intel/ds: Fix precise store latency handling
	perf stat: Clear evsel->reset_group for each stat run
	scsi: ufs: core: Enable link lost interrupt
	scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
	bpf: Don't use tnum_range on array range checking for poke descriptors
	Linux 5.15.64

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8e4d8a8ed90e22487e249b9635b210935febda6e
2022-09-24 10:01:28 +02:00
Greg Kroah-Hartman
239044beef Merge 5.15.63 into android14-5.15
Changes in 5.15.63
	ALSA: info: Fix llseek return value when using callback
	ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
	KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
	x86/mm: Use proper mask when setting PUD mapping
	rds: add missing barrier to release_refill
	locking/atomic: Make test_and_*_bit() ordered on failure
	drm/nouveau: recognise GA103
	drm/ttm: Fix dummy res NULL ptr deref bug
	drm/amd/display: Check correct bounds for stream encoder instances for DCN303
	ata: libata-eh: Add missing command name
	mmc: pxamci: Fix another error handling path in pxamci_probe()
	mmc: pxamci: Fix an error handling path in pxamci_probe()
	mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
	btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
	btrfs: reset RO counter on block group if we fail to relocate
	btrfs: fix lost error handling when looking up extended ref on log replay
	cifs: Fix memory leak on the deferred close
	x86/kprobes: Fix JNG/JNLE emulation
	tracing/perf: Fix double put of trace event when init fails
	tracing/eprobes: Do not allow eprobes to use $stack, or % for regs
	tracing/eprobes: Do not hardcode $comm as a string
	tracing/eprobes: Have event probes be consistent with kprobes and uprobes
	tracing/probes: Have kprobes and uprobes use $COMM too
	tracing: Have filter accept "common_cpu" to be consistent
	ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II
	dt-bindings: usb: mtk-xhci: Allow wakeup interrupt-names to be optional
	can: ems_usb: fix clang's -Wunaligned-access warning
	apparmor: fix quiet_denied for file rules
	apparmor: fix absroot causing audited secids to begin with =
	apparmor: Fix failed mount permission check error message
	apparmor: fix aa_label_asxprint return check
	apparmor: fix setting unconfined mode on a loaded profile
	apparmor: fix overlapping attachment computation
	apparmor: fix reference count leak in aa_pivotroot()
	apparmor: Fix memleak in aa_simple_write_to_buffer()
	Documentation: ACPI: EINJ: Fix obsolete example
	NFSv4.1: Don't decrease the value of seq_nr_highest_sent
	NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly
	NFSv4: Fix races in the legacy idmapper upcall
	NFSv4.1: RECLAIM_COMPLETE must handle EACCES
	NFSv4/pnfs: Fix a use-after-free bug in open
	BPF: Fix potential bad pointer dereference in bpf_sys_bpf()
	bpf: Don't reinit map value in prealloc_lru_pop
	bpf: Acquire map uref in .init_seq_private for array map iterator
	bpf: Acquire map uref in .init_seq_private for hash map iterator
	bpf: Acquire map uref in .init_seq_private for sock local storage map iterator
	bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator
	bpf: Check the validity of max_rdwr_access for sock local storage map iterator
	can: mcp251x: Fix race condition on receive interrupt
	can: j1939: j1939_session_destroy(): fix memory leak of skbs
	net: atlantic: fix aq_vec index out of range error
	m68k: coldfire/device.c: protect FLEXCAN blocks
	sunrpc: fix expiry of auth creds
	SUNRPC: Fix xdr_encode_bool()
	SUNRPC: Reinitialise the backchannel request buffers before reuse
	virtio_net: fix memory leak inside XPD_TX with mergeable
	devlink: Fix use-after-free after a failed reload
	net: phy: Warn about incorrect mdio_bus_phy_resume() state
	net: bcmgenet: Indicate MAC is in charge of PHY PM
	net: bgmac: Fix a BUG triggered by wrong bytes_compl
	selftests: forwarding: Fix failing tests with old libnet
	dt-bindings: arm: qcom: fix Alcatel OneTouch Idol 3 compatibles
	pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
	pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
	pinctrl: amd: Don't save/restore interrupt status and wake status bits
	pinctrl: sunxi: Add I/O bias setting for H6 R-PIO
	pinctrl: qcom: sm8250: Fix PDC map
	Input: exc3000 - fix return value check of wait_for_completion_timeout
	octeontx2-pf: Fix NIX_AF_TL3_TL2X_LINKX_CFG register configuration
	octeontx2-af: Apply tx nibble fixup always
	octeontx2-af: suppress external profile loading warning
	octeontx2-af: Fix mcam entry resource leak
	octeontx2-af: Fix key checking for source mac
	ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
	geneve: do not use RT_TOS for IPv6 flowlabel
	mlx5: do not use RT_TOS for IPv6 flowlabel
	ipv6: do not use RT_TOS for IPv6 flowlabel
	plip: avoid rcu debug splat
	vsock: Fix memory leak in vsock_connect()
	vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
	dt-bindings: gpio: zynq: Add missing compatible strings
	dt-bindings: arm: qcom: fix Longcheer L8150 compatibles
	dt-bindings: arm: qcom: fix MSM8916 MTP compatibles
	dt-bindings: arm: qcom: fix MSM8994 boards compatibles
	dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources
	spi: dt-bindings: cadence: add missing 'required'
	spi: dt-bindings: zynqmp-qspi: add missing 'required'
	ceph: use correct index when encoding client supported features
	tools/vm/slabinfo: use alphabetic order when two values are equal
	ceph: don't leak snap_rwsem in handle_cap_grant
	kbuild: dummy-tools: avoid tmpdir leak in dummy gcc
	tools build: Switch to new openssl API for test-libcrypto
	NTB: ntb_tool: uninitialized heap data in tool_fn_write()
	nfp: ethtool: fix the display error of `ethtool -m DEVNAME`
	xen/xenbus: fix return type in xenbus_file_read()
	atm: idt77252: fix use-after-free bugs caused by tst_timer
	geneve: fix TOS inheriting for ipv4
	perf probe: Fix an error handling path in 'parse_perf_probe_command()'
	perf parse-events: Fix segfault when event parser gets an error
	perf tests: Fix Track with sched_switch test for hybrid case
	dpaa2-eth: trace the allocated address instead of page struct
	fs/ntfs3: Fix using uninitialized value n when calling indx_read
	fs/ntfs3: Fix NULL deref in ntfs_update_mftmirr
	fs/ntfs3: Don't clear upper bits accidentally in log_replay()
	fs/ntfs3: Fix double free on remount
	fs/ntfs3: Do not change mode if ntfs_set_ea failed
	fs/ntfs3: Fix missing i_op in ntfs_read_mft
	nios2: page fault et.al. are *not* restartable syscalls...
	nios2: don't leave NULLs in sys_call_table[]
	nios2: traced syscall does need to check the syscall number
	nios2: fix syscall restart checks
	nios2: restarts apply only to the first sigframe we build...
	nios2: add force_successful_syscall_return()
	iavf: Fix adminq error handling
	iavf: Fix reset error handling
	ASoC: SOF: debug: Fix potential buffer overflow by snprintf()
	ASoC: tas2770: Set correct FSYNC polarity
	ASoC: tas2770: Allow mono streams
	ASoC: tas2770: Drop conflicting set_bias_level power setting
	ASoC: tas2770: Fix handling of mute/unmute
	ASoC: codec: tlv320aic32x4: fix mono playback via I2S
	netfilter: nf_tables: use READ_ONCE and WRITE_ONCE for shared generation id access
	fs/ntfs3: uninitialized variable in ntfs_set_acl_ex()
	netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag
	netfilter: nf_tables: possible module reference underflow in error path
	netfilter: nf_tables: really skip inactive sets when allocating name
	netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag
	netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags
	netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END
	netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified
	powerpc/pci: Fix get_phb_number() locking
	spi: meson-spicc: add local pow2 clock ops to preserve rate between messages
	net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change()
	net: dsa: mv88e6060: prevent crash on an unused port
	mlxsw: spectrum: Clear PTP configuration after unregistering the netdevice
	net: moxa: pass pdev instead of ndev to DMA functions
	net: fix potential refcount leak in ndisc_router_discovery()
	net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry
	net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters
	net: genl: fix error path memory leak in policy dumping
	net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it
	net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
	ice: Ignore EEXIST when setting promisc mode
	i2c: imx: Make sure to unregister adapter on remove()
	regulator: pca9450: Remove restrictions for regulator-name
	i40e: Fix to stop tx_timeout recovery if GLOBR fails
	fec: Fix timer capture timing in `fec_ptp_enable_pps()`
	stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
	igb: Add lock to avoid data race
	kbuild: fix the modules order between drivers and libs
	gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
	tracing/eprobes: Fix reading of string fields
	drm/imx/dcss: get rid of HPD warning message
	ASoC: SOF: Intel: hda: Define rom_status_reg in sof_intel_dsp_desc
	ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()
	drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
	drm/sun4i: dsi: Prevent underflow when computing packet sizes
	net: qrtr: start MHI channel after endpoit creation
	KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems
	KVM: arm64: Reject 32bit user PSTATE on asymmetric systems
	HID: multitouch: new device class fix Lenovo X12 trackpad sticky
	PCI: Add ACS quirk for Broadcom BCM5750x NICs
	platform/chrome: cros_ec_proto: don't show MKBP version if unsupported
	usb: cdns3 fix use-after-free at workaround 2
	usb: cdns3: fix random warning message when driver load
	usb: gadget: uvc: calculate the number of request depending on framesize
	usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info
	PCI: aardvark: Fix reporting Slot capabilities on emulated bridge
	irqchip/tegra: Fix overflow implicit truncation warnings
	drm/meson: Fix overflow implicit truncation warnings
	clk: ti: Stop using legacy clkctrl names for omap4 and 5
	scsi: ufs: ufs-mediatek: Fix the timing of configuring device regulators
	usb: host: ohci-ppc-of: Fix refcount leak bug
	usb: renesas: Fix refcount leak bug
	usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch
	vboxguest: Do not use devm for irq
	clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
	uacce: Handle parent device removal or parent driver module rmmod
	zram: do not lookup algorithm in backends table
	clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
	scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
	scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
	gadgetfs: ep_io - wait until IRQ finishes
	coresight: etm4x: avoid build failure with unrolled loops
	habanalabs/gaudi: fix shift out of bounds
	habanalabs/gaudi: mask constant value before cast
	mmc: tmio: avoid glitches when resetting
	pinctrl: intel: Check against matching data instead of ACPI companion
	cxl: Fix a memory leak in an error handling path
	PCI/ACPI: Guard ARM64-specific mcfg_quirks
	um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
	dmaengine: dw-axi-dmac: do not print NULL LLI during error
	dmaengine: dw-axi-dmac: ignore interrupt if no descriptor
	RDMA/rxe: Limit the number of calls to each tasklet
	csky/kprobe: reclaim insn_slot on kprobe unregistration
	selftests/kprobe: Do not test for GRP/ without event failures
	dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed
	openrisc: io: Define iounmap argument as volatile
	phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks
	md: Notify sysfs sync_completed in md_reap_sync_thread()
	nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown
	drivers:md:fix a potential use-after-free bug
	ext4: avoid remove directory when directory is corrupted
	ext4: avoid resizing to a partial cluster size
	lib/list_debug.c: Detect uninitialized lists
	tty: serial: Fix refcount leak bug in ucc_uart.c
	KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings
	vfio: Clear the caps->buf to NULL after free
	mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
	iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit
	modules: Ensure natural alignment for .altinstructions and __bug_table sections
	ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl()
	riscv: dts: sifive: Add fu740 topology information
	riscv: dts: canaan: Add k210 topology information
	riscv: mmap with PROT_WRITE but no PROT_READ is invalid
	RISC-V: Add fast call path of crash_kexec()
	watchdog: export lockup_detector_reconfigure
	powerpc/32: Set an IBAT covering up to _einittext during init
	powerpc/32: Don't always pass -mcpu=powerpc to the compiler
	ovl: warn if trusted xattr creation fails
	powerpc/ioda/iommu/debugfs: Generate unique debugfs entries
	ALSA: core: Add async signal helpers
	ALSA: timer: Use deferred fasync helper
	ALSA: control: Use deferred fasync helper
	f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
	f2fs: fix to do sanity check on segment type in build_sit_entries()
	smb3: check xattr value length earlier
	powerpc/64: Init jump labels before parse_early_param()
	venus: pm_helpers: Fix warning in OPP during probe
	video: fbdev: i740fb: Check the argument of i740_calc_vclk()
	MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
	can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once()
	scsi: ufs: ufs-mediatek: Fix build error and type mismatch
	xfs: flush inodegc workqueue tasks before cancel
	xfs: reserve quota for dir expansion when linking/unlinking files
	xfs: reserve quota for target dir expansion when renaming files
	xfs: remove infinite loop when reserving free block pool
	xfs: always succeed at setting the reserve pool size
	xfs: fix overfilling of reserve pool
	xfs: fix soft lockup via spinning in filestream ag selection loop
	xfs: revert "xfs: actually bump warning counts when we send warnings"
	xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
	Linux 5.15.63

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I85d0cf74054be9e400907eac7d8f2d4d85914f6f
2022-09-24 10:01:09 +02:00
Greg Kroah-Hartman
f77b9e2dac Merge 5.15.62 into android14-5.15
Changes in 5.15.62
	io_uring: use original request task for inflight tracking
	tee: add overflow check in register_shm_helper()
	net_sched: cls_route: disallow handle of 0
	ksmbd: prevent out of bound read for SMB2_WRITE
	ksmbd: fix heap-based overflow in set_ntacl_dacl()
	Revert "x86/ftrace: Use alternative RET encoding"
	x86/ibt,ftrace: Make function-graph play nice
	x86/ftrace: Use alternative RET encoding
	btrfs: only write the sectors in the vertical stripe which has data stripes
	btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
	Linux 5.15.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic9a7c1049f62fe0e7de7eff6a4691c2b2dbcafbd
2022-09-24 09:57:07 +02:00
Alistair Delva
4c43a506ef ANDROID: GKI: Build-in REGMAP_SPMI
REGMAP_SPMI is a hidden symbol normally selected by other SPMI drivers,
but it wasn't built-in to GKI like other REGMAP APIs so vendors had to
build it downstream.

This is a small amount of code and can be modularized later.

For allmodconfig, select SPMI via Kconfig.gki instead of gki_defconfig,
because otherwise allmodconfig will build SPMI=m and REGMAP_SPMI=y,
which is not allowed.

Bug: 248307451
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: Ic3833e3a2dc44386c12a2422562994a1581a549c
2022-09-23 12:38:00 -07:00
Alistair Delva
066ab8e6b6 ANDROID: GKI: x86: Enable CONFIG_SPMI
This option was only enabled on arm64 when landed, and although there
are no SPMI drivers for x86 and likely never will be, the subsystem
compiles just fine. To keep changes to Kconfig.gki simple, and to
improve build coverage, just enable it for x86.

Bug: 248307451
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: Ib35cbfd74efe64358801455d5cd9ed8e1ac330ab
2022-09-23 11:58:24 -07:00
Treehugger Robot
e7612822c1 Merge "Merge 5.15.61 into android14-5.15" into android14-5.15 2022-09-23 17:22:01 +00:00
Bowgo Tsai
7a412a5af4 ANDROID: Enable BUILD_GKI_CERTIFICATION_TOOLS for x86_64 GKI
The tools are required to certify a x86_64 GKI boot.img.

Bug: 241497048
Test: BUILD_CONFIG=common/build.config.gki.x86_64 build/build.sh
Signed-off-by: Bowgo Tsai <bowgotsai@google.com>
Change-Id: I0a34b9c8376cdfd77fb9b58b1b50ac734696672f
(cherry picked from commit 35b34f2880)
2022-09-23 02:24:35 +00:00
Ramji Jiyani
44e8479df1 ANDROID: GKI: Remove unused symbol lists
Symbol lists which are not updated after the fork
from the 13-5.15 kernel are deleted to force
regeneration of those lists when needed.

Remove stale symbols from the remaining lists.
Stale symbols (exported in 13-5.15 but not in 14-5.15):
- kfree_skb
- tty_schedule_flip

Bug: 248334110
Signed-off-by: Ramji Jiyani <ramjiyani@google.com>
Change-Id: Icc5ef9feb9f5268ac19a84979951c3e15afc2af5
2022-09-22 22:22:26 +00:00
Tadeusz Struk
edfdfcf556 ANDROID: selftests: incfs: Increase timeout in concurrent_reads_and_writes_test
Increase the default timeout value for concurrent_reads_and_writes_test
to avoid timeout valuse. With timeout value equal to 500ms the test
doesn't timeout on a VM and all functional tests pass.

Bug: 248081692

Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Change-Id: I04225cf3c007ed250a29b8d35b6056f97a4957dc
2022-09-22 17:24:14 +00:00
Tadeusz Struk
4ccf391a7b ANDROID: incfs: Add check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr
Add an explicite check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr.
Both of these attributes can not be set at the same time, otherwise
notify_change() function will check it and invoke BUG(), crashing
the system.

Bug: 243394930

Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Change-Id: I91080d68efbd62f1441e20a5c02feef3d1b06e4e
2022-09-22 08:47:52 -07:00
Greg Kroah-Hartman
47c7e57022 Merge 5.15.61 into android14-5.15
Changes in 5.15.61
        Makefile: link with -z noexecstack --no-warn-rwx-segments
        x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
        Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"
        scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
        pNFS/flexfiles: Report RDMA connection errors to the server
        NFSD: Clean up the show_nf_flags() macro
        nfsd: eliminate the NFSD_FILE_BREAK_* flags
        ALSA: usb-audio: Add quirk for Behringer UMC202HD
        ALSA: bcd2000: Fix a UAF bug on the error path of probing
        ALSA: hda/realtek: Add quirk for Clevo NV45PZ
        ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
        wifi: mac80211_hwsim: fix race condition in pending packet
        wifi: mac80211_hwsim: add back erroneously removed cast
        wifi: mac80211_hwsim: use 32-bit skb cookie
        add barriers to buffer_uptodate and set_buffer_uptodate
        lockd: detect and reject lock arguments that overflow
        HID: hid-input: add Surface Go battery quirk
        HID: wacom: Only report rotation for art pen
        HID: wacom: Don't register pad_input for touch switch
        KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
        KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case
        KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
        KVM: s390: pv: don't present the ecall interrupt twice
        KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits
        KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value
        KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks
        KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4
        KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
        KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
        KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1
        KVM: x86: Tag kvm_mmu_x86_module_init() with __init
        KVM: x86: do not report preemption if the steal time cache is stale
        KVM: x86: revalidate steal time cache if MSR value changes
        riscv: set default pm_power_off to NULL
        ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
        ALSA: hda/cirrus - support for iMac 12,1 model
        ALSA: hda/realtek: Add quirk for another Asus K42JZ model
        ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED
        tty: vt: initialize unicode screen buffer
        vfs: Check the truncate maximum size in inode_newsize_ok()
        fs: Add missing umask strip in vfs_tmpfile
        thermal: sysfs: Fix cooling_device_stats_setup() error code path
        fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
        fbcon: Fix accelerated fbdev scrolling while logo is still shown
        usbnet: Fix linkwatch use-after-free on disconnect
        fix short copy handling in copy_mc_pipe_to_iter()
        crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
        ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
        parisc: Fix device names in /proc/iomem
        parisc: Drop pa_swapper_pg_lock spinlock
        parisc: Check the return value of ioremap() in lba_driver_probe()
        parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode
        riscv:uprobe fix SR_SPIE set/clear handling
        dt-bindings: riscv: fix SiFive l2-cache's cache-sets
        RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context
        RISC-V: Fixup get incorrect user mode PC for kernel mode regs
        RISC-V: Fixup schedule out issue in machine_crash_shutdown()
        RISC-V: Add modules to virtual kernel memory layout dump
        rtc: rx8025: fix 12/24 hour mode detection on RX-8035
        drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error
        drm/shmem-helper: Add missing vunmap on error
        drm/vc4: hdmi: Disable audio if dmas property is present but empty
        drm/hyperv-drm: Include framebuffer and EDID headers
        drm/nouveau: fix another off-by-one in nvbios_addr
        drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend()
        drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime
        drm/nouveau/kms: Fix failure path for creating DP connectors
        drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
        drm/amdgpu: fix check in fbdev init
        bpf: Fix KASAN use-after-free Read in compute_effective_progs
        btrfs: reject log replay if there is unsupported RO compat flag
        mtd: rawnand: arasan: Fix clock rate in NV-DDR
        mtd: rawnand: arasan: Update NAND bus clock instead of system clock
        um: Remove straying parenthesis
        um: seed rng using host OS rng
        iio: fix iio_format_avail_range() printing for none IIO_VAL_INT
        iio: light: isl29028: Fix the warning in isl29028_remove()
        scsi: sg: Allow waiting for commands to complete on removed device
        scsi: qla2xxx: Fix incorrect display of max frame size
        scsi: qla2xxx: Zero undefined mailbox IN registers
        soundwire: qcom: Check device status before reading devid
        ksmbd: fix memory leak in smb2_handle_negotiate
        ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT
        ksmbd: fix use-after-free bug in smb2_tree_disconect
        fuse: limit nsec
        fuse: ioctl: translate ENOSYS
        serial: mvebu-uart: uart2 error bits clearing
        md-raid: destroy the bitmap after destroying the thread
        md-raid10: fix KASAN warning
        mbcache: don't reclaim used entries
        mbcache: add functions to delete entry if unused
        media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator
        ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
        PCI: Add defines for normal and subtractive PCI bridges
        powerpc/fsl-pci: Fix Class Code of PCIe Root Port
        powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
        powerpc/powernv: Avoid crashing if rng is NULL
        MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
        coresight: Clear the connection field properly
        usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
        USB: HCD: Fix URB giveback issue in tasklet function
        ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
        arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
        usb: dwc3: gadget: refactor dwc3_repare_one_trb
        usb: dwc3: gadget: fix high speed multiplier setting
        netfilter: nf_tables: do not allow SET_ID to refer to another table
        netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
        netfilter: nf_tables: do not allow RULE_ID to refer to another chain
        netfilter: nf_tables: fix null deref due to zeroed list head
        epoll: autoremove wakers even more aggressively
        x86: Handle idle=nomwait cmdline properly for x86_idle
        arch: make TRACE_IRQFLAGS_NMI_SUPPORT generic
        arm64: Do not forget syscall when starting a new thread.
        arm64: fix oops in concurrently setting insn_emulation sysctls
        arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"
        ext2: Add more validity checks for inode counts
        sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg
        genirq: Don't return error on missing optional irq_request_resources()
        irqchip/mips-gic: Only register IPI domain when SMP is enabled
        genirq: GENERIC_IRQ_IPI depends on SMP
        sched/core: Always flush pending blk_plug
        irqchip/mips-gic: Check the return value of ioremap() in gic_of_init()
        wait: Fix __wait_event_hrtimeout for RT/DL tasks
        ARM: dts: imx6ul: add missing properties for sram
        ARM: dts: imx6ul: change operating-points to uint32-matrix
        ARM: dts: imx6ul: fix keypad compatible
        ARM: dts: imx6ul: fix csi node compatible
        ARM: dts: imx6ul: fix lcdif node compatible
        ARM: dts: imx6ul: fix qspi node compatible
        ARM: dts: BCM5301X: Add DT for Meraki MR26
        ARM: dts: ux500: Fix Codina accelerometer mounting matrix
        ARM: dts: ux500: Fix Gavini accelerometer mounting matrix
        spi: synquacer: Add missing clk_disable_unprepare()
        ARM: OMAP2+: display: Fix refcount leak bug
        ARM: OMAP2+: pdata-quirks: Fix refcount leak bug
        ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks
        ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk
        ACPI: PM: save NVS memory for Lenovo G40-45
        ACPI: LPSS: Fix missing check in register_device_clock()
        ARM: dts: qcom: sdx55: Fix the IRQ trigger type for UART
        arm64: dts: qcom: ipq8074: fix NAND node name
        arm64: dts: allwinner: a64: orangepi-win: Fix LED node name
        ARM: shmobile: rcar-gen2: Increase refcount for new reference
        firmware: tegra: Fix error check return value of debugfs_create_file()
        hwmon: (dell-smm) Add Dell XPS 13 7390 to fan control whitelist
        hwmon: (sht15) Fix wrong assumptions in device remove callback
        PM: hibernate: defer device probing when resuming from hibernation
        selinux: fix memleak in security_read_state_kernel()
        selinux: Add boundary check in put_entry()
        kasan: test: Silence GCC 12 warnings
        drm/amdgpu: Remove one duplicated ef removal
        powerpc/64s: Disable stack variable initialisation for prom_init
        spi: spi-rspi: Fix PIO fallback on RZ platforms
        ARM: findbit: fix overflowing offset
        meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
        arm64: dts: renesas: beacon: Fix regulator node names
        spi: spi-altera-dfl: Fix an error handling path
        ARM: bcm: Fix refcount leak in bcm_kona_smc_init
        ACPI: processor/idle: Annotate more functions to live in cpuidle section
        ARM: dts: imx7d-colibri-emmc: add cpu1 supply
        soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values
        scsi: hisi_sas: Use managed PCI functions
        dt-bindings: iio: accel: Add DT binding doc for ADXL355
        soc: amlogic: Fix refcount leak in meson-secure-pwrc.c
        arm64: dts: renesas: Fix thermal-sensors on single-zone sensors
        x86/pmem: Fix platform-device leak in error path
        ARM: dts: ast2500-evb: fix board compatible
        ARM: dts: ast2600-evb: fix board compatible
        ARM: dts: ast2600-evb-a1: fix board compatible
        arm64: dts: mt8192: Fix idle-states nodes naming scheme
        arm64: dts: mt8192: Fix idle-states entry-method
        arm64: select TRACE_IRQFLAGS_NMI_SUPPORT
        arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1
        locking/lockdep: Fix lockdep_init_map_*() confusion
        arm64: dts: qcom: sc7180: Remove ipa_fw_mem node on trogdor
        soc: fsl: guts: machine variable might be unset
        block: fix infinite loop for invalid zone append
        ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg
        ARM: OMAP2+: Fix refcount leak in omapdss_init_of
        ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
        arm64: dts: qcom: sdm630: disable GPU by default
        arm64: dts: qcom: sdm630: fix the qusb2phy ref clock
        arm64: dts: qcom: sdm630: fix gpu's interconnect path
        arm64: dts: qcom: sdm636-sony-xperia-ganges-mermaid: correct sdc2 pinconf
        cpufreq: zynq: Fix refcount leak in zynq_get_revision
        regulator: qcom_smd: Fix pm8916_pldo range
        ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
        ARM: dts: qcom-msm8974: fix irq type on blsp2_uart1
        soc: qcom: ocmem: Fix refcount leak in of_get_ocmem
        soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register
        ARM: dts: qcom: pm8841: add required thermal-sensor-cells
        bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
        stack: Declare {randomize_,}kstack_offset to fix Sparse warnings
        arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
        ACPI: APEI: explicit init of HEST and GHES in apci_init()
        drivers/iio: Remove all strcpy() uses
        ACPI: VIOT: Fix ACS setup
        arm64: dts: qcom: sm6125: Move sdc2 pinctrl from seine-pdx201 to sm6125
        arm64: dts: qcom: sm6125: Append -state suffix to pinctrl nodes
        arm64: dts: qcom: sm8250: add missing PCIe PHY clock-cells
        arm64: dts: mt7622: fix BPI-R64 WPS button
        arm64: tegra: Fixup SYSRAM references
        arm64: tegra: Update Tegra234 BPMP channel addresses
        arm64: tegra: Mark BPMP channels as no-memory-wc
        arm64: tegra: Fix SDMMC1 CD on P2888
        erofs: avoid consecutive detection for Highmem memory
        blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
        spi: Fix simplification of devm_spi_register_controller
        spi: tegra20-slink: fix UAF in tegra_slink_remove()
        hwmon: (drivetemp) Add module alias
        blktrace: Trace remapped requests correctly
        PM: domains: Ensure genpd_debugfs_dir exists before remove
        dm writecache: return void from functions
        dm writecache: count number of blocks read, not number of read bios
        dm writecache: count number of blocks written, not number of write bios
        dm writecache: count number of blocks discarded, not number of discard bios
        regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
        soc: qcom: Make QCOM_RPMPD depend on PM
        arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment
        irqdomain: Report irq number for NOMAP domains
        drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX
        nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
        x86/extable: Fix ex_handler_msr() print condition
        selftests/seccomp: Fix compile warning when CC=clang
        thermal/tools/tmon: Include pthread and time headers in tmon.h
        dm: return early from dm_pr_call() if DM device is suspended
        pwm: sifive: Simplify offset calculation for PWMCMP registers
        pwm: sifive: Ensure the clk is enabled exactly once per running PWM
        pwm: sifive: Shut down hardware only after pwmchip_remove() completed
        pwm: lpc18xx-sct: Reduce number of devm memory allocations
        pwm: lpc18xx-sct: Simplify driver by not using pwm_[gs]et_chip_data()
        pwm: lpc18xx: Fix period handling
        drm/dp: Export symbol / kerneldoc fixes for DP AUX bus
        drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function
        ath10k: do not enforce interrupt trigger type
        drm/st7735r: Fix module autoloading for Okaya RH128128T
        drm/panel: Fix build error when CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20=y && CONFIG_DRM_DISPLAY_HELPER=m
        wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
        ath11k: fix netdev open race
        drm/mipi-dbi: align max_chunk to 2 in spi_transfer
        ath11k: Fix incorrect debug_mask mappings
        drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
        drm/mediatek: Modify dsi funcs to atomic operations
        drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs
        drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
        drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR
        drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init
        drm/bridge: lt9611uxc: Cancel only driver's work
        i2c: npcm: Remove own slave addresses 2:10
        i2c: npcm: Correct slave role behavior
        i2c: mxs: Silence a clang warning
        virtio-gpu: fix a missing check to avoid NULL dereference
        drm/shmem-helper: Unexport drm_gem_shmem_create_with_handle()
        drm/shmem-helper: Export dedicated wrappers for GEM object functions
        drm/shmem-helper: Pass GEM shmem object in public interfaces
        drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
        drm: adv7511: override i2c address of cec before accessing it
        crypto: sun8i-ss - do not allocate memory when handling hash requests
        crypto: sun8i-ss - fix error codes in allocate_flows()
        net: fix sk_wmem_schedule() and sk_rmem_schedule() errors
        can: netlink: allow configuring of fixed bit rates without need for do_set_bittiming callback
        can: netlink: allow configuring of fixed data bit rates without need for do_set_data_bittiming callback
        i2c: Fix a potential use after free
        crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs()
        media: atmel: atmel-sama7g5-isc: fix warning in configs without OF
        media: tw686x: Register the irq at the end of probe
        media: imx-jpeg: Correct some definition according specification
        media: imx-jpeg: Leave a blank space before the configuration data
        media: imx-jpeg: Add pm-runtime support for imx-jpeg
        media: imx-jpeg: use NV12M to represent non contiguous NV12
        media: imx-jpeg: Set V4L2_BUF_FLAG_LAST at eos
        media: imx-jpeg: Refactor function mxc_jpeg_parse
        media: imx-jpeg: Identify and handle precision correctly
        media: imx-jpeg: Handle source change in a function
        media: imx-jpeg: Support dynamic resolution change
        media: imx-jpeg: Align upwards buffer size
        media: imx-jpeg: Implement drain using v4l2-mem2mem helpers
        ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
        wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
        drm/radeon: fix incorrrect SPDX-License-Identifiers
        rcutorture: Warn on individual rcu_torture_init() error conditions
        rcutorture: Don't cpuhp_remove_state() if cpuhp_setup_state() failed
        rcutorture: Fix ksoftirqd boosting timing and iteration
        test_bpf: fix incorrect netdev features
        crypto: ccp - During shutdown, check SEV data pointer before using
        drm: bridge: adv7511: Add check for mipi_dsi_driver_register
        media: imx-jpeg: Disable slot interrupt when frame done
        drm/mcde: Fix refcount leak in mcde_dsi_bind
        media: hdpvr: fix error value returns in hdpvr_read
        media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set
        media: driver/nxp/imx-jpeg: fix a unexpected return value problem
        media: tw686x: Fix memory leak in tw686x_video_init
        drm/vc4: plane: Remove subpixel positioning check
        drm/vc4: plane: Fix margin calculations for the right/bottom edges
        drm/bridge: Add a function to abstract away panels
        drm/vc4: dsi: Switch to devm_drm_of_get_bridge
        drm/vc4: Use of_device_get_match_data()
        drm/vc4: dsi: Release workaround buffer and DMA
        drm/vc4: dsi: Correct DSI divider calculations
        drm/vc4: dsi: Correct pixel order for DSI0
        drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type
        drm/vc4: dsi: Fix dsi0 interrupt support
        drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration
        drm/vc4: hdmi: Fix HPD GPIO detection
        drm/vc4: hdmi: Avoid full hdmi audio fifo writes
        drm/vc4: hdmi: Reset HDMI MISC_CONTROL register
        drm/vc4: hdmi: Fix timings for interlaced modes
        drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes
        crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE
        selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0
        drm/rockchip: vop: Don't crash for invalid duplicate_state()
        drm/rockchip: Fix an error handling path rockchip_dp_probe()
        drm/mediatek: dpi: Remove output format of YUV
        drm/mediatek: dpi: Only enable dpi after the bridge is enabled
        drm: bridge: sii8620: fix possible off-by-one
        hinic: Use the bitmap API when applicable
        net: hinic: fix bug that ethtool get wrong stats
        net: hinic: avoid kernel hung in hinic_get_stats64()
        drm/msm/mdp5: Fix global state lock backoff
        crypto: hisilicon/sec - don't sleep when in softirq
        crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq
        media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
        drm/msm: Avoid dirtyfb stalls on video mode displays (v2)
        drm/msm/dpu: Fix for non-visible planes
        mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
        mt76: mt7615: do not update pm stats in case of error
        ieee80211: add EHT 1K aggregation definitions
        mt76: mt7921: fix aggregation subframes setting to HE max
        mt76: mt7921: enlarge maximum VHT MPDU length to 11454
        mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
        mediatek: mt76: eeprom: fix missing of_node_put() in mt76_find_power_limits_node()
        skmsg: Fix invalid last sg check in sk_msg_recvmsg()
        drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed.
        tcp: make retransmitted SKB fit into the send window
        libbpf: Fix the name of a reused map
        selftests: timers: valid-adjtimex: build fix for newer toolchains
        selftests: timers: clocksource-switch: fix passing errors from child
        bpf: Fix subprog names in stack traces.
        fs: check FMODE_LSEEK to control internal pipe splicing
        media: cedrus: h265: Fix flag name
        media: hantro: postproc: Fix motion vector space size
        media: hantro: Simplify postprocessor
        media: hevc: Embedded indexes in RPS
        media: staging: media: hantro: Fix typos
        wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
        wifi: p54: Fix an error handling path in p54spi_probe()
        wifi: p54: add missing parentheses in p54_flush()
        selftests/bpf: fix a test for snprintf() overflow
        libbpf: fix an snprintf() overflow check
        can: pch_can: do not report txerr and rxerr during bus-off
        can: rcar_can: do not report txerr and rxerr during bus-off
        can: sja1000: do not report txerr and rxerr during bus-off
        can: hi311x: do not report txerr and rxerr during bus-off
        can: sun4i_can: do not report txerr and rxerr during bus-off
        can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off
        can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off
        can: usb_8dev: do not report txerr and rxerr during bus-off
        can: error: specify the values of data[5..7] of CAN error frames
        can: pch_can: pch_can_error(): initialize errc before using it
        Bluetooth: hci_intel: Add check for platform_driver_register
        i2c: cadence: Support PEC for SMBus block read
        i2c: mux-gpmux: Add of_node_put() when breaking out of loop
        wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
        wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
        wifi: libertas: Fix possible refcount leak in if_usb_probe()
        media: cedrus: hevc: Add check for invalid timestamp
        net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version
        net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS
        net/mlx5: Adjust log_max_qp to be 18 at most
        crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq
        crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
        crypto: hisilicon/sec - fix auth key size error
        inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH()
        ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH()
        net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
        netdevsim: fib: Fix reference count leak on route deletion failure
        wifi: rtw88: check the return value of alloc_workqueue()
        iavf: Fix max_rate limiting
        iavf: Fix 'tc qdisc show' listing too many queues
        netdevsim: Avoid allocation warnings triggered from user space
        net: rose: fix netdev reference changes
        net: ionic: fix error check for vlan flags in ionic_set_nic_features()
        dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
        net: usb: make USB_RTL8153_ECM non user configurable
        wireguard: ratelimiter: use hrtimer in selftest
        wireguard: allowedips: don't corrupt stack when detecting overflow
        HID: amd_sfh: Don't show client init failed as error when discovery fails
        clk: renesas: r9a06g032: Fix UART clkgrp bitsel
        mtd: maps: Fix refcount leak in of_flash_probe_versatile
        mtd: maps: Fix refcount leak in ap_flash_init
        mtd: rawnand: meson: Fix a potential double free issue
        of: check previous kernel's ima-kexec-buffer against memory bounds
        scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing
        scsi: qla2xxx: edif: Fix potential stuck session in sa update
        scsi: qla2xxx: edif: Reduce connection thrash
        scsi: qla2xxx: edif: Fix inconsistent check of db_flags
        scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application
        scsi: qla2xxx: edif: Add retry for ELS passthrough
        scsi: qla2xxx: edif: Fix n2n discovery issue with secure target
        scsi: qla2xxx: edif: Fix n2n login retry for secure device
        KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails"
        KVM: SVM: Stuff next_rip on emulated INT3 injection if NRIPS is supported
        phy: samsung: exynosautov9-ufs: correct TSRV register configurations
        PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains()
        PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
        HID: cp2112: prevent a buffer overflow in cp2112_xfer()
        mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
        mtd: partitions: Fix refcount leak in parse_redboot_of
        mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset
        mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
        PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains()
        fpga: altera-pr-ip: fix unsigned comparison with less than zero
        usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
        usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
        usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()
        usb: xhci: tegra: Fix error check
        netfilter: xtables: Bring SPDX identifier back
        scsi: qla2xxx: edif: Send LOGO for unexpected IKE message
        scsi: qla2xxx: edif: Reduce disruption due to multiple app start
        scsi: qla2xxx: edif: Fix no login after app start
        scsi: qla2xxx: edif: Tear down session if keys have been removed
        scsi: qla2xxx: edif: Fix session thrash
        scsi: qla2xxx: edif: Fix no logout on delete for N2N
        iio: accel: bma400: Fix the scale min and max macro values
        platform/chrome: cros_ec: Always expose last resume result
        iio: accel: bma400: Reordering of header files
        clk: mediatek: reset: Fix written reset bit offset
        lib/test_hmm: avoid accessing uninitialized pages
        memremap: remove support for external pgmap refcounts
        mm/memremap: fix memunmap_pages() race with get_dev_pagemap()
        KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
        mwifiex: Ignore BTCOEX events from the 88W8897 firmware
        mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
        scsi: iscsi: Allow iscsi_if_stop_conn() to be called from kernel
        scsi: iscsi: Add helper to remove a session from the kernel
        scsi: iscsi: Fix session removal on shutdown
        dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics
        mtd: dataflash: Add SPI ID table
        clk: qcom: camcc-sm8250: Fix halt on boot by reducing driver's init level
        misc: rtsx: Fix an error handling path in rtsx_pci_probe()
        driver core: fix potential deadlock in __driver_attach
        clk: qcom: clk-krait: unlock spin after mux completion
        clk: qcom: gcc-msm8939: Add missing SYSTEM_MM_NOC_BFDCD_CLK_SRC
        clk: qcom: gcc-msm8939: Fix bimc_ddr_clk_src rcgr base address
        clk: qcom: gcc-msm8939: Add missing system_mm_noc_bfdcd_clk_src
        clk: qcom: gcc-msm8939: Point MM peripherals to system_mm_noc clock
        usb: host: xhci: use snprintf() in xhci_decode_trb()
        RDMA/rxe: Fix deadlock in rxe_do_local_ops()
        clk: qcom: ipq8074: fix NSS core PLL-s
        clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
        clk: qcom: ipq8074: fix NSS port frequency tables
        clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
        clk: qcom: camcc-sdm845: Fix topology around titan_top power domain
        clk: qcom: camcc-sm8250: Fix topology around titan_top power domain
        clk: qcom: clk-rcg2: Fail Duty-Cycle configuration if MND divider is not enabled.
        clk: qcom: clk-rcg2: Make sure to not write d=0 to the NMD register
        mm/mempolicy: fix get_nodes out of bound access
        PCI: dwc: Stop link on host_init errors and de-initialization
        PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
        PCI: dwc: Disable outbound windows only for controllers using iATU
        PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address
        PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
        PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists
        soundwire: bus_type: fix remove and shutdown support
        soundwire: revisit driver bind/unbind and callbacks
        KVM: arm64: Don't return from void function
        dmaengine: sf-pdma: Add multithread support for a DMA channel
        PCI: endpoint: Don't stop controller when unbinding endpoint function
        scsi: qla2xxx: Check correct variable in qla24xx_async_gffid()
        intel_th: Fix a resource leak in an error handling path
        intel_th: msu-sink: Potential dereference of null pointer
        intel_th: msu: Fix vmalloced buffers
        binder: fix redefinition of seq_file attributes
        staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback
        mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
        mmc: mxcmmc: Silence a clang warning
        mmc: renesas_sdhi: Get the reset handle early in the probe
        memstick/ms_block: Fix some incorrect memory allocation
        memstick/ms_block: Fix a memory leak
        mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
        of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer
        mmc: block: Add single read for 4k sector cards
        KVM: s390: pv: leak the topmost page table when destroy fails
        PCI/portdrv: Don't disable AER reporting in get_port_device_capability()
        PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
        scsi: smartpqi: Fix DMA direction for RAID requests
        xtensa: iss/network: provide release() callback
        xtensa: iss: fix handling error cases in iss_net_configure()
        usb: gadget: udc: amd5536 depends on HAS_DMA
        usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
        usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
        usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
        usb: dwc3: qcom: fix missing optional irq warnings
        eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
        phy: stm32: fix error return in stm32_usbphyc_phy_init
        interconnect: imx: fix max_node_id
        um: random: Don't initialise hwrng struct with zero
        RDMA/irdma: Fix a window for use-after-free
        RDMA/irdma: Fix VLAN connection with wildcard address
        RDMA/irdma: Fix setting of QP context err_rq_idx_valid field
        RDMA/rtrs-srv: Fix modinfo output for stringify
        RDMA/rtrs: Fix warning when use poll mode on client side.
        RDMA/rtrs: Replace duplicate check with is_pollqueue helper
        RDMA/rtrs: Introduce destroy_cq helper
        RDMA/rtrs: Do not allow sessname to contain special symbols / and .
        RDMA/rtrs: Rename rtrs_sess to rtrs_path
        RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path
        RDMA/rtrs-clt: Rename rtrs_clt_sess to rtrs_clt_path
        RDMA/rtrs-clt: Replace list_next_or_null_rr_rcu with an inline function
        RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
        RDMA/hns: Fix incorrect clearing of interrupt status register
        RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
        iio: cros: Register FIFO callback after sensor is registered
        clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk
        RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
        gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
        HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
        HID: amd_sfh: Add NULL check for hid device
        dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t)
        scripts/gdb: lx-dmesg: read records individually
        scripts/gdb: fix 'lx-dmesg' on 32 bits arch
        RDMA/rxe: Fix mw bind to allow any consumer key portion
        mmc: cavium-octeon: Add of_node_put() when breaking out of loop
        mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
        HID: alps: Declare U1_UNICORN_LEGACY support
        RDMA/rxe: For invalidate compare according to set keys in mr
        PCI: tegra194: Fix Root Port interrupt handling
        PCI: tegra194: Fix link up retry sequence
        HID: amd_sfh: Handle condition of "no sensors"
        USB: serial: fix tty-port initialized comments
        usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
        mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}()
        KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP
        platform/olpc: Fix uninitialized data in debugfs write
        RDMA/srpt: Duplicate port name members
        RDMA/srpt: Introduce a reference count in struct srpt_device
        RDMA/srpt: Fix a use-after-free
        android: binder: stop saving a pointer to the VMA
        mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
        selftests: kvm: set rax before vmcall
        of/fdt: declared return type does not match actual return type
        RDMA/mlx5: Add missing check for return value in get namespace flow
        RDMA/rxe: Add memory barriers to kernel queues
        RDMA/rxe: Remove the is_user members of struct rxe_sq/rxe_rq/rxe_srq
        RDMA/rxe: Fix error unwind in rxe_create_qp()
        block/rnbd-srv: Set keep_id to true after mutex_trylock
        null_blk: fix ida error handling in null_add_dev()
        nvme: use command_id instead of req->tag in trace_nvme_complete_rq()
        nvme: define compat_ioctl again to unbreak 32-bit userspace.
        nvme: disable namespace access for unsupported metadata
        nvme: don't return an error from nvme_configure_metadata
        nvme: catch -ENODEV from nvme_revalidate_zones again
        block/bio: remove duplicate append pages code
        block: ensure iov_iter advances for added pages
        jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction()
        ext4: recover csum seed of tmp_inode after migrating to extents
        jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
        usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable()
        opp: Fix error check in dev_pm_opp_attach_genpd()
        ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe
        ASoC: samsung: Fix error handling in aries_audio_probe
        ASoC: imx-audmux: Silence a clang warning
        ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
        ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe
        ASoC: codecs: da7210: add check for i2c_add_driver
        ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
        serial: 8250: Export ICR access helpers for internal use
        serial: 8250: dma: Allow driver operations before starting DMA transfers
        serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
        ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV
        ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
        rpmsg: char: Add mutex protection for rpmsg_eptdev_open()
        rpmsg: mtk_rpmsg: Fix circular locking dependency
        remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
        selftests/livepatch: better synchronize test_klp_callbacks_busy
        profiling: fix shift too large makes kernel panic
        remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init
        ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header
        powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable
        ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables
        tty: n_gsm: Delete gsmtty open SABM frame when config requester
        tty: n_gsm: fix user open not possible at responder until initiator open
        tty: n_gsm: fix tty registration before control channel open
        tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()
        tty: n_gsm: fix missing timer to handle stalled links
        tty: n_gsm: fix non flow control frames during mux flow off
        tty: n_gsm: fix packet re-transmission without open control channel
        tty: n_gsm: fix race condition in gsmld_write()
        tty: n_gsm: fix resource allocation order in gsm_activate_mux()
        ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe()
        ASoC: imx-card: Fix DSD/PDM mclk frequency
        remoteproc: qcom: wcnss: Fix handling of IRQs
        vfio/ccw: Do not change FSM state in subchannel event
        serial: 8250_fsl: Don't report FE, PE and OE twice
        tty: n_gsm: fix wrong T1 retry count handling
        tty: n_gsm: fix DM command
        tty: n_gsm: fix missing corner cases in gsmld_poll()
        MIPS: vdso: Utilize __pa() for gic_pfn
        swiotlb: fail map correctly with failed io_tlb_default_mem
        ASoC: mt6359: Fix refcount leak bug
        serial: 8250_bcm7271: Save/restore RTS in suspend/resume
        iommu/exynos: Handle failed IOMMU device registration properly
        9p: fix a bunch of checkpatch warnings
        9p: Drop kref usage
        9p: Add client parameter to p9_req_put()
        net: 9p: fix refcount leak in p9_read_work() error handling
        MIPS: Fixed __debug_virt_addr_valid()
        rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
        kfifo: fix kfifo_to_user() return type
        lib/smp_processor_id: fix imbalanced instrumentation_end() call
        proc: fix a dentry lock race between release_task and lookup
        remoteproc: qcom: pas: Check if coredump is enabled
        remoteproc: sysmon: Wait for SSCTL service to come up
        mfd: t7l66xb: Drop platform disable callback
        mfd: max77620: Fix refcount leak in max77620_initialise_fps
        iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
        perf tools: Fix dso_id inode generation comparison
        s390/dump: fix old lowcore virtual vs physical address confusion
        s390/maccess: fix semantics of memcpy_real() and its callers
        s390/crash: fix incorrect number of bytes to copy to user space
        s390/zcore: fix race when reading from hardware system area
        ASoC: fsl_asrc: force cast the asrc_format type
        ASoC: fsl-asoc-card: force cast the asrc_format type
        ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format
        ASoC: imx-card: use snd_pcm_format_t type for asrc_format
        ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
        fuse: Remove the control interface for virtio-fs
        ASoC: audio-graph-card: Add of_node_put() in fail path
        watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource
        watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
        video: fbdev: amba-clcd: Fix refcount leak bugs
        video: fbdev: sis: fix typos in SiS_GetModeID()
        ASoC: mchp-spdifrx: disable end of block interrupt on failures
        powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping.
        powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32
        powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case
        powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
        tty: serial: fsl_lpuart: correct the count of break characters
        s390/dump: fix os_info virtual vs physical address confusion
        s390/smp: cleanup target CPU callback starting
        s390/smp: cleanup control register update routines
        s390/maccess: rework absolute lowcore accessors
        s390/smp: enforce lowcore protection on CPU restart
        f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
        powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
        powerpc/xive: Fix refcount leak in xive_get_max_prio
        powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
        perf symbol: Fail to read phdr workaround
        kprobes: Forbid probing on trampoline and BPF code areas
        x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero
        powerpc/pci: Fix PHB numbering when using opal-phbid
        genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
        scripts/faddr2line: Fix vmlinux detection on arm64
        sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy()
        sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
        x86/numa: Use cpumask_available instead of hardcoded NULL check
        video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
        tools/thermal: Fix possible path truncations
        sched: Fix the check of nr_running at queue wakelist
        sched: Remove the limitation of WF_ON_CPU on wakelist if wakee cpu is idle
        sched/core: Do not requeue task on CPU excluded from cpus_mask
        x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y
        f2fs: allow compression for mmap files in compress_mode=user
        f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED
        video: fbdev: vt8623fb: Check the size of screen before memset_io()
        video: fbdev: arkfb: Check the size of screen before memset_io()
        video: fbdev: s3fb: Check the size of screen before memset_io()
        scsi: ufs: core: Correct ufshcd_shutdown() flow
        scsi: zfcp: Fix missing auto port scan and thus missing target ports
        scsi: qla2xxx: Fix imbalance vha->vref_count
        scsi: qla2xxx: Fix discovery issues in FC-AL topology
        scsi: qla2xxx: Turn off multi-queue for 8G adapters
        scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
        scsi: qla2xxx: Fix excessive I/O error messages by default
        scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection
        scsi: qla2xxx: Wind down adapter after PCIe error
        scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os
        scsi: qla2xxx: Fix losing target when it reappears during delete
        scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests
        x86/bugs: Enable STIBP for IBPB mitigated RETBleed
        ftrace/x86: Add back ftrace_expected assignment
        x86/kprobes: Update kcb status flag after singlestepping
        x86/olpc: fix 'logical not is only applied to the left hand side'
        SMB3: fix lease break timeout when multiple deferred close handles for the same file.
        posix-cpu-timers: Cleanup CPU timers before freeing them during exec
        Input: gscps2 - check return value of ioremap() in gscps2_probe()
        __follow_mount_rcu(): verify that mount_lock remains unchanged
        spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
        drm/mediatek: Allow commands to be sent during video mode
        drm/mediatek: Keep dsi as LP00 before dcs cmds transfer
        crypto: blake2s - remove shash module
        drm/dp/mst: Read the extended DPCD capabilities during system resume
        drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component
        usbnet: smsc95xx: Don't clear read-only PHY interrupt
        usbnet: smsc95xx: Avoid link settings race on interrupt reception
        usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling
        usbnet: smsc95xx: Fix deadlock on runtime resume
        firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
        scsi: lpfc: Fix EEH support for NVMe I/O
        scsi: lpfc: SLI path split: Refactor lpfc_iocbq
        scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4
        scsi: lpfc: SLI path split: Refactor SCSI paths
        scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID
        intel_th: pci: Add Meteor Lake-P support
        intel_th: pci: Add Raptor Lake-S PCH support
        intel_th: pci: Add Raptor Lake-S CPU support
        KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors
        KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS)
        iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
        PCI/AER: Iterate over error counters instead of error strings
        PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
        serial: 8250_pci: Refactor the loop in pci_ite887x_init()
        serial: 8250_pci: Replace dev_*() by pci_*() macros
        serial: 8250: Fold EndRun device support into OxSemi Tornado code
        serial: 8250: Add proper clock handling for OxSemi PCIe devices
        tty: 8250: Add support for Brainboxes PX cards.
        dm writecache: set a default MAX_WRITEBACK_JOBS
        kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
        dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
        net/9p: Initialize the iounit field during fid creation
        ARM: remove some dead code
        timekeeping: contribute wall clock to rng on time change
        locking/csd_lock: Change csdlock_debug from early_param to __setup
        block: remove the struct blk_queue_ctx forward declaration
        block: don't allow the same type rq_qos add more than once
        btrfs: ensure pages are unlocked on cow_file_range() failure
        btrfs: reset block group chunk force if we have to wait
        btrfs: properly flag filesystem with BTRFS_FEATURE_INCOMPAT_BIG_METADATA
        ACPI: CPPC: Do not prevent CPPC from working in the future
        powerpc/powernv/kvm: Use darn for H_RANDOM on Power9
        KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter
        KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU
        KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl
        KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL
        KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists
        dm raid: fix address sanitizer warning in raid_status
        dm raid: fix address sanitizer warning in raid_resume
        tracing: Add '__rel_loc' using trace event macros
        tracing: Avoid -Warray-bounds warning for __rel_loc macro
        ext4: update s_overhead_clusters in the superblock during an on-line resize
        ext4: fix extent status tree race in writeback error recovery path
        ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
        ext4: fix use-after-free in ext4_xattr_set_entry
        ext4: correct max_inline_xattr_value_size computing
        ext4: correct the misjudgment in ext4_iget_extra_inode
        ext4: fix warning in ext4_iomap_begin as race between bmap and write
        ext4: check if directory block is within i_size
        ext4: make sure ext4_append() always allocates new block
        ext4: remove EA inode entry from mbcache on inode eviction
        ext4: use kmemdup() to replace kmalloc + memcpy
        ext4: unindent codeblock in ext4_xattr_block_set()
        ext4: fix race when reusing xattr blocks
        KEYS: asymmetric: enforce SM2 signature use pkey algo
        tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH
        xen-blkback: fix persistent grants negotiation
        xen-blkback: Apply 'feature_persistent' parameter when connect
        xen-blkfront: Apply 'feature_persistent' parameter when connect
        powerpc: Fix eh field when calling lwarx on PPC32
        tracing: Use a struct alignof to determine trace event field alignment
        net_sched: cls_route: remove from list when handle is 0
        mac80211: fix a memory leak where sta_info is not freed
        tcp: fix over estimation in sk_forced_mem_schedule()
        crypto: lib/blake2s - reduce stack frame usage in self test
        Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
        Revert "s390/smp: enforce lowcore protection on CPU restart"
        drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function
        net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode
        drm/vc4: change vc4_dma_range_matches from a global to static
        tracing/perf: Avoid -Warray-bounds warning for __rel_loc macro
        drm/msm: Fix dirtyfb refcounting
        drm/meson: Fix refcount leak in meson_encoder_hdmi_init
        io_uring: mem-account pbuf buckets
        Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
        Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
        drm/bridge: Move devm_drm_of_get_bridge to bridge/panel.c
        scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup()
        scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4()
        scsi: lpfc: Resolve some cleanup issues following SLI path refactoring
        Linux 5.15.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iec359ed301bcbcd6e19b67ee8534418fab26850b
2022-09-21 17:30:12 +02:00
Shikha Panwar
75a03dbfc8 ANDROID: [GKI] Include ioremap_guard in cmdline arg
The idea is to move the 'early boot' args to built-in kernel commandline
to allow kernel to boot directly without bootloader.

Note - This is an arm64 only option. AVF uses this to enable KVM MMIO
guard functionality. It is also guarded by
kvm_arm_hyp_service_available(xx).

Bug: 247813394
Signed-off-by: Shikha Panwar <shikhapanwar@google.com>
Change-Id: I032b51b264614f5859869ee77bf34ec2b54baadc
2022-09-20 18:13:22 +00:00
Shikha Panwar
782ed2c9f9 ANDROID: [GKI] Include bootconfig in CONFIG_CMDLINE
The bootloader anyways uses bootconfig across the ecosystem. Make it a
part of built-in command line.

Test: Inspect ./config generated from the kernel build
Bug: 247548654
Change-Id: I356e6839e06bd6cde59801da7209f96a6e7dfc21
Signed-off-by: Shikha Panwar <shikhapanwar@google.com>
2022-09-20 17:22:35 +00:00
Yifan Hong
b8323be61d ANDROID: kleaf: Explicit list of ABI files.
In BUILD.bazel, explicitly list abi_definition,
kmi_symbol_list, and additional_kmi_symbol_lists.
This avoids using the glob expression which may
accidentally match editor backup files.

Bug: 246344503
Test: TH
Change-Id: I8fbad63bf744672ba5b76b51cc908926d7b10849
Signed-off-by: Yifan Hong <elsk@google.com>
2022-09-19 22:34:09 +00:00
Masahiro Yamada
c3154ba8a5 UPSTREAM: kbuild: rename cmd_{bzip2,lzma,lzo,lz4,xzkern,zstd22}
GZIP-compressed files end with 4 byte data that represents the size
of the original input. The decompressors (the self-extracting kernel)
exploit it to know the vmlinux size beforehand. To mimic the GZIP's
trailer, Kbuild provides cmd_{bzip2,lzma,lzo,lz4,xzkern,zstd22}.
Unfortunately these macros are used everywhere despite the appended
size data is only useful for the decompressors.

There is no guarantee that such hand-crafted trailers are safely ignored.
In fact, the kernel refuses compressed initramdfs with the garbage data.
That is why usr/Makefile overrides size_append to make it no-op.

To limit the use of such broken compressed files, this commit renames
the existing macros as follows:

  cmd_bzip2   --> cmd_bzip2_with_size
  cmd_lzma    --> cmd_lzma_with_size
  cmd_lzo     --> cmd_lzo_with_size
  cmd_lz4     --> cmd_lz4_with_size
  cmd_xzkern  --> cmd_xzkern_with_size
  cmd_zstd22  --> cmd_zstd22_with_size

To keep the decompressors working, I updated the following Makefiles
accordingly:

  arch/arm/boot/compressed/Makefile
  arch/h8300/boot/compressed/Makefile
  arch/mips/boot/compressed/Makefile
  arch/parisc/boot/compressed/Makefile
  arch/s390/boot/compressed/Makefile
  arch/sh/boot/compressed/Makefile
  arch/x86/boot/compressed/Makefile

I reused the current macro names for the normal usecases; they produce
the compressed data in the proper format.

I did not touch the following:

  arch/arc/boot/Makefile
  arch/arm64/boot/Makefile
  arch/csky/boot/Makefile
  arch/mips/boot/Makefile
  arch/riscv/boot/Makefile
  arch/sh/boot/Makefile
  kernel/Makefile

This means those Makefiles will stop appending the size data.

I dropped the 'override size_append' hack from usr/Makefile.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicolas Schier <n.schier@avm.de>

Bug: 135791357
(cherry picked from commit 7ce7e984ab
 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master)
Signed-off-by: SzuWei Lin <szuweilin@google.com>
Change-Id: I3f0ebdf13b2edb00fd405afdfacfe94e0e5fbee7
2022-09-17 11:54:24 +00:00
Alistair Delva
f3fcce16af ANDROID: GKI: Enable CONFIG_NULL_TTY by default
Because GKI has various serial drivers built in (8250, pl031, samsung,
sprd, geni) for earlycon, if they succeed probes for full functionality,
(such as if they are specified in DT as UART devices), the kernel would
unconditionally set up the first console device as the default console,
which is not generally desirable for production.

Enable CONFIG_NULL_TTY and enable "console=ttynull" by default. This
causes the kernel to always be silent unless a kernel console device is
explicitly specified on the cmdline. This has no effect on earlycon
"boot console" devices, just normal "console" devices.

Bug: 223797063
Change-Id: Id4cd0615bad79462f39397427380302b1904e42b
Signed-off-by: Alistair Delva <adelva@google.com>
2022-09-16 18:25:25 +00:00
Todd Kjos
ed8d3d91b9 ANDROID: fix build warning found by 0-day
The 0-day test-bot found this warning:

include/trace/hooks/thermal.h:16:25: warning: 'struct cpufreq_policy'
declared inside parameter list will not be visible outside of this
definition or declaration

Fixed by this patch.

Reported-by: kernel test robot <lkp@intel.com>
Fixes: b3efd2ad71 ("ANDROID: remove inclusions from hook definition headers")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I27d178f5056ab417b24eb14ca8dcb95f0d20cac7
2022-09-15 21:27:38 +00:00
Jone Chou
b5eedeaba6 ANDROID: kernel: add scmversion for debug_kinfo
Backup CONFIG_MODULE_SCMVERSION and scmversion offset.

Bug: 241477257
Signed-off-by: Jone Chou <jonechou@google.com>
Change-Id: If98f5c6d5014326ad2e07306a08571d1640d2c37
2022-09-15 10:26:50 +00:00
Yifan Hong
b0f8873811 ANDROID: kleaf: convert fips140 to kleaf
As a result of this change:

- fips140 is no longer part of the GKI build but a
  separate module, so it is not signed
  (CONFIG_MODULE_SIG_ALL is not set)

- GKI images (e.g. system_dlkm image, boot images)
  etc. are no longer part of the build -- because
  they are unnecessary.

- The build config no longer inherits from build.config.gki.aarch64
  directly to avoid building unnecessary system_dklm, boot images,
  GKI artifacts, etc.

Test: BUILD_CONFIG=common/build.config.gki.aarch64.fips140 build/build.sh
Test: tools/bazel build //common:fips140_dist
Bug: 232083350

Change-Id: I2cb0ee0b55c2a5ea46e6d73ecad4aa97585c1989
Signed-off-by: Yifan Hong <elsk@google.com>
2022-09-13 15:48:16 -07:00
Todd Kjos
b3efd2ad71 ANDROID: remove inclusions from hook definition headers
To avoid changing the visibiliy of data types when including
hook definition headers remove header file inclusions from
the hook definition header files.

Instead, the hook definition headers should just have forward
declarations that don't require full definition.

To provide full definitions of the types for the KMI, the
headers that define the types should be included by the
source file that instantiates the hooks - normally
vendor_hooks.c.

Bug: 233047575
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Iaaa1a6f45a356569c04ad2fea0b1514e0454f041
2022-09-08 23:24:37 +00:00
Todd Kjos
b6dace455e ANDROID: subsystem-specific vendor_hooks.c for sched
Change how vendor hooks are instantiated to promote
more complete structure definition in the ABI XML
description without complicating hook definition for
partners.

We don't want to force partners to include all
headers as part of the hook definition in include/trace/hooks/
since that causes extra headers to be included in
source files that runs the risk of changing visibility
resulting in CRC changes to KMI symbols. Instead continue
the practice of using forward declarations in the hook
header files.

Instead of instantiating all hook tracepoints globally in
drivers/android/vendor_hooks.c, use subsystem-specific
vendor_hooks.c if inclusion of subsystem-specific
header files is required. This avoids namespace collisions
between internal header files and limits the exposure
to the internal headers to the instantiation, not the
call sites.

In this patch, all of the scheduler related hooks are
instantiated in kernel/sched/vendor_hooks.c which can
cleanly include scheduler-related header files to
provide full type visibility.

Bug: 233047575
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Ife5a66c2968de73e3f6d05840411310611e2e175
2022-09-08 23:24:37 +00:00
Todd Kjos
4bc072dd20 ANDROID: remove CONFIG_TRACEPOINTS from hook definition headers
Remove the obsolete use of CONFIG_TRACEPOINTS in hook definition
header files. The !CONFIG_TRACEPOINTS case is correctly handled
by the included trace header files.

Bug: 233047575
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I957649bcfef375284f2885cf732ff2960c303837
2022-09-08 23:24:37 +00:00
Todd Kjos
5fdf33a8be Revert "ANDROID: arm64: smp: fix Lockdep warning: RCU used illegally from idle CPU."
This reverts commit 4af50419db.

Causes a build break for kernel_microdroid_aarch64 builds

Change-Id: I385a8e56ae1245bccba4d1b641175e73807da88b
Signed-off-by: Todd Kjos <tkjos@google.com>
2022-09-08 23:24:37 +00:00
Sumit Semwal
b87251d01e Revert "BACKPORT: FROMLIST: ext4: implement speculative fault handling"
This reverts commit a21ca34904.

Enabling SPF for ext4 breaks RB5 and DB845c testing on androidX-5.15
branches, causing vts-ltp tests to fail intermittently.

While this is debugged, let's disable SPF for ext4 to enable testing
meanwhile.

Bug: 245389404
Fixes: a21ca34904 ("FROMLIST: ext4: implement speculative fault handling")
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Change-Id: Id8cf6e1548aef1db59cdeffbc1ee0b60affd76ea
2022-09-08 19:41:17 +00:00
Greg Kroah-Hartman
bcecd2ee19 Linux 5.15.66
Link: https://lore.kernel.org/r/20220906132821.713989422@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
Tested-by: Ron Economos <re@w6rz.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Johan Hovold
e1779c25e4 USB: serial: ch341: fix disabled rx timer on older devices
commit 41ca302a69 upstream.

At least one older CH341 appears to have the RX timer enable bit
inverted so that setting it disables the RX timer and prevents the FIFO
from emptying until it is full.

Only set the RX timer enable bit for devices with version newer than
0x27 (even though this probably affects all pre-0x30 devices).

Reported-by: Jonathan Woithe <jwoithe@just42.net>
Tested-by: Jonathan Woithe <jwoithe@just42.net>
Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au
Fixes: 4e46c410e0 ("USB: serial: ch341: reinitialize chip on reconfiguration")
Cc: stable@vger.kernel.org      # 4.10
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Johan Hovold
e0923b4f38 USB: serial: ch341: fix lost character on LCR updates
commit 8e83622ae7 upstream.

Disable LCR updates for pre-0x30 devices which use a different (unknown)
protocol for line control and where the current register write causes
the next received character to be lost.

Note that updating LCR using the INIT command has no effect on these
devices either.

Reported-by: Jonathan Woithe <jwoithe@just42.net>
Tested-by: Jonathan Woithe <jwoithe@just42.net>
Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au
Fixes: 4e46c410e0 ("USB: serial: ch341: reinitialize chip on reconfiguration")
Fixes: 55fa15b598 ("USB: serial: ch341: fix baud rate and line-control handling")
Cc: stable@vger.kernel.org      # 4.10
Signed-off-by: Johan Hovold <johan@kernel.org>
[ johan: adjust context to 5.15 ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Johan Hovold
55d3289243 usb: dwc3: disable USB core PHY management
commit 6000b8d900 upstream.

The dwc3 driver manages its PHYs itself so the USB core PHY management
needs to be disabled.

Use the struct xhci_plat_priv hack added by commits 46034a999c ("usb:
host: xhci-plat: add platform data support") and f768e71891 ("usb:
host: xhci-plat: add priv quirk for skip PHY initialization") to
propagate the setting for now.

Fixes: 4e88d4c083 ("usb: add a flag to skip PHY initialization to struct usb_hcd")
Fixes: 178a0bce05 ("usb: core: hcd: integrate the PHY wrapper into the HCD core")
Tested-by: Matthias Kaehlcke <mka@chromium.org>
Cc: stable <stable@kernel.org>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20220825131836.19769-1-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ johan: adjust context to 5.15 ]
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Johan Hovold
121c6e37da usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
commit  a872ab303d upstream.

The Qualcomm dwc3 runtime-PM implementation checks the xhci
platform-device pointer in the wakeup-interrupt handler to determine
whether the controller is in host mode and if so triggers a resume.

After a role switch in OTG mode the xhci platform-device would have been
freed and the next wakeup from runtime suspend would access the freed
memory.

Note that role switching is executed from a freezable workqueue, which
guarantees that the pointer is stable during suspend.

Also note that runtime PM has been broken since commit 2664deb093
("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which
incidentally also prevents this issue from being triggered.

Fixes: a4333c3a6b ("usb: dwc3: Add Qualcomm DWC3 glue driver")
Cc: stable@vger.kernel.org      # 4.18
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20220804151001.23612-5-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ johan: adjust context for 5.15 ]
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Johan Hovold
9d6a2d0220 usb: dwc3: fix PHY disable sequence
commit d2ac7bef95 upstream.

Generic PHYs must be powered-off before they can be tore down.

Similarly, suspending legacy PHYs after having powered them off makes no
sense.

Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded
dwc3_probe() error-path sequences that got this wrong.

Note that this makes dwc3_core_exit() match the dwc3_core_init() error
path with respect to powering off the PHYs.

Fixes: 03c1fd622f ("usb: dwc3: core: add phy cleanup for probe error handling")
Fixes: c499ff71ff ("usb: dwc3: core: re-factor init and exit paths")
Cc: stable@vger.kernel.org      # 4.8
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ johan: adjust context to 5.15 ]
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Martin Rodriguez Reboredo
b775fbf532 kbuild: Add skip_encoding_btf_enum64 option to pahole
New pahole (version 1.24) generates by default new BTF_KIND_ENUM64 BTF tag,
which is not supported by stable kernel.

As a result the kernel with CONFIG_DEBUG_INFO_BTF option will fail to
compile with following error:

  BTFIDS  vmlinux
FAILED: load BTF from vmlinux: Invalid argument

New pahole provides --skip_encoding_btf_enum64 option to skip BTF_KIND_ENUM64
generation and produce BTF supported by stable kernel.

Adding this option to scripts/pahole-flags.sh.

This change does not have equivalent commit in linus tree, because linus tree
has support for BTF_KIND_ENUM64 tag, so it does not need to be disabled.

Signed-off-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Jiri Olsa
0baced0e09 kbuild: Unify options for BTF generation for vmlinux and modules
commit e27f05147b upstream.

Using new PAHOLE_FLAGS variable to pass extra arguments to
pahole for both vmlinux and modules BTF data generation.

Adding new scripts/pahole-flags.sh script that detect and
prints pahole options.

[ fixed issues found by kernel test robot ]

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20211029125729.70002-1-jolsa@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Mazin Al Haddad
309aea4b6b tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
commit f16c6d2e58 upstream.

A null pointer dereference can happen when attempting to access the
"gsm->receive()" function in gsmld_receive_buf(). Currently, the code
assumes that gsm->recieve is only called after MUX activation.
Since the gsmld_receive_buf() function can be accessed without the need to
initialize the MUX, the gsm->receive() function will not be set and a
NULL pointer dereference will occur.

Fix this by avoiding the call to "gsm->receive()" in case the function is
not initialized by adding a sanity check.

Call Trace:
 <TASK>
 gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861
 tiocsti drivers/tty/tty_io.c:2293 [inline]
 tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Link: https://syzkaller.appspot.com/bug?id=bdf035c61447f8c6e0e6920315d577cb5cc35ac5
Fixes: 01aecd9171 ("tty: n_gsm: fix tty registration before control channel open")
Cc: stable <stable@kernel.org>
Reported-and-tested-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com
Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com>
Link: https://lore.kernel.org/r/20220814015211.84180-1-mazinalhaddad05@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Ville Syrjälä
1787ec7dcc drm/i915: Skip wm/ddb readout for disabled pipes
commit 0211c2a0ea upstream.

The stuff programmed into the wm/ddb registers of planes
on disabled pipes doesn't matter. So during readout just
leave our software state tracking for those zeroed.

This should avoid us trying too hard to clean up after
whatever mess the VBIOS/GOP left in there. The actual
hardware state will get cleaned up if/when we enable
the pipe anyway.

Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5711
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220617195948.24007-1-ville.syrjala@linux.intel.com
Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
(cherry picked from commit b183db8f47)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Diego Santa Cruz
f9a0f49be7 drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
commit 919bef7a10 upstream.

The quirk added in upstream commit 90c3e21987 ("drm/i915/glk: Add
Quirk for GLK NUC HDMI port issues.") is also required on the ECS Liva
Q2.

Note: Would be nicer to figure out the extra delay required for the
retimer without quirks, however don't know how to check for that.

Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1326
Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220616124137.3184371-1-jani.nikula@intel.com
(cherry picked from commit 08e9505fa8)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Takashi Iwai
301be8985e ALSA: seq: Fix data-race at module auto-loading
commit 3e7e04b747 upstream.

It's been reported that there is a possible data-race accessing to the
global card_requested[] array at ALSA sequencer core, which is used
for determining whether to call request_module() for the card or not.
This data race itself is almost harmless, as it might end up with one
extra request_module() call for the already loaded module at most.
But it's still better to fix.

This patch addresses the possible data race of card_requested[] and
client_requested[] arrays by replacing them with bitmask.
It's an atomic operation and can work without locks.

Reported-by: Abhishek Shah <abhishek.shah@columbia.edu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/CAEHB24_ay6YzARpA1zgCsE7=H9CSJJzux618E=Ka4h0YdKn=qA@mail.gmail.com
Link: https://lore.kernel.org/r/20220823072717.1706-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:08 +02:00
Takashi Iwai
9b7a07fcc5 ALSA: seq: oss: Fix data-race for max_midi_devs access
commit 22dec134db upstream.

ALSA OSS sequencer refers to a global variable max_midi_devs at
creating a new port, storing it to its own field.  Meanwhile this
variable may be changed by other sequencer events at
snd_seq_oss_midi_check_exit_port() in parallel, which may cause a data
race.

OTOH, this data race itself is almost harmless, as the access to the
MIDI device is done via get_mdev() and it's protected with a refcount,
hence its presence is guaranteed.

Though, it's sill better to address the data-race from the code sanity
POV, and this patch adds the proper spinlock for the protection.

Reported-by: Abhishek Shah <abhishek.shah@columbia.edu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/CAEHB2493pZRXs863w58QWnUTtv3HHfg85aYhLn5HJHCwxqtHQg@mail.gmail.com
Link: https://lore.kernel.org/r/20220823072717.1706-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Kacper Michajłow
b2c973b52f ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
commit a2d57ebec1 upstream.

Magic initialization sequence was extracted from Windows driver and
cleaned up manually.

Fixes internal speakers output.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=207423
Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1851518
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220827203328.30363-1-kasper93@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Miquel Raynal
c5652d5d71 net: mac802154: Fix a condition in the receive path
commit f0da47118c upstream.

Upon reception, a packet must be categorized, either it's destination is
the host, or it is another host. A packet with no destination addressing
fields may be valid in two situations:
- the packet has no source field: only ACKs are built like that, we
  consider the host as the destination.
- the packet has a valid source field: it is directed to the PAN
  coordinator, as for know we don't have this information we consider we
  are not the PAN coordinator.

There was likely a copy/paste error made during a previous cleanup
because the if clause is now containing exactly the same condition as in
the switch case, which can never be true. In the past the destination
address was used in the switch and the source address was used in the
if, which matches what the spec says.

Cc: stable@vger.kernel.org
Fixes: ae531b9475 ("ieee802154: use ieee802154_addr instead of *_sa variants")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20220826142954.254853-1-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Sebastian Andrzej Siewior
4b9f3743a8 net: Use u64_stats_fetch_begin_irq() for stats fetch.
commit 278d3ba615 upstream.

On 32bit-UP u64_stats_fetch_begin() disables only preemption. If the
reader is in preemptible context and the writer side
(u64_stats_update_begin*()) runs in an interrupt context (IRQ or
softirq) then the writer can update the stats during the read operation.
This update remains undetected.

Use u64_stats_fetch_begin_irq() to ensure the stats fetch on 32bit-UP
are not interrupted by a writer. 32bit-SMP remains unaffected by this
change.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Catherine Sullivan <csully@google.com>
Cc: David Awogbemila <awogbemila@google.com>
Cc: Dimitris Michailidis <dmichail@fungible.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Hans Ulli Kroll <ulli.kroll@googlemail.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Jeroen de Borst <jeroendb@google.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <simon.horman@corigine.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: oss-drivers@corigine.com
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Nicolas Dichtel
57f1407ca1 ip: fix triggering of 'icmp redirect'
commit eb55dc09b5 upstream.

__mkroute_input() uses fib_validate_source() to trigger an icmp redirect.
My understanding is that fib_validate_source() is used to know if the src
address and the gateway address are on the same link. For that,
fib_validate_source() returns 1 (same link) or 0 (not the same network).
__mkroute_input() is the only user of these positive values, all other
callers only look if the returned value is negative.

Since the below patch, fib_validate_source() didn't return anymore 1 when
both addresses are on the same network, because the route lookup returns
RT_SCOPE_LINK instead of RT_SCOPE_HOST. But this is, in fact, right.
Let's adapat the test to return 1 again when both addresses are on the same
link.

CC: stable@vger.kernel.org
Fixes: 747c143072 ("ip: fix dflt addr selection for connected nexthop")
Reported-by: kernel test robot <yujie.liu@intel.com>
Reported-by: Heng Qi <hengqi@linux.alibaba.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220829100121.3821-1-nicolas.dichtel@6wind.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Siddh Raman Pant
5d20c6f932 wifi: mac80211: Fix UAF in ieee80211_scan_rx()
commit 60deb9f10e upstream.

ieee80211_scan_rx() tries to access scan_req->flags after a
null check, but a UAF is observed when the scan is completed
and __ieee80211_scan_completed() executes, which then calls
cfg80211_scan_done() leading to the freeing of scan_req.

Since scan_req is rcu_dereference()'d, prevent the racing in
__ieee80211_scan_completed() by ensuring that from mac80211's
POV it is no longer accessed from an RCU read critical section
before we call cfg80211_scan_done().

Cc: stable@vger.kernel.org
Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com
Suggested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Siddh Raman Pant <code@siddh.me>
Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Siddh Raman Pant
552ba102a6 wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
commit 15bc8966b6 upstream.

When we are not connected to a channel, sending channel "switch"
announcement doesn't make any sense.

The BSS list is empty in that case. This causes the for loop in
cfg80211_get_bss() to be bypassed, so the function returns NULL
(check line 1424 of net/wireless/scan.c), causing the WARN_ON()
in ieee80211_ibss_csa_beacon() to get triggered (check line 500
of net/mac80211/ibss.c), which was consequently reported on the
syzkaller dashboard.

Thus, check if we have an existing connection before generating
the CSA beacon in ieee80211_ibss_finish_csa().

Cc: stable@vger.kernel.org
Fixes: cd7760e62c ("mac80211: add support for CSA in IBSS mode")
Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
Signed-off-by: Siddh Raman Pant <code@siddh.me>
Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Isaac J. Manjarres
253ec5fb84 driver core: Don't probe devices after bus_type.match() probe deferral
commit 25e9fbf0fd upstream.

Both __device_attach_driver() and __driver_attach() check the return
code of the bus_type.match() function to see if the device needs to be
added to the deferred probe list. After adding the device to the list,
the logic attempts to bind the device to the driver anyway, as if the
device had matched with the driver, which is not correct.

If __device_attach_driver() detects that the device in question is not
ready to match with a driver on the bus, then it doesn't make sense for
the device to attempt to bind with the current driver or continue
attempting to match with any of the other drivers on the bus. So, update
the logic in __device_attach_driver() to reflect this.

If __driver_attach() detects that a driver tried to match with a device
that is not ready to match yet, then the driver should not attempt to bind
with the device. However, the driver can still attempt to match and bind
with other devices on the bus, as drivers can be bound to multiple
devices. So, update the logic in __driver_attach() to reflect this.

Fixes: 656b8035b0 ("ARM: 8524/1: driver cohandle -EPROBE_DEFER from bus_type.match()")
Cc: stable@vger.kernel.org
Cc: Saravana Kannan <saravanak@google.com>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Saravana Kannan <saravanak@google.com>
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Link: https://lore.kernel.org/r/20220817184026.3468620-1-isaacmanjarres@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Krishna Kurapati
7da29a2cc5 usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
commit 9d4dc16ec7 upstream.

During cdrom emulation, the response to read_toc command must contain
the cdrom address as the number of sectors (2048 byte sized blocks)
represented either as an absolute value (when MSF bit is '0') or in
terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of
cdrom, the fsg_lun_open call sets the sector size to 2048 bytes.

When MAC OS sends a read_toc request with MSF set to '1', the
store_cdrom_address assumes that the address being provided is the
LUN size represented in 512 byte sized blocks instead of 2048. It
tries to modify the address further to convert it to 2048 byte sized
blocks and store it in MSF format. This results in data transfer
failures as the cdrom address being provided in the read_toc response
is incorrect.

Fixes: 3f565a363c ("usb: gadget: storage: adapt logic block size to bound block devices")
Cc: stable@vger.kernel.org
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Chunfeng Yun
299f4f420f usb: xhci-mtk: fix bandwidth release issue
commit 6020f48000 upstream.

This happens when @udev->reset_resume is set to true, when usb resume,
the flow as below:
  - hub_resume
    - usb_disable_interface
      - usb_disable_endpoint
        - usb_hcd_disable_endpoint
          - xhci_endpoint_disable  // it set @ep->hcpriv to NULL

Then when reset usb device, it will drop allocated endpoints,
the flow as below:
  - usb_reset_and_verify_device
    - usb_hcd_alloc_bandwidth
      - xhci_mtk_drop_ep

but @ep->hcpriv is already set to NULL, the bandwidth will be not
released anymore.

Due to the added endponts are stored in hash table, we can drop the check
of @ep->hcpriv.

Fixes: 4ce186665e ("usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint")
Cc: stable <stable@kernel.org>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/20220819080556.32215-2-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Chunfeng Yun
27102b39b6 usb: xhci-mtk: relax TT periodic bandwidth allocation
commit 8b13ea0511 upstream.

Currently uses the worst case byte budgets on FS/LS bus bandwidth,
for example, for an isochronos IN endpoint with 192 bytes budget, it
will consume the whole 5 uframes(188 * 5) while the actual FS bus
budget should be just 192 bytes. It cause that many usb audio headsets
with 3 interfaces (audio input, audio output, and HID) cannot be
configured.
To improve it, changes to use "approximate" best case budget for FS/LS
bandwidth management. For the same endpoint from the above example,
the approximate best case budget is now reduced to (188 * 2) bytes.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20220819080556.32215-1-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
Alan Stern
c548b99e1c USB: core: Prevent nested device-reset calls
commit 9c6d778800 upstream.

Automatic kernel fuzzing revealed a recursive locking violation in
usb-storage:

============================================
WARNING: possible recursive locking detected
5.18.0 #3 Not tainted
--------------------------------------------
kworker/1:3/1205 is trying to acquire lock:
ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230

but task is already holding lock:
ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230

...

stack backtrace:
CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2988 [inline]
check_deadlock kernel/locking/lockdep.c:3031 [inline]
validate_chain kernel/locking/lockdep.c:3816 [inline]
__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109
r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622
usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:545 [inline]
device_remove+0x11f/0x170 drivers/base/dd.c:537
__device_release_driver drivers/base/dd.c:1222 [inline]
device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248
usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627
usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118
usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114

This turned out not to be an error in usb-storage but rather a nested
device reset attempt.  That is, as the rtl8712 driver was being
unbound from a composite device in preparation for an unrelated USB
reset (that driver does not have pre_reset or post_reset callbacks),
its ->remove routine called usb_reset_device() -- thus nesting one
reset call within another.

Performing a reset as part of disconnect processing is a questionable
practice at best.  However, the bug report points out that the USB
core does not have any protection against nested resets.  Adding a
reset_in_progress flag and testing it will prevent such errors in the
future.

Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6keN==voRbP0g@mail.gmail.com/
Cc: stable@vger.kernel.org
Reported-and-tested-by: Rondreis <linhaoguo86@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00