Commit Graph

1168443 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
96d435eb13 Revert "exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case"
This reverts commit b45605fac3 which is
commit 543841d1806029889c2f69f040e88b247aba8e22 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I22e4874caa735da68f10a3d6477069f24bc0462d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 14:53:08 +00:00
Greg Kroah-Hartman
ac6e319e7c Merge b3847b6622 ("iommu/arm-smmu-v3: Clean up more on probe failure") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: Ibfe96f79401fb2bf536c39c9a473a784e0543ea2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 14:52:54 +00:00
Greg Kroah-Hartman
fd1d84ca7a Revert "mptcp: handle fastopen disconnect correctly"
This reverts commit 73e268b4be which is
commit 619af16b3b57a3a4ee50b9a30add9ff155541e71 upstream.

It breaks the Android kernel build and can be brought back in the future
in an safe way if it is really needed.

Bug: 161946584
Change-Id: Ice4a456e51817eb48fad85c2ae048a88338807ef
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 14:49:39 +00:00
Greg Kroah-Hartman
f6d414dac6 Merge 73e268b4be ("mptcp: handle fastopen disconnect correctly") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I2083da426f991e78e8ec6afbd498445f63717263
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 14:48:41 +00:00
Greg Kroah-Hartman
a32de01c74 Merge 3b5332d416 ("mptcp: consolidate suboption status") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I26ab839e8edf228edbec0cddd53d59fca6075594
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 14:46:15 +00:00
Greg Kroah-Hartman
44b6a8ed8f Revert "usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS"
This reverts commit 4953207927 which is
commit 4d27afbf256028a1f54363367f30efc8854433c3 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I6b743cfeb8ce98af2f957100d6a32ab4ea4bf515
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 09:50:19 +00:00
Greg Kroah-Hartman
66c6868930 Merge 4953207927 ("usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	drivers/usb/typec/tcpm/tcpci.c
	drivers/usb/typec/tcpm/tcpm.c

Change-Id: Id20ff6e44155d868c2542d94a30131d8658800c2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:53:02 +00:00
Greg Kroah-Hartman
6e376e10ea Merge 17d426628c ("usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	drivers/usb/dwc3/core.c

Change-Id: I2c283da276b9179cd76403d2fa83da077615d0be
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:37:04 +00:00
Greg Kroah-Hartman
11cb0c5d29 Merge 2c3e83538f ("usb: gadget: f_tcm: Fix Get/SetInterface return value") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: Id44c263751cf95215390ad95c101ec68edf461ed
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:34:36 +00:00
Greg Kroah-Hartman
c6490faa0a Merge 93a56dbe12 ("drivers/card_reader/rtsx_usb: Restore interrupt based detection") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	drivers/usb/host/xhci-ring.c

Change-Id: Ie123285eab89802392003b95ec495b21820ad41b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:31:24 +00:00
Greg Kroah-Hartman
9fb90380c1 Merge e10b392a74 ("net: usb: rtl8150: enable basic endpoint checking") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	scripts/Makefile.lib

Change-Id: Id496f510e74b8576bd71449bf8ffa338072eb8e4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:11:45 +00:00
Greg Kroah-Hartman
015c802557 Merge ad8f71d64a ("tools/bootconfig: Fix the wrong format specifier") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I30bcf71d285ba65a092b9a4899532cde31208c48
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:09:42 +00:00
Greg Kroah-Hartman
3e716b1ee2 Revert "bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write"
This reverts commit 8f7cc7c763 which is
commit 8ac412a3361173e3000b16167af3d1f6f90af613 upstream.

It breaks the Android kernel build and can be brought back in the future
in an build-safe way if it is really needed.

Bug: 161946584
Change-Id: I150a126d974ab67537cdb11d1348441834b154c5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:07:24 +00:00
Greg Kroah-Hartman
9775060702 Merge 8f7cc7c763 ("bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I624b68d0d97588c1934baa197d65c1a48c05ae34
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:06:49 +00:00
Greg Kroah-Hartman
0bc46e8fb4 Merge be42a09fe8 ("bpf: Send signals asynchronously if !preemptible") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: Ibd1adb3cc93660336fe0bd65b91d65f4ca1e0fcb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:04:25 +00:00
Greg Kroah-Hartman
0d704e39b1 Merge e397ad3f16 ("ASoC: Intel: avs: Fix theoretical infinite loop") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I1dccc0094c873f1be70ee97b941f74b5ace58e1e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:49:40 +00:00
Greg Kroah-Hartman
759b090e5d Merge 220883fba3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I12ddac7329f6db60e21f195f3e500ac786f2db7c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:48:15 +00:00
Greg Kroah-Hartman
ef5c5ad7df Merge 0f1719a2ba ("genirq: Make handle_enforce_irqctx() unconditionally available") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I2092799139b4c393c1c99953d110500920fa3200
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:35:22 +00:00
Greg Kroah-Hartman
309e9dd394 Revert "OPP: Rearrange entries in pm_opp.h"
This reverts commit 4dff070117 which is
commit 754833b319 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Iee1382014bb394455d5d39e5dee9a036e8988cae
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:59 +00:00
Greg Kroah-Hartman
4fd8e25317 Revert "OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs"
This reverts commit 92fcb46659 which is
commit 142e17c1c2 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I1af7c9d9e49c81fae8706dc5fcb1f80e5aaac0b0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
44a6d4af33 Revert "OPP: Introduce dev_pm_opp_get_freq_indexed() API"
This reverts commit 7f73098bc6 which is
commit 5f756d03e2 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I2e361b5c7e9306d76e606eaa5eb1fa87af5eed28
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
f7d6d8d971 Revert "OPP: Add dev_pm_opp_find_freq_exact_indexed()"
This reverts commit 7baa59f83f which is
commit a5893928bb upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I00b677f975738c791bf7074c982a8e215f8054ac
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
6811b9303c Revert "OPP: Reuse dev_pm_opp_get_freq_indexed()"
This reverts commit e20fd4d3a4 which is
commit 746de82550 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I13648075fb2871b25977bc22ce6d11bd9e795506
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
f7d86656ca Revert "OPP: add index check to assert to avoid buffer overflow in _read_freq()"
This reverts commit 774dd6f0f0 which is
commit d659bc68ed489022ea33342cfbda2911a81e7a0d upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I6295c420bb6642fb9f04770a9f3baefa2d0aee72
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
3e0043876d Revert "OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized"
This reverts commit 8532fd078d which is
commit b44b9bc7cab2967c3d6a791b1cd542c89fc07f0e upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I2ae4174ecb2214b5c1bc30b07970dd3468c1b43f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:57 +00:00
Greg Kroah-Hartman
635b2890f4 Merge 8532fd078d ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I9feed811f2bd01f2c28c951c949936d87b886ee8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:57 +00:00
Greg Kroah-Hartman
3df8fd8f21 Revert "sched/psi: Use task->psi_flags to clear in CPU migration"
This reverts commit 371e1a0e38 which is
commit 52b33d87b9 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ic3741eb342637ace98373f24857a4d302cf7cfc7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 06:07:52 +00:00
Greg Kroah-Hartman
0b3a7df78d Revert "sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat"
This reverts commit a18682ccd2 which is
commit a430d99e349026d53e2557b7b22bd2ebd61fe12a upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ia71eb1867950bae93b6c426a596d584716137b29
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 06:07:31 +00:00
Greg Kroah-Hartman
d4e5cb0cd9 Merge 0764df6b80 ("drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	kernel/sched/fair.c

Change-Id: I875e1c0846dd439a019d0d5b81f09cdac4a5c74e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-05 16:54:20 +00:00
Greg Kroah-Hartman
b3026e7cef Merge branch 'android14-6.1' into android14-6.1-lts
Catch the lts branch up with changes made in the normal one.  Commits
include in here are:

* a624f97c9a Merge tag 'android14-6.1.128_r00' into android14-6.1
* 52a41f0bf1 ANDROID: usb: typec: tcpci: Combine the parameters of set_auto_vbus_discharge_threshold
* f84d5a5fad FROMGIT: usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
* a5f88b6529 UPSTREAM: f2fs: Optimize f2fs_truncate_data_blocks_range()
* 8171ecc314 BACKPORT: f2fs: add parameter @len to f2fs_invalidate_blocks()
* 2e7c1f7a45 UPSTREAM: f2fs: update_sit_entry_for_release() supports consecutive blocks.
* 80b35f89f0 BACKPORT: f2fs: introduce update_sit_entry_for_release/alloc()
* 600d7eac27 BACKPORT: f2fs: add parameter @len to f2fs_invalidate_internal_cache()
* 187a48cb98 UPSTREAM: f2fs: expand f2fs_invalidate_compress_page() to f2fs_invalidate_compress_pages_range()
* edcfc793f8 UPSTREAM: f2fs: fix to truncate meta inode pages forcely
* 3812bc69b2 BACKPORT: f2fs: introduce f2fs_invalidate_internal_cache() for cleanup
* ccc9157843 ANDROID: cma: Add restrict_cma_redirect boot parameter
* 34a86330cc FROMLIST: KVM: arm64: Fix alignment of kvm_hyp_memcache allocations
* c93dcf3b53 UPSTREAM: binder: log transaction code on failure
* 4e534b8a58 ANDROID: GKI: Galaxy android14-6.1 update symbol for alsa audio device
* 1ac09f5c05 ANDROID: GKI: Update symbol list for arg
* e5f309b277 ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
* 09717ac61c ANDROID: Update the ABI symbol list
* 3031fa1817 ANDROID: Adding an Android vendor LMK event
* 7658169f5f BACKPORT: usb: xhci: Fix NULL pointer dereference on certain command aborts
* 4033df202b ANDROID: OPP: Fix incorrectly backported logic in _set_opp_level()
* 1cf6be7092 UPSTREAM: io_uring: fix waiters missing wake ups
* 2055772ead UPSTREAM: f2fs: avoid trying to get invalid block address
* 554eb9d61a ANDROID: KABI macros to release excess KABI fields for use with backports
* 773ad7ab13 ANDROID: GKI: Add new symbol list for arg

Change-Id: I71e368853a486e3893c0cc5b964b8fc3c390a4e9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-02-22 10:42:36 +00:00
Greg Kroah-Hartman
a624f97c9a Merge tag 'android14-6.1.128_r00' into android14-6.1
This merges the android14-6.1.128_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 8ae119f6f2 ANDROID: hrtimers: revert mismerged commit in 6.1.127 LTS merge
*   e6d1ba5430 Merge 6.1.128 into android14-6.1-lts
|\
| * 0cbb5f65e5 Linux 6.1.128
| * a9401cd5d1 drm/v3d: Assign job pointer to NULL before signaling the fence
| * 7d06d97e23 ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation
| * 44c495818d smb: client: fix NULL ptr deref in crypto_aead_setkey()
| * 4982cc83da Input: xpad - add support for wooting two he (arm)
| * b336f58326 Input: xpad - add unofficial Xbox 360 wireless receiver clone
| * dd00051871 Input: atkbd - map F23 key to support default copilot shortcut
| * 4631653d8d ALSA: usb-audio: Add delay quirk for USB Audio Device
| * 33233b06ad Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
| * 4b9b41fabc USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
| * bce966530f smb: client: fix UAF in async decryption
| * 49a27ee475 wifi: iwlwifi: add a few rate index validity checks
| * 182a4b7c73 scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
| * ce11424026 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
| * 13ea954776 ext4: fix access to uninitialised lock in fc replay path
| * 6bcb8a5b70 vfio/platform: check the bounds of read/write syscalls
| * 1a1b2b8c28 Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
| * 8476f8428e block: fix integer overflow in BLKSECDISCARD
| * 1332c6ed44 net: sched: fix ets qdisc OOB Indexing
| * 74a37ce697 io_uring: fix waiters missing wake ups
| * 2a40a140e1 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
| * 754df8c9b7 xfs: respect the stable writes flag on the RT device
| * bc4ad69947 xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
| * 7880b1f0ad xfs: dquot recovery does not validate the recovered dquot
| * df716416db xfs: clean up dqblk extraction
| * 318cac2b98 xfs: inode recovery does not validate the recovered inode
| * 6e7826272e xfs: fix internal error from AGFL exhaustion
| * 323a707978 xfs: up(ic_sema) if flushing data device fails
| * 67c362b810 xfs: only remap the written blocks in xfs_reflink_end_cow_extent
| * b655ee7d1a xfs: abort intent items when recovery intents fail
| * 16cf312bf0 xfs: factor out xfs_defer_pending_abort
| * 6685b88514 xfs: allow read IO and FICLONE to run concurrently
| * 4eb3b579b4 xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
| * feb30fe495 xfs: introduce protection for drop nlink
| * 4d607041cf xfs: make sure maxlen is still congruent with prod when rounding down
| * 34167d0216 xfs: fix units conversion error in xfs_bmap_del_extent_delay
| * 9153644934 xfs: rt stubs should return negative errnos when rt disabled
| * 9670abd18c xfs: prevent rt growfs when quota is enabled
| * 8ee604ac13 xfs: hoist freeing of rt data fork extent mappings
| * 79bdab54b6 xfs: bump max fsgeom struct version
| * f1bc570611 softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
| * d0ec61c9f3 ipv6: Fix soft lockups in fib6_select_path under high next hop churn
| * 9fdec47866 regmap: detach regmap from dev on regmap_exit
| * 87d6969081 ASoC: samsung: Add missing depends on I2C
| * 656100f656 ASoC: samsung: midas_wm1811: Map missing jack kcontrols
| * d2b4b39b75 irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
| * b7d2461858 drm/amd/display: Use HW lock mgr for PSR1
| * 2104ad7193 scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
| * 18cb5798df seccomp: Stub for !CONFIG_SECCOMP
| * b873c88bfc ASoC: samsung: Add missing selects for MFD_WM8994
| * 8cf587aab9 ASoC: wm8994: Add depends on MFD core
* | 979fb1d6ec Revert "fs: fix missing declaration of init_files"
* | 42cbb80279 Revert "net: add exit_batch_rtnl() method"
* | 5b18fc7e2e Revert "gtp: use exit_batch_rtnl() method"
* | da69d6681f Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()."
* | f3dfa82675 Revert "gtp: Destroy device along with udp socket's netns dismantle."
* | 79f1b689da Merge 6.1.127 into android14-6.1-lts
|\|
| * 75cefdf153 Linux 6.1.127
| * be7c61ea5f net: fix data-races around sk->sk_forward_alloc
| * 060de3717c x86/xen: fix SLS mitigation in xen_hypercall_iret()
| * 400fb0e9c2 nfsd: add list_head nf_gc to struct nfsd_file
| * 75a0a6dde8 erofs: handle NONHEAD !delta[1] lclusters gracefully
| * 6326a3dc14 erofs: tidy up EROFS on-disk naming
| * 6e5dbd1c04 wifi: ath10k: avoid NULL pointer error during sdio remove
| * cd862903fa Revert "regmap: detach regmap from dev on regmap_exit"
| * 275b8347e2 scsi: sg: Fix slab-use-after-free read in sg_release()
| * 9e95518eca RDMA/rxe: Fix the qp flush warnings in req
| * e77360374f Revert "drm/amdgpu: rework resume handling for display (v2)"
| * 1921fe7d28 block: fix uaf for flush rq while iterating tags
| * 05b1b33936 drm/amdgpu: fix usage slab after free
| * 5bd410c210 drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
| * 64b79afdca iio: adc: rockchip_saradc: fix information leak in triggered buffer
| * d3e25180ba iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
| * f2e4823baa iio: imu: inv_icm42600: fix spi burst write not supported
| * 479a42eedb Revert "PCI: Use preserve_config in place of pci_flags"
| * 6603aca936 drm/i915/fb: Relax clear color alignment to 64 bytes
| * 3d41dbf82e hrtimers: Handle CPU state correctly on hotplug
| * d7b0e89610 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
| * e64612f8e8 irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
| * e1994d0f50 irqchip: Plug a OF node reference leak in platform_irqchip_probe()
| * 699cc10cc3 pmdomain: imx8mp-blk-ctrl: add missing loop break condition
| * d38c49f7bd gpiolib: cdev: Fix use after free in lineinfo_changed_notify
| * 65c367bd9d fs/proc: fix softlockup in __read_vmcore (part 2)
| * 80fc836f3e filemap: avoid truncating 64-bit offset to 32 bits
| * b52e50dd4f vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
| * cc586af35b vsock: reset socket state when de-assigning the transport
| * a3c9390f14 vsock/virtio: cancel close work in the destructor
| * 88244163bc vsock/virtio: discard packets if the transport changes
| * 435349d49f net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
| * 9e1f509476 selftests: mptcp: avoid spurious errors on disconnect
| * 73411e09d0 mptcp: be sure to send ack when mptcp-level window re-opens
| * fe3de867f9 zram: fix potential UAF of zram table
| * f983099430 ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
| * 0b30238c5c x86/asm: Make serialize() always_inline
| * 3375bdf84c poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
| * 7ca4bd6b75 iomap: avoid avoid truncating 64-bit offset to 32 bits
| * a5045ca6eb ACPI: resource: acpi_dev_irq_override(): Check DMI match last
| * bea2a4cf27 selftests: tc-testing: reduce rshift value
| * 435df80d46 scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
| * f937130b8d cachefiles: Parse the "secctx" immediately
| * d8680dad14 kheaders: Ignore silly-rename files
| * bb00b1190b fs: fix missing declaration of init_files
| * 190218579c hfs: Sanity check the root record
| * 41e4ca8acb mac802154: check local interfaces before deleting sdata list
| * cce9254a04 nvmet: propagate npwg topology
| * 75505de002 i2c: rcar: fix NACK handling when being a target
| * 53336f3367 i2c: mux: demux-pinctrl: check initial mux selection, too
| * 4c833c3652 Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
| * 79fe53ed76 hwmon: (tmp513) Fix division of negative numbers
| * 2a1c88f7ca drm/v3d: Ensure job pointer is set to NULL after job completion
| * efc92a260e net/mlx5: Clear port select structure when fail to create
| * edb43b46a2 net/mlx5: Fix RDMA TX steering prio
| * 207c81e2ec net: xilinx: axienet: Fix IRQ coalescing packet count overflow
| * c385389ab0 nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
| * efec287cba gtp: Destroy device along with udp socket's netns dismantle.
| * c91e694619 gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
| * a3fdd5f3d6 gtp: use exit_batch_rtnl() method
| * 760f415e08 net: add exit_batch_rtnl() method
| * e5d24a7074 pktgen: Avoid out-of-bounds access in get_imix_entries
| * ea9e990356 openvswitch: fix lockup on tx to unregistering netdev with carrier
| * d0a3b3d117 bpf: Fix bpf_sk_select_reuseport() memory leak
| * 075248178c net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
* | 766d61c1b6 Merge branch 'android14-6.1' into android14-6.1-lts
* | 12fe448232 Merge 6.1.126 into android14-6.1-lts
|\|
| * f4f677285b Linux 6.1.126
| * f6247d3e3f Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals
* | 3ad3cca387 Merge 6.1.125 into android14-6.1-lts
|\|
| * 60ceadf924 Linux 6.1.125
| * 9734fd7a27 xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
| * d208571943 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
| * 90d4d2718e drm: bridge: adv7511: use dev_err_probe in probe function
| * 2d43119248 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
| * 18a1cd923b ocfs2: correct return value of ocfs2_local_free_info()
| * ad9ec26aba of: address: Preserve the flags portion on 1:1 dma-ranges mapping
| * 007662f785 of: address: Store number of bus flag cells rather than bool
| * 7eb954ec96 of: address: Remove duplicated functions
| * 30eb1123b2 of: address: Fix address translation when address-size is greater than 2
| * 46dfdb0f93 of/address: Add support for 3 address cell bus
| * 57e3220c28 of: unittest: Add bus address range parsing tests
| * 40153aae1c arm64: dts: rockchip: add hevc power domain clock to rk3328
| * 2550149fcd block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
| * 64b0aebed9 ARM: dts: imxrt1050: Fix clocks for mmc
| * 6b63308c28 io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
| * 3e871c1d51 iio: adc: ad7124: Disable all channels at probe time
| * 6c92d6f2c7 iio: inkern: call iio_device_put() only on mapped devices
| * 25ef52f1c1 iio: adc: at91: call input_free_device() on allocated iio_dev
| * 26016d08c4 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
| * 7bc7e9d6bd iio: gyro: fxas21002c: Fix missing data update in trigger handler
| * ebe2672bc4 iio: adc: ti-ads8688: fix information leak in triggered buffer
| * 6985ba4467 iio: imu: kmx61: fix information leak in triggered buffer
| * 47d245be86 iio: light: vcnl4035: fix information leak in triggered buffer
| * b0642d9c87 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
| * b7849f62e6 iio: pressure: zpa2326: fix information leak in triggered buffer
| * 82f60f3600 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
| * 9981c33aae usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
| * dc51b66ec2 usb: fix reference leak in usb_new_device()
| * c6f763b54c USB: core: Disable LPM only for non-suspended ports
| * 39219c2611 USB: usblp: return error when setting unsupported protocol
| * 92a185bf7e usb: dwc3-am62: Disable autosuspend during remove
| * 3d730e8758 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
| * d26b9f0b99 misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
| * 79aef6187e misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
| * ca47e933a9 topology: Keep the cpumask unchanged when printing cpumap
| * 20a5725627 usb: dwc3: gadget: fix writing NYET threshold
| * 32af3bcca3 USB: serial: cp210x: add Phoenix Contact UPS Device
| * 65cb57b9f1 usb-storage: Add max sectors quirk for Nokia 208
| * 78e8abbdf7 staging: iio: ad9832: Correct phase range check
| * 331e6e9fb0 staging: iio: ad9834: Correct phase range check
| * c712fa6158 USB: serial: option: add Neoway N723-EA support
| * fb94621286 USB: serial: option: add MeiG Smart SRM815
* | afc952d5b1 Merge 43f4df339a ("bpf: Fix overloading of MEM_UNINIT's meaning") into android14-6.1-lts
|\|
| * 43f4df339a bpf: Fix overloading of MEM_UNINIT's meaning
* | 22d4625eb5 Merge 2a72b2ce9e ("bpf: Add MEM_WRITE attribute") into android14-6.1-lts
|\|
| * 2a72b2ce9e bpf: Add MEM_WRITE attribute
* | b3b3e04dad Merge 6bc6ee3111 ("dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)") into android14-6.1-lts
|\|
| * 6bc6ee3111 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
| * e3ce913a32 drm/amd/display: increase MAX_SURFACES to the value supported by hw
| * abe587a4eb ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
| * 88b9cf8f11 ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
| * c21df31fc2 riscv: Fix sleeping in invalid context in die()
| * d0645e1114 thermal: of: fix OF node leak in of_thermal_zone_find()
| * f3d1e4062e drm/amd/display: Add check for granularity in dml ceil/floor helpers
| * 44ee863592 sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
| * e919197fb8 sctp: sysctl: udp_port: avoid using current->nsproxy
| * 1b67030d39 sctp: sysctl: auth_enable: avoid using current->nsproxy
| * 4059507e34 sctp: sysctl: rto_min/max: avoid using current->nsproxy
| * 3cd0659deb sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
* | c0e2451628 Merge c0dde4a52b ("dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY") into android14-6.1-lts
|/
* c0dde4a52b dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
* 12771050b6 dm thin: make get_first_thin use rcu-safe list first function
* bb87b494ae cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
* 13e41c58c7 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
* aabe47cf5a afs: Fix the maximum cell name length
* ee7e40f7fb ksmbd: fix a missing return value check bug
* f05f5ab5e7 drm/mediatek: Add return value check when reading DPCD
* 4e6749237d drm/mediatek: Fix mode valid issue for dp
* e0ad4b014c drm/mediatek: Fix YCbCr422 color format issue for DP
* 21c501e66a drm/mediatek: stop selecting foreign drivers
* f0a2808767 net/mlx5: Fix variable not being completed when function returns
* a777e06dfc sched: sch_cake: add bounds checks to host bulk flow fairness counts
* 5552b4fd44 netfilter: conntrack: clamp maximum hashtable size to INT_MAX
* d470b92593 netfilter: nf_tables: imbalance in flowtable binding
* 636d7b95c2 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
* faa8a33e86 Bluetooth: hci_sync: Fix not setting Random Address when required
* ecb1356a97 tls: Fix tls_sw_sendmsg error handling
* 657a87c2a0 ice: fix incorrect PHY settings for 100 GB/s
* 8a7b73f19f cxgb4: Avoid removal of uninserted tid
* b958283830 bnxt_en: Fix possible memory leak when hwrm_req_replace fails
* 2011749ca9 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
* 2d230410a9 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
* c0b0d9ae36 tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
* 0a5026be1a net: 802: LLC+SNAP OID:PID lookup on start of skb data
* 4589abf8c4 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
* f6dce4dc12 ASoC: mediatek: disable buffer pre-allocation
* 939d239fe8 scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
* d23f2621fc exfat: fix the infinite loop in __exfat_free_cluster()
* 31beabd0f4 exfat: fix the infinite loop in exfat_readdir()
* 43c38c3b73 dm array: fix cursor index when skipping across block boundaries
* 956a74b22d dm array: fix unreleased btree blocks on closing a faulty array cursor
* e477021d25 dm array: fix releasing a faulty array block twice in dm_array_cursor_end
* 5af095cb86 jbd2: flush filesystem device before updating tail sequence
* 62834f5bf5 jbd2: increase IO priority for writing revoke records
* 397383db9c sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
* b79a0d1e9a bpf, sockmap: Fix race between element replace and close()
* e4b168c64d ceph: give up on paths longer than PATH_MAX

Change-Id: Ia18514bdd4d67e9850b55a4637d0fbe4a138658f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-02-22 02:15:06 -08:00
Kyle Tso
52a41f0bf1 ANDROID: usb: typec: tcpci: Combine the parameters of set_auto_vbus_discharge_threshold
The change Ifdb1ba19f7147da286ea5e044e84dfb679050a94 ("FROMGIT: usb:
typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS") breaks the KMI. Prevent the breakage by combining the parameters
"requested_vbus_voltage" and "pps_apdo_min_voltage" to a single u32
variable whose value is selected according to the values of parameter
"mode" and parameter "pps_active".

Bug: 388029777
Change-Id: I85872b9490561d248169bc8e008f3d907cc6c3c0
Signed-off-by: Kyle Tso <kyletso@google.com>
2025-02-21 11:14:03 -08:00
Kyle Tso
f84d5a5fad FROMGIT: usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
The Source can drop its output voltage to the minimum of the requested
PPS APDO voltage range when it is in Current Limit Mode. If this voltage
falls within the range of vPpsShutdown, the Source initiates a Hard
Reset and discharges Vbus. However, currently the Sink may disconnect
before the voltage reaches vPpsShutdown, leading to unexpected behavior.

Prevent premature disconnection by setting the Sink's disconnect
threshold to the minimum vPpsShutdown value. Additionally, consider the
voltage drop due to IR drop when calculating the appropriate threshold.
This ensures a robust and reliable interaction between the Source and
Sink during SPR PPS Current Limit Mode operation.

Fixes: 4288debeaa ("usb: typec: tcpci: Fix up sink disconnect thresholds for PD")
Cc: stable <stable@kernel.org>
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20250114142435.2093857-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 388029777
(cherry picked from commit 4d27afbf256028a1f54363367f30efc8854433c3
 https: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/
 usb-next)
Change-Id: Ifdb1ba19f7147da286ea5e044e84dfb679050a94
Signed-off-by: Kyle Tso <kyletso@google.com>
2025-02-21 11:14:03 -08:00
Robin Murphy
b3847b6622 iommu/arm-smmu-v3: Clean up more on probe failure
[ Upstream commit fcbd621567420b3a2f21f49bbc056de8b273c625 ]

kmemleak noticed that the iopf queue allocated deep down within
arm_smmu_init_structures() can be leaked by a subsequent error return
from arm_smmu_device_probe(). Furthermore, after arm_smmu_device_reset()
we will also leave the SMMU enabled with an empty Stream Table, silently
blocking all DMA. This proves rather annoying for debugging said probe
failure, so let's handle it a bit better by putting the SMMU back into
(more or less) the same state as if it hadn't probed at all.

Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/5137901958471cf67f2fad5c2229f8a8f1ae901a.1733406914.git.robin.murphy@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:33 +01:00
David Woodhouse
6821918f45 x86/kexec: Allocate PGD for x86_64 transition page tables separately
[ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]

Now that the following fix:

  d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")

stops kernel_ident_mapping_init() from scribbling over the end of a
4KiB PGD by assuming the following 4KiB will be a userspace PGD,
there's no good reason for the kexec PGD to be part of a single
8KiB allocation with the control_code_page.

( It's not clear that that was the reason for x86_64 kexec doing it that
  way in the first place either; there were no comments to that effect and
  it seems to have been the case even before PTI came along. It looks like
  it was just a happy accident which prevented memory corruption on kexec. )

Either way, it definitely isn't needed now. Just allocate the PGD
separately on x86_64, like i386 already does.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Link: https://lore.kernel.org/r/20241205153343.3275139-6-dwmw2@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:33 +01:00
Liu Ye
14fc53fb25 selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
[ Upstream commit 3a0b7fa095212b51ed63892540c4f249991a2d74 ]

Address Null pointer dereference / undefined behavior in rtattr_pack
(note that size is 0 in the bad case).

Flagged by cppcheck as:
    tools/testing/selftests/net/ipsec.c:230:25: warning: Possible null pointer
    dereference: payload [nullPointer]
    memcpy(RTA_DATA(attr), payload, size);
                           ^
    tools/testing/selftests/net/ipsec.c:1618:54: note: Calling function 'rtattr_pack',
    4th argument 'NULL' value is 0
    if (rtattr_pack(&req.nh, sizeof(req), XFRMA_IF_ID, NULL, 0)) {
                                                       ^
    tools/testing/selftests/net/ipsec.c:230:25: note: Null pointer dereference
    memcpy(RTA_DATA(attr), payload, size);
                           ^
Signed-off-by: Liu Ye <liuye@kylinos.cn>

Link: https://patch.msgid.link/20250116013037.29470-1-liuye@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:33 +01:00
Dan Carpenter
5328b25bbd tipc: re-order conditions in tipc_crypto_key_rcv()
[ Upstream commit 5fe71fda89745fc3cd95f70d06e9162b595c3702 ]

On a 32bit system the "keylen + sizeof(struct tipc_aead_key)" math could
have an integer wrapping issue.  It doesn't matter because the "keylen"
is checked on the next line, but just to make life easier for static
analysis tools, let's re-order these conditions and avoid the integer
overflow.

Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:33 +01:00
Yuanjie Yang
3a78d7c76b mmc: sdhci-msm: Correctly set the load for the regulator
[ Upstream commit 20a0c37e44063997391430c4ae09973e9cbc3911 ]

Qualcomm regulator supports two power supply modes: HPM and LPM.
Currently, the sdhci-msm.c driver does not set the load to adjust
the current for eMMC and SD. If the regulator dont't set correct
load in LPM state, it will lead to the inability to properly
initialize eMMC and SD.

Set the correct regulator current for eMMC and SD to ensure that the
device can work normally even when the regulator is in LPM.

Signed-off-by: Yuanjie Yang <quic_yuanjiey@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20250114083514.258379-1-quic_yuanjiey@quicinc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:33 +01:00
Maciej S. Szmigiero
0b5ccf9a4e net: wwan: iosm: Fix hibernation by re-binding the driver around it
[ Upstream commit 0b6f6593aa8c3a05f155c12fd0e7ad33a5149c31 ]

Currently, the driver is seriously broken with respect to the
hibernation (S4): after image restore the device is back into
IPC_MEM_EXEC_STAGE_BOOT (which AFAIK means bootloader stage) and needs
full re-launch of the rest of its firmware, but the driver restore
handler treats the device as merely sleeping and just sends it a
wake-up command.

This wake-up command times out but device nodes (/dev/wwan*) remain
accessible.
However attempting to use them causes the bootloader to crash and
enter IPC_MEM_EXEC_STAGE_CD_READY stage (which apparently means "a crash
dump is ready").

It seems that the device cannot be re-initialized from this crashed
stage without toggling some reset pin (on my test platform that's
apparently what the device _RST ACPI method does).

While it would theoretically be possible to rewrite the driver to tear
down the whole MUX / IPC layers on hibernation (so the bootloader does
not crash from improper access) and then re-launch the device on
restore this would require significant refactoring of the driver
(believe me, I've tried), since there are quite a few assumptions
hard-coded in the driver about the device never being partially
de-initialized (like channels other than devlink cannot be closed,
for example).
Probably this would also need some programming guide for this hardware.

Considering that the driver seems orphaned [1] and other people are
hitting this issue too [2] fix it by simply unbinding the PCI driver
before hibernation and re-binding it after restore, much like
USB_QUIRK_RESET_RESUME does for USB devices that exhibit a similar
problem.

Tested on XMM7360 in HP EliteBook 855 G7 both with s2idle (which uses
the existing suspend / resume handlers) and S4 (which uses the new code).

[1]: https://lore.kernel.org/all/c248f0b4-2114-4c61-905f-466a786bdebb@leemhuis.info/
[2]:
https://github.com/xmm7360/xmm7360-pci/issues/211#issuecomment-1804139413

Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Link: https://patch.msgid.link/e60287ebdb0ab54c4075071b72568a40a75d0205.1736372610.git.mail@maciej.szmigiero.name
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:33 +01:00
Mazin Al Haddad
75e65b983c Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
[ Upstream commit 26fbd3494a7dd26269cb0817c289267dbcfdec06 ]

This fixes the following crash:

==================================================================
BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543
Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961

CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543
 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 16026:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568
 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:726
 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 16022:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2338 [inline]
 slab_free mm/slub.c:4598 [inline]
 kfree+0x196/0x420 mm/slub.c:4746
 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550
 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
 hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
 sock_do_ioctl+0x158/0x460 net/socket.c:1209
 sock_ioctl+0x626/0x8e0 net/socket.c:1328
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=479aff51bb361ef5aa18
Tested-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com
Signed-off-by: Mazin Al Haddad <mazin@getstate.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Borislav Petkov
87fc26b018 APEI: GHES: Have GHES honor the panic= setting
[ Upstream commit 5c0e00a391dd0099fe95991bb2f962848d851916 ]

The GHES driver overrides the panic= setting by force-rebooting the
system after a fatal hw error has been reported. The intent being that
such an error would be reported earlier.

However, this is not optimal when a hard-to-debug issue requires long
time to reproduce and when that happens, the box will get rebooted after
30 seconds and thus destroy the whole hw context of when the error
happened.

So rip out the default GHES panic timeout and honor the global one.

In the panic disabled (panic=0) case, the error will still be logged to
dmesg for later inspection and if panic after a hw error is really
required, then that can be controlled the usual way - use panic= on the
cmdline or set it in the kernel .config's CONFIG_PANIC_TIMEOUT.

Reported-by: Feng Tang <feng.tang@linux.alibaba.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Feng Tang <feng.tang@linux.alibaba.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Link: https://patch.msgid.link/20250113125224.GFZ4UMiNtWIJvgpveU@fat_crate.local
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Randolph Ha
f2e5a46a27 i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
[ Upstream commit bfd74cd1fbc026f04446e67d6915c7e199c2bffd ]

When a 400KHz freq is used on this model of ELAN touchpad in Linux,
excessive smoothing (similar to when the touchpad's firmware detects
a noisy signal) is sometimes applied. As some devices' (e.g, Lenovo
V15 G4) ACPI tables specify a 400KHz frequency for this device and
some I2C busses (e.g, Designware I2C) default to a 400KHz freq,
force the speed to 100KHz as a workaround.

For future investigation: This problem may be related to the default
HCNT/LCNT values given by some busses' drivers, because they are not
specified in the aforementioned devices' ACPI tables, and because
the device works without issues on Windows at what is expected to be
a 400KHz frequency. The root cause of the issue is not known.

Signed-off-by: Randolph Ha <rha051117@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Miri Korenblit
7ce13d8b59 wifi: iwlwifi: avoid memory leak
[ Upstream commit 80e96206a3ef348fbd658d98f2f43149c36df8bc ]

A caller of iwl_acpi_get_dsm_object must free the returned object.
iwl_acpi_get_dsm_integer returns immediately without freeing
it if the expected size is more than 8 bytes. Fix that.

Note that with the current code this will never happen, since the caller
of iwl_acpi_get_dsm_integer already checks that the expected size if
either 1 or 4 bytes, so it can't exceed 8 bytes.

While at it, print the DSM value instead of the return value, as this
was the intention in the first place.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Stefan Dösinger
af525a8b2a wifi: brcmfmac: Check the return value of of_property_read_string_index()
[ Upstream commit 082d9e263af8de68f0c34f67b251818205160f6e ]

Somewhen between 6.10 and 6.11 the driver started to crash on my
MacBookPro14,3. The property doesn't exist and 'tmp' remains
uninitialized, so we pass a random pointer to devm_kstrdup().

The crash I am getting looks like this:

BUG: unable to handle page fault for address: 00007f033c669379
PF: supervisor read access in kernel mode
PF: error_code(0x0001) - permissions violation
PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025
Oops: Oops: 0001 [#1] SMP PTI
CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1
Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024
RIP: 0010:strlen+0x4/0x30
Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc
RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202
RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001
RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379
RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a
R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8
R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30
FS:  00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ? __die+0x23/0x70
 ? page_fault_oops+0x149/0x4c0
 ? raw_spin_rq_lock_nested+0xe/0x20
 ? sched_balance_newidle+0x22b/0x3c0
 ? update_load_avg+0x78/0x770
 ? exc_page_fault+0x6f/0x150
 ? asm_exc_page_fault+0x26/0x30
 ? __pfx_pci_conf1_write+0x10/0x10
 ? strlen+0x4/0x30
 devm_kstrdup+0x25/0x70
 brcmf_of_probe+0x273/0x350 [brcmfmac]

Signed-off-by: Stefan Dösinger <stefan@codeweavers.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20250106170958.3595-1-stefan@codeweavers.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Vadim Fedorenko
67adfca904 net/mlx5: use do_aux_work for PHC overflow checks
[ Upstream commit e61e6c415ba9ff2b32bb6780ce1b17d1d76238f1 ]

The overflow_work is using system wq to do overflow checks and updates
for PHC device timecounter, which might be overhelmed by other tasks.
But there is dedicated kthread in PTP subsystem designed for such
things. This patch changes the work queue to proper align with PTP
subsystem and to avoid overloading system work queue.
The adjfine() function acts the same way as overflow check worker,
we can postpone ptp aux worker till the next overflow period after
adjfine() was called.

Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
Acked-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250107104812.380225-1-vadfed@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Even Xu
408c7704ce HID: Wacom: Add PCI Wacom device support
[ Upstream commit c4c123504a65583e3689b3de04a61dc5272e453a ]

Add PCI device ID of wacom device into driver support list.

Signed-off-by: Even Xu <even.xu@intel.com>
Tested-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:32 +01:00
Hans de Goede
abf856bd8e mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
[ Upstream commit 1e89d21f8189d286f80b900e1b7cf57cb1f3037e ]

On N4100 / N4120 Gemini Lake SoCs the ISA bridge PCI device-id is 31e8
rather the 3197 found on e.g. the N4000 / N4020.

While at fix the existing GLK PCI-id table entry breaking the table
being sorted by device-id.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20241114193808.110132-1-hdegoede@redhat.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:31 +01:00
Tetsuo Handa
a01c200fa7 tomoyo: don't emit warning in tomoyo_write_control()
[ Upstream commit 3df7546fc03b8f004eee0b9e3256369f7d096685 ]

syzbot is reporting too large allocation warning at tomoyo_write_control(),
for one can write a very very long line without new line character. To fix
this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE,
for practically a valid line should be always shorter than 32KB where the
"too small to fail" memory-allocation rule applies.

One might try to write a valid line that is longer than 32KB, but such
request will likely fail with -ENOMEM. Therefore, I feel that separately
returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant.
There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.

Reported-by: syzbot+7536f77535e5210a5c76@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7536f77535e5210a5c76
Reported-by: Leo Stone <leocstone@gmail.com>
Closes: https://lkml.kernel.org/r/20241216021459.178759-2-leocstone@gmail.com
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:31 +01:00
Dmitry Antipov
ada9df08b3 wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
[ Upstream commit 3f4a0948c3524ae50f166dbc6572a3296b014e62 ]

In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN()
instead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access.
Compile tested only.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241210070441.836362-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:31 +01:00
Shawn Lin
d795108824 mmc: core: Respect quirk_max_rate for non-UHS SDIO card
[ Upstream commit a2a44f8da29352f76c99c6904ee652911b8dc7dd ]

The card-quirk was added to limit the clock-rate for a card with UHS-mode
support, although let's respect the quirk for non-UHS mode too, to make the
behaviour consistent.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Message-ID: <1732268242-72799-1-git-send-email-shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:31 +01:00