Commit Graph

1878 Commits

Author SHA1 Message Date
Tao Huang
cc17504307 Merge tag 'android12-5.10-2023-02_r1' of https://android.googlesource.com/kernel/common
android12-5.10 February 2023 release 1

Artifacts:
  https://ci.android.com/builds/submitted/9611440/kernel_aarch64/latest

* tag 'android12-5.10-2023-02_r1': (5560 commits)
  ANDROID: GKI: Enable ARM64_ERRATUM_2454944
  ANDROID: dma-ops: Add restricted vendor hook
  ANDROID: arm64: Work around Cortex-A510 erratum 2454944
  ANDROID: mm/vmalloc: Add override for lazy vunmap
  ANDROID: cpuidle-psci: Fix suspicious RCU usage
  ANDROID: ABI: update allowed list for galaxy
  FROMGIT: f2fs: add sysfs nodes to set last_age_weight
  FROMGIT: f2fs: fix wrong calculation of block age
  ANDROID: struct io_uring ABI preservation hack for 5.10.162 changes
  ANDROID: fix up struct task_struct ABI change in 5.10.162
  ANDROID: add flags variable back to struct proto_ops
  UPSTREAM: io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups
  UPSTREAM: eventfd: provide a eventfd_signal_mask() helper
  UPSTREAM: eventpoll: add EPOLL_URING_WAKE poll wakeup flag
  UPSTREAM: Revert "proc: don't allow async path resolution of /proc/self components"
  UPSTREAM: Revert "proc: don't allow async path resolution of /proc/thread-self components"
  UPSTREAM: net: remove cmsg restriction from io_uring based send/recvmsg calls
  UPSTREAM: task_work: unconditionally run task_work from get_signal()
  UPSTREAM: signal: kill JOBCTL_TASK_WORK
  UPSTREAM: io_uring: import 5.15-stable io_uring
  ...

Change-Id: I2b16474d6e3a91f1d702486ec6d1565a7bc310e3

Conflicts:
	Documentation/ABI/testing/configfs-usb-gadget-uac2
	Documentation/usb/gadget-testing.rst
	Makefile
	arch/arm/boot/dts/rk3288-evb-act8846.dts
	arch/arm64/mm/Makefile
	drivers/dma-buf/dma-buf.c
	drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
	drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
	drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
	drivers/gpu/drm/rockchip/rockchip_drm_vop.c
	drivers/mmc/core/mmc.c
	drivers/pci/controller/dwc/pcie-designware-host.c
	drivers/pinctrl/pinctrl-rockchip.c
	drivers/regulator/core.c
	drivers/usb/dwc3/ep0.c
	drivers/usb/dwc3/gadget.c
	drivers/usb/gadget/function/f_hid.c
	drivers/usb/gadget/function/f_uac1.c
	drivers/usb/gadget/function/f_uac2.c
	drivers/usb/gadget/function/u_audio.c
	drivers/usb/gadget/function/u_audio.h
	drivers/usb/gadget/function/u_uac2.h
	drivers/usb/host/xhci.h
	drivers/usb/storage/unusual_uas.h
	drivers/usb/typec/altmodes/displayport.c
	include/linux/page_ext.h
	mm/cma.c
	mm/page_ext.c
	sound/core/pcm_dmaengine.c
	sound/soc/codecs/hdmi-codec.c
	include/linux/stmmac.h
	sound/drivers/aloop.c
	drivers/pci/controller/dwc/pcie-designware.h
2023-03-14 09:44:51 +08:00
Greg Kroah-Hartman
01ef2d0b53 Merge 5.10.159 into android12-5.10-lts
Changes in 5.10.159
	arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
	arm: dts: rockchip: fix node name for hym8563 rtc
	ARM: dts: rockchip: fix ir-receiver node names
	arm64: dts: rockchip: fix ir-receiver node names
	ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
	ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
	ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
	ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
	ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
	9p/fd: Use P9_HDRSZ for header size
	regulator: slg51000: Wait after asserting CS pin
	ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
	btrfs: send: avoid unaligned encoded writes when attempting to clone range
	ASoC: soc-pcm: Add NULL check in BE reparenting
	regulator: twl6030: fix get status of twl6032 regulators
	fbcon: Use kzalloc() in fbcon_prepare_logo()
	usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer
	9p/xen: check logical size for buffer size
	net: usb: qmi_wwan: add u-blox 0x1342 composition
	mm/khugepaged: take the right locks for page table retraction
	mm/khugepaged: fix GUP-fast interaction by sending IPI
	mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
	rtc: mc146818: Prevent reading garbage
	rtc: mc146818: Detect and handle broken RTCs
	rtc: mc146818: Dont test for bit 0-5 in Register D
	rtc: cmos: remove stale REVISIT comments
	rtc: mc146818-lib: change return values of mc146818_get_time()
	rtc: Check return value from mc146818_get_time()
	rtc: mc146818-lib: fix RTC presence check
	rtc: mc146818-lib: extract mc146818_avoid_UIP
	rtc: cmos: avoid UIP when writing alarm time
	rtc: cmos: avoid UIP when reading alarm time
	rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ
	rtc: mc146818: Reduce spinlock section in mc146818_set_time()
	xen/netback: Ensure protocol headers don't fall in the non-linear area
	xen/netback: do some code cleanup
	xen/netback: don't call kfree_skb() with interrupts disabled
	media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
	Revert "ARM: dts: imx7: Fix NAND controller size-cells"
	media: v4l2-dv-timings.c: fix too strict blanking sanity checks
	memcg: fix possible use-after-free in memcg_write_event_control()
	mm/gup: fix gup_pud_range() for dax
	Bluetooth: btusb: Add debug message for CSR controllers
	Bluetooth: Fix crash when replugging CSR fake controllers
	KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
	drm/vmwgfx: Don't use screen objects when SEV is active
	drm/shmem-helper: Remove errant put in error path
	drm/shmem-helper: Avoid vm_open error paths
	HID: usbhid: Add ALWAYS_POLL quirk for some mice
	HID: hid-lg4ff: Add check for empty lbuf
	HID: core: fix shift-out-of-bounds in hid_report_raw_event
	can: af_can: fix NULL pointer dereference in can_rcv_filter
	mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
	rtc: cmos: Disable irq around direct invocation of cmos_interrupt()
	rtc: mc146818-lib: fix locking in mc146818_set_time
	rtc: mc146818-lib: fix signedness bug in mc146818_get_time()
	netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
	ieee802154: cc2520: Fix error return code in cc2520_hw_init()
	ca8210: Fix crash by zero initializing data
	netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
	drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
	gpio: amd8111: Fix PCI device reference count leak
	e1000e: Fix TX dispatch condition
	igb: Allocate MSI-X vector when testing
	drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420
	af_unix: Get user_ns from in_skb in unix_diag_get_exact().
	vmxnet3: correctly report encapsulated LRO packet
	Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
	Bluetooth: Fix not cleanup led when bt_init fails
	net: dsa: ksz: Check return value
	selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
	net: encx24j600: Add parentheses to fix precedence
	net: encx24j600: Fix invalid logic in reading of MISTAT register
	xen-netfront: Fix NULL sring after live migration
	net: mvneta: Prevent out of bounds read in mvneta_config_rss()
	i40e: Fix not setting default xps_cpus after reset
	i40e: Fix for VF MAC address 0
	i40e: Disallow ip4 and ip6 l4_4_bytes
	NFC: nci: Bounds check struct nfc_target arrays
	nvme initialize core quirks before calling nvme_init_subsystem
	net: stmmac: fix "snps,axi-config" node property parsing
	ip_gre: do not report erspan version on GRE interface
	net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
	net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
	net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
	tipc: Fix potential OOB in tipc_link_proto_rcv()
	ipv4: Fix incorrect route flushing when source address is deleted
	ipv4: Fix incorrect route flushing when table ID 0 is used
	net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
	tipc: call tipc_lxc_xmit without holding node_read_lock
	ethernet: aeroflex: fix potential skb leak in greth_init_rings()
	xen/netback: fix build warning
	net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
	ipv6: avoid use-after-free in ip6_fragment()
	net: mvneta: Fix an out of bounds check
	macsec: add missing attribute validation for offload
	can: esd_usb: Allow REC and TEC to return to zero
	Linux 5.10.159

Change-Id: I3ec26473c358ffda0ea8a8dd91ee265f58739029
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2022-12-14 13:11:31 +01:00
Ismael Ferreras Morezuelas
380d183e99 Bluetooth: btusb: Add debug message for CSR controllers
commit 955aebd445 upstream.

The rationale of showing this is that it's potentially critical
information to diagnose and find more CSR compatibility bugs in the
future and it will save a lot of headaches.

Given that clones come from a wide array of vendors (some are actually
Barrot, some are something else) and these numbers are what let us find
differences between actual and fake ones, it will be immensely helpful
to scour the Internet looking for this pattern and building an actual
database to find correlations and improve the checks.

Cc: stable@vger.kernel.org
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-14 11:31:58 +01:00
Greg Kroah-Hartman
0b500f5b16 Merge 5.10.150 into android12-5.10-lts
Changes in 5.10.150
	ALSA: oss: Fix potential deadlock at unregistration
	ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
	ALSA: usb-audio: Fix potential memory leaks
	ALSA: usb-audio: Fix NULL dererence at error path
	ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
	ALSA: hda/realtek: Correct pin configs for ASUS G533Z
	ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
	ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
	mtd: rawnand: atmel: Unmap streaming DMA mappings
	cifs: destage dirty pages before re-reading them for cache=none
	cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
	iio: dac: ad5593r: Fix i2c read protocol requirements
	iio: ltc2497: Fix reading conversion results
	iio: adc: ad7923: fix channel readings for some variants
	iio: pressure: dps310: Refactor startup procedure
	iio: pressure: dps310: Reset chip after timeout
	usb: add quirks for Lenovo OneLink+ Dock
	can: kvaser_usb: Fix use of uninitialized completion
	can: kvaser_usb_leaf: Fix overread with an invalid command
	can: kvaser_usb_leaf: Fix TX queue out of sync after restart
	can: kvaser_usb_leaf: Fix CAN state after restart
	mmc: sdhci-sprd: Fix minimum clock limit
	fs: dlm: fix race between test_bit() and queue_work()
	fs: dlm: handle -EBUSY first in lock arg validation
	HID: multitouch: Add memory barriers
	quota: Check next/prev free block number after reading from quota file
	platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
	ASoC: wcd9335: fix order of Slimbus unprepare/disable
	ASoC: wcd934x: fix order of Slimbus unprepare/disable
	hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
	regulator: qcom_rpm: Fix circular deferral regression
	RISC-V: Make port I/O string accessors actually work
	parisc: fbdev/stifb: Align graphics memory size to 4MB
	riscv: Allow PROT_WRITE-only mmap()
	riscv: Make VM_WRITE imply VM_READ
	riscv: Pass -mno-relax only on lld < 15.0.0
	UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	nvme-pci: set min_align_mask before calculating max_hw_sectors
	drm/virtio: Check whether transferred 2D BO is shmem
	drm/udl: Restore display mode on resume
	block: fix inflight statistics of part0
	mm/mmap: undo ->mmap() when arch_validate_flags() fails
	PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
	powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
	powerpc/boot: Explicitly disable usage of SPE instructions
	scsi: qedf: Populate sysfs attributes for vport
	fbdev: smscufx: Fix use-after-free in ufx_ops_open()
	btrfs: fix race between quota enable and quota rescan ioctl
	f2fs: increase the limit for reserve_root
	f2fs: fix to do sanity check on destination blkaddr during recovery
	f2fs: fix to do sanity check on summary info
	hardening: Clarify Kconfig text for auto-var-init
	hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
	hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
	jbd2: wake up journal waiters in FIFO order, not LIFO
	jbd2: fix potential buffer head reference count leak
	jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
	jbd2: add miss release buffer head in fc_do_one_pass()
	ext4: avoid crash when inline data creation follows DIO write
	ext4: fix null-ptr-deref in ext4_write_info
	ext4: make ext4_lazyinit_thread freezable
	ext4: fix check for block being out of directory size
	ext4: don't increase iversion counter for ea_inodes
	ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
	ext4: place buffer head allocation before handle start
	ext4: fix miss release buffer head in ext4_fc_write_inode
	ext4: fix potential memory leak in ext4_fc_record_modified_inode()
	ext4: fix potential memory leak in ext4_fc_record_regions()
	ext4: update 'state->fc_regions_size' after successful memory allocation
	livepatch: fix race between fork and KLP transition
	ftrace: Properly unset FTRACE_HASH_FL_MOD
	ring-buffer: Allow splice to read previous partially read pages
	ring-buffer: Have the shortest_full queue be the shortest not longest
	ring-buffer: Check pending waiters when doing wake ups as well
	ring-buffer: Add ring_buffer_wake_waiters()
	ring-buffer: Fix race between reset page and reading page
	tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
	thunderbolt: Explicitly enable lane adapter hotplug events at startup
	efi: libstub: drop pointless get_memory_map() call
	media: cedrus: Set the platform driver data earlier
	KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
	KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
	KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
	staging: greybus: audio_helper: remove unused and wrong debugfs usage
	drm/nouveau/kms/nv140-: Disable interlacing
	drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
	drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
	drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
	smb3: must initialize two ACL struct fields to zero
	selinux: use "grep -E" instead of "egrep"
	userfaultfd: open userfaultfds with O_RDONLY
	sh: machvec: Use char[] for section boundaries
	MIPS: SGI-IP27: Free some unused memory
	MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
	ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
	ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
	objtool: Preserve special st_shndx indexes in elf_update_symbol
	nfsd: Fix a memory leak in an error handling path
	wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
	leds: lm3601x: Don't use mutex after it was destroyed
	wifi: mac80211: allow bw change during channel switch in mesh
	bpftool: Fix a wrong type cast in btf_dumper_int
	spi: mt7621: Fix an error message in mt7621_spi_probe()
	x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
	Bluetooth: btusb: Fine-tune mt7663 mechanism.
	Bluetooth: btusb: fix excessive stack usage
	Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
	wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
	selftests/xsk: Avoid use-after-free on ctx
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
	wifi: rtl8xxxu: Fix skb misuse in TX queue selection
	spi: meson-spicc: do not rely on busy flag in pow2 clk ops
	bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
	wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
	wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
	net: fs_enet: Fix wrong check in do_pd_setup
	bpf: Ensure correct locking around vulnerable function find_vpid()
	Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
	wifi: ath11k: fix number of VHT beamformee spatial streams
	x86/microcode/AMD: Track patch allocation size explicitly
	x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
	spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
	spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
	i2c: mlxbf: support lock mechanism
	Bluetooth: hci_core: Fix not handling link timeouts propertly
	netfilter: nft_fib: Fix for rpath check with VRF devices
	spi: s3c64xx: Fix large transfers with DMA
	wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
	vhost/vsock: Use kvmalloc/kvfree for larger packets.
	mISDN: fix use-after-free bugs in l1oip timer handlers
	sctp: handle the error returned from sctp_auth_asoc_init_active_key
	tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
	spi: Ensure that sg_table won't be used after being freed
	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
	bnx2x: fix potential memory leak in bnx2x_tpa_stop()
	net/ieee802154: reject zero-sized raw_sendmsg()
	once: add DO_ONCE_SLOW() for sleepable contexts
	net: mvpp2: fix mvpp2 debugfs leak
	drm: bridge: adv7511: fix CEC power down control register offset
	drm/bridge: Avoid uninitialized variable warning
	drm/mipi-dsi: Detach devices when removing the host
	drm/bridge: parade-ps8640: Fix regulator supply order
	drm/dp_mst: fix drm_dp_dpcd_read return value checks
	drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
	platform/chrome: fix double-free in chromeos_laptop_prepare()
	platform/chrome: fix memory corruption in ioctl
	ASoC: tas2764: Allow mono streams
	ASoC: tas2764: Drop conflicting set_bias_level power setting
	ASoC: tas2764: Fix mute/unmute
	platform/x86: msi-laptop: Fix old-ec check for backlight registering
	platform/x86: msi-laptop: Fix resource cleanup
	drm: fix drm_mipi_dbi build errors
	drm/bridge: megachips: Fix a null pointer dereference bug
	ASoC: rsnd: Add check for rsnd_mod_power_on
	ALSA: hda: beep: Simplify keep-power-at-enable behavior
	drm/omap: dss: Fix refcount leak bugs
	mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
	ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
	drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
	drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
	ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
	ALSA: dmaengine: increment buffer pointer atomically
	mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
	ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
	ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
	ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
	ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
	ALSA: hda/hdmi: Don't skip notification handling during PM operation
	memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
	memory: of: Fix refcount leak bug in of_get_ddr_timings()
	memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
	soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
	soc: qcom: smem_state: Add refcounting for the 'state->of_node'
	ARM: dts: turris-omnia: Fix mpp26 pin name and comment
	ARM: dts: kirkwood: lsxl: fix serial line
	ARM: dts: kirkwood: lsxl: remove first ethernet port
	ia64: export memory_add_physaddr_to_nid to fix cxl build error
	soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
	ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
	ARM: Drop CMDLINE_* dependency on ATAGS
	arm64: ftrace: fix module PLTs with mcount
	ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
	iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
	iio: adc: at91-sama5d2_adc: check return status for pressure and touch
	iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
	iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
	iio: inkern: only release the device node when done with it
	iio: ABI: Fix wrong format of differential capacitance channel ABI.
	usb: ch9: Add USB 3.2 SSP attributes
	usb: common: Parse for USB SSP genXxY
	usb: common: add function to get interval expressed in us unit
	usb: common: move function's kerneldoc next to its definition
	usb: common: debug: Check non-standard control requests
	clk: meson: Hold reference returned by of_get_parent()
	clk: oxnas: Hold reference returned by of_get_parent()
	clk: qoriq: Hold reference returned by of_get_parent()
	clk: berlin: Add of_node_put() for of_get_parent()
	clk: sprd: Hold reference returned by of_get_parent()
	clk: tegra: Fix refcount leak in tegra210_clock_init
	clk: tegra: Fix refcount leak in tegra114_clock_init
	clk: tegra20: Fix refcount leak in tegra20_clock_init
	HSI: omap_ssi: Fix refcount leak in ssi_probe
	HSI: omap_ssi_port: Fix dma_map_sg error check
	media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
	tty: xilinx_uartps: Fix the ignore_status
	media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
	media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
	RDMA/rxe: Fix "kernel NULL pointer dereference" error
	RDMA/rxe: Fix the error caused by qp->sk
	misc: ocxl: fix possible refcount leak in afu_ioctl()
	fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
	dmaengine: hisilicon: Disable channels when unregister hisi_dma
	dmaengine: hisilicon: Fix CQ head update
	dmaengine: hisilicon: Add multi-thread support for a DMA channel
	dyndbg: fix static_branch manipulation
	dyndbg: fix module.dyndbg handling
	dyndbg: let query-modname override actual module name
	dyndbg: drop EXPORTed dynamic_debug_exec_queries
	mtd: devices: docg3: check the return value of devm_ioremap() in the probe
	mtd: rawnand: fsl_elbc: Fix none ECC mode
	RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
	ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
	ata: fix ata_id_has_devslp()
	ata: fix ata_id_has_ncq_autosense()
	ata: fix ata_id_has_dipm()
	mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
	md: Replace snprintf with scnprintf
	md/raid5: Ensure stripe_fill happens on non-read IO with journal
	RDMA/cm: Use SLID in the work completion as the DLID in responder side
	IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
	xhci: Don't show warning for reinit on known broken suspend
	usb: gadget: function: fix dangling pnp_string in f_printer.c
	drivers: serial: jsm: fix some leaks in probe
	serial: 8250: Add an empty line and remove some useless {}
	serial: 8250: Toggle IER bits on only after irq has been set up
	tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
	phy: qualcomm: call clk_disable_unprepare in the error handling
	staging: vt6655: fix some erroneous memory clean-up loops
	firmware: google: Test spinlock on panic path to avoid lockups
	serial: 8250: Fix restoring termios speed after suspend
	scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
	scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
	clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
	fsi: core: Check error number after calling ida_simple_get
	mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
	mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
	mfd: lp8788: Fix an error handling path in lp8788_probe()
	mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
	mfd: fsl-imx25: Fix check for platform_get_irq() errors
	mfd: sm501: Add check for platform_driver_register()
	clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
	dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
	spmi: pmic-arb: correct duplicate APID to PPID mapping logic
	clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
	clk: baikal-t1: Fix invalid xGMAC PTP clock divider
	clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
	clk: baikal-t1: Add SATA internal ref clock buffer
	clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
	clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
	clk: ast2600: BCLK comes from EPLL
	mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
	powerpc/math_emu/efp: Include module.h
	powerpc/sysdev/fsl_msi: Add missing of_node_put()
	powerpc/pci_dn: Add missing of_node_put()
	powerpc/powernv: add missing of_node_put() in opal_export_attrs()
	x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
	powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
	powerpc: Fix SPE Power ISA properties for e500v1 platforms
	crypto: sahara - don't sleep when in softirq
	crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
	hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
	cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
	iommu/omap: Fix buffer overflow in debugfs
	crypto: akcipher - default implementation for setting a private key
	crypto: ccp - Release dma channels before dmaengine unrgister
	crypto: inside-secure - Change swab to swab32
	crypto: qat - fix use of 'dma_map_single'
	crypto: qat - use pre-allocated buffers in datapath
	crypto: qat - fix DMA transfer direction
	iommu/iova: Fix module config properly
	tracing: kprobe: Fix kprobe event gen test module on exit
	tracing: kprobe: Make gen test module work in arm and riscv
	kbuild: remove the target in signal traps when interrupted
	kbuild: rpm-pkg: fix breakage when V=1 is used
	crypto: marvell/octeontx - prevent integer overflows
	crypto: cavium - prevent integer overflow loading firmware
	thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
	ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
	f2fs: fix race condition on setting FI_NO_EXTENT flag
	f2fs: fix to avoid REQ_TIME and CP_TIME collision
	f2fs: fix to account FS_CP_DATA_IO correctly
	selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
	rcu: Back off upon fill_page_cache_func() allocation failure
	rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
	ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
	MIPS: BCM47XX: Cast memcmp() of function to (void *)
	powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
	thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
	x86/entry: Work around Clang __bdos() bug
	NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
	NFSD: fix use-after-free on source server when doing inter-server copy
	wifi: brcmfmac: fix invalid address access when enabling SCAN log level
	bpftool: Clear errno after libcap's checks
	openvswitch: Fix double reporting of drops in dropwatch
	openvswitch: Fix overreporting of drops in dropwatch
	tcp: annotate data-race around tcp_md5sig_pool_populated
	wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
	xfrm: Update ipcomp_scratches with NULL when freed
	wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
	regulator: core: Prevent integer underflow
	Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
	Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
	can: bcm: check the result of can_send() in bcm_can_tx()
	wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
	wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
	wifi: rt2x00: set VGC gain for both chains of MT7620
	wifi: rt2x00: set SoC wmac clock register
	wifi: rt2x00: correctly set BBP register 86 for MT7620
	net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
	Bluetooth: L2CAP: Fix user-after-free
	r8152: Rate limit overflow messages
	drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
	drm: Use size_t type for len variable in drm_copy_field()
	drm: Prevent drm_copy_field() to attempt copying a NULL pointer
	gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
	drm/amd/display: fix overflow on MIN_I64 definition
	udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
	drm: bridge: dw_hdmi: only trigger hotplug event on link change
	drm/vc4: vec: Fix timings for VEC modes
	drm: panel-orientation-quirks: Add quirk for Anbernic Win600
	platform/chrome: cros_ec: Notify the PM of wake events during resume
	platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
	ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
	drm/amdgpu: fix initial connector audio value
	drm/meson: explicitly remove aggregate driver at module unload time
	mmc: sdhci-msm: add compatible string check for sdm670
	drm/dp: Don't rewrite link config when setting phy test pattern
	drm/amd/display: Remove interface for periodic interrupt 1
	ARM: dts: imx7d-sdb: config the max pressure for tsc2046
	ARM: dts: imx6q: add missing properties for sram
	ARM: dts: imx6dl: add missing properties for sram
	ARM: dts: imx6qp: add missing properties for sram
	ARM: dts: imx6sl: add missing properties for sram
	ARM: dts: imx6sll: add missing properties for sram
	ARM: dts: imx6sx: add missing properties for sram
	kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
	arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
	btrfs: scrub: try to fix super block errors
	clk: zynqmp: Fix stack-out-of-bounds in strncpy`
	media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
	clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
	usb: host: xhci-plat: suspend and resume clocks
	usb: host: xhci-plat: suspend/resume clks for brcm
	scsi: 3w-9xxx: Avoid disabling device if failing to enable it
	nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
	power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
	staging: vt6655: fix potential memory leak
	blk-throttle: prevent overflow while calculating wait time
	ata: libahci_platform: Sanity check the DT child nodes number
	bcache: fix set_at_max_writeback_rate() for multiple attached devices
	soundwire: cadence: Don't overwrite msg->buf during write commands
	soundwire: intel: fix error handling on dai registration issues
	HID: roccat: Fix use-after-free in roccat_read()
	md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
	usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
	usb: musb: Fix musb_gadget.c rxstate overflow bug
	Revert "usb: storage: Add quirk for Samsung Fit flash"
	staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
	nvme: copy firmware_rev on each init
	nvmet-tcp: add bounds check on Transfer Tag
	usb: idmouse: fix an uninit-value in idmouse_open
	clk: bcm2835: Make peripheral PLLC critical
	perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
	arm64: topology: fix possible overflow in amu_fie_setup()
	io_uring: correct pinned_vm accounting
	io_uring/af_unix: defer registered files gc to io_uring release
	mm: hugetlb: fix UAF in hugetlb_handle_userfault
	net: ieee802154: return -EINVAL for unknown addr type
	Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
	net/ieee802154: don't warn zero-sized raw_sendmsg()
	Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega"
	Revert "drm/amdgpu: use dirty framebuffer helper"
	ext4: continue to expand file system when the target size doesn't reach
	inet: fully convert sk->sk_rx_dst to RCU rules
	thermal: intel_powerclamp: Use first online CPU as control_cpu
	f2fs: fix wrong condition to trigger background checkpoint correctly
	gcov: support GCC 12.1 and newer compilers
	Revert "drm/amdgpu: make sure to init common IP before gmc"
	Linux 5.10.150

Change-Id: I54f32f1f0149ec614c8bc7944e15adb5d80cd51a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2022-11-15 19:14:08 +00:00
Tetsuo Handa
d7cc0d51ff Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
[ Upstream commit 3124d320c2 ]

syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1],
for rcu_sync_enter() is called without rcu_sync_init() due to
hci_uart_tty_open() ignoring percpu_init_rwsem() failure.

While we are at it, fix that hci_uart_register_device() ignores
percpu_init_rwsem() failure and hci_uart_unregister_device() does not
call percpu_free_rwsem().

Link: https://syzkaller.appspot.com/bug?extid=576dfca25381fb6fbc5f [1]
Reported-by: syzbot <syzbot+576dfca25381fb6fbc5f@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 67d2f8781b ("Bluetooth: hci_ldisc: Allow sleeping while proto locks are held.")
Fixes: d73e172816 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:21 +02:00
Sean Wang
ea1b6b5409 Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
[ Upstream commit fd3f106677 ]

WMT cmd/event doesn't follow up the generic HCI cmd/event handling, it
needs constantly polling control pipe until the host received the WMT
event, thus, we should require to specifically acquire PM counter on the
USB to prevent the interface from entering auto suspended while WMT
cmd/event in progress.

Fixes: a1c49c434e ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices")
Co-developed-by: Jing Cai <jing.cai@mediatek.com>
Signed-off-by: Jing Cai <jing.cai@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:19 +02:00
Arnd Bergmann
07194ccbb1 Bluetooth: btusb: fix excessive stack usage
[ Upstream commit 10888140f0 ]

Enlarging the size of 'struct btmtk_hci_wmt_cmd' makes it no longer
fit on the kernel stack, as seen from this compiler warning:

drivers/bluetooth/btusb.c:3365:12: error: stack frame size of 1036 bytes in function 'btusb_mtk_hci_wmt_sync' [-Werror,-Wframe-larger-than=]

Change the function to dynamically allocate the buffer instead.
As there are other sleeping functions called from the same location,
using GFP_KERNEL should be fine here, and the runtime overhead should
not matter as this is rarely called.

Unfortunately, I could not figure out why the message size is
increased in the previous patch. Using dynamic allocation means
any size is possible now, but there is still a range check that
limits the total size (including the five-byte header) to 255
bytes, so whatever was intended there is now undone.

Fixes: 48c13301e6 ("Bluetooth: btusb: Fine-tune mt7663 mechanism.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Stable-dep-of: fd3f106677 ("Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:19 +02:00
Mark Chen
cdadf95435 Bluetooth: btusb: Fine-tune mt7663 mechanism.
[ Upstream commit 48c13301e6 ]

Fine-tune read register for mt7663/mt7921.
For mediatek chip spcific wmt protocol, we add more delay to send EP0
In-Token.

Signed-off-by: Mark Chen <Mark-YW.Chen@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Stable-dep-of: fd3f106677 ("Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:19 +02:00
Greg Kroah-Hartman
fbe6a13851 Merge 5.10.137 into android12-5.10-lts
Changes in 5.10.137
	Makefile: link with -z noexecstack --no-warn-rwx-segments
	x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
	Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"
	scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
	ALSA: bcd2000: Fix a UAF bug on the error path of probing
	ALSA: hda/realtek: Add quirk for Clevo NV45PZ
	ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
	wifi: mac80211_hwsim: fix race condition in pending packet
	wifi: mac80211_hwsim: add back erroneously removed cast
	wifi: mac80211_hwsim: use 32-bit skb cookie
	add barriers to buffer_uptodate and set_buffer_uptodate
	HID: wacom: Only report rotation for art pen
	HID: wacom: Don't register pad_input for touch switch
	KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
	KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case
	KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
	KVM: s390: pv: don't present the ecall interrupt twice
	KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value
	KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
	KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
	KVM: x86: Tag kvm_mmu_x86_module_init() with __init
	riscv: set default pm_power_off to NULL
	mm: Add kvrealloc()
	xfs: only set IOMAP_F_SHARED when providing a srcmap to a write
	xfs: fix I_DONTCACHE
	mm/mremap: hold the rmap lock in write mode when moving page table entries.
	ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
	ALSA: hda/cirrus - support for iMac 12,1 model
	ALSA: hda/realtek: Add quirk for another Asus K42JZ model
	ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED
	tty: vt: initialize unicode screen buffer
	vfs: Check the truncate maximum size in inode_newsize_ok()
	fs: Add missing umask strip in vfs_tmpfile
	thermal: sysfs: Fix cooling_device_stats_setup() error code path
	fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
	fbcon: Fix accelerated fbdev scrolling while logo is still shown
	usbnet: Fix linkwatch use-after-free on disconnect
	ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
	parisc: Fix device names in /proc/iomem
	parisc: Check the return value of ioremap() in lba_driver_probe()
	parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode
	drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error
	drm/vc4: hdmi: Disable audio if dmas property is present but empty
	drm/nouveau: fix another off-by-one in nvbios_addr
	drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend()
	drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime
	drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
	mtd: rawnand: arasan: Update NAND bus clock instead of system clock
	iio: light: isl29028: Fix the warning in isl29028_remove()
	scsi: sg: Allow waiting for commands to complete on removed device
	scsi: qla2xxx: Fix incorrect display of max frame size
	scsi: qla2xxx: Zero undefined mailbox IN registers
	fuse: limit nsec
	serial: mvebu-uart: uart2 error bits clearing
	md-raid: destroy the bitmap after destroying the thread
	md-raid10: fix KASAN warning
	media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator
	ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
	PCI: Add defines for normal and subtractive PCI bridges
	powerpc/fsl-pci: Fix Class Code of PCIe Root Port
	powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
	powerpc/powernv: Avoid crashing if rng is NULL
	MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	coresight: Clear the connection field properly
	usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
	USB: HCD: Fix URB giveback issue in tasklet function
	ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
	arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
	usb: dwc3: gadget: refactor dwc3_repare_one_trb
	usb: dwc3: gadget: fix high speed multiplier setting
	lockdep: Allow tuning tracing capacity constants.
	netfilter: nf_tables: do not allow SET_ID to refer to another table
	netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
	netfilter: nf_tables: do not allow RULE_ID to refer to another chain
	netfilter: nf_tables: fix null deref due to zeroed list head
	epoll: autoremove wakers even more aggressively
	x86: Handle idle=nomwait cmdline properly for x86_idle
	arm64: Do not forget syscall when starting a new thread.
	arm64: fix oops in concurrently setting insn_emulation sysctls
	ext2: Add more validity checks for inode counts
	genirq: Don't return error on missing optional irq_request_resources()
	irqchip/mips-gic: Only register IPI domain when SMP is enabled
	genirq: GENERIC_IRQ_IPI depends on SMP
	irqchip/mips-gic: Check the return value of ioremap() in gic_of_init()
	wait: Fix __wait_event_hrtimeout for RT/DL tasks
	ARM: dts: imx6ul: add missing properties for sram
	ARM: dts: imx6ul: change operating-points to uint32-matrix
	ARM: dts: imx6ul: fix keypad compatible
	ARM: dts: imx6ul: fix csi node compatible
	ARM: dts: imx6ul: fix lcdif node compatible
	ARM: dts: imx6ul: fix qspi node compatible
	ARM: dts: BCM5301X: Add DT for Meraki MR26
	spi: synquacer: Add missing clk_disable_unprepare()
	ARM: OMAP2+: display: Fix refcount leak bug
	ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks
	ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk
	ACPI: PM: save NVS memory for Lenovo G40-45
	ACPI: LPSS: Fix missing check in register_device_clock()
	arm64: dts: qcom: ipq8074: fix NAND node name
	arm64: dts: allwinner: a64: orangepi-win: Fix LED node name
	ARM: shmobile: rcar-gen2: Increase refcount for new reference
	firmware: tegra: Fix error check return value of debugfs_create_file()
	PM: hibernate: defer device probing when resuming from hibernation
	selinux: Add boundary check in put_entry()
	powerpc/64s: Disable stack variable initialisation for prom_init
	spi: spi-rspi: Fix PIO fallback on RZ platforms
	ARM: findbit: fix overflowing offset
	meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
	arm64: dts: renesas: beacon: Fix regulator node names
	ARM: bcm: Fix refcount leak in bcm_kona_smc_init
	ACPI: processor/idle: Annotate more functions to live in cpuidle section
	ARM: dts: imx7d-colibri-emmc: add cpu1 supply
	Input: atmel_mxt_ts - fix up inverted RESET handler
	soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values
	soc: amlogic: Fix refcount leak in meson-secure-pwrc.c
	arm64: dts: renesas: Fix thermal-sensors on single-zone sensors
	x86/pmem: Fix platform-device leak in error path
	ARM: dts: ast2500-evb: fix board compatible
	ARM: dts: ast2600-evb: fix board compatible
	hexagon: select ARCH_WANT_LD_ORPHAN_WARN
	arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1
	locking/lockdep: Fix lockdep_init_map_*() confusion
	soc: fsl: guts: machine variable might be unset
	block: fix infinite loop for invalid zone append
	ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg
	ARM: OMAP2+: Fix refcount leak in omapdss_init_of
	ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
	cpufreq: zynq: Fix refcount leak in zynq_get_revision
	regulator: qcom_smd: Fix pm8916_pldo range
	ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
	soc: qcom: ocmem: Fix refcount leak in of_get_ocmem
	soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register
	ARM: dts: qcom: pm8841: add required thermal-sensor-cells
	bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
	arm64: dts: mt7622: fix BPI-R64 WPS button
	arm64: tegra: Fix SDMMC1 CD on P2888
	erofs: avoid consecutive detection for Highmem memory
	blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
	hwmon: (drivetemp) Add module alias
	block: remove the request_queue to argument request based tracepoints
	blktrace: Trace remapped requests correctly
	regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
	soc: qcom: Make QCOM_RPMPD depend on PM
	arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment
	drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX
	nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
	selftests/seccomp: Fix compile warning when CC=clang
	thermal/tools/tmon: Include pthread and time headers in tmon.h
	dm: return early from dm_pr_call() if DM device is suspended
	pwm: sifive: Don't check the return code of pwmchip_remove()
	pwm: sifive: Simplify offset calculation for PWMCMP registers
	pwm: sifive: Ensure the clk is enabled exactly once per running PWM
	pwm: sifive: Shut down hardware only after pwmchip_remove() completed
	pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource()
	drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function
	drm/bridge: tc358767: Make sure Refclk clock are enabled
	ath10k: do not enforce interrupt trigger type
	drm/st7735r: Fix module autoloading for Okaya RH128128T
	wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
	ath11k: fix netdev open race
	drm/mipi-dbi: align max_chunk to 2 in spi_transfer
	ath11k: Fix incorrect debug_mask mappings
	drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
	drm/mediatek: Modify dsi funcs to atomic operations
	drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs
	drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
	i2c: npcm: Remove own slave addresses 2:10
	i2c: npcm: Correct slave role behavior
	virtio-gpu: fix a missing check to avoid NULL dereference
	drm: adv7511: override i2c address of cec before accessing it
	crypto: sun8i-ss - do not allocate memory when handling hash requests
	crypto: sun8i-ss - fix error codes in allocate_flows()
	net: fix sk_wmem_schedule() and sk_rmem_schedule() errors
	i2c: Fix a potential use after free
	crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs()
	media: tw686x: Register the irq at the end of probe
	ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
	wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
	drm/radeon: fix incorrrect SPDX-License-Identifiers
	test_bpf: fix incorrect netdev features
	crypto: ccp - During shutdown, check SEV data pointer before using
	drm: bridge: adv7511: Add check for mipi_dsi_driver_register
	drm/mcde: Fix refcount leak in mcde_dsi_bind
	media: hdpvr: fix error value returns in hdpvr_read
	media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set
	media: tw686x: Fix memory leak in tw686x_video_init
	drm/vc4: plane: Remove subpixel positioning check
	drm/vc4: plane: Fix margin calculations for the right/bottom edges
	drm/vc4: dsi: Correct DSI divider calculations
	drm/vc4: dsi: Correct pixel order for DSI0
	drm/vc4: drv: Remove the DSI pointer in vc4_drv
	drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array
	drm/vc4: dsi: Introduce a variant structure
	drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type
	drm/vc4: dsi: Fix dsi0 interrupt support
	drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration
	drm/vc4: hdmi: Remove firmware logic for MAI threshold setting
	drm/vc4: hdmi: Avoid full hdmi audio fifo writes
	drm/vc4: hdmi: Don't access the connector state in reset if kmalloc fails
	drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling
	drm/vc4: hdmi: Fix timings for interlaced modes
	drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes
	crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE
	selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0
	drm/rockchip: vop: Don't crash for invalid duplicate_state()
	drm/rockchip: Fix an error handling path rockchip_dp_probe()
	drm/mediatek: dpi: Remove output format of YUV
	drm/mediatek: dpi: Only enable dpi after the bridge is enabled
	drm: bridge: sii8620: fix possible off-by-one
	lib: bitmap: order includes alphabetically
	lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc()
	hinic: Use the bitmap API when applicable
	net: hinic: fix bug that ethtool get wrong stats
	net: hinic: avoid kernel hung in hinic_get_stats64()
	drm/msm/mdp5: Fix global state lock backoff
	crypto: hisilicon/sec - fixes some coding style
	crypto: hisilicon/sec - don't sleep when in softirq
	crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq
	media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
	mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
	mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
	drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed.
	tcp: make retransmitted SKB fit into the send window
	libbpf: Fix the name of a reused map
	selftests: timers: valid-adjtimex: build fix for newer toolchains
	selftests: timers: clocksource-switch: fix passing errors from child
	bpf: Fix subprog names in stack traces.
	fs: check FMODE_LSEEK to control internal pipe splicing
	wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
	wifi: p54: Fix an error handling path in p54spi_probe()
	wifi: p54: add missing parentheses in p54_flush()
	selftests/bpf: fix a test for snprintf() overflow
	can: pch_can: do not report txerr and rxerr during bus-off
	can: rcar_can: do not report txerr and rxerr during bus-off
	can: sja1000: do not report txerr and rxerr during bus-off
	can: hi311x: do not report txerr and rxerr during bus-off
	can: sun4i_can: do not report txerr and rxerr during bus-off
	can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off
	can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off
	can: usb_8dev: do not report txerr and rxerr during bus-off
	can: error: specify the values of data[5..7] of CAN error frames
	can: pch_can: pch_can_error(): initialize errc before using it
	Bluetooth: hci_intel: Add check for platform_driver_register
	i2c: cadence: Support PEC for SMBus block read
	i2c: mux-gpmux: Add of_node_put() when breaking out of loop
	wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
	wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
	wifi: libertas: Fix possible refcount leak in if_usb_probe()
	media: cedrus: hevc: Add check for invalid timestamp
	net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version
	net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS
	crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq
	crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
	crypto: hisilicon/sec - fix auth key size error
	inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH()
	tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if()
	ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH()
	tcp: Fix data-races around sysctl_tcp_l3mdev_accept.
	net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
	iavf: Fix max_rate limiting
	netdevsim: Avoid allocation warnings triggered from user space
	net: rose: fix netdev reference changes
	net: ionic: fix error check for vlan flags in ionic_set_nic_features()
	dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
	wireguard: ratelimiter: use hrtimer in selftest
	wireguard: allowedips: don't corrupt stack when detecting overflow
	clk: renesas: r9a06g032: Fix UART clkgrp bitsel
	mtd: maps: Fix refcount leak in of_flash_probe_versatile
	mtd: maps: Fix refcount leak in ap_flash_init
	mtd: rawnand: meson: Fix a potential double free issue
	PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
	HID: cp2112: prevent a buffer overflow in cp2112_xfer()
	mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
	mtd: partitions: Fix refcount leak in parse_redboot_of
	mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
	fpga: altera-pr-ip: fix unsigned comparison with less than zero
	usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
	usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
	usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()
	usb: xhci: tegra: Fix error check
	netfilter: xtables: Bring SPDX identifier back
	iio: accel: bma400: Fix the scale min and max macro values
	platform/chrome: cros_ec: Always expose last resume result
	iio: accel: bma400: Reordering of header files
	clk: mediatek: reset: Fix written reset bit offset
	KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
	mwifiex: Ignore BTCOEX events from the 88W8897 firmware
	mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
	dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics
	misc: rtsx: Fix an error handling path in rtsx_pci_probe()
	driver core: fix potential deadlock in __driver_attach
	clk: qcom: clk-krait: unlock spin after mux completion
	usb: host: xhci: use snprintf() in xhci_decode_trb()
	clk: qcom: ipq8074: fix NSS core PLL-s
	clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
	clk: qcom: ipq8074: fix NSS port frequency tables
	clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
	clk: qcom: camcc-sdm845: Fix topology around titan_top power domain
	PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
	PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
	PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists
	soundwire: bus_type: fix remove and shutdown support
	KVM: arm64: Don't return from void function
	dmaengine: sf-pdma: apply proper spinlock flags in sf_pdma_prep_dma_memcpy()
	dmaengine: sf-pdma: Add multithread support for a DMA channel
	PCI: endpoint: Don't stop controller when unbinding endpoint function
	intel_th: Fix a resource leak in an error handling path
	intel_th: msu-sink: Potential dereference of null pointer
	intel_th: msu: Fix vmalloced buffers
	staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback
	mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
	memstick/ms_block: Fix some incorrect memory allocation
	memstick/ms_block: Fix a memory leak
	mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
	mmc: block: Add single read for 4k sector cards
	KVM: s390: pv: leak the topmost page table when destroy fails
	PCI/portdrv: Don't disable AER reporting in get_port_device_capability()
	PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
	scsi: smartpqi: Fix DMA direction for RAID requests
	xtensa: iss/network: provide release() callback
	xtensa: iss: fix handling error cases in iss_net_configure()
	usb: gadget: udc: amd5536 depends on HAS_DMA
	usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
	usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
	usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
	usb: dwc3: qcom: fix missing optional irq warnings
	eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
	interconnect: imx: fix max_node_id
	um: random: Don't initialise hwrng struct with zero
	RDMA/rtrs: Define MIN_CHUNK_SIZE
	RDMA/rtrs: Avoid Wtautological-constant-out-of-range-compare
	RDMA/rtrs-srv: Fix modinfo output for stringify
	RDMA/qedr: Improve error logs for rdma_alloc_tid error return
	RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
	RDMA/hns: Fix incorrect clearing of interrupt status register
	RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
	RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
	gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
	HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
	mmc: cavium-octeon: Add of_node_put() when breaking out of loop
	mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
	HID: alps: Declare U1_UNICORN_LEGACY support
	PCI: tegra194: Fix Root Port interrupt handling
	PCI: tegra194: Fix link up retry sequence
	USB: serial: fix tty-port initialized comments
	usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
	platform/olpc: Fix uninitialized data in debugfs write
	RDMA/srpt: Duplicate port name members
	RDMA/srpt: Introduce a reference count in struct srpt_device
	RDMA/srpt: Fix a use-after-free
	mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
	selftests: kvm: set rax before vmcall
	RDMA/mlx5: Add missing check for return value in get namespace flow
	RDMA/rxe: Fix error unwind in rxe_create_qp()
	null_blk: fix ida error handling in null_add_dev()
	nvme: use command_id instead of req->tag in trace_nvme_complete_rq()
	jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction()
	ext4: recover csum seed of tmp_inode after migrating to extents
	jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
	usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable()
	opp: Fix error check in dev_pm_opp_attach_genpd()
	ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe
	ASoC: samsung: Fix error handling in aries_audio_probe
	ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
	ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe
	ASoC: codecs: da7210: add check for i2c_add_driver
	ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
	serial: 8250: Export ICR access helpers for internal use
	serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
	ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV
	ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
	rpmsg: mtk_rpmsg: Fix circular locking dependency
	remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
	selftests/livepatch: better synchronize test_klp_callbacks_busy
	profiling: fix shift too large makes kernel panic
	ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header
	powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable
	ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables
	tty: n_gsm: Delete gsmtty open SABM frame when config requester
	tty: n_gsm: fix user open not possible at responder until initiator open
	tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()
	tty: n_gsm: fix non flow control frames during mux flow off
	tty: n_gsm: fix packet re-transmission without open control channel
	tty: n_gsm: fix race condition in gsmld_write()
	ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe()
	remoteproc: qcom: wcnss: Fix handling of IRQs
	vfio: Remove extra put/gets around vfio_device->group
	vfio: Simplify the lifetime logic for vfio_device
	vfio: Split creation of a vfio_device into init and register ops
	vfio/mdev: Make to_mdev_device() into a static inline
	vfio/ccw: Do not change FSM state in subchannel event
	tty: n_gsm: fix wrong T1 retry count handling
	tty: n_gsm: fix DM command
	tty: n_gsm: fix missing corner cases in gsmld_poll()
	iommu/exynos: Handle failed IOMMU device registration properly
	rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
	kfifo: fix kfifo_to_user() return type
	lib/smp_processor_id: fix imbalanced instrumentation_end() call
	remoteproc: sysmon: Wait for SSCTL service to come up
	mfd: t7l66xb: Drop platform disable callback
	mfd: max77620: Fix refcount leak in max77620_initialise_fps
	iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
	perf tools: Fix dso_id inode generation comparison
	s390/dump: fix old lowcore virtual vs physical address confusion
	s390/zcore: fix race when reading from hardware system area
	ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format
	ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
	fuse: Remove the control interface for virtio-fs
	ASoC: audio-graph-card: Add of_node_put() in fail path
	watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
	video: fbdev: amba-clcd: Fix refcount leak bugs
	video: fbdev: sis: fix typos in SiS_GetModeID()
	ASoC: mchp-spdifrx: disable end of block interrupt on failures
	powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32
	powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
	f2fs: don't set GC_FAILURE_PIN for background GC
	f2fs: write checkpoint during FG_GC
	f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
	powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
	powerpc/xive: Fix refcount leak in xive_get_max_prio
	powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
	perf symbol: Fail to read phdr workaround
	kprobes: Forbid probing on trampoline and BPF code areas
	powerpc/pci: Fix PHB numbering when using opal-phbid
	genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
	scripts/faddr2line: Fix vmlinux detection on arm64
	sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy()
	sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
	x86/numa: Use cpumask_available instead of hardcoded NULL check
	video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
	tools/thermal: Fix possible path truncations
	sched: Fix the check of nr_running at queue wakelist
	x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y
	video: fbdev: vt8623fb: Check the size of screen before memset_io()
	video: fbdev: arkfb: Check the size of screen before memset_io()
	video: fbdev: s3fb: Check the size of screen before memset_io()
	scsi: zfcp: Fix missing auto port scan and thus missing target ports
	scsi: qla2xxx: Fix discovery issues in FC-AL topology
	scsi: qla2xxx: Turn off multi-queue for 8G adapters
	scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection
	scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os
	scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests
	x86/bugs: Enable STIBP for IBPB mitigated RETBleed
	ftrace/x86: Add back ftrace_expected assignment
	x86/olpc: fix 'logical not is only applied to the left hand side'
	posix-cpu-timers: Cleanup CPU timers before freeing them during exec
	Input: gscps2 - check return value of ioremap() in gscps2_probe()
	__follow_mount_rcu(): verify that mount_lock remains unchanged
	spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
	drm/i915/dg1: Update DMC_DEBUG3 register
	drm/mediatek: Allow commands to be sent during video mode
	drm/mediatek: Keep dsi as LP00 before dcs cmds transfer
	HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx
	HID: hid-input: add Surface Go battery quirk
	drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component
	mtd: rawnand: Add a helper to clarify the interface configuration
	mtd: rawnand: arasan: Check the proposed data interface is supported
	mtd: rawnand: Add NV-DDR timings
	mtd: rawnand: arasan: Fix a macro parameter
	mtd: rawnand: arasan: Support NV-DDR interface
	mtd: rawnand: arasan: Fix clock rate in NV-DDR
	usbnet: smsc95xx: Don't clear read-only PHY interrupt
	usbnet: smsc95xx: Avoid link settings race on interrupt reception
	firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
	intel_th: pci: Add Meteor Lake-P support
	intel_th: pci: Add Raptor Lake-S PCH support
	intel_th: pci: Add Raptor Lake-S CPU support
	KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors
	KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS)
	iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
	PCI/AER: Write AER Capability only when we control it
	PCI/ERR: Bind RCEC devices to the Root Port driver
	PCI/ERR: Rename reset_link() to reset_subordinates()
	PCI/ERR: Simplify by using pci_upstream_bridge()
	PCI/ERR: Simplify by computing pci_pcie_type() once
	PCI/ERR: Use "bridge" for clarity in pcie_do_recovery()
	PCI/ERR: Avoid negated conditional for clarity
	PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery()
	PCI/ERR: Recover from RCEC AER errors
	PCI/AER: Iterate over error counters instead of error strings
	serial: 8250: Dissociate 4MHz Titan ports from Oxford ports
	serial: 8250: Correct the clock for OxSemi PCIe devices
	serial: 8250_pci: Refactor the loop in pci_ite887x_init()
	serial: 8250_pci: Replace dev_*() by pci_*() macros
	serial: 8250: Fold EndRun device support into OxSemi Tornado code
	dm writecache: set a default MAX_WRITEBACK_JOBS
	kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification
	dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
	timekeeping: contribute wall clock to rng on time change
	um: Allow PM with suspend-to-idle
	btrfs: reject log replay if there is unsupported RO compat flag
	btrfs: reset block group chunk force if we have to wait
	ACPI: CPPC: Do not prevent CPPC from working in the future
	KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4()
	KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4()
	KVM: SVM: Drop VMXE check from svm_set_cr4()
	KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops hook
	KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4
	KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh
	KVM: x86/pmu: Use binary search to check filtered events
	KVM: x86/pmu: Use different raw event masks for AMD and Intel
	KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter
	KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU
	KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl
	xen-blkback: fix persistent grants negotiation
	xen-blkback: Apply 'feature_persistent' parameter when connect
	xen-blkfront: Apply 'feature_persistent' parameter when connect
	KEYS: asymmetric: enforce SM2 signature use pkey algo
	tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH
	tracing: Use a struct alignof to determine trace event field alignment
	ext4: check if directory block is within i_size
	ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
	ext4: fix warning in ext4_iomap_begin as race between bmap and write
	ext4: make sure ext4_append() always allocates new block
	ext4: fix use-after-free in ext4_xattr_set_entry
	ext4: update s_overhead_clusters in the superblock during an on-line resize
	ext4: fix extent status tree race in writeback error recovery path
	ext4: correct max_inline_xattr_value_size computing
	ext4: correct the misjudgment in ext4_iget_extra_inode
	dm raid: fix address sanitizer warning in raid_resume
	dm raid: fix address sanitizer warning in raid_status
	net_sched: cls_route: remove from list when handle is 0
	KVM: Add infrastructure and macro to mark VM as bugged
	KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
	KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
	mac80211: fix a memory leak where sta_info is not freed
	tcp: fix over estimation in sk_forced_mem_schedule()
	Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
	drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function
	drm/vc4: change vc4_dma_range_matches from a global to static
	Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
	Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
	mtd: rawnand: arasan: Prevent an unsupported configuration
	kvm: x86/pmu: Fix the compare function used by the pmu event filter
	tee: add overflow check in register_shm_helper()
	net/9p: Initialize the iounit field during fid creation
	net_sched: cls_route: disallow handle of 0
	sched/fair: Fix fault in reweight_entity
	btrfs: only write the sectors in the vertical stripe which has data stripes
	btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
	Linux 5.10.137

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5775ddfad6460c5a737b1ad3f8e0b8f798338786
2022-08-29 16:53:14 +02:00
Jiasheng Jiang
0c5dbac1ce Bluetooth: hci_intel: Add check for platform_driver_register
[ Upstream commit ab2d2a982f ]

As platform_driver_register() could fail, it should be better
to deal with the return value in order to maintain the code
consisitency.

Fixes: 1ab1f239bf ("Bluetooth: hci_intel: Add support for platform driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-21 15:15:49 +02:00
Greg Kroah-Hartman
b7247246f6 Merge 5.10.136 into android12-5.10-lts
Changes in 5.10.136
	x86/speculation: Make all RETbleed mitigations 64-bit only
	ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()
	ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
	selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
	selftests/bpf: Check dst_port only on the client socket
	tun: avoid double free in tun_free_netdev
	ACPI: video: Force backlight native for some TongFang devices
	ACPI: video: Shortening quirk list by identifying Clevo by board_name only
	ACPI: APEI: Better fix to avoid spamming the console with old error logs
	crypto: arm64/poly1305 - fix a read out-of-bound
	tools/kvm_stat: fix display of error when multiple processes are found
	selftests: KVM: Handle compiler optimizations in ucall
	Bluetooth: hci_bcm: Add BCM4349B1 variant
	Bluetooth: hci_bcm: Add DT compatible for CYW55572
	Bluetooth: btusb: Add support of IMC Networks PID 0x3568
	Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007
	Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675
	Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558
	Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587
	Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586
	macintosh/adb: fix oob read in do_adb_query() function
	x86/speculation: Add RSB VM Exit protections
	x86/speculation: Add LFENCE to RSB fill sequence
	Linux 5.10.136

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If3acb748677e784475236f80fbab77933c566c26
2022-08-11 15:56:44 +02:00
Hilda Wu
75742ffc36 Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586
commit 6ad353dfc8 upstream.

Add the support ID(0x13D3, 0x3586) to usb_device_id table for
Realtek RTL8852C.

The device info from /sys/kernel/debug/usb/devices as below.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3586 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Hilda Wu
40e2e7f1bf Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587
commit 8f0054dd29 upstream.

Add the support ID(0x13D3, 0x3587) to usb_device_id table for
Realtek RTL8852C.

The device info from /sys/kernel/debug/usb/devices as below.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3587 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Hilda Wu
9c45bb363e Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558
commit 5b75ee37eb upstream.

Add the support ID(0x0CB8, 0xC558) to usb_device_id table for
Realtek RTL8852C.

The device info from /sys/kernel/debug/usb/devices as below.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0cb8 ProdID=c558 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Hilda Wu
3a292cb181 Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675
commit 893fa8bc99 upstream.

Add the support ID(0x04c5, 0x1675) to usb_device_id table for
Realtek RTL8852C.

The device info from /sys/kernel/debug/usb/devices as below.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04c5 ProdID=1675 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Hilda Wu
1a2a2e3456 Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007
commit c379c96cc2 upstream.

Add the support ID(0x04CA, 0x4007) to usb_device_id table for
Realtek RTL8852C.

The device info from /sys/kernel/debug/usb/devices as below.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04ca ProdID=4007 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Aaron Ma
e81f95d030 Bluetooth: btusb: Add support of IMC Networks PID 0x3568
commit c69ecb0ea4 upstream.

It is 13d3:3568 for MediaTek MT7922 USB Bluetooth chip.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=480 MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3568 Rev=01.00
S:  Manufacturer=MediaTek Inc.
S:  Product=Wireless_Device
S:  SerialNumber=...
C:  #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us

Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Hakan Jansson
918ce738e2 Bluetooth: hci_bcm: Add DT compatible for CYW55572
commit f8cad62002 upstream.

CYW55572 is a Wi-Fi + Bluetooth combo device from Infineon.

Signed-off-by: Hakan Jansson <hakan.jansson@infineon.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:46 +02:00
Ahmad Fatoum
033a4455d9 Bluetooth: hci_bcm: Add BCM4349B1 variant
commit 4f17c2b669 upstream.

The BCM4349B1, aka CYW/BCM89359, is a WiFi+BT chip and its Bluetooth
portion can be controlled over serial.

Two subversions are added for the chip, because ROM firmware reports
002.002.013 (at least for the chips I have here), while depending on
patchram firmware revision, either 002.002.013 or 002.002.014 is
reported.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-11 13:06:45 +02:00
Greg Kroah-Hartman
2de0a17df4 Merge 5.10.120 into android12-5.10-lts
Changes in 5.10.120
	pinctrl: sunxi: fix f1c100s uart2 function
	percpu_ref_init(): clean ->percpu_count_ref on failure
	net: af_key: check encryption module availability consistency
	nfc: pn533: Fix buggy cleanup order
	net: ftgmac100: Disable hardware checksum on AST2600
	i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
	drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
	netfilter: nf_tables: disallow non-stateful expression in sets earlier
	pipe: make poll_usage boolean and annotate its access
	pipe: Fix missing lock in pipe_resize_ring()
	cfg80211: set custom regdomain after wiphy registration
	assoc_array: Fix BUG_ON during garbage collect
	io_uring: don't re-import iovecs from callbacks
	io_uring: fix using under-expanded iters
	net: ipa: compute proper aggregation limit
	xfs: detect overflows in bmbt records
	xfs: show the proper user quota options
	xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks
	xfs: fix an ABBA deadlock in xfs_rename
	xfs: Fix CIL throttle hang when CIL space used going backwards
	drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
	exfat: check if cluster num is valid
	lib/crypto: add prompts back to crypto libraries
	crypto: drbg - prepare for more fine-grained tracking of seeding state
	crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
	crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
	crypto: drbg - make reseeding from get_random_bytes() synchronous
	netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
	netfilter: conntrack: re-fetch conntrack after insertion
	KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator
	x86/kvm: Alloc dummy async #PF token outside of raw spinlock
	x86, kvm: use correct GFP flags for preemption disabled
	KVM: x86: avoid calling x86 emulator without a decoded instruction
	crypto: caam - fix i.MX6SX entropy delay value
	crypto: ecrdsa - Fix incorrect use of vli_cmp
	zsmalloc: fix races between asynchronous zspage free and page migration
	Bluetooth: hci_qca: Use del_timer_sync() before freeing
	ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries
	dm integrity: fix error code in dm_integrity_ctr()
	dm crypt: make printing of the key constant-time
	dm stats: add cond_resched when looping over entries
	dm verity: set DM_TARGET_IMMUTABLE feature flag
	raid5: introduce MD_BROKEN
	HID: multitouch: Add support for Google Whiskers Touchpad
	HID: multitouch: add quirks to enable Lenovo X12 trackpoint
	tpm: Fix buffer access in tpm2_get_tpm_pt()
	tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
	docs: submitting-patches: Fix crossref to 'The canonical patch format'
	NFS: Memory allocation failures are not server fatal errors
	NFSD: Fix possible sleep during nfsd4_release_lockowner()
	bpf: Fix potential array overflow in bpf_trampoline_get_progs()
	bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
	Linux 5.10.120

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I48c0d649a50bd16ad719b2cb9f0ffccd0a74519a
2022-07-23 16:09:48 +02:00
Tao Huang
c7a43f0886 Merge tag 'ASB-2022-06-05_12-5.10' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2022-01-01
CVE-2022-24958
CVE-2022-20136
CVE-2022-23960
CVE-2022-20141
CVE-2021-4154
CVE-2022-20132

* tag 'ASB-2022-06-05_12-5.10': (1188 commits)
  BACKPORT: net/sched: cls_u32: fix netns refcount changes in u32_change()
  UPSTREAM: io_uring: always use original task when preparing req identity
  FROMLIST: remoteproc: Fix dma_mem leak after rproc_shutdown
  FROMLIST: dma-mapping: Add dma_release_coherent_memory to DMA API
  ANDROID: Update QCOM symbol list for __reset_control_get
  ANDROID: vendor_hooks: Add hooks for mutex
  BACKPORT: can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
  BACKPORT: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: oplus: Update the ABI xml and symbol list
  UPSTREAM: remoteproc: Fix count check in rproc_coredump_write()
  BACKPORT: esp: Fix possible buffer overflow in ESP transformation
  ANDROID: Fix the drain_all_pages default condition broken by a hook
  UPSTREAM: Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"
  UPSTREAM: xfrm: fix MTU regression
  ANDROID: signal: Add vendor hook for memory reaping
  FROMGIT: usb: gadget: uvc: allow for application to cleanly shutdown
  FROMGIT: usb: dwc3: gadget: increase tx fifo size for ss isoc endpoints
  UPSTREAM: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
  FROMGIT: usb: gadget: uvc: remove pause flag use
  ...

Change-Id: Idf3eea3b21dc69c8189161c0e24744336431913a

Conflicts:
	drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
	drivers/spi/spi-rockchip.c
	drivers/usb/gadget/function/f_uvc.c
	drivers/usb/gadget/function/uvc.h
	drivers/usb/gadget/function/uvc_configfs.c
	drivers/usb/gadget/function/uvc_queue.c
	drivers/usb/gadget/function/uvc_video.c
	sound/soc/rockchip/rockchip_i2s.c
2022-07-15 17:58:38 +08:00
Tao Huang
24cbee6672 Merge tag 'ASB-2022-04-05_12-5.10' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2022-04-01
CVE-2021-0707
CVE-2021-39800
CVE-2021-39801 (4.9 only)
CVE-2021-39802

* tag 'ASB-2022-04-05_12-5.10': (3832 commits)
  ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
  ANDROID: vendor_hooks: Reduce pointless modversions CRC churn
  UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class
  ANDROID: mm: Fix implicit declaration of function 'isolate_lru_page'
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: GKI: Add hook symbol to symbol list
  Revert "ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree"
  ANDROID: vendor_hooks: Add hooks to for free_unref_page_commit
  ANDROID: vendor_hooks: Add hooks to for alloc_contig_range
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: vendor_hooks: Add hook in shrink_node_memcgs
  ANDROID: GKI: Add symbols to symbol list
  FROMGIT: iommu/iova: Improve 32-bit free space estimate
  ANDROID: export walk_page_range and swp_swap_info
  ANDROID: vendor_hooks: export shrink_slab
  ANDROID: usb: gadget: f_accessory: add compat_ioctl support
  UPSTREAM: sr9700: sanity check for packet length
  UPSTREAM: io_uring: return back safer resurrect
  UPSTREAM: Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
  ...

Change-Id: Ic61ead530b99b10ffd535a358a48fe9bb8c33fd4

Conflicts:
	drivers/android/Kconfig
	drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
	drivers/gpu/drm/rockchip/rockchip_vop_reg.c
	drivers/i2c/busses/i2c-rk3x.c
	drivers/media/i2c/imx258.c
	drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
	drivers/usb/dwc2/gadget.c
	drivers/usb/gadget/function/uvc.h
	lib/Kconfig.debug
2022-07-15 17:40:39 +08:00
Steven Rostedt
4989bb0334 Bluetooth: hci_qca: Use del_timer_sync() before freeing
commit 72ef98445a upstream.

While looking at a crash report on a timer list being corrupted, which
usually happens when a timer is freed while still active. This is
commonly triggered by code calling del_timer() instead of
del_timer_sync() just before freeing.

One possible culprit is the hci_qca driver, which does exactly that.

Eric mentioned that wake_retrans_timer could be rearmed via the work
queue, so also move the destruction of the work queue before
del_timer_sync().

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 0ff252c197 ("Bluetooth: hciuart: Add support QCA chipset for UART")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-06 08:42:43 +02:00
Greg Kroah-Hartman
95f4203fc9 Merge 5.10.110 into android12-5.10-lts
Changes in 5.10.110
	swiotlb: fix info leak with DMA_FROM_DEVICE
	USB: serial: pl2303: add IBM device IDs
	USB: serial: simple: add Nokia phone driver
	hv: utils: add PTP_1588_CLOCK to Kconfig to fix build
	netdevice: add the case if dev is NULL
	HID: logitech-dj: add new lightspeed receiver id
	xfrm: fix tunnel model fragmentation behavior
	ARM: mstar: Select HAVE_ARM_ARCH_TIMER
	virtio_console: break out of buf poll on remove
	vdpa/mlx5: should verify CTRL_VQ feature exists for MQ
	tools/virtio: fix virtio_test execution
	ethernet: sun: Free the coherent when failing in probing
	gpio: Revert regression in sysfs-gpio (gpiolib.c)
	spi: Fix invalid sgs value
	net:mcf8390: Use platform_get_irq() to get the interrupt
	Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"
	spi: Fix erroneous sgs value with min_t()
	Input: zinitix - do not report shadow fingers
	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
	net: dsa: microchip: add spi_device_id tables
	locking/lockdep: Avoid potential access of invalid memory in lock_class
	iommu/iova: Improve 32-bit free space estimate
	tpm: fix reference counting for struct tpm_chip
	virtio-blk: Use blk_validate_block_size() to validate block size
	USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
	xhci: fix garbage USBSTS being logged in some cases
	xhci: fix runtime PM imbalance in USB2 resume
	xhci: make xhci_handshake timeout for xhci_reset() adjustable
	xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
	mei: me: add Alder Lake N device id.
	mei: avoid iterator usage outside of list_for_each_entry
	coresight: Fix TRCCONFIGR.QE sysfs interface
	iio: afe: rescale: use s64 for temporary scale calculations
	iio: inkern: apply consumer scale on IIO_VAL_INT cases
	iio: inkern: apply consumer scale when no channel scale is available
	iio: inkern: make a best effort on offset calculation
	greybus: svc: fix an error handling bug in gb_svc_hello()
	clk: uniphier: Fix fixed-rate initialization
	ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
	KEYS: fix length validation in keyctl_pkey_params_get_2()
	Documentation: add link to stable release candidate tree
	Documentation: update stable tree link
	firmware: stratix10-svc: add missing callback parameter on RSU
	HID: intel-ish-hid: Use dma_alloc_coherent for firmware update
	SUNRPC: avoid race between mod_timer() and del_timer_sync()
	NFSD: prevent underflow in nfssvc_decode_writeargs()
	NFSD: prevent integer overflow on 32 bit systems
	f2fs: fix to unlock page correctly in error path of is_alive()
	f2fs: quota: fix loop condition at f2fs_quota_sync()
	f2fs: fix to do sanity check on .cp_pack_total_block_count
	remoteproc: Fix count check in rproc_coredump_write()
	pinctrl: samsung: drop pin banks references on error paths
	spi: mxic: Fix the transmit path
	mtd: rawnand: protect access to rawnand devices while in suspend
	can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
	jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
	jffs2: fix memory leak in jffs2_do_mount_fs
	jffs2: fix memory leak in jffs2_scan_medium
	mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
	mm: invalidate hwpoison page cache page in fault path
	mempolicy: mbind_range() set_policy() after vma_merge()
	scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
	qed: display VF trust config
	qed: validate and restrict untrusted VFs vlan promisc mode
	riscv: Fix fill_callchain return value
	riscv: Increase stack size under KASAN
	Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
	cifs: prevent bad output lengths in smb2_ioctl_query_info()
	cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
	ALSA: cs4236: fix an incorrect NULL check on list iterator
	ALSA: hda: Avoid unsol event during RPM suspending
	ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
	ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
	mm: madvise: skip unmapped vma holes passed to process_madvise
	mm: madvise: return correct bytes advised with process_madvise
	Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"
	mm,hwpoison: unmap poisoned page before invalidation
	mm/kmemleak: reset tag when compare object pointer
	dm integrity: set journal entry unused when shrinking device
	drbd: fix potential silent data corruption
	can: isotp: sanitize CAN ID checks in isotp_bind()
	powerpc/kvm: Fix kvm_use_magic_page
	udp: call udp_encap_enable for v6 sockets when enabling encap
	arm64: signal: nofpsimd: Do not allocate fp/simd context when not available
	arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs
	arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs
	arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs
	ACPI: properties: Consistently return -ENOENT if there are no more references
	coredump: Also dump first pages of non-executable ELF libraries
	ext4: fix ext4_fc_stats trace point
	ext4: fix fs corruption when tring to remove a non-empty directory with IO error
	drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
	mailbox: tegra-hsp: Flush whole channel
	block: limit request dispatch loop duration
	block: don't merge across cgroup boundaries if blkcg is enabled
	drm/edid: check basic audio support on CEA extension block
	video: fbdev: sm712fb: Fix crash in smtcfb_read()
	video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
	ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
	ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
	ARM: dts: exynos: add missing HDMI supplies on SMDK5250
	ARM: dts: exynos: add missing HDMI supplies on SMDK5420
	mgag200 fix memmapsl configuration in GCTL6 register
	carl9170: fix missing bit-wise or operator for tx_params
	pstore: Don't use semaphores in always-atomic-context code
	thermal: int340x: Increase bitmap size
	lib/raid6/test: fix multiple definition linking error
	exec: Force single empty string when argv is empty
	crypto: rsa-pkcs1pad - only allow with rsa
	crypto: rsa-pkcs1pad - correctly get hash from source scatterlist
	crypto: rsa-pkcs1pad - restore signature length check
	crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
	bcache: fixup multiple threads crash
	DEC: Limit PMAX memory probing to R3k systems
	media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC
	media: davinci: vpif: fix unbalanced runtime PM get
	media: davinci: vpif: fix unbalanced runtime PM enable
	xtensa: fix stop_machine_cpuslocked call in patch_text
	xtensa: fix xtensa_wsr always writing 0
	brcmfmac: firmware: Allocate space for default boardrev in nvram
	brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
	brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
	brcmfmac: pcie: Fix crashes due to early IRQs
	drm/i915/opregion: check port number bounds for SWSCI display power state
	drm/i915/gem: add missing boundary check in vm_access
	PCI: pciehp: Clear cmd_busy bit in polling mode
	PCI: xgene: Revert "PCI: xgene: Fix IB window setup"
	regulator: qcom_smd: fix for_each_child.cocci warnings
	selinux: check return value of sel_make_avc_files
	hwrng: cavium - Check health status while reading random data
	hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
	crypto: sun8i-ss - really disable hash on A80
	crypto: authenc - Fix sleep in atomic context in decrypt_tail
	crypto: mxs-dcp - Fix scatterlist processing
	thermal: int340x: Check for NULL after calling kmemdup()
	spi: tegra114: Add missing IRQ check in tegra_spi_probe
	arm64/mm: avoid fixmap race condition when create pud mapping
	selftests/x86: Add validity check and allow field splitting
	crypto: rockchip - ECB does not need IV
	audit: log AUDIT_TIME_* records only from rules
	EVM: fix the evm= __setup handler return value
	crypto: ccree - don't attempt 0 len DMA mappings
	spi: pxa2xx-pci: Balance reference count for PCI DMA device
	hwmon: (pmbus) Add mutex to regulator ops
	hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
	nvme: cleanup __nvme_check_ids
	block: don't delete queue kobject before its children
	PM: hibernate: fix __setup handler error handling
	PM: suspend: fix return value of __setup handler
	spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
	hwrng: atmel - disable trng on failure path
	crypto: sun8i-ss - call finalize with bh disabled
	crypto: sun8i-ce - call finalize with bh disabled
	crypto: amlogic - call finalize with bh disabled
	crypto: vmx - add missing dependencies
	clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix
	clocksource/drivers/exynos_mct: Refactor resources allocation
	clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts
	clocksource/drivers/timer-microchip-pit64b: Use notrace
	clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init()
	ACPI: APEI: fix return value of __setup handlers
	crypto: ccp - ccp_dmaengine_unregister release dma channels
	crypto: ccree - Fix use after free in cc_cipher_exit()
	vfio: platform: simplify device removal
	amba: Make the remove callback return void
	hwrng: nomadik - Change clk_disable to clk_disable_unprepare
	hwmon: (pmbus) Add Vin unit off handling
	clocksource: acpi_pm: fix return value of __setup handler
	io_uring: terminate manual loop iterator loop correctly for non-vecs
	watch_queue: Fix NULL dereference in error cleanup
	watch_queue: Actually free the watch
	f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
	sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
	sched/core: Export pelt_thermal_tp
	rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs()
	rseq: Remove broken uapi field layout on 32-bit little endian
	perf/core: Fix address filter parser for multiple filters
	perf/x86/intel/pt: Fix address filter config for 32-bit kernel
	f2fs: fix missing free nid in f2fs_handle_failed_inode
	nfsd: more robust allocation failure handling in nfsd_file_cache_init
	f2fs: fix to avoid potential deadlock
	btrfs: fix unexpected error path when reflinking an inline extent
	f2fs: compress: remove unneeded read when rewrite whole cluster
	f2fs: fix compressed file start atomic write may cause data corruption
	selftests, x86: fix how check_cc.sh is being invoked
	kunit: make kunit_test_timeout compatible with comment
	media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size
	media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
	media: mtk-vcodec: potential dereference of null pointer
	media: bttv: fix WARNING regression on tunerless devices
	ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting
	ASoC: generic: simple-card-utils: remove useless assignment
	media: coda: Fix missing put_device() call in coda_get_vdoa_data
	media: meson: vdec: potential dereference of null pointer
	media: hantro: Fix overfill bottom register field name
	media: aspeed: Correct value for h-total-pixels
	video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen
	video: fbdev: controlfb: Fix set but not used warnings
	video: fbdev: controlfb: Fix COMPILE_TEST build
	video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
	video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
	video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
	firmware: qcom: scm: Remove reassignment to desc following initializer
	ARM: dts: qcom: ipq4019: fix sleep clock
	soc: qcom: rpmpd: Check for null return of devm_kcalloc
	soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem
	soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
	arm64: dts: qcom: sdm845: fix microphone bias properties and values
	arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
	firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined
	soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
	ARM: dts: sun8i: v3s: Move the csi1 block to follow address order
	ARM: dts: imx: Add missing LVDS decoder on M53Menlo
	media: video/hdmi: handle short reads of hdmi info frame.
	media: em28xx: initialize refcount before kref_get
	media: usb: go7007: s2250-board: fix leak in probe()
	media: cedrus: H265: Fix neighbour info buffer size
	media: cedrus: h264: Fix neighbour info buffer size
	ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put
	uaccess: fix nios2 and microblaze get_user_8()
	ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
	ASoC: ti: davinci-i2s: Add check for clk_enable()
	ALSA: spi: Add check for clk_enable()
	arm64: dts: ns2: Fix spi-cpol and spi-cpha property
	arm64: dts: broadcom: Fix sata nodename
	printk: fix return value of printk.devkmsg __setup handler
	ASoC: mxs-saif: Handle errors for clk_enable
	ASoC: atmel_ssc_dai: Handle errors for clk_enable
	ASoC: dwc-i2s: Handle errors for clk_enable
	ASoC: soc-compress: prevent the potentially use of null pointer
	memory: emif: Add check for setup_interrupts
	memory: emif: check the pointer temp in get_device_details()
	ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
	arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly
	m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined
	media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
	media: vidtv: Check for null return of vzalloc
	ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
	ASoC: wm8350: Handle error for wm8350_register_irq
	ASoC: fsi: Add check for clk_enable
	video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
	media: saa7134: convert list_for_each to entry variant
	media: saa7134: fix incorrect use to determine if list is empty
	ivtv: fix incorrect device_caps for ivtvfb
	ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource()
	ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe
	ASoC: SOF: Add missing of_node_put() in imx8m_probe
	ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
	ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
	ASoC: fsl_spdif: Disable TX clock when stop
	ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
	ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe
	mmc: davinci_mmc: Handle error for clk_enable
	ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card()
	ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe
	ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe
	ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data
	ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS
	drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops
	drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
	drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
	drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe
	drm: bridge: adv7511: Fix ADV7535 HPD enablement
	ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
	drm/panfrost: Check for error num after setting mask
	libbpf: Fix possible NULL pointer dereference when destroying skeleton
	udmabuf: validate ubuf->pagecount
	Bluetooth: hci_serdev: call init_rwsem() before p->open()
	mtd: onenand: Check for error irq
	mtd: rawnand: gpmi: fix controller timings setting
	drm/edid: Don't clear formats if using deep color
	ionic: fix type complaint in ionic_dev_cmd_clean()
	drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
	drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
	drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function
	ath9k_htc: fix uninit value bugs
	RDMA/core: Set MR type in ib_reg_user_mr
	KVM: PPC: Fix vmx/vsx mixup in mmio emulation
	i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
	i40e: respect metadata on XSK Rx to skb
	power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
	ray_cs: Check ioremap return value
	powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch
	KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
	powerpc/perf: Don't use perf_hw_context for trace IMC PMU
	mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode
	mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv
	mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
	mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
	net: dsa: mv88e6xxx: Enable port policy support on 6097
	scripts/dtc: Call pkg-config POSIXly correct
	livepatch: Fix build failure on 32 bits processors
	PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
	drm/bridge: dw-hdmi: use safe format when first in bridge chain
	power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
	HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
	iommu/ipmmu-vmsa: Check for error num after setting mask
	drm/amd/pm: enable pm sysfs write for one VF mode
	drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug
	IB/cma: Allow XRC INI QPs to set their local ACK timeout
	dax: make sure inodes are flushed before destroy cache
	iwlwifi: Fix -EIO error code that is never returned
	iwlwifi: mvm: Fix an error code in iwl_mvm_up()
	drm/msm/dp: populate connector of struct dp_panel
	drm/msm/dpu: add DSPP blocks teardown
	drm/msm/dpu: fix dp audio condition
	dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
	scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
	scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
	scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
	scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config()
	scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
	scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
	scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
	scsi: pm8001: Fix NCQ NON DATA command task initialization
	scsi: pm8001: Fix NCQ NON DATA command completion handling
	scsi: pm8001: Fix abort all task initialization
	RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
	drm/amd/display: Remove vupdate_int_entry definition
	TOMOYO: fix __setup handlers return values
	ext2: correct max file size computing
	drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
	power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return
	scsi: hisi_sas: Change permission of parameter prot_mask
	drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
	bpf, arm64: Call build_prologue() first in first JIT pass
	bpf, arm64: Feed byte-offset into bpf line info
	gpu: host1x: Fix a memory leak in 'host1x_remove()'
	libbpf: Skip forward declaration when counting duplicated type names
	powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties()
	powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
	KVM: x86: Fix emulation in writing cr8
	KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor()
	hv_balloon: rate-limit "Unhandled message" warning
	i2c: xiic: Make bus names unique
	power: supply: wm8350-power: Handle error for wm8350_register_irq
	power: supply: wm8350-power: Add missing free in free_charger_irq
	IB/hfi1: Allow larger MTU without AIP
	PCI: Reduce warnings on possible RW1C corruption
	net: axienet: fix RX ring refill allocation failure handling
	mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
	powerpc/sysdev: fix incorrect use to determine if list is empty
	mfd: mc13xxx: Add check for mc13xxx_irq_request
	libbpf: Unmap rings when umem deleted
	selftests/bpf: Make test_lwt_ip_encap more stable and faster
	platform/x86: huawei-wmi: check the return value of device_create_file()
	powerpc: 8xx: fix a return value error in mpc8xx_pic_init
	vxcan: enable local echo for sent CAN frames
	ath10k: Fix error handling in ath10k_setup_msa_resources
	mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
	MIPS: RB532: fix return value of __setup handler
	MIPS: pgalloc: fix memory leak caused by pgd_free()
	mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
	RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
	bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
	bpf, sockmap: Fix more uncharged while msg has more_data
	bpf, sockmap: Fix double uncharge the mem of sk_msg
	samples/bpf, xdpsock: Fix race when running for fix duration of time
	USB: storage: ums-realtek: fix error code in rts51x_read_mem()
	can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
	can: isotp: support MSG_TRUNC flag when reading from socket
	bareudp: use ipv6_mod_enabled to check if IPv6 enabled
	selftests/bpf: Fix error reporting from sock_fields programs
	Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed
	Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
	ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
	af_netlink: Fix shift out of bounds in group mask calculation
	i2c: meson: Fix wrong speed use from probe
	i2c: mux: demux-pinctrl: do not deactivate a master that is not active
	selftests/bpf/test_lirc_mode2.sh: Exit with proper code
	PCI: Avoid broken MSI on SB600 USB devices
	net: bcmgenet: Use stronger register read/writes to assure ordering
	tcp: ensure PMTU updates are processed during fastopen
	openvswitch: always update flow key after nat
	tipc: fix the timer expires after interval 100ms
	mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
	mxser: fix xmit_buf leak in activate when LSR == 0xff
	pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
	fsi: aspeed: convert to devm_platform_ioremap_resource
	fsi: Aspeed: Fix a potential double free
	misc: alcor_pci: Fix an error handling path
	cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse
	soundwire: intel: fix wrong register name in intel_shim_wake
	clk: qcom: ipq8074: fix PCI-E clock oops
	iio: mma8452: Fix probe failing when an i2c_device_id is used
	staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
	pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
	pinctrl: renesas: checker: Fix miscalculation of number of states
	clk: qcom: ipq8074: Use floor ops for SDCC1 clock
	phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
	serial: 8250_mid: Balance reference count for PCI DMA device
	serial: 8250_lpss: Balance reference count for PCI DMA device
	NFS: Use of mapping_set_error() results in spurious errors
	serial: 8250: Fix race condition in RTS-after-send handling
	iio: adc: Add check for devm_request_threaded_irq
	habanalabs: Add check for pci_enable_device
	NFS: Return valid errors from nfs2/3_decode_dirent()
	dma-debug: fix return value of __setup handlers
	clk: imx7d: Remove audio_mclk_root_clk
	clk: at91: sama7g5: fix parents of PDMCs' GCLK
	clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
	clk: qcom: clk-rcg2: Update the frac table for pixel clock
	dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma
	remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
	remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
	remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
	nvdimm/region: Fix default alignment for small regions
	clk: actions: Terminate clk_div_table with sentinel element
	clk: loongson1: Terminate clk_div_table with sentinel element
	clk: clps711x: Terminate clk_div_table with sentinel element
	clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver
	NFS: remove unneeded check in decode_devicenotify_args()
	staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
	staging: mt7621-dts: fix formatting
	staging: mt7621-dts: fix pinctrl properties for ethernet
	staging: mt7621-dts: fix GB-PC2 devicetree
	pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
	pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
	pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get()
	pinctrl: mediatek: paris: Fix pingroup pin config state readback
	pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs
	pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
	pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
	tty: hvc: fix return value of __setup handler
	kgdboc: fix return value of __setup handler
	serial: 8250: fix XOFF/XON sending when DMA is used
	kgdbts: fix return value of __setup handler
	firmware: google: Properly state IOMEM dependency
	driver core: dd: fix return value of __setup handler
	jfs: fix divide error in dbNextAG
	netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
	NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
	kdb: Fix the putarea helper function
	clk: qcom: gcc-msm8994: Fix gpll4 width
	clk: Initialize orphan req_rate
	xen: fix is_xen_pmu()
	net: enetc: report software timestamping via SO_TIMESTAMPING
	net: hns3: fix bug when PF set the duplicate MAC address for VFs
	net: phy: broadcom: Fix brcm_fet_config_init()
	selftests: test_vxlan_under_vrf: Fix broken test case
	qlcnic: dcb: default to returning -EOPNOTSUPP
	net/x25: Fix null-ptr-deref caused by x25_disconnect
	NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
	net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
	fs: fd tables have to be multiples of BITS_PER_LONG
	lib/test: use after free in register_test_dev_kmod()
	fs: fix fd table size alignment properly
	LSM: general protection fault in legacy_parse_param
	regulator: rpi-panel: Handle I2C errors/timing to the Atmel
	gcc-plugins/stackleak: Exactly match strings instead of prefixes
	pinctrl: npcm: Fix broken references to chip->parent_device
	block, bfq: don't move oom_bfqq
	selinux: use correct type for context length
	selinux: allow FIOCLEX and FIONCLEX with policy capability
	loop: use sysfs_emit() in the sysfs xxx show()
	Fix incorrect type in assignment of ipv6 port for audit
	irqchip/qcom-pdc: Fix broken locking
	irqchip/nvic: Release nvic_base upon failure
	fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
	bfq: fix use-after-free in bfq_dispatch_request
	ACPICA: Avoid walking the ACPI Namespace if it is not there
	lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
	Revert "Revert "block, bfq: honor already-setup queue merges""
	ACPI/APEI: Limit printable size of BERT table data
	PM: core: keep irq flags in device_pm_check_callbacks()
	parisc: Fix handling off probe non-access faults
	nvme-tcp: lockdep: annotate in-kernel sockets
	spi: tegra20: Use of_device_get_match_data()
	locking/lockdep: Iterate lock_classes directly when reading lockdep files
	ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb
	ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
	ext4: don't BUG if someone dirty pages without asking ext4 first
	f2fs: fix to do sanity check on curseg->alloc_type
	NFSD: Fix nfsd_breaker_owns_lease() return values
	f2fs: compress: fix to print raw data size in error path of lz4 decompression
	ntfs: add sanity check on allocation size
	media: staging: media: zoran: move videodev alloc
	media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com
	media: staging: media: zoran: fix various V4L2 compliance errors
	media: ir_toy: free before error exiting
	video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
	video: fbdev: w100fb: Reset global state
	video: fbdev: cirrusfb: check pixclock to avoid divide by zero
	video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
	ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
	ARM: dts: bcm2837: Add the missing L1/L2 cache information
	ASoC: madera: Add dependencies on MFD
	media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards
	media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
	ARM: ftrace: avoid redundant loads or clobbering IP
	ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
	arm64: defconfig: build imx-sdma as a module
	video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
	video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
	video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
	ARM: dts: bcm2711: Add the missing L1/L2 cache information
	ASoC: soc-core: skip zero num_dai component in searching dai name
	media: cx88-mpeg: clear interrupt status register before streaming video
	uaccess: fix type mismatch warnings from access_ok()
	lib/test_lockup: fix kernel pointer check for separate address spaces
	ARM: tegra: tamonten: Fix I2C3 pad setting
	ARM: mmp: Fix failure to remove sram device
	video: fbdev: sm712fb: Fix crash in smtcfb_write()
	media: Revert "media: em28xx: add missing em28xx_close_extension"
	media: hdpvr: initialize dev->worker at hdpvr_register_videodev
	mmc: host: Return an error when ->enable_sdio_irq() ops is missing
	media: atomisp: fix bad usage at error handling logic
	ALSA: hda/realtek: Add alc256-samsung-headphone fixup
	KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU
	powerpc/kasan: Fix early region not updated correctly
	powerpc/lib/sstep: Fix 'sthcx' instruction
	powerpc/lib/sstep: Fix build errors with newer binutils
	powerpc: Fix build errors with newer binutils
	scsi: qla2xxx: Fix stuck session in gpdb
	scsi: qla2xxx: Fix scheduling while atomic
	scsi: qla2xxx: Fix wrong FDMI data for 64G adapter
	scsi: qla2xxx: Fix warning for missing error code
	scsi: qla2xxx: Fix device reconnect in loop topology
	scsi: qla2xxx: Add devids and conditionals for 28xx
	scsi: qla2xxx: Check for firmware dump already collected
	scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
	scsi: qla2xxx: Fix disk failure to rediscover
	scsi: qla2xxx: Fix incorrect reporting of task management failure
	scsi: qla2xxx: Fix hang due to session stuck
	scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests
	scsi: qla2xxx: Fix N2N inconsistent PLOGI
	scsi: qla2xxx: Reduce false trigger to login
	scsi: qla2xxx: Use correct feature type field during RFF_ID processing
	platform: chrome: Split trace include file
	KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
	KVM: Prevent module exit until all VMs are freed
	KVM: x86: fix sending PV IPI
	KVM: SVM: fix panic on out-of-bounds guest IRQ
	ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
	ubifs: rename_whiteout: Fix double free for whiteout_ui->data
	ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
	ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
	ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
	ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
	ubifs: Fix to add refcount once page is set private
	ubifs: rename_whiteout: correct old_dir size computing
	wireguard: queueing: use CFI-safe ptr_ring cleanup function
	wireguard: socket: free skb in send6 when ipv6 is disabled
	wireguard: socket: ignore v6 endpoints when ipv6 is disabled
	XArray: Fix xas_create_range() when multi-order entry present
	can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
	can: mcba_usb: properly check endpoint type
	can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value
	XArray: Update the LRU list in xas_split()
	rtc: check if __rtc_read_time was successful
	gfs2: Make sure FITRIM minlen is rounded up to fs block size
	net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware
	rxrpc: Fix call timer start racing with call destruction
	mailbox: imx: fix wakeup failure from freeze mode
	crypto: arm/aes-neonbs-cbc - Select generic cbc and aes
	watch_queue: Free the page array when watch_queue is dismantled
	pinctrl: pinconf-generic: Print arguments for bias-pull-*
	watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function
	pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR()
	pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE()
	ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
	ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
	ARM: iop32x: offset IRQ numbers by 1
	io_uring: fix memory leak of uid in files registration
	riscv module: remove (NOLOAD)
	ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
	platform/chrome: cros_ec_typec: Check for EC device
	can: isotp: restore accidentally removed MSG_PEEK feature
	proc: bootconfig: Add null pointer check
	staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet
	ASoC: soc-compress: Change the check for codec_dai
	batman-adv: Check ptr for NULL before reducing its refcnt
	mm/mmap: return 1 from stack_guard_gap __setup() handler
	ARM: 9187/1: JIVE: fix return value of __setup handler
	mm/memcontrol: return 1 from cgroup.memory __setup() handler
	mm/usercopy: return 1 from hardened_usercopy __setup() handler
	bpf: Adjust BPF stack helper functions to accommodate skip > 0
	bpf: Fix comment for helper bpf_current_task_under_cgroup()
	dt-bindings: mtd: nand-controller: Fix the reg property description
	dt-bindings: mtd: nand-controller: Fix a comment in the examples
	dt-bindings: spi: mxic: The interrupt property is not mandatory
	ubi: fastmap: Return error code if memory allocation fails in add_aeb()
	ASoC: topology: Allow TLV control to be either read or write
	ARM: dts: spear1340: Update serial node properties
	ARM: dts: spear13xx: Update SPI dma properties
	um: Fix uml_mconsole stop/go
	docs: sysctl/kernel: add missing bit to panic_print
	openvswitch: Fixed nd target mask field in the flow dump.
	KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
	can: m_can: m_can_tx_handler(): fix use after free of skb
	can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
	coredump: Snapshot the vmas in do_coredump
	coredump: Remove the WARN_ON in dump_vma_snapshot
	coredump/elf: Pass coredump_params into fill_note_info
	coredump: Use the vma snapshot in fill_files_note
	arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones
	PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup"
	Linux 5.10.110

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I12fbe227793dd40c0582588e1700cf88cafd0ac6
2022-04-18 17:41:18 +02:00
Yake Yang
70a6cf749d Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
[ Upstream commit b062a0b9c1 ]

Fix the following kernel oops in btmtksdio_interrrupt

[   14.339134]  btmtksdio_interrupt+0x28/0x54
[   14.339139]  process_sdio_pending_irqs+0x68/0x1a0
[   14.339144]  sdio_irq_work+0x40/0x70
[   14.339154]  process_one_work+0x184/0x39c
[   14.339160]  worker_thread+0x228/0x3e8
[   14.339168]  kthread+0x148/0x3ac
[   14.339176]  ret_from_fork+0x10/0x30

That happened because hdev->power_on is already called before
sdio_set_drvdata which btmtksdio_interrupt handler relies on is not
properly set up.

The details are shown as the below: hci_register_dev would run
queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI
workqueue_struct to complete the power-on sequeunce and thus hci_power_on
may run before sdio_set_drvdata is done in btmtksdio_probe.

The hci_dev_do_open in hci_power_on would initialize the device and enable
the interrupt and thus it is possible that btmtksdio_interrupt is being
called right before sdio_set_drvdata is filled out.

When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled
, the kernel oops is going to happen because btmtksdio_interrupt access an
uninitialized pointer.

Fixes: 9aebfd4a22 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Reviewed-by: Mark Chen <markyawenchen@gmail.com>
Co-developed-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Yake Yang <yake.yang@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08 14:40:22 +02:00
Pavel Skripkin
96ea88eb9b Bluetooth: hci_serdev: call init_rwsem() before p->open()
[ Upstream commit 9d7cbe2b9c ]

kvartet reported, that hci_uart_tx_wakeup() uses uninitialized rwsem.
The problem was in wrong place for percpu_init_rwsem() call.

hci_uart_proto::open() may register a timer whose callback may call
hci_uart_tx_wakeup(). There is a chance, that hci_uart_register_device()
thread won't be fast enough to call percpu_init_rwsem().

Fix it my moving percpu_init_rwsem() call before p->open().

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 2 PID: 18524 Comm: syz-executor.5 Not tainted 5.16.0-rc6 #9
...
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 assign_lock_key kernel/locking/lockdep.c:951 [inline]
 register_lock_class+0x148d/0x1950 kernel/locking/lockdep.c:1263
 __lock_acquire+0x106/0x57e0 kernel/locking/lockdep.c:4906
 lock_acquire kernel/locking/lockdep.c:5637 [inline]
 lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5602
 percpu_down_read_trylock include/linux/percpu-rwsem.h:92 [inline]
 hci_uart_tx_wakeup+0x12e/0x490 drivers/bluetooth/hci_ldisc.c:124
 h5_timed_event+0x32f/0x6a0 drivers/bluetooth/hci_h5.c:188
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421

Fixes: d73e172816 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops")
Reported-by: Yiru Xu <xyru1999@gmail.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08 14:40:12 +02:00
Greg Kroah-Hartman
4ec3c2eea5 Merge 5.10.94 into android12-5.10-lts
Changes in 5.10.94
	KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
	HID: uhid: Fix worker destroying device without any protection
	HID: wacom: Reset expected and received contact counts at the same time
	HID: wacom: Ignore the confidence flag when a touch is removed
	HID: wacom: Avoid using stale array indicies to read contact count
	f2fs: fix to do sanity check in is_alive()
	nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
	mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
	mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
	mtd: Fixed breaking list in __mtd_del_partition.
	mtd: rawnand: davinci: Don't calculate ECC when reading page
	mtd: rawnand: davinci: Avoid duplicated page read
	mtd: rawnand: davinci: Rewrite function description
	x86/gpu: Reserve stolen memory for first integrated Intel GPU
	tools/nolibc: x86-64: Fix startup code bug
	tools/nolibc: i386: fix initial stack alignment
	tools/nolibc: fix incorrect truncation of exit code
	rtc: cmos: take rtc_lock while reading from CMOS
	media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
	media: flexcop-usb: fix control-message timeouts
	media: mceusb: fix control-message timeouts
	media: em28xx: fix control-message timeouts
	media: cpia2: fix control-message timeouts
	media: s2255: fix control-message timeouts
	media: dib0700: fix undefined behavior in tuner shutdown
	media: redrat3: fix control-message timeouts
	media: pvrusb2: fix control-message timeouts
	media: stk1160: fix control-message timeouts
	media: cec-pin: fix interrupt en/disable handling
	can: softing_cs: softingcs_probe(): fix memleak on registration failure
	iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
	lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
	iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
	gpu: host1x: Add back arm_iommu_detach_device()
	dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
	PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
	mm_zone: add function to check if managed dma zone exists
	dma/pool: create dma atomic pool only if dma zone has managed pages
	mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
	shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
	drm/ttm: Put BO in its memory manager's lru list
	Bluetooth: L2CAP: Fix not initializing sk_peer_pid
	drm/bridge: display-connector: fix an uninitialized pointer in probe()
	drm: fix null-ptr-deref in drm_dev_init_release()
	drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
	drm/panel: innolux-p079zca: Delete panel on attach() failure
	drm/rockchip: dsi: Fix unbalanced clock on probe error
	drm/rockchip: dsi: Hold pm-runtime across bind/unbind
	drm/rockchip: dsi: Disable PLL clock on bind error
	drm/rockchip: dsi: Reconfigure hardware on resume()
	Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
	clk: bcm-2835: Pick the closest clock rate
	clk: bcm-2835: Remove rounding up the dividers
	drm/vc4: hdmi: Set a default HSM rate
	wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
	wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
	wcn36xx: Fix DMA channel enable/disable cycle
	wcn36xx: Release DMA channel descriptor allocations
	wcn36xx: Put DXE block into reset before freeing memory
	wcn36xx: populate band before determining rate on RX
	wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
	ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
	mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
	media: videobuf2: Fix the size printk format
	media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
	media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
	media: atomisp: fix inverted logic in buffers_needed()
	media: atomisp: do not use err var when checking port validity for ISP2400
	media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
	media: atomisp: fix ifdefs in sh_css.c
	media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c
	media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
	media: atomisp: fix enum formats logic
	media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
	media: aspeed: fix mode-detect always time out at 2nd run
	media: em28xx: fix memory leak in em28xx_init_dev
	media: aspeed: Update signal status immediately to ensure sane hw state
	arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
	arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
	arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
	arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
	fs: dlm: use sk->sk_socket instead of con->sock
	fs: dlm: don't call kernel_getpeername() in error_report()
	memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
	Bluetooth: stop proccessing malicious adv data
	ath11k: Fix ETSI regd with weather radar overlap
	ath11k: clear the keys properly via DISABLE_KEY
	ath11k: reset RSN/WPA present state for open BSS
	tee: fix put order in teedev_close_context()
	fs: dlm: fix build with CONFIG_IPV6 disabled
	drm/vboxvideo: fix a NULL vs IS_ERR() check
	arm64: dts: renesas: cat875: Add rx/tx delays
	media: dmxdev: fix UAF when dvb_register_device() fails
	crypto: qce - fix uaf on qce_ahash_register_one
	crypto: qce - fix uaf on qce_skcipher_register_one
	mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
	ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
	crypto: qat - fix spelling mistake: "messge" -> "message"
	crypto: qat - remove unnecessary collision prevention step in PFVF
	crypto: qat - make pfvf send message direction agnostic
	crypto: qat - fix undetected PFVF timeout in ACK loop
	ath11k: Use host CE parameters for CE interrupts configuration
	arm64: dts: ti: k3-j721e: correct cache-sets info
	tty: serial: atmel: Check return code of dmaengine_submit()
	tty: serial: atmel: Call dma_async_issue_pending()
	mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
	mfd: atmel-flexcom: Use .resume_noirq
	media: rcar-csi2: Correct the selection of hsfreqrange
	media: imx-pxp: Initialize the spinlock prior to using it
	media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
	media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
	media: coda: fix CODA960 JPEG encoder buffer overflow
	media: venus: pm_helpers: Control core power domain manually
	media: venus: core, venc, vdec: Fix probe dependency error
	media: venus: core: Fix a potential NULL pointer dereference in an error handling path
	media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
	thermal/drivers/imx: Implement runtime PM support
	netfilter: bridge: add support for pppoe filtering
	arm64: dts: qcom: msm8916: fix MMC controller aliases
	cgroup: Trace event cgroup id fields should be u64
	ACPI: EC: Rework flushing of EC work while suspended to idle
	thermal/drivers/imx8mm: Enable ADC when enabling monitor
	drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
	drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
	arm64: dts: ti: k3-j7200: Fix the L2 cache sets
	arm64: dts: ti: k3-j721e: Fix the L2 cache sets
	arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
	tty: serial: uartlite: allow 64 bit address
	serial: amba-pl011: do not request memory region twice
	floppy: Fix hang in watchdog when disk is ejected
	staging: rtl8192e: return error code from rtllib_softmac_init()
	staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
	Bluetooth: btmtksdio: fix resume failure
	sched/fair: Fix detection of per-CPU kthreads waking a task
	sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
	bpf: Adjust BTF log size limit.
	bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
	bpf: Remove config check to enable bpf support for branch records
	arm64: lib: Annotate {clear, copy}_page() as position-independent
	arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
	media: dib8000: Fix a memleak in dib8000_init()
	media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
	media: si2157: Fix "warm" tuner state detection
	wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
	sched/rt: Try to restart rt period timer when rt runtime exceeded
	drm/msm/dp: displayPort driver need algorithm rational
	rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
	mwifiex: Fix possible ABBA deadlock
	xfrm: fix a small bug in xfrm_sa_len()
	x86/uaccess: Move variable into switch case statement
	selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST
	selftests: harness: avoid false negatives if test has no ASSERTs
	crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter
	crypto: stm32/cryp - fix CTR counter carry
	crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
	crypto: stm32/cryp - check early input data
	crypto: stm32/cryp - fix double pm exit
	crypto: stm32/cryp - fix lrw chaining mode
	crypto: stm32/cryp - fix bugs and crash in tests
	crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
	ath11k: Fix deleting uninitialized kernel timer during fragment cache flush
	ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
	media: dw2102: Fix use after free
	media: msi001: fix possible null-ptr-deref in msi001_probe()
	media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
	ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
	arm64: dts: qcom: c630: Fix soundcard setup
	arm64: dts: qcom: ipq6018: Fix gpio-ranges property
	drm/msm/dpu: fix safe status debugfs file
	drm/bridge: ti-sn65dsi86: Set max register for regmap
	drm/tegra: vic: Fix DMA API misuse
	media: hantro: Fix probe func error path
	xfrm: interface with if_id 0 should return error
	xfrm: state and policy should fail if XFRMA_IF_ID 0
	ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
	usb: ftdi-elan: fix memory leak on device disconnect
	arm64: dts: marvell: cn9130: add GPIO and SPI aliases
	arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
	ARM: dts: armada-38x: Add generic compatible to UART nodes
	iwlwifi: mvm: fix 32-bit build in FTM
	iwlwifi: mvm: test roc running status bits before removing the sta
	mmc: meson-mx-sdhc: add IRQ check
	mmc: meson-mx-sdio: add IRQ check
	selinux: fix potential memleak in selinux_add_opt()
	um: fix ndelay/udelay defines
	um: virtio_uml: Fix time-travel external time propagation
	Bluetooth: L2CAP: Fix using wrong mode
	bpftool: Enable line buffering for stdout
	backlight: qcom-wled: Validate enabled string indices in DT
	backlight: qcom-wled: Pass number of elements to read to read_u32_array
	backlight: qcom-wled: Fix off-by-one maximum with default num_strings
	backlight: qcom-wled: Override default length with qcom,enabled-strings
	backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion
	backlight: qcom-wled: Respect enabled-strings in set_brightness
	software node: fix wrong node passed to find nargs_prop
	Bluetooth: hci_qca: Stop IBS timer during BT OFF
	x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS
	hwmon: (mr75203) fix wrong power-up delay value
	x86/mce/inject: Avoid out-of-bounds write when setting flags
	ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
	pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
	pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
	power: reset: mt6397: Check for null res pointer
	netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
	bpf: Don't promote bogus looking registers after null check.
	bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
	netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
	ppp: ensure minimum packet size in ppp_write()
	rocker: fix a sleeping in atomic bug
	staging: greybus: audio: Check null pointer
	fsl/fman: Check for null pointer after calling devm_ioremap
	Bluetooth: hci_bcm: Check for error irq
	Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
	usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
	debugfs: lockdown: Allow reading debugfs files that are not world readable
	net/mlx5e: Fix page DMA map/unmap attributes
	net/mlx5e: Don't block routes with nexthop objects in SW
	Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
	net/mlx5: Set command entry semaphore up once got index free
	lib/mpi: Add the return value check of kcalloc()
	Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
	spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
	ax25: uninitialized variable in ax25_setsockopt()
	netrom: fix api breakage in nr_setsockopt()
	regmap: Call regmap_debugfs_exit() prior to _init()
	can: mcp251xfd: add missing newline to printed strings
	tpm: add request_locality before write TPM_INT_ENABLE
	tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
	can: softing: softing_startstop(): fix set but not used variable warning
	can: xilinx_can: xcan_probe(): check for error irq
	pcmcia: fix setting of kthread task states
	iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
	net: mcs7830: handle usb read errors properly
	ext4: avoid trim error on fs with small groups
	ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
	ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
	ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
	RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit"
	RDMA/hns: Validate the pkey index
	scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
	clk: imx8mn: Fix imx8mn_clko1_sels
	powerpc/prom_init: Fix improper check of prom_getprop()
	ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
	dt-bindings: thermal: Fix definition of cooling-maps contribution property
	powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C
	powerpc/perf: MMCR0 control for PMU registers under PMCC=00
	powerpc/perf: move perf irq/nmi handling details into traps.c
	powerpc/irq: Add helper to set regs->softe
	powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC
	powerpc/32s: Fix shift-out-of-bounds in KASAN init
	clocksource: Reduce clocksource-skew threshold
	clocksource: Avoid accidental unstable marking of clocksources
	ALSA: oss: fix compile error when OSS_DEBUG is enabled
	ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
	char/mwave: Adjust io port register size
	binder: fix handling of error during copy
	openrisc: Add clone3 ABI wrapper
	iommu/io-pgtable-arm: Fix table descriptor paddr formatting
	scsi: ufs: Fix race conditions related to driver data
	RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
	PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
	powerpc/powermac: Add additional missing lockdep_register_key()
	RDMA/core: Let ib_find_gid() continue search even after empty entry
	RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
	ASoC: rt5663: Handle device_property_read_u32_array error codes
	of: unittest: fix warning on PowerPC frame size warning
	of: unittest: 64 bit dma address test requires arch support
	clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell
	mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support
	mips: fix Kconfig reference to PHYS_ADDR_T_64BIT
	dmaengine: pxa/mmp: stop referencing config->slave_id
	iommu/amd: Remove iommu_init_ga()
	iommu/amd: Restore GA log/tail pointer on host resume
	ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
	iommu/iova: Fix race between FQ timeout and teardown
	scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
	phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
	ASoC: mediatek: Check for error clk pointer
	ASoC: samsung: idma: Check of ioremap return value
	misc: lattice-ecp3-config: Fix task hung when firmware load failed
	counter: stm32-lptimer-cnt: remove iio counter abi
	arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering
	arm64: tegra: Remove non existent Tegra194 reset
	mips: lantiq: add support for clk_set_parent()
	mips: bcm63xx: add support for clk_set_parent()
	powerpc/xive: Add missing null check after calling kmalloc
	ASoC: fsl_mqs: fix MODULE_ALIAS
	RDMA/cxgb4: Set queue pair state when being queried
	ASoC: fsl_asrc: refine the check of available clock divider
	clk: bm1880: remove kfrees on static allocations
	of: base: Fix phandle argument length mismatch error message
	ARM: dts: omap3-n900: Fix lp5523 for multi color
	Bluetooth: Fix debugfs entry leak in hci_register_dev()
	fs: dlm: filter user dlm messages for kernel locks
	drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
	selftests/bpf: Fix bpf_object leak in skb_ctx selftest
	ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
	drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR
	drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
	media: atomisp: fix try_fmt logic
	media: atomisp: set per-device's default mode
	media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure
	ARM: shmobile: rcar-gen2: Add missing of_node_put()
	batman-adv: allow netlink usage in unprivileged containers
	media: atomisp: handle errors at sh_css_create_isp_params()
	ath11k: Fix crash caused by uninitialized TX ring
	usb: gadget: f_fs: Use stream_open() for endpoint files
	drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
	HID: apple: Do not reset quirks when the Fn key is not found
	media: b2c2: Add missing check in flexcop_pci_isr:
	EDAC/synopsys: Use the quirk for version instead of ddr version
	ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
	drm/amd/display: check top_pipe_to_program pointer
	drm/amdgpu/display: set vblank_disable_immediate for DC
	soc: ti: pruss: fix referenced node in error message
	mlxsw: pci: Add shutdown method in PCI driver
	drm/bridge: megachips: Ensure both bridges are probed before registration
	tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()
	gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
	HSI: core: Fix return freed object in hsi_new_client
	crypto: jitter - consider 32 LSB for APT
	mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
	rsi: Fix use-after-free in rsi_rx_done_handler()
	rsi: Fix out-of-bounds read in rsi_read_pkt()
	ath11k: Avoid NULL ptr access during mgmt tx cleanup
	media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions
	ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table
	ACPI: Change acpi_device_always_present() into acpi_device_override_status()
	ACPI / x86: Allow specifying acpi_device_override_status() quirks by path
	ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win
	arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
	usb: uhci: add aspeed ast2600 uhci support
	floppy: Add max size check for user space request
	x86/mm: Flush global TLB when switching to trampoline page-table
	drm: rcar-du: Fix CRTC timings when CMM is used
	media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
	media: rcar-vin: Update format alignment constraints
	media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
	media: m920x: don't use stack on USB reads
	thunderbolt: Runtime PM activate both ends of the device link
	iwlwifi: mvm: synchronize with FW after multicast commands
	iwlwifi: mvm: avoid clearing a just saved session protection id
	ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
	ath10k: Fix tx hanging
	net-sysfs: update the queue counts in the unregistration path
	net: phy: prefer 1000baseT over 1000baseKX
	gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
	selftests/ftrace: make kprobe profile testcase description unique
	ath11k: Avoid false DEADLOCK warning reported by lockdep
	x86/mce: Allow instrumentation during task work queueing
	x86/mce: Mark mce_panic() noinstr
	x86/mce: Mark mce_end() noinstr
	x86/mce: Mark mce_read_aux() noinstr
	net: bonding: debug: avoid printing debug logs when bond is not notifying peers
	bpf: Do not WARN in bpf_warn_invalid_xdp_action()
	HID: quirks: Allow inverting the absolute X/Y values
	media: igorplugusb: receiver overflow should be reported
	media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
	mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
	audit: ensure userspace is penalized the same as the kernel when under pressure
	arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
	arm64: tegra: Adjust length of CCPLEX cluster MMIO region
	PM: runtime: Add safety net to supplier device release
	cpufreq: Fix initialization of min and max frequency QoS requests
	usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
	ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
	rtw88: 8822c: update rx settings to prevent potential hw deadlock
	PM: AVS: qcom-cpr: Use div64_ul instead of do_div
	iwlwifi: fix leaks/bad data after failed firmware load
	iwlwifi: remove module loading failure message
	iwlwifi: mvm: Fix calculation of frame length
	iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
	um: registers: Rename function names to avoid conflicts and build problems
	ath11k: Fix napi related hang
	Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
	xfrm: rate limit SA mapping change message to user space
	drm/etnaviv: consider completed fence seqno in hang check
	jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
	ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
	ACPICA: Utilities: Avoid deleting the same object twice in a row
	ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
	ACPICA: Fix wrong interpretation of PCC address
	ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
	drm/amdgpu: fixup bad vram size on gmc v8
	amdgpu/pm: Make sysfs pm attributes as read-only for VFs
	ACPI: battery: Add the ThinkPad "Not Charging" quirk
	btrfs: remove BUG_ON() in find_parent_nodes()
	btrfs: remove BUG_ON(!eie) in find_parent_nodes
	net: mdio: Demote probed message to debug print
	mac80211: allow non-standard VHT MCS-10/11
	dm btree: add a defensive bounds check to insert_at()
	dm space map common: add bounds check to sm_ll_lookup_bitmap()
	mlxsw: pci: Avoid flow control for EMAD packets
	net: phy: marvell: configure RGMII delays for 88E1118
	net: gemini: allow any RGMII interface mode
	regulator: qcom_smd: Align probe function with rpmh-regulator
	serial: pl010: Drop CR register reset on set_termios
	serial: core: Keep mctrl register state and cached copy in sync
	random: do not throw away excess input to crng_fast_load
	parisc: Avoid calling faulthandler_disabled() twice
	x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs
	powerpc/6xx: add missing of_node_put
	powerpc/powernv: add missing of_node_put
	powerpc/cell: add missing of_node_put
	powerpc/btext: add missing of_node_put
	powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
	i2c: i801: Don't silently correct invalid transfer size
	powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
	i2c: mpc: Correct I2C reset procedure
	clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
	powerpc/powermac: Add missing lockdep_register_key()
	KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots
	KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
	w1: Misuse of get_user()/put_user() reported by sparse
	nvmem: core: set size for sysfs bin file
	dm: fix alloc_dax error handling in alloc_dev
	scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
	ALSA: seq: Set upper limit of processed events
	MIPS: Loongson64: Use three arguments for slti
	powerpc/40x: Map 32Mbytes of memory at startup
	selftests/powerpc/spectre_v2: Return skip code when miss_percent is high
	powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
	powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic
	udf: Fix error handling in udf_new_inode()
	MIPS: OCTEON: add put_device() after of_find_device_by_node()
	irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
	i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
	MIPS: Octeon: Fix build errors using clang
	scsi: sr: Don't use GFP_DMA
	ASoC: mediatek: mt8173: fix device_node leak
	ASoC: mediatek: mt8183: fix device_node leak
	phy: mediatek: Fix missing check in mtk_mipi_tx_probe
	rpmsg: core: Clean up resources on announce_create failure.
	crypto: omap-aes - Fix broken pm_runtime_and_get() usage
	crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
	crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
	ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
	tpm: fix NPE on probe for missing device
	spi: uniphier: Fix a bug that doesn't point to private data correctly
	xen/gntdev: fix unmap notification order
	fuse: Pass correct lend value to filemap_write_and_wait_range()
	serial: Fix incorrect rs485 polarity on uart open
	cputime, cpuacct: Include guest time in user time in cpuacct.stat
	tracing/kprobes: 'nmissed' not showed correctly for kretprobe
	iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
	s390/mm: fix 2KB pgtable release race
	device property: Fix fwnode_graph_devcon_match() fwnode leak
	drm/etnaviv: limit submit sizes
	drm/nouveau/kms/nv04: use vzalloc for nv04_display
	drm/bridge: analogix_dp: Make PSR-exit block less
	parisc: Fix lpa and lpa_user defines
	powerpc/64s/radix: Fix huge vmap false positive
	PCI: xgene: Fix IB window setup
	PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
	PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only
	PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
	PCI: pci-bridge-emul: Fix definitions of reserved bits
	PCI: pci-bridge-emul: Correctly set PCIe capabilities
	PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
	xfrm: fix policy lookup for ipv6 gre packets
	btrfs: fix deadlock between quota enable and other quota operations
	btrfs: check the root node for uptodate before returning it
	btrfs: respect the max size in the header when activating swap file
	ext4: make sure to reset inode lockdep class when quota enabling fails
	ext4: make sure quota gets properly shutdown on error
	ext4: fix a possible ABBA deadlock due to busy PA
	ext4: initialize err_blk before calling __ext4_get_inode_loc
	ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
	ext4: set csum seed in tmp inode while migrating to extents
	ext4: Fix BUG_ON in ext4_bread when write quota data
	ext4: use ext4_ext_remove_space() for fast commit replay delete range
	ext4: fast commit may miss tracking unwritten range during ftruncate
	ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
	ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
	ext4: don't use the orphan list when migrating an inode
	drm/radeon: fix error handling in radeon_driver_open_kms
	of: base: Improve argument length mismatch error
	firmware: Update Kconfig help text for Google firmware
	can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message
	media: rcar-csi2: Optimize the selection PHTW register
	drm/vc4: hdmi: Make sure the device is powered with CEC
	media: correct MEDIA_TEST_SUPPORT help text
	Documentation: dmaengine: Correctly describe dmatest with channel unset
	Documentation: ACPI: Fix data node reference documentation
	Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
	Documentation: fix firewire.rst ABI file path error
	Bluetooth: hci_sync: Fix not setting adv set duration
	scsi: core: Show SCMD_LAST in text form
	dmaengine: uniphier-xdmac: Fix type of address variables
	RDMA/hns: Modify the mapping attribute of doorbell to device
	RDMA/rxe: Fix a typo in opcode name
	dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
	Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
	powerpc/cell: Fix clang -Wimplicit-fallthrough warning
	powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
	block: Fix fsync always failed if once failed
	bpftool: Remove inclusion of utilities.mak from Makefiles
	xdp: check prog type before updating BPF link
	perf evsel: Override attr->sample_period for non-libpfm4 events
	ipv4: update fib_info_cnt under spinlock protection
	ipv4: avoid quadratic behavior in netns dismantle
	net/fsl: xgmac_mdio: Add workaround for erratum A-009885
	net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
	parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
	f2fs: compress: fix potential deadlock of compress file
	f2fs: fix to reserve space for IO align feature
	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
	clk: Emit a stern warning with writable debugfs enabled
	clk: si5341: Fix clock HW provider cleanup
	net/smc: Fix hung_task when removing SMC-R devices
	net: axienet: increase reset timeout
	net: axienet: Wait for PhyRstCmplt after core reset
	net: axienet: reset core on initialization prior to MDIO access
	net: axienet: add missing memory barriers
	net: axienet: limit minimum TX ring size
	net: axienet: Fix TX ring slot available check
	net: axienet: fix number of TX ring slots for available check
	net: axienet: fix for TX busy handling
	net: axienet: increase default TX ring size to 128
	HID: vivaldi: fix handling devices not using numbered reports
	rtc: pxa: fix null pointer dereference
	vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
	virtio_ring: mark ring unused on error
	taskstats: Cleanup the use of task->exit_code
	inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
	netns: add schedule point in ops_exit_list()
	xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
	gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
	libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
	perf script: Fix hex dump character output
	dmaengine: at_xdmac: Don't start transactions at tx_submit level
	dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
	dmaengine: at_xdmac: Print debug message after realeasing the lock
	dmaengine: at_xdmac: Fix concurrency over xfers_list
	dmaengine: at_xdmac: Fix lld view setting
	dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
	perf probe: Fix ppc64 'perf probe add events failed' case
	devlink: Remove misleading internal_flags from health reporter dump
	arm64: dts: qcom: msm8996: drop not documented adreno properties
	net: bonding: fix bond_xmit_broadcast return value error bug
	net_sched: restore "mpu xxx" handling
	bcmgenet: add WOL IRQ check
	net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
	net: sfp: fix high power modules without diagnostic monitoring
	net: mscc: ocelot: fix using match before it is set
	dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
	dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
	dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
	scripts/dtc: dtx_diff: remove broken example from help text
	lib82596: Fix IRQ check in sni_82596_probe
	mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
	lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
	mtd: nand: bbt: Fix corner case in bad block table handling
	ath10k: Fix the MTU size on QCA9377 SDIO
	scripts: sphinx-pre-install: add required ctex dependency
	scripts: sphinx-pre-install: Fix ctex support on Debian
	Linux 5.10.94

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I857f2417c899508815a1ba13d1285fd400a1f133
2022-01-27 11:49:22 +01:00
Luiz Augusto von Dentz
0b7beb2fea Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
[ Upstream commit cfb4c313be ]

This set HCI_QUIRK_VALID_LE_STATES quirk which is required for the likes
of experimental LE simultaneous roles.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 10:54:18 +01:00
Miaoqian Lin
4579954bf4 Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
[ Upstream commit 6845667146 ]

The function devm_gpiod_get_index() return error pointers on error.
Thus devm_gpiod_get_index_optional() could return NULL and error pointers.
The same as devm_gpiod_get_optional() function. Using IS_ERR_OR_NULL()
check to catch error pointers.

Fixes: 77131dfe ("Bluetooth: hci_qca: Replace devm_gpiod_get() with devm_gpiod_get_optional()")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 10:54:01 +01:00
Jiasheng Jiang
f6bf3d6639 Bluetooth: hci_bcm: Check for error irq
[ Upstream commit b38cd3b42f ]

For the possible failure of the platform_get_irq(), the returned irq
could be error number and will finally cause the failure of the
request_irq().
Consider that platform_get_irq() can now in certain cases return
-EPROBE_DEFER, and the consequences of letting request_irq() effectively
convert that into -EINVAL, even at probe time rather than later on.
So it might be better to check just now.

Fixes: 0395ffc1ee ("Bluetooth: hci_bcm: Add PM for BCM devices")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 10:54:01 +01:00
Panicker Harish
70eec71f32 Bluetooth: hci_qca: Stop IBS timer during BT OFF
[ Upstream commit df1e5c5149 ]

The IBS timers are not stopped properly once BT OFF is triggered.
we could see IBS commands being sent along with version command,
so stopped IBS timers while Bluetooth is off.

Fixes: 3e4be65eb8 ("Bluetooth: hci_qca: Add poweroff support during hci down for wcn3990")
Signed-off-by: Panicker Harish <quic_pharish@quicinc.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 10:54:00 +01:00
Sean Wang
ec121517ac Bluetooth: btmtksdio: fix resume failure
[ Upstream commit 561ae1d46a ]

btmtksdio have to rely on MMC_PM_KEEP_POWER in pm_flags to avoid that
SDIO power is being shut off during the device is in suspend. That fixes
the SDIO command fails to access the bus after the device is resumed.

Fixes: 7f3c563c57 ("Bluetooth: btmtksdio: Add runtime PM support to SDIO based Bluetooth")
Co-developed-by: Mark-yw Chen <mark-yw.chen@mediatek.com>
Signed-off-by: Mark-yw Chen <mark-yw.chen@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 10:53:53 +01:00
Greg Kroah-Hartman
7dd0d263fe Merge 5.10.92 into android12-5.10-lts
Changes in 5.10.92
	md: revert io stats accounting
	workqueue: Fix unbind_workers() VS wq_worker_running() race
	bpf: Fix out of bounds access from invalid *_or_null type verification
	Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
	Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
	Bluetooth: btusb: Add support for Foxconn MT7922A
	Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
	Bluetooth: bfusb: fix division by zero in send path
	ARM: dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
	USB: core: Fix bug in resuming hub's handling of wakeup requests
	USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
	ath11k: Fix buffer overflow when scanning with extraie
	mmc: sdhci-pci: Add PCI ID for Intel ADL
	veth: Do not record rx queue hint in veth_xmit
	mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
	can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data
	can: isotp: convert struct tpcon::{idx,len} to unsigned int
	can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
	random: fix data race on crng_node_pool
	random: fix data race on crng init time
	random: fix crash on multiple early calls to add_bootloader_randomness()
	media: Revert "media: uvcvideo: Set unique vdev name based in type"
	staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()
	drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
	staging: greybus: fix stack size warning with UBSAN
	Linux 5.10.92

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If1a622474ca6cad5fbe08c171396f3df521bd9a0
2022-01-16 10:33:53 +01:00
Johan Hovold
b6dd070236 Bluetooth: bfusb: fix division by zero in send path
commit b5e6fa7a12 upstream.

Add the missing bulk-out endpoint sanity check to probe() to avoid
division by zero in bfusb_send_frame() in case a malicious device has
broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4f ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-16 09:14:22 +01:00
Aaron Ma
869e1677a0 Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
commit 1cd563ebd0 upstream.

Add an ID of Qualcomm Bluetooth SoC WCN6855.

T:  Bus=05 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e0d0 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:* If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
I:  If#= 1 Alt= 7 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  65 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  65 Ivl=1ms

Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-16 09:14:22 +01:00
Aaron Ma
c20021ce94 Bluetooth: btusb: Add support for Foxconn MT7922A
commit 6932627425 upstream.

Add 2 USB IDs for MT7922A chip.
These 2 devices got the same description.

T:  Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e0d8 Rev= 1.00

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e0d9 Rev= 1.00
S:  Manufacturer=MediaTek Inc.
S:  Product=Wireless_Device
S:  SerialNumber=000000000
C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us

Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-16 09:14:22 +01:00
Zijun Hu
8349391838 Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
commit d2666be51d upstream.

Add USB IDs (0x10ab, 0x9309) and (0x10ab, 0x9409) to
usb_device_id table for WCN6855.

* /sys/kernel/debug/usb/devices
T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=10ab ProdID=9309 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
I:  If#= 1 Alt= 7 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  65 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  65 Ivl=1ms

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=10ab ProdID=9409 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
I:  If#= 1 Alt= 7 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  65 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  65 Ivl=1ms

Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-16 09:14:22 +01:00
Mark-YW.Chen
294c0dd80d Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
commit 60c6a63a3d upstream.

Driver should free `usb->setup_packet` to avoid the leak.

$ cat /sys/kernel/debug/kmemleak
unreferenced object 0xffffffa564a58080 (size 128):
    backtrace:
        [<000000007eb8dd70>] kmem_cache_alloc_trace+0x22c/0x384
        [<000000008a44191d>] btusb_mtk_hci_wmt_sync+0x1ec/0x994
    [btusb]
        [<00000000ca7189a3>] btusb_mtk_setup+0x6b8/0x13cc
    [btusb]
        [<00000000c6105069>] hci_dev_do_open+0x290/0x974
    [bluetooth]
        [<00000000a583f8b8>] hci_power_on+0xdc/0x3cc [bluetooth]
        [<000000005d80e687>] process_one_work+0x514/0xc80
        [<00000000f4d57637>] worker_thread+0x818/0xd0c
        [<00000000dc7bdb55>] kthread+0x2f8/0x3b8
        [<00000000f9999513>] ret_from_fork+0x10/0x30

Fixes: a1c49c434e ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices")
Signed-off-by: Mark-YW.Chen <mark-yw.chen@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-16 09:14:22 +01:00
Tao Huang
f6909c028f Merge tag 'ASB-2021-12-05_12-5.10' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2021-12-01
CVE-2021-33909
CVE-2021-38204
CVE-2021-0961

* tag 'ASB-2021-12-05_12-5.10': (3010 commits)
  ANDROID: workqueue: export symbol of the function wq_worker_comm()
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: vendor_hooks: Add hooks for binder proc transaction
  ANDROID: GKI: Add symbols abi for USB IP kernel modules.
  ANDROID: GKI: Fix file mode on mtk abi file
  UPSTREAM: erofs: fix deadlock when shrink erofs slab
  ANDROID: init_task: Init android vendor and oem data
  UPSTREAM: sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
  ANDROID: Update symbol list for mtk
  UPSTREAM: erofs: fix unsafe pagevec reuse of hooked pclusters
  UPSTREAM: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
  UPSTREAM: usb: dwc3: gadget: Fix null pointer exception
  ANDROID: fips140: support "evaluation testing" builds via build.sh
  FROMGIT: sched/scs: Reset task stack state in bringup_cpu()
  ANDROID: dma-buf: heaps: fix dma-buf heap pool pages stat
  ANDROID: ABI: Add several spi_mem related symbols
  UPSTREAM: spi: spi-mem: add spi_mem_dtr_supports_op()
  ANDROID: gki_defconfig: enable CONFIG_SPI_MEM
  ANDROID: ABI: Add several iio related symbols
  ANDROID: ABI: Update symbol list for IMX
  ...

Change-Id: I09cddc92fa34553b944e62cc5cbbba94a84e5437

Conflicts:
	arch/arm/boot/dts/rk322x.dtsi
	arch/arm64/boot/dts/rockchip/rk3399.dtsi
	drivers/dma-buf/heaps/system_heap.c
	drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
	drivers/gpu/drm/rockchip/rockchip_drm_vop.c
	drivers/gpu/drm/rockchip/rockchip_lvds.c
	drivers/gpu/drm/rockchip/rockchip_vop_reg.c
	drivers/mtd/nand/spi/core.c
	drivers/pci/controller/pcie-rockchip-host.c
	drivers/soc/rockchip/Kconfig
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/core.h
2021-12-14 17:09:02 +08:00
Greg Kroah-Hartman
c553d9a246 Merge 5.10.80 into android12-5.10-lts
Changes in 5.10.80
	xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
	usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
	binder: use euid from cred instead of using task
	binder: use cred instead of task for selinux checks
	binder: use cred instead of task for getsecid
	Input: iforce - fix control-message timeout
	Input: elantench - fix misreporting trackpoint coordinates
	Input: i8042 - Add quirk for Fujitsu Lifebook T725
	libata: fix read log timeout value
	ocfs2: fix data corruption on truncate
	scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
	scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
	scsi: qla2xxx: Fix use after free in eh_abort path
	mmc: mtk-sd: Add wait dma stop done flow
	mmc: dw_mmc: Dont wait for DRTO on Write RSP error
	exfat: fix incorrect loading of i_blocks for large files
	parisc: Fix set_fixmap() on PA1.x CPUs
	parisc: Fix ptrace check on syscall return
	tpm: Check for integer overflow in tpm2_map_response_body()
	firmware/psci: fix application of sizeof to pointer
	crypto: s5p-sss - Add error handling in s5p_aes_probe()
	media: rkvdec: Do not override sizeimage for output format
	media: ite-cir: IR receiver stop working after receive overflow
	media: rkvdec: Support dynamic resolution changes
	media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
	media: v4l2-ioctl: Fix check_ext_ctrls
	ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
	ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
	ALSA: hda/realtek: Add quirk for Clevo PC70HS
	ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
	ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
	ALSA: hda/realtek: Add quirk for ASUS UX550VE
	ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
	ALSA: ua101: fix division by zero at probe
	ALSA: 6fire: fix control and bulk message timeouts
	ALSA: line6: fix control and interrupt message timeouts
	ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
	ALSA: usb-audio: Add registration quirk for JBL Quantum 400
	ALSA: hda: Free card instance properly at probe errors
	ALSA: synth: missing check for possible NULL after the call to kstrdup
	ALSA: timer: Fix use-after-free problem
	ALSA: timer: Unconditionally unlink slave instances, too
	ext4: fix lazy initialization next schedule time computation in more granular unit
	ext4: ensure enough credits in ext4_ext_shift_path_extents
	ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
	fuse: fix page stealing
	x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
	x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
	x86/irq: Ensure PI wakeup handler is unregistered before module unload
	ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked()
	ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers
	cavium: Return negative value when pci_alloc_irq_vectors() fails
	scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
	scsi: qla2xxx: Fix unmap of already freed sgl
	mISDN: Fix return values of the probe function
	cavium: Fix return values of the probe function
	sfc: Export fibre-specific supported link modes
	sfc: Don't use netif_info before net_device setup
	hyperv/vmbus: include linux/bitops.h
	ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode
	reset: socfpga: add empty driver allowing consumers to probe
	mmc: winbond: don't build on M68K
	drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
	fcnal-test: kill hanging ping/nettest binaries on cleanup
	bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT
	bpf: Prevent increasing bpf_jit_limit above max
	gpio: mlxbf2.c: Add check for bgpio_init failure
	xen/netfront: stop tx queues during live migration
	nvmet-tcp: fix a memory leak when releasing a queue
	spi: spl022: fix Microwire full duplex mode
	net: multicast: calculate csum of looped-back and forwarded packets
	watchdog: Fix OMAP watchdog early handling
	drm: panel-orientation-quirks: Add quirk for GPD Win3
	block: schedule queue restart after BLK_STS_ZONE_RESOURCE
	nvmet-tcp: fix header digest verification
	r8169: Add device 10ec:8162 to driver r8169
	vmxnet3: do not stop tx queues after netif_device_detach()
	nfp: bpf: relax prog rejection for mtu check through max_pkt_offset
	net/smc: Fix smc_link->llc_testlink_time overflow
	net/smc: Correct spelling mistake to TCPF_SYN_RECV
	rds: stop using dmapool
	btrfs: clear MISSING device status bit in btrfs_close_one_device
	btrfs: fix lost error handling when replaying directory deletes
	btrfs: call btrfs_check_rw_degradable only if there is a missing device
	KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
	ia64: kprobes: Fix to pass correct trampoline address to the handler
	selinux: fix race condition when computing ocontext SIDs
	hwmon: (pmbus/lm25066) Add offset coefficients
	regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
	regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
	EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
	mwifiex: fix division by zero in fw download path
	ath6kl: fix division by zero in send path
	ath6kl: fix control-message timeout
	ath10k: fix control-message timeout
	ath10k: fix division by zero in send path
	PCI: Mark Atheros QCA6174 to avoid bus reset
	rtl8187: fix control-message timeouts
	evm: mark evm_fixmode as __ro_after_init
	ifb: Depend on netfilter alternatively to tc
	wcn36xx: Fix HT40 capability for 2Ghz band
	wcn36xx: Fix tx_status mechanism
	wcn36xx: Fix (QoS) null data frame bitrate/modulation
	PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions
	mwifiex: Read a PCI register after writing the TX ring write pointer
	mwifiex: Try waking the firmware until we get an interrupt
	libata: fix checking of DMA state
	wcn36xx: handle connection loss indication
	rsi: fix occasional initialisation failure with BT coex
	rsi: fix key enabled check causing unwanted encryption for vap_id > 0
	rsi: fix rate mask set leading to P2P failure
	rsi: Fix module dev_oper_mode parameter description
	perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
	perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
	RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
	signal: Remove the bogus sigkill_pending in ptrace_stop
	memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
	signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
	soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
	soc: fsl: dpio: use the combined functions to protect critical zone
	mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
	power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
	power: supply: max17042_battery: use VFSOC for capacity when no rsns
	KVM: arm64: Extract ESR_ELx.EC only
	KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
	can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
	can: j1939: j1939_can_recv(): ignore messages with invalid source address
	powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
	ring-buffer: Protect ring_buffer_reset() from reentrancy
	serial: core: Fix initializing and restoring termios speed
	ifb: fix building without CONFIG_NET_CLS_ACT
	ALSA: mixer: oss: Fix racy access to slots
	ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
	xen/balloon: add late_initcall_sync() for initial ballooning done
	ovl: fix use after free in struct ovl_aio_req
	PCI: pci-bridge-emul: Fix emulation of W1C bits
	PCI: cadence: Add cdns_plat_pcie_probe() missing return
	PCI: aardvark: Do not clear status bits of masked interrupts
	PCI: aardvark: Fix checking for link up via LTSSM state
	PCI: aardvark: Do not unmask unused interrupts
	PCI: aardvark: Fix reporting Data Link Layer Link Active
	PCI: aardvark: Fix configuring Reference clock
	PCI: aardvark: Fix return value of MSI domain .alloc() method
	PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
	PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge
	PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
	PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
	PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
	quota: check block number when reading the block in quota file
	quota: correct error number in free_dqentry()
	pinctrl: core: fix possible memory leak in pinctrl_enable()
	coresight: cti: Correct the parameter for pm_runtime_put
	iio: dac: ad5446: Fix ad5622_write() return value
	iio: ad5770r: make devicetree property reading consistent
	USB: serial: keyspan: fix memleak on probe errors
	serial: 8250: fix racy uartclk update
	most: fix control-message timeouts
	USB: iowarrior: fix control-message timeouts
	USB: chipidea: fix interrupt deadlock
	power: supply: max17042_battery: Clear status bits in interrupt handler
	dma-buf: WARN on dmabuf release with pending attachments
	drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
	drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
	drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
	Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
	Bluetooth: fix use-after-free error in lock_sock_nested()
	drm/panel-orientation-quirks: add Valve Steam Deck
	rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
	platform/x86: wmi: do not fail if disabling fails
	MIPS: lantiq: dma: add small delay after reset
	MIPS: lantiq: dma: reset correct number of channel
	locking/lockdep: Avoid RCU-induced noinstr fail
	net: sched: update default qdisc visibility after Tx queue cnt changes
	rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
	smackfs: Fix use-after-free in netlbl_catmap_walk()
	ath11k: Align bss_chan_info structure with firmware
	x86: Increase exception stack sizes
	mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
	mwifiex: Properly initialize private structure on interface type changes
	fscrypt: allow 256-bit master keys with AES-256-XTS
	drm/amdgpu: Fix MMIO access page fault
	ath11k: Avoid reg rules update during firmware recovery
	ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
	ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
	ath10k: high latency fixes for beacon buffer
	media: mt9p031: Fix corrupted frame after restarting stream
	media: netup_unidvb: handle interrupt properly according to the firmware
	media: atomisp: Fix error handling in probe
	media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
	media: uvcvideo: Set capability in s_param
	media: uvcvideo: Return -EIO for control errors
	media: uvcvideo: Set unique vdev name based in type
	media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
	media: s5p-mfc: Add checking to s5p_mfc_probe().
	media: imx: set a media_device bus_info string
	media: mceusb: return without resubmitting URB in case of -EPROTO error.
	ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
	rtw88: fix RX clock gate setting while fifo dump
	brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
	media: rcar-csi2: Add checking to rcsi2_start_receiver()
	ipmi: Disable some operations during a panic
	fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
	ACPICA: Avoid evaluating methods too early during system resume
	media: ipu3-imgu: imgu_fmt: Handle properly try
	media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
	media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
	net-sysfs: try not to restart the syscall if it will fail eventually
	tracefs: Have tracefs directories not set OTH permission bits by default
	ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
	mmc: moxart: Fix reference count leaks in moxart_probe
	iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
	ACPI: battery: Accept charges over the design capacity as full
	drm/amdkfd: fix resume error when iommu disabled in Picasso
	net: phy: micrel: make *-skew-ps check more lenient
	leaking_addresses: Always print a trailing newline
	drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
	block: bump max plugged deferred size from 16 to 32
	md: update superblock after changing rdev flags in state_store
	memstick: r592: Fix a UAF bug when removing the driver
	lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
	lib/xz: Validate the value before assigning it to an enum variable
	workqueue: make sysfs of unbound kworker cpumask more clever
	tracing/cfi: Fix cmp_entries_* functions signature mismatch
	mt76: mt7915: fix an off-by-one bound check
	mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
	block: remove inaccurate requeue check
	media: allegro: ignore interrupt if mailbox is not initialized
	nvmet: fix use-after-free when a port is removed
	nvmet-rdma: fix use-after-free when a port is removed
	nvmet-tcp: fix use-after-free when a port is removed
	nvme: drop scan_lock and always kick requeue list when removing namespaces
	PM: hibernate: Get block device exclusively in swsusp_check()
	selftests: kvm: fix mismatched fclose() after popen()
	selftests/bpf: Fix perf_buffer test on system with offline cpus
	iwlwifi: mvm: disable RX-diversity in powersave
	smackfs: use __GFP_NOFAIL for smk_cipso_doi()
	ARM: clang: Do not rely on lr register for stacktrace
	gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
	gfs2: Cancel remote delete work asynchronously
	gfs2: Fix glock_hash_walk bugs
	ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
	vrf: run conntrack only in context of lower/physdev for locally generated packets
	net: annotate data-race in neigh_output()
	ACPI: AC: Quirk GK45 to skip reading _PSR
	btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
	btrfs: do not take the uuid_mutex in btrfs_rm_device
	spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
	wcn36xx: Correct band/freq reporting on RX
	x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
	drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
	selftests/core: fix conflicting types compile error for close_range()
	parisc: fix warning in flush_tlb_all
	task_stack: Fix end_of_stack() for architectures with upwards-growing stack
	erofs: don't trigger WARN() when decompression fails
	parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
	parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
	netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state
	selftests/bpf: Fix strobemeta selftest regression
	Bluetooth: fix init and cleanup of sco_conn.timeout_work
	rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
	MIPS: lantiq: dma: fix burst length for DEU
	objtool: Add xen_start_kernel() to noreturn list
	x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
	objtool: Fix static_call list generation
	drm/v3d: fix wait for TMU write combiner flush
	virtio-gpu: fix possible memory allocation failure
	lockdep: Let lock_is_held_type() detect recursive read as read
	net: net_namespace: Fix undefined member in key_remove_domain()
	cgroup: Make rebind_subsystems() disable v2 controllers all at once
	wcn36xx: Fix Antenna Diversity Switching
	wilc1000: fix possible memory leak in cfg_scan_result()
	Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
	crypto: caam - disable pkc for non-E SoCs
	rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
	net: dsa: rtl8366rb: Fix off-by-one bug
	ath11k: fix some sleeping in atomic bugs
	ath11k: Avoid race during regd updates
	ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
	ath11k: Fix memory leak in ath11k_qmi_driver_event_work
	ath10k: Fix missing frame timestamp for beacon/probe-resp
	ath10k: sdio: Add missing BH locking around napi_schdule()
	drm/ttm: stop calling tt_swapin in vm_access
	arm64: mm: update max_pfn after memory hotplug
	drm/amdgpu: fix warning for overflow check
	media: em28xx: add missing em28xx_close_extension
	media: cxd2880-spi: Fix a null pointer dereference on error handling path
	media: dvb-usb: fix ununit-value in az6027_rc_query
	media: v4l2-ioctl: S_CTRL output the right value
	media: TDA1997x: handle short reads of hdmi info frame.
	media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
	media: radio-wl1273: Avoid card name truncation
	media: si470x: Avoid card name truncation
	media: tm6000: Avoid card name truncation
	media: cx23885: Fix snd_card_free call on null card pointer
	kprobes: Do not use local variable when creating debugfs file
	crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
	cpuidle: Fix kobject memory leaks in error paths
	media: em28xx: Don't use ops->suspend if it is NULL
	ath9k: Fix potential interrupt storm on queue reset
	PM: EM: Fix inefficient states detection
	EDAC/amd64: Handle three rank interleaving mode
	rcu: Always inline rcu_dynticks_task*_{enter,exit}()
	netfilter: nft_dynset: relax superfluous check on set updates
	media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
	crypto: qat - detect PFVF collision after ACK
	crypto: qat - disregard spurious PFVF interrupts
	hwrng: mtk - Force runtime pm ops for sleep ops
	b43legacy: fix a lower bounds test
	b43: fix a lower bounds test
	gve: Recover from queue stall due to missed IRQ
	mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
	mmc: sdhci-omap: Fix context restore
	memstick: avoid out-of-range warning
	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
	net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
	hwmon: Fix possible memleak in __hwmon_device_register()
	hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
	ath10k: fix max antenna gain unit
	kernel/sched: Fix sched_fork() access an invalid sched_task_group
	tcp: switch orphan_count to bare per-cpu counters
	drm/msm: potential error pointer dereference in init()
	drm/msm: uninitialized variable in msm_gem_import()
	net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
	media: ir_toy: assignment to be16 should be of correct type
	mmc: mxs-mmc: disable regulator on error and in the remove function
	platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
	mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
	mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
	mt76: mt7915: fix possible infinite loop release semaphore
	mt76: mt7915: fix sta_rec_wtbl tag len
	mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
	rsi: stop thread firstly in rsi_91x_init() error handling
	mwifiex: Send DELBA requests according to spec
	net: enetc: unmap DMA in enetc_send_cmd()
	phy: micrel: ksz8041nl: do not use power down mode
	nvme-rdma: fix error code in nvme_rdma_setup_ctrl
	PM: hibernate: fix sparse warnings
	clocksource/drivers/timer-ti-dm: Select TIMER_OF
	x86/sev: Fix stack type check in vc_switch_off_ist()
	drm/msm: Fix potential NULL dereference in DPU SSPP
	smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
	KVM: selftests: Add operand to vmsave/vmload/vmrun in svm.c
	KVM: selftests: Fix nested SVM tests when built with clang
	bpftool: Avoid leaking the JSON writer prepared for program metadata
	libbpf: Fix BTF data layout checks and allow empty BTF
	libbpf: Allow loading empty BTFs
	libbpf: Fix overflow in BTF sanity checks
	libbpf: Fix BTF header parsing checks
	s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
	KVM: s390: pv: avoid double free of sida page
	KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
	irq: mips: avoid nested irq_enter()
	tpm: fix Atmel TPM crash caused by too frequent queries
	tpm_tis_spi: Add missing SPI ID
	libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
	tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
	spi: spi-rpc-if: Check return value of rpcif_sw_init()
	samples/kretprobes: Fix return value if register_kretprobe() failed
	KVM: s390: Fix handle_sske page fault handling
	libertas_tf: Fix possible memory leak in probe and disconnect
	libertas: Fix possible memory leak in probe and disconnect
	wcn36xx: add proper DMA memory barriers in rx path
	wcn36xx: Fix discarded frames due to wrong sequence number
	drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
	selftests: bpf: Convert sk_lookup ctx access tests to PROG_TEST_RUN
	selftests/bpf: Fix fd cleanup in sk_lookup test
	net: amd-xgbe: Toggle PLL settings during rate change
	net: phylink: avoid mvneta warning when setting pause parameters
	crypto: pcrypt - Delay write to padata->info
	selftests/bpf: Fix fclose/pclose mismatch in test_progs
	udp6: allow SO_MARK ctrl msg to affect routing
	ibmvnic: don't stop queue in xmit
	ibmvnic: Process crqs after enabling interrupts
	cgroup: Fix rootcg cpu.stat guest double counting
	bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
	bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
	of: unittest: fix EXPECT text for gpio hog errors
	iio: st_sensors: Call st_sensors_power_enable() from bus drivers
	iio: st_sensors: disable regulators after device unregistration
	RDMA/rxe: Fix wrong port_cap_flags
	ARM: dts: BCM5301X: Fix memory nodes names
	clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
	ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
	arm64: dts: rockchip: Fix GPU register width for RK3328
	ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
	RDMA/bnxt_re: Fix query SRQ failure
	arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
	arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
	arm64: dts: meson-g12a: Fix the pwm regulator supply properties
	arm64: dts: meson-g12b: Fix the pwm regulator supply properties
	bus: ti-sysc: Fix timekeeping_suspended warning on resume
	ARM: dts: at91: tse850: the emac<->phy interface is rmii
	scsi: dc395: Fix error case unwinding
	MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
	JFS: fix memleak in jfs_mount
	arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
	arm64: dts: renesas: beacon: Fix Ethernet PHY mode
	arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
	ALSA: hda: Reduce udelay() at SKL+ position reporting
	ALSA: hda: Release controller display power during shutdown/reboot
	ALSA: hda: Fix hang during shutdown due to link reset
	ALSA: hda: Use position buffer for SKL+ again
	soundwire: debugfs: use controller id and link_id for debugfs
	scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
	driver core: Fix possible memory leak in device_link_add()
	arm: dts: omap3-gta04a4: accelerometer irq fix
	ASoC: SOF: topology: do not power down primary core during topology removal
	soc/tegra: Fix an error handling path in tegra_powergate_power_up()
	memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
	clk: at91: check pmc node status before registering syscore ops
	video: fbdev: chipsfb: use memset_io() instead of memset()
	powerpc: Refactor is_kvm_guest() declaration to new header
	powerpc: Rename is_kvm_guest() to check_kvm_guest()
	powerpc: Reintroduce is_kvm_guest() as a fast-path check
	powerpc: Fix is_kvm_guest() / kvm_para_available()
	powerpc: fix unbalanced node refcount in check_kvm_guest()
	serial: 8250_dw: Drop wrong use of ACPI_PTR()
	usb: gadget: hid: fix error code in do_config()
	power: supply: rt5033_battery: Change voltage values to µV
	power: supply: max17040: fix null-ptr-deref in max17040_probe()
	scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
	RDMA/mlx4: Return missed an error if device doesn't support steering
	usb: musb: select GENERIC_PHY instead of depending on it
	staging: most: dim2: do not double-register the same device
	staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
	pinctrl: renesas: checker: Fix off-by-one bug in drive register check
	ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
	ARM: dts: stm32: fix SAI sub nodes register range
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	ASoC: cs42l42: Correct some register default values
	ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
	soc: qcom: rpmhpd: Provide some missing struct member descriptions
	soc: qcom: rpmhpd: Make power_on actually enable the domain
	usb: typec: STUSB160X should select REGMAP_I2C
	iio: adis: do not disabe IRQs in 'adis_init()'
	scsi: ufs: Refactor ufshcd_setup_clocks() to remove skip_ref_clk
	scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
	serial: imx: fix detach/attach of serial console
	usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
	usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
	usb: dwc2: drd: reset current session before setting the new one
	firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
	soc: qcom: apr: Add of_node_put() before return
	pinctrl: equilibrium: Fix function addition in multiple groups
	phy: qcom-qusb2: Fix a memory leak on probe
	phy: ti: gmii-sel: check of_get_address() for failure
	phy: qcom-snps: Correct the FSEL_MASK
	serial: xilinx_uartps: Fix race condition causing stuck TX
	clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
	HID: u2fzero: clarify error check and length calculations
	HID: u2fzero: properly handle timeouts in usb_submit_urb
	powerpc/44x/fsp2: add missing of_node_put
	ASoC: cs42l42: Disable regulators if probe fails
	ASoC: cs42l42: Use device_property API instead of of_property
	ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
	virtio_ring: check desc == NULL when using indirect with packed
	mips: cm: Convert to bitfield API to fix out-of-bounds access
	power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
	apparmor: fix error check
	rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
	nfsd: don't alloc under spinlock in rpc_parse_scope_id
	i2c: mediatek: fixing the incorrect register offset
	NFS: Fix dentry verifier races
	pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
	drm/plane-helper: fix uninitialized variable reference
	PCI: aardvark: Don't spam about PIO Response Status
	PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
	opp: Fix return in _opp_add_static_v2()
	NFS: Fix deadlocks in nfs_scan_commit_list()
	fs: orangefs: fix error return code of orangefs_revalidate_lookup()
	mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
	PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
	mtd: core: don't remove debugfs directory if device is in use
	remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()'
	rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
	dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
	NFS: Fix up commit deadlocks
	NFS: Fix an Oops in pnfs_mark_request_commit()
	Fix user namespace leak
	auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
	auxdisplay: ht16k33: Connect backlight to fbdev
	auxdisplay: ht16k33: Fix frame buffer device blanking
	soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read
	netfilter: nfnetlink_queue: fix OOB when mac header was cleared
	dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
	signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
	m68k: set a default value for MEMORY_RESERVE
	watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
	ar7: fix kernel builds for compiler test
	scsi: qla2xxx: Changes to support FCP2 Target
	scsi: qla2xxx: Relogin during fabric disturbance
	scsi: qla2xxx: Fix gnl list corruption
	scsi: qla2xxx: Turn off target reset during issue_lip
	NFSv4: Fix a regression in nfs_set_open_stateid_locked()
	i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
	xen-pciback: Fix return in pm_ctrl_init()
	net: davinci_emac: Fix interrupt pacing disable
	ethtool: fix ethtool msg len calculation for pause stats
	openrisc: fix SMP tlb flush NULL pointer dereference
	net: vlan: fix a UAF in vlan_dev_real_dev()
	ice: Fix replacing VF hardware MAC to existing MAC filter
	ice: Fix not stopping Tx queues for VFs
	ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
	drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
	net: phy: fix duplex out of sync problem while changing settings
	bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
	mfd: core: Add missing of_node_put for loop iteration
	can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable()
	mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
	zram: off by one in read_block_state()
	perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
	llc: fix out-of-bound array index in llc_sk_dev_hash()
	nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
	arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
	bpf, sockmap: Remove unhash handler for BPF sockmap usage
	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
	gve: Fix off by one in gve_tx_timeout()
	seq_file: fix passing wrong private data
	net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
	net: hns3: fix kernel crash when unload VF while it is being reset
	net: hns3: allow configure ETS bandwidth of all TCs
	net: stmmac: allow a tc-taprio base-time of zero
	vsock: prevent unnecessary refcnt inc for nonblocking connect
	net/smc: fix sk_refcnt underflow on linkdown and fallback
	cxgb4: fix eeprom len when diagnostics not implemented
	selftests/net: udpgso_bench_rx: fix port argument
	ARM: 9155/1: fix early early_iounmap()
	ARM: 9156/1: drop cc-option fallbacks for architecture selection
	parisc: Fix backtrace to always include init funtion names
	MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
	x86/mce: Add errata workaround for Skylake SKX37
	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
	irqchip/sifive-plic: Fixup EOI failed when masked
	f2fs: should use GFP_NOFS for directory inodes
	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
	9p/net: fix missing error check in p9_check_errors
	memcg: prohibit unconditional exceeding the limit of dying tasks
	powerpc/lib: Add helper to check if offset is within conditional branch range
	powerpc/bpf: Validate branch ranges
	powerpc/security: Add a helper to query stf_barrier type
	powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
	mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
	mm, oom: do not trigger out_of_memory from the #PF
	mfd: dln2: Add cell for initializing DLN2 ADC
	video: backlight: Drop maximum brightness override for brightness zero
	s390/cio: check the subchannel validity for dev_busid
	s390/tape: fix timer initialization in tape_std_assign()
	s390/ap: Fix hanging ioctl caused by orphaned replies
	s390/cio: make ccw_device_dma_* more robust
	mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
	powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
	powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
	drm/sun4i: Fix macros in sun8i_csc.h
	PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
	PCI: aardvark: Fix PCIe Max Payload Size setting
	SUNRPC: Partial revert of commit 6f9f17287e
	ath10k: fix invalid dma_addr_t token assignment
	mmc: moxart: Fix null pointer dereference on pointer host
	selftests/bpf: Fix also no-alu32 strobemeta selftest
	arch/cc: Introduce a function to check for confidential computing features
	x86/sev: Add an x86 version of cc_platform_has()
	x86/sev: Make the #VC exception stacks part of the default stacks storage
	soc/tegra: pmc: Fix imbalanced clock disabling in error code path
	Linux 5.10.80

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I21c750863965fbf584251fa2de3c941ae5922d3f
2021-11-19 11:50:41 +01:00
Dinghao Liu
f0b40bf3e4 Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
[ Upstream commit 3e5f2d90c2 ]

bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.

Fixes: e0b67035a9 ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:04:03 +01:00
Greg Kroah-Hartman
674d2ac211 Merge 5.10.62 into android12-5.10-lts
Changes in 5.10.62
	net: qrtr: fix another OOB Read in qrtr_endpoint_post
	bpf: Fix ringbuf helper function compatibility
	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
	ASoC: rt5682: Adjust headset volume button threshold
	ASoC: component: Remove misplaced prefix handling in pin control functions
	ARC: Fix CONFIG_STACKDEPOT
	netfilter: conntrack: collect all entries in one cycle
	once: Fix panic when module unload
	blk-iocost: fix lockdep warning on blkcg->lock
	ovl: fix uninitialized pointer read in ovl_lookup_real_one()
	net: mscc: Fix non-GPL export of regmap APIs
	can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
	ceph: correctly handle releasing an embedded cap flush
	riscv: Ensure the value of FP registers in the core dump file is up to date
	Revert "btrfs: compression: don't try to compress if we don't have enough pages"
	drm/amdgpu: Cancel delayed work when GFXOFF is disabled
	Revert "USB: serial: ch341: fix character loss at high transfer rates"
	USB: serial: option: add new VID/PID to support Fibocom FG150
	usb: renesas-xhci: Prefer firmware loading on unknown ROM state
	usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
	usb: dwc3: gadget: Stop EP0 transfers during pullup disable
	scsi: core: Fix hang of freezing queue between blocking and running device
	RDMA/bnxt_re: Add missing spin lock initialization
	IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
	RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init()
	ice: do not abort devlink info if board identifier can't be found
	net: usb: pegasus: fixes of set_register(s) return value evaluation;
	igc: fix page fault when thunderbolt is unplugged
	igc: Use num_tx_queues when iterating over tx_ring queue
	e1000e: Fix the max snoop/no-snoop latency for 10M
	e1000e: Do not take care about recovery NVM checksum
	RDMA/efa: Free IRQ vectors on error flow
	ip_gre: add validation for csum_start
	xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
	net: marvell: fix MVNETA_TX_IN_PRGRS bit number
	ucounts: Increase ucounts reference counter before the security hook
	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
	ipv6: use siphash in rt6_exception_hash()
	ipv4: use siphash instead of Jenkins in fnhe_hashfun()
	cxgb4: dont touch blocked freelist bitmap after free
	rtnetlink: Return correct error on changing device netns
	net: hns3: clear hardware resource when loading driver
	net: hns3: add waiting time before cmdq memory is released
	net: hns3: fix duplicate node in VLAN list
	net: hns3: fix get wrong pfc_en when query PFC configuration
	Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711"
	net: stmmac: add mutex lock to protect est parameters
	net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
	drm/i915: Fix syncmap memory leak
	usb: gadget: u_audio: fix race condition on endpoint stop
	dt-bindings: sifive-l2-cache: Fix 'select' matching
	perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
	clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference
	iwlwifi: pnvm: accept multiple HW-type TLVs
	opp: remove WARN when no valid OPPs remain
	cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
	virtio: Improve vq->broken access to avoid any compiler optimization
	virtio_pci: Support surprise removal of virtio pci device
	virtio_vdpa: reject invalid vq indices
	vringh: Use wiov->used to check for read/write desc order
	tools/virtio: fix build
	qed: qed ll2 race condition fixes
	qed: Fix null-pointer dereference in qed_rdma_create_qp()
	Revert "drm/amd/pm: fix workload mismatch on vega10"
	drm/amd/pm: change the workload type for some cards
	blk-mq: don't grab rq's refcount in blk_mq_check_expired()
	drm: Copy drm_wait_vblank to user before returning
	drm/nouveau/disp: power down unused DP links during init
	drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences
	net/rds: dma_map_sg is entitled to merge entries
	btrfs: fix race between marking inode needs to be logged and log syncing
	pipe: avoid unnecessary EPOLLET wakeups under normal loads
	pipe: do FASYNC notifications for every pipe IO, not just state changes
	mtd: spinand: Fix incorrect parameters for on-die ECC
	tipc: call tipc_wait_for_connect only when dlen is not 0
	vt_kdsetmode: extend console locking
	Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
	riscv: Fixup wrong ftrace remove cflag
	riscv: Fixup patch_text panic in ftrace
	perf env: Fix memory leak of bpf_prog_info_linear member
	perf symbol-elf: Fix memory leak by freeing sdt_note.args
	perf record: Fix memory leak in vDSO found using ASAN
	perf tools: Fix arm64 build error with gcc-11
	perf annotate: Fix jump parsing for C++ code.
	powerpc/perf: Invoke per-CPU variable access with disabled interrupts
	srcu: Provide internal interface to start a Tree SRCU grace period
	srcu: Provide polling interfaces for Tree SRCU grace periods
	srcu: Provide internal interface to start a Tiny SRCU grace period
	srcu: Make Tiny SRCU use multi-bit grace-period counter
	srcu: Provide polling interfaces for Tiny SRCU grace periods
	tracepoint: Use rcu get state and cond sync for static call updates
	usb: typec: ucsi: acpi: Always decode connector change information
	usb: typec: ucsi: Work around PPM losing change information
	usb: typec: ucsi: Clear pending after acking connector change
	net: dsa: mt7530: fix VLAN traffic leaks again
	lkdtm: Enable DOUBLE_FAULT on all architectures
	arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
	btrfs: fix NULL pointer dereference when deleting device by invalid id
	kthread: Fix PF_KTHREAD vs to_kthread() race
	Revert "floppy: reintroduce O_NDELAY fix"
	Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
	audit: move put_tree() to avoid trim_trees refcount underflow and UAF
	bpf: Fix potentially incorrect results with bpf_get_local_storage()
	Linux 5.10.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3
2021-09-03 10:51:56 +02:00
Pauli Virtanen
b42fde92cd Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
commit 55981d3541 upstream.

Some USB BT adapters don't satisfy the MTU requirement mentioned in
commit e848dbd364 ("Bluetooth: btusb: Add support USB ALT 3 for WBS")
and have ALT 3 setting that produces no/garbled audio. Some adapters
with larger MTU were also reported to have problems with ALT 3.

Add a flag and check it and MTU before selecting ALT 3, falling back to
ALT 1. Enable the flag for Realtek, restoring the previous behavior for
non-Realtek devices.

Tested with USB adapters (mtu<72, no/garbled sound with ALT3, ALT1
works) BCM20702A1 0b05:17cb, CSR8510A10 0a12:0001, and (mtu>=72, ALT3
works) RTL8761BU 0bda:8771, Intel AX200 8087:0029 (after disabling
ALT6). Also got reports for (mtu>=72, ALT 3 reported to produce bad
audio) Intel 8087:0a2b.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Fixes: e848dbd364 ("Bluetooth: btusb: Add support USB ALT 3 for WBS")
Tested-by: Michał Kępień <kernel@kempniu.pl>
Tested-by: Jonathan Lampérth <jon@h4n.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-03 10:09:28 +02:00
Greg Kroah-Hartman
8db62be3c3 Merge 5.10.51 into android12-5.10-lts
Changes in 5.10.51
	drm/mxsfb: Don't select DRM_KMS_FB_HELPER
	drm/zte: Don't select DRM_KMS_FB_HELPER
	drm/ast: Fixed CVE for DP501
	drm/amd/display: fix HDCP reset sequence on reinitialize
	drm/amd/amdgpu/sriov disable all ip hw status by default
	drm/vc4: fix argument ordering in vc4_crtc_get_margins()
	drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true
	net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
	drm/amd/display: fix use_max_lb flag for 420 pixel formats
	clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe()
	hugetlb: clear huge pte during flush function on mips platform
	atm: iphase: fix possible use-after-free in ia_module_exit()
	mISDN: fix possible use-after-free in HFC_cleanup()
	atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
	net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
	drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init()
	net: mdio: ipq8064: add regmap config to disable REGCACHE
	drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE
	reiserfs: add check for invalid 1st journal block
	drm/virtio: Fix double free on probe failure
	net: mdio: provide shim implementation of devm_of_mdiobus_register
	net/sched: cls_api: increase max_reclassify_loop
	pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE
	drm/scheduler: Fix hang when sched_entity released
	drm/sched: Avoid data corruptions
	udf: Fix NULL pointer dereference in udf_symlink function
	drm/vc4: Fix clock source for VEC PixelValve on BCM2711
	drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co()
	e100: handle eeprom as little endian
	igb: handle vlan types with checker enabled
	igb: fix assignment on big endian machines
	drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer()
	clk: renesas: r8a77995: Add ZA2 clock
	net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet
	net/mlx5: Fix lag port remapping logic
	drm: rockchip: add missing registers for RK3188
	drm: rockchip: add missing registers for RK3066
	net: stmmac: the XPCS obscures a potential "PHY not found" error
	RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH
	clk: tegra: Fix refcounting of gate clocks
	clk: tegra: Ensure that PLLU configuration is applied properly
	drm: bridge: cdns-mhdp8546: Fix PM reference leak in
	virtio-net: Add validation for used length
	ipv6: use prandom_u32() for ID generation
	MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B)
	MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER
	drm/amd/display: Avoid HDCP over-read and corruption
	drm/amdgpu: remove unsafe optimization to drop preamble ib
	net: tcp better handling of reordering then loss cases
	RDMA/cxgb4: Fix missing error code in create_qp()
	dm space maps: don't reset space map allocation cursor when committing
	dm writecache: don't split bios when overwriting contiguous cache content
	dm: Fix dm_accept_partial_bio() relative to zone management commands
	net: bridge: mrp: Update ring transitions.
	pinctrl: mcp23s08: fix race condition in irq handler
	ice: set the value of global config lock timeout longer
	ice: fix clang warning regarding deadcode.DeadStores
	virtio_net: Remove BUG() to avoid machine dead
	net: mscc: ocelot: check return value after calling platform_get_resource()
	net: bcmgenet: check return value after calling platform_get_resource()
	net: mvpp2: check return value after calling platform_get_resource()
	net: micrel: check return value after calling platform_get_resource()
	net: moxa: Use devm_platform_get_and_ioremap_resource()
	drm/amd/display: Fix DCN 3.01 DSCCLK validation
	drm/amd/display: Update scaling settings on modeset
	drm/amd/display: Release MST resources on switch from MST to SST
	drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7
	drm/amd/display: Fix off-by-one error in DML
	net: phy: realtek: add delay to fix RXC generation issue
	selftests: Clean forgotten resources as part of cleanup()
	net: sgi: ioc3-eth: check return value after calling platform_get_resource()
	drm/amdkfd: use allowed domain for vmbo validation
	fjes: check return value after calling platform_get_resource()
	selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
	r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM
	drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check
	xfrm: Fix error reporting in xfrm_state_construct.
	dm writecache: commit just one block, not a full page
	wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
	wl1251: Fix possible buffer overflow in wl1251_cmd_scan
	cw1200: add missing MODULE_DEVICE_TABLE
	drm/amdkfd: fix circular locking on get_wave_state
	drm/amdkfd: Fix circular lock in nocpsch path
	bpf: Fix up register-based shifts in interpreter to silence KUBSAN
	ice: fix incorrect payload indicator on PTYPE
	ice: mark PTYPE 2 as reserved
	mt76: mt7615: fix fixed-rate tx status reporting
	net: fix mistake path for netdev_features_strings
	net: ipa: Add missing of_node_put() in ipa_firmware_load()
	net: sched: fix error return code in tcf_del_walker()
	io_uring: fix false WARN_ONCE
	drm/amdgpu: fix bad address translation for sienna_cichlid
	drm/amdkfd: Walk through list with dqm lock hold
	mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode
	rtl8xxxu: Fix device info for RTL8192EU devices
	MIPS: add PMD table accounting into MIPS'pmd_alloc_one
	net: fec: add ndo_select_queue to fix TX bandwidth fluctuations
	atm: nicstar: use 'dma_free_coherent' instead of 'kfree'
	atm: nicstar: register the interrupt handler in the right place
	vsock: notify server to shutdown when client has pending signal
	RDMA/rxe: Don't overwrite errno from ib_umem_get()
	iwlwifi: mvm: don't change band on bound PHY contexts
	iwlwifi: mvm: fix error print when session protection ends
	iwlwifi: pcie: free IML DMA memory allocation
	iwlwifi: pcie: fix context info freeing
	sfc: avoid double pci_remove of VFs
	sfc: error code if SRIOV cannot be disabled
	wireless: wext-spy: Fix out-of-bounds warning
	cfg80211: fix default HE tx bitrate mask in 2G band
	mac80211: consider per-CPU statistics if present
	mac80211_hwsim: add concurrent channels scanning support over virtio
	IB/isert: Align target max I/O size to initiator size
	media, bpf: Do not copy more entries than user space requested
	net: ip: avoid OOM kills with large UDP sends over loopback
	RDMA/cma: Fix rdma_resolve_route() memory leak
	Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.
	Bluetooth: Fix the HCI to MGMT status conversion table
	Bluetooth: Fix alt settings for incoming SCO with transparent coding format
	Bluetooth: Shutdown controller after workqueues are flushed or cancelled
	Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500)
	Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails
	Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
	Bluetooth: btusb: Add support USB ALT 3 for WBS
	Bluetooth: mgmt: Fix the command returns garbage parameter value
	Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
	sched/fair: Ensure _sum and _avg values stay consistent
	bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc()
	flow_offload: action should not be NULL when it is referenced
	sctp: validate from_addr_param return
	sctp: add size validation when walking chunks
	MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops
	MIPS: set mips32r5 for virt extensions
	selftests/resctrl: Fix incorrect parsing of option "-t"
	MIPS: MT extensions are not available on MIPS32r1
	ath11k: unlock on error path in ath11k_mac_op_add_interface()
	arm64: dts: rockchip: add rk3328 dwc3 usb controller node
	arm64: dts: rockchip: Enable USB3 for rk3328 Rock64
	loop: fix I/O error on fsync() in detached loop devices
	mm,hwpoison: return -EBUSY when migration fails
	io_uring: simplify io_remove_personalities()
	io_uring: Convert personality_idr to XArray
	io_uring: convert io_buffer_idr to XArray
	scsi: iscsi: Fix race condition between login and sync thread
	scsi: iscsi: Fix iSCSI cls conn state
	powerpc/mm: Fix lockup on kernel exec fault
	powerpc/barrier: Avoid collision with clang's __lwsync macro
	powerpc/powernv/vas: Release reference to tgid during window close
	drm/amdgpu: Update NV SIMD-per-CU to 2
	drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2)
	drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create()
	drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64
	drm/vc4: txp: Properly set the possible_crtcs mask
	drm/vc4: crtc: Skip the TXP
	drm/vc4: hdmi: Prevent clock unbalance
	drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info()
	drm/rockchip: dsi: remove extra component_del() call
	drm/amd/display: fix incorrrect valid irq check
	pinctrl/amd: Add device HID for new AMD GPIO controller
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/tegra: Don't set allow_fb_modifiers explicitly
	drm/msm/mdp4: Fix modifier support enabling
	drm/arm/malidp: Always list modifiers
	drm/nouveau: Don't set allow_fb_modifiers explicitly
	drm/i915/display: Do not zero past infoframes.vsc
	mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B
	mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
	mmc: core: clear flags before allowing to retune
	mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
	ata: ahci_sunxi: Disable DIPM
	arm64: tlb: fix the TTL value of tlb_get_level
	cpu/hotplug: Cure the cpusets trainwreck
	clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
	fpga: stratix10-soc: Add missing fpga_mgr_free() call
	ASoC: tegra: Set driver_name=tegra for all machine drivers
	i40e: fix PTP on 5Gb links
	qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
	ipmi/watchdog: Stop watchdog timer when the current action is 'none'
	thermal/drivers/int340x/processor_thermal: Fix tcc setting
	ubifs: Fix races between xattr_{set|get} and listxattr operations
	power: supply: ab8500: Fix an old bug
	mfd: syscon: Free the allocated name field of struct regmap_config
	nvmem: core: add a missing of_node_put
	lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE
	selftests/lkdtm: Fix expected text for CR4 pinning
	extcon: intel-mrfld: Sync hardware and software state on init
	seq_buf: Fix overflow in seq_buf_putmem_hex()
	rq-qos: fix missed wake-ups in rq_qos_throttle try two
	tracing: Simplify & fix saved_tgids logic
	tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
	ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
	coresight: Propagate symlink failure
	coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
	dm zoned: check zone capacity
	dm writecache: flush origin device when writing and cache is full
	dm btree remove: assign new_root only when removal succeeds
	PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
	PCI: aardvark: Fix checking for PIO Non-posted Request
	PCI: aardvark: Implement workaround for the readback value of VEND_ID
	media: subdev: disallow ioctl for saa6588/davinci
	media: dtv5100: fix control-request directions
	media: zr364xx: fix memory leak in zr364xx_start_readpipe
	media: gspca/sq905: fix control-request direction
	media: gspca/sunplus: fix zero-length control requests
	media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
	io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function
	dm writecache: write at least 4k when committing
	pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq()
	drm/ast: Remove reference to struct drm_device.pdev
	jfs: fix GPF in diFree
	smackfs: restrict bytes count in smk_set_cipso()
	ext4: fix memory leak in ext4_fill_super
	f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
	Linux 5.10.51

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Icb10fed733a0050848ecc23db13ae3d134895acd
2021-07-19 17:29:53 +02:00
Tim Jiang
e2296a4365 Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
[ Upstream commit 4f00bfb372 ]

This is btsoc timing issue, after host start to downloading bt firmware,
ep2 need time to switch from function acl to function dfu, so host add
20ms delay as workaround.

Signed-off-by: Tim Jiang <tjiang@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:54 +02:00
Hilda Wu
05298f1733 Bluetooth: btusb: Add support USB ALT 3 for WBS
[ Upstream commit e848dbd364 ]

Because mSBC frames do not need to be aligned to the SCO packet
boundary. Using USB ALT 3 let HCI payload >= 60 bytes, let mSBC
data satisfy 60 Bytes avoid payload unaligned situation and fixed
some headset no voise issue.

USB Alt 3 supported also need HFP support transparent MTU in 72 Bytes.

Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:54 +02:00
Daniel Lenski
c4a9967e4d Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500)
[ Upstream commit 0324d19cb9 ]

This patch adds the 0cf3:e500 Bluetooth device (from a QCA9377 board) as a
QCA_ROME device.  It appears to be functionally identical to another device
ID, also from a QCA9377 board, which was previously marked as QCA_ROME in
0a03f98b98
("Bluetooth: Add a new 04ca:3015 QCA_ROME device").

Without this patch, the WiFi side of the QCA9377 board is slow or unusable
when the Bluetooth side is in use.

See https://askubuntu.com/a/1137852 for another report of QCA_ROME fixing
this issue for this device ID.

/sys/kernel/debug/usb/devices:

T:  Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0cf3 ProdID=e500 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Daniel Lenski <dlenski@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:54 +02:00
mark-yw.chen
5f5f8022c1 Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.
[ Upstream commit 8454ed9ff9 ]

This patch reduce in-token during download patch procedure.
Don't submit urb for polling event before sending hci command.

Signed-off-by: mark-yw.chen <mark-yw.chen@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:53 +02:00
Greg Kroah-Hartman
2df0fb4a4b Merge 5.10.50 into android12-5.10-lts
Changes in 5.10.50
	Bluetooth: hci_qca: fix potential GPF
	Bluetooth: btqca: Don't modify firmware contents in-place
	Bluetooth: Remove spurious error message
	ALSA: usb-audio: fix rate on Ozone Z90 USB headset
	ALSA: usb-audio: Fix OOB access at proc output
	ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire
	ALSA: usb-audio: scarlett2: Fix wrong resume call
	ALSA: intel8x0: Fix breakage at ac97 clock measurement
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8
	ALSA: hda/realtek: Add another ALC236 variant support
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8
	ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx
	ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D
	ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC
	media: dvb-usb: fix wrong definition
	Input: usbtouchscreen - fix control-request directions
	net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
	usb: gadget: eem: fix echo command packet response issue
	usb: renesas-xhci: Fix handling of unknown ROM state
	USB: cdc-acm: blacklist Heimann USB Appset device
	usb: dwc3: Fix debugfs creation flow
	usb: typec: Add the missed altmode_id_remove() in typec_register_altmode()
	xhci: solve a double free problem while doing s4
	gfs2: Fix underflow in gfs2_page_mkwrite
	gfs2: Fix error handling in init_statfs
	ntfs: fix validity check for file name attribute
	selftests/lkdtm: Avoid needing explicit sub-shell
	copy_page_to_iter(): fix ITER_DISCARD case
	iov_iter_fault_in_readable() should do nothing in xarray case
	Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
	crypto: nx - Fix memcpy() over-reading in nonce
	crypto: ccp - Annotate SEV Firmware file names
	arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode
	ARM: dts: ux500: Fix LED probing
	ARM: dts: at91: sama5d4: fix pinctrl muxing
	btrfs: send: fix invalid path for unlink operations after parent orphanization
	btrfs: compression: don't try to compress if we don't have enough pages
	btrfs: clear defrag status of a root if starting transaction fails
	ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle
	ext4: fix kernel infoleak via ext4_extent_header
	ext4: fix overflow in ext4_iomap_alloc()
	ext4: return error code when ext4_fill_flex_info() fails
	ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit
	ext4: remove check for zero nr_to_scan in ext4_es_scan()
	ext4: fix avefreec in find_group_orlov
	ext4: use ext4_grp_locked_error in mb_find_extent
	can: bcm: delay release of struct bcm_op after synchronize_rcu()
	can: gw: synchronize rcu operations before removing gw job entry
	can: isotp: isotp_release(): omit unintended hrtimer restart on socket release
	can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done
	can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path
	mac80211: remove iwlwifi specific workaround that broke sta NDP tx
	SUNRPC: Fix the batch tasks count wraparound.
	SUNRPC: Should wake up the privileged task firstly.
	bus: mhi: Wait for M2 state during system resume
	mm/gup: fix try_grab_compound_head() race with split_huge_page()
	perf/smmuv3: Don't trample existing events with global filter
	KVM: nVMX: Handle split-lock #AC exceptions that happen in L2
	KVM: PPC: Book3S HV: Workaround high stack usage with clang
	KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
	KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk
	s390/cio: dont call css_wait_for_slow_path() inside a lock
	s390: mm: Fix secure storage access exception handling
	f2fs: Prevent swap file in LFS mode
	clk: agilex/stratix10/n5x: fix how the bypass_reg is handled
	clk: agilex/stratix10: remove noc_clk
	clk: agilex/stratix10: fix bypass representation
	rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path
	iio: frequency: adf4350: disable reg and clk on error in adf4350_probe()
	iio: light: tcs3472: do not free unallocated IRQ
	iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too
	iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR
	iio: ltr501: ltr501_read_ps(): add missing endianness conversion
	iio: accel: bma180: Fix BMA25x bandwidth register values
	serial: mvebu-uart: fix calculation of clock divisor
	serial: sh-sci: Stop dmaengine transfer in sci_stop_tx()
	serial_cs: Add Option International GSM-Ready 56K/ISDN modem
	serial_cs: remove wrong GLOBETROTTER.cis entry
	ath9k: Fix kernel NULL pointer dereference during ath_reset_internal()
	ssb: sdio: Don't overwrite const buffer if block_write fails
	rsi: Assign beacon rate settings to the correct rate_info descriptor field
	rsi: fix AP mode with WPA failure due to encrypted EAPOL
	tracing/histograms: Fix parsing of "sym-offset" modifier
	tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
	seq_buf: Make trace_seq_putmem_hex() support data longer than 8
	powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()
	loop: Fix missing discard support when using LOOP_CONFIGURE
	evm: Execute evm_inode_init_security() only when an HMAC key is loaded
	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded
	fuse: Fix crash in fuse_dentry_automount() error path
	fuse: Fix crash if superblock of submount gets killed early
	fuse: Fix infinite loop in sget_fc()
	fuse: ignore PG_workingset after stealing
	fuse: check connected before queueing on fpq->io
	fuse: reject internal errno
	thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure
	spi: Make of_register_spi_device also set the fwnode
	Add a reference to ucounts for each cred
	staging: media: rkvdec: fix pm_runtime_get_sync() usage count
	media: marvel-ccic: fix some issues when getting pm_runtime
	media: mdk-mdp: fix pm_runtime_get_sync() usage count
	media: s5p: fix pm_runtime_get_sync() usage count
	media: am437x: fix pm_runtime_get_sync() usage count
	media: sh_vou: fix pm_runtime_get_sync() usage count
	media: mtk-vcodec: fix PM runtime get logic
	media: s5p-jpeg: fix pm_runtime_get_sync() usage count
	media: sunxi: fix pm_runtime_get_sync() usage count
	media: sti/bdisp: fix pm_runtime_get_sync() usage count
	media: exynos4-is: fix pm_runtime_get_sync() usage count
	media: exynos-gsc: fix pm_runtime_get_sync() usage count
	spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
	spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages()
	spi: omap-100k: Fix the length judgment problem
	regulator: uniphier: Add missing MODULE_DEVICE_TABLE
	sched/core: Initialize the idle task with preemption disabled
	hwrng: exynos - Fix runtime PM imbalance on error
	crypto: nx - add missing MODULE_DEVICE_TABLE
	media: sti: fix obj-$(config) targets
	media: cpia2: fix memory leak in cpia2_usb_probe
	media: cobalt: fix race condition in setting HPD
	media: hevc: Fix dependent slice segment flags
	media: pvrusb2: fix warning in pvr2_i2c_core_done
	media: imx: imx7_mipi_csis: Fix logging of only error event counters
	crypto: qat - check return code of qat_hal_rd_rel_reg()
	crypto: qat - remove unused macro in FW loader
	crypto: qce: skcipher: Fix incorrect sg count for dma transfers
	arm64: perf: Convert snprintf to sysfs_emit
	sched/fair: Fix ascii art by relpacing tabs
	media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to set xvclk on/off
	media: bt878: do not schedule tasklet when it is not setup
	media: em28xx: Fix possible memory leak of em28xx struct
	media: hantro: Fix .buf_prepare
	media: cedrus: Fix .buf_prepare
	media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
	media: bt8xx: Fix a missing check bug in bt878_probe
	media: st-hva: Fix potential NULL pointer dereferences
	crypto: hisilicon/sec - fixup 3des minimum key size declaration
	Makefile: fix GDB warning with CONFIG_RELR
	media: dvd_usb: memory leak in cinergyt2_fe_attach
	memstick: rtsx_usb_ms: fix UAF
	mmc: sdhci-sprd: use sdhci_sprd_writew
	mmc: via-sdmmc: add a check against NULL pointer dereference
	spi: meson-spicc: fix a wrong goto jump for avoiding memory leak.
	spi: meson-spicc: fix memory leak in meson_spicc_probe
	crypto: shash - avoid comparing pointers to exported functions under CFI
	media: dvb_net: avoid speculation from net slot
	media: siano: fix device register error path
	media: imx-csi: Skip first few frames from a BT.656 source
	hwmon: (max31790) Report correct current pwm duty cycles
	hwmon: (max31790) Fix pwmX_enable attributes
	drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe()
	KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors
	btrfs: fix error handling in __btrfs_update_delayed_inode
	btrfs: abort transaction if we fail to update the delayed inode
	btrfs: sysfs: fix format string for some discard stats
	btrfs: don't clear page extent mapped if we're not invalidating the full page
	btrfs: disable build on platforms having page size 256K
	locking/lockdep: Fix the dep path printing for backwards BFS
	lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage()
	KVM: s390: get rid of register asm usage
	regulator: mt6358: Fix vdram2 .vsel_mask
	regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
	media: Fix Media Controller API config checks
	ACPI: video: use native backlight for GA401/GA502/GA503
	HID: do not use down_interruptible() when unbinding devices
	EDAC/ti: Add missing MODULE_DEVICE_TABLE
	ACPI: processor idle: Fix up C-state latency if not ordered
	hv_utils: Fix passing zero to 'PTR_ERR' warning
	lib: vsprintf: Fix handling of number field widths in vsscanf
	Input: goodix - platform/x86: touchscreen_dmi - Move upside down quirks to touchscreen_dmi.c
	platform/x86: touchscreen_dmi: Add an extra entry for the upside down Goodix touchscreen on Teclast X89 tablets
	platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of TM800A550L tablets
	ACPI: EC: Make more Asus laptops use ECDT _GPE
	block_dump: remove block_dump feature in mark_inode_dirty()
	blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter
	blk-mq: clear stale request in tags->rq[] before freeing one request pool
	fs: dlm: cancel work sync othercon
	random32: Fix implicit truncation warning in prandom_seed_state()
	open: don't silently ignore unknown O-flags in openat2()
	drivers: hv: Fix missing error code in vmbus_connect()
	fs: dlm: fix memory leak when fenced
	ACPICA: Fix memory leak caused by _CID repair function
	ACPI: bus: Call kobject_put() in acpi_init() error path
	ACPI: resources: Add checks for ACPI IRQ override
	block: fix race between adding/removing rq qos and normal IO
	platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures"
	platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15"
	platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard()
	nvme-pci: fix var. type for increasing cq_head
	nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst()
	EDAC/Intel: Do not load EDAC driver when running as a guest
	PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv()
	cifs: improve fallocate emulation
	ACPI: EC: trust DSDT GPE for certain HP laptop
	clocksource: Retry clock read if long delays detected
	clocksource: Check per-CPU clock synchronization when marked unstable
	tpm_tis_spi: add missing SPI device ID entries
	ACPI: tables: Add custom DSDT file as makefile prerequisite
	HID: wacom: Correct base usage for capacitive ExpressKey status bits
	cifs: fix missing spinlock around update to ses->status
	mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device
	block: fix discard request merge
	kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()
	ia64: mca_drv: fix incorrect array size calculation
	writeback, cgroup: increment isw_nr_in_flight before grabbing an inode
	spi: Allow to have all native CSs in use along with GPIOs
	spi: Avoid undefined behaviour when counting unused native CSs
	media: venus: Rework error fail recover logic
	media: s5p_cec: decrement usage count if disabled
	media: hantro: do a PM resume earlier
	crypto: ixp4xx - dma_unmap the correct address
	crypto: ixp4xx - update IV after requests
	crypto: ux500 - Fix error return code in hash_hw_final()
	sata_highbank: fix deferred probing
	pata_rb532_cf: fix deferred probing
	media: I2C: change 'RST' to "RSET" to fix multiple build errors
	sched/uclamp: Fix wrong implementation of cpu.uclamp.min
	sched/uclamp: Fix locking around cpu_util_update_eff()
	kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n'
	pata_octeon_cf: avoid WARN_ON() in ata_host_activate()
	evm: fix writing <securityfs>/evm overflow
	x86/elf: Use _BITUL() macro in UAPI headers
	crypto: sa2ul - Fix leaks on failure paths with sa_dma_init()
	crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe()
	crypto: ccp - Fix a resource leak in an error handling path
	media: rc: i2c: Fix an error message
	pata_ep93xx: fix deferred probing
	locking/lockdep: Reduce LOCKDEP dependency list
	media: rkvdec: Fix .buf_prepare
	media: exynos4-is: Fix a use after free in isp_video_release
	media: au0828: fix a NULL vs IS_ERR() check
	media: tc358743: Fix error return code in tc358743_probe_of()
	media: gspca/gl860: fix zero-length control requests
	m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning
	media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2()
	regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK
	crypto: nitrox - fix unchecked variable in nitrox_register_interrupts
	crypto: omap-sham - Fix PM reference leak in omap sham ops
	crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit
	crypto: sm2 - remove unnecessary reset operations
	crypto: sm2 - fix a memory leak in sm2
	mmc: usdhi6rol0: fix error return code in usdhi6_probe()
	arm64: consistently use reserved_pg_dir
	arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan
	media: subdev: remove VIDIOC_DQEVENT_TIME32 handling
	media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx
	hwmon: (lm70) Use device_get_match_data()
	hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI"
	hwmon: (max31722) Remove non-standard ACPI device IDs
	hwmon: (max31790) Fix fan speed reporting for fan7..12
	KVM: nVMX: Sync all PGDs on nested transition with shadow paging
	KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap
	KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch
	KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level()
	perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number
	KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set
	regulator: hi655x: Fix pass wrong pointer to config.driver_data
	btrfs: clear log tree recovering status if starting transaction fails
	x86/sev: Make sure IRQs are disabled while GHCB is active
	x86/sev: Split up runtime #VC handler for correct state tracking
	sched/rt: Fix RT utilization tracking during policy change
	sched/rt: Fix Deadline utilization tracking during policy change
	sched/uclamp: Fix uclamp_tg_restrict()
	lockdep: Fix wait-type for empty stack
	lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING
	spi: spi-sun6i: Fix chipselect/clock bug
	crypto: nx - Fix RCU warning in nx842_OF_upd_status
	psi: Fix race between psi_trigger_create/destroy
	media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev
	media: video-mux: Skip dangling endpoints
	PM / devfreq: Add missing error code in devfreq_add_device()
	ACPI: PM / fan: Put fan device IDs into separate header file
	block: avoid double io accounting for flush request
	nvme-pci: look for StorageD3Enable on companion ACPI device instead
	ACPI: sysfs: Fix a buffer overrun problem with description_show()
	mark pstore-blk as broken
	clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG
	extcon: extcon-max8997: Fix IRQ freeing at error path
	ACPI: APEI: fix synchronous external aborts in user-mode
	blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled()
	blk-wbt: make sure throttle is enabled properly
	ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros
	ACPI: bgrt: Fix CFI violation
	cpufreq: Make cpufreq_online() call driver->offline() on errors
	blk-mq: update hctx->dispatch_busy in case of real scheduler
	ocfs2: fix snprintf() checking
	dax: fix ENOMEM handling in grab_mapping_entry()
	mm/debug_vm_pgtable/basic: add validation for dirtiness after write protect
	mm/debug_vm_pgtable/basic: iterate over entire protection_map[]
	mm/debug_vm_pgtable: ensure THP availability via has_transparent_hugepage()
	swap: fix do_swap_page() race with swapoff
	mm/shmem: fix shmem_swapin() race with swapoff
	mm: memcg/slab: properly set up gfp flags for objcg pointer array
	mm: page_alloc: refactor setup_per_zone_lowmem_reserve()
	mm/page_alloc: fix counting of managed_pages
	xfrm: xfrm_state_mtu should return at least 1280 for ipv6
	drm/bridge/sii8620: fix dependency on extcon
	drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable()
	drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect()
	drm/ast: Fix missing conversions to managed API
	video: fbdev: imxfb: Fix an error message
	net: mvpp2: Put fwnode in error case during ->probe()
	net: pch_gbe: Propagate error from devm_gpio_request_one()
	pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin
	pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities
	drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command
	drm/vmwgfx: Fix cpu updates of coherent multisample surfaces
	net: qrtr: ns: Fix error return code in qrtr_ns_init()
	clk: meson: g12a: fix gp0 and hifi ranges
	net: ftgmac100: add missing error return code in ftgmac100_probe()
	drm: rockchip: set alpha_en to 0 if it is not used
	drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write()
	drm/rockchip: dsi: move all lane config except LCDC mux to bind()
	drm/rockchip: lvds: Fix an error handling path
	drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result
	mptcp: fix pr_debug in mptcp_token_new_connect
	mptcp: generate subflow hmac after mptcp_finish_join()
	RDMA/srp: Fix a recently introduced memory leak
	RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats
	RDMA/rtrs: Do not reset hb_missed_max after re-connection
	RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object
	RDMA/rtrs-srv: Fix memory leak when having multiple sessions
	RDMA/rtrs-clt: Check if the queue_depth has changed during a reconnection
	RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats
	ehea: fix error return code in ehea_restart_qps()
	clk: tegra30: Use 300MHz for video decoder by default
	xfrm: remove the fragment check for ipv6 beet mode
	net/sched: act_vlan: Fix modify to allow 0
	RDMA/core: Sanitize WQ state received from the userspace
	drm/pl111: depend on CONFIG_VEXPRESS_CONFIG
	RDMA/rxe: Fix failure during driver load
	drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends
	drm/vc4: hdmi: Fix error path of hpd-gpios
	clk: vc5: fix output disabling when enabling a FOD
	drm: qxl: ensure surf.data is ininitialized
	tools/bpftool: Fix error return code in do_batch()
	ath10k: go to path err_unsupported when chip id is not supported
	ath10k: add missing error return code in ath10k_pci_probe()
	wireless: carl9170: fix LEDS build errors & warnings
	ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others
	clk: imx8mq: remove SYS PLL 1/2 clock gates
	wcn36xx: Move hal_buf allocation to devm_kmalloc in probe
	ssb: Fix error return code in ssb_bus_scan()
	brcmfmac: fix setting of station info chains bitmask
	brcmfmac: correctly report average RSSI in station info
	brcmfmac: Fix a double-free in brcmf_sdio_bus_reset
	brcmsmac: mac80211_if: Fix a resource leak in an error handling path
	cw1200: Revert unnecessary patches that fix unreal use-after-free bugs
	ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n()
	ath10k: Fix an error code in ath10k_add_interface()
	ath11k: send beacon template after vdev_start/restart during csa
	netlabel: Fix memory leak in netlbl_mgmt_add_common
	RDMA/mlx5: Don't add slave port to unaffiliated list
	netfilter: nft_exthdr: check for IPv6 packet before further processing
	netfilter: nft_osf: check for TCP packet before further processing
	netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
	RDMA/rxe: Fix qp reference counting for atomic ops
	selftests/bpf: Whitelist test_progs.h from .gitignore
	xsk: Fix missing validation for skb and unaligned mode
	xsk: Fix broken Tx ring validation
	bpf: Fix libelf endian handling in resolv_btfids
	RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr
	samples/bpf: Fix Segmentation fault for xdp_redirect command
	samples/bpf: Fix the error return code of xdp_redirect's main()
	mt76: fix possible NULL pointer dereference in mt76_tx
	mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb()
	net: ethernet: aeroflex: fix UAF in greth_of_remove
	net: ethernet: ezchip: fix UAF in nps_enet_remove
	net: ethernet: ezchip: fix error handling
	vrf: do not push non-ND strict packets with a source LLA through packet taps again
	net: sched: add barrier to ensure correct ordering for lockless qdisc
	tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
	netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic
	pkt_sched: sch_qfq: fix qfq_change_class() error path
	xfrm: Fix xfrm offload fallback fail case
	iwlwifi: increase PNVM load timeout
	rtw88: 8822c: fix lc calibration timing
	vxlan: add missing rcu_read_lock() in neigh_reduce()
	ip6_tunnel: fix GRE6 segmentation
	net/ipv4: swap flow ports when validating source
	net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues
	tc-testing: fix list handling
	ieee802154: hwsim: Fix memory leak in hwsim_add_one
	ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl()
	bpf: Fix null ptr deref with mixed tail calls and subprogs
	drm/msm: Fix error return code in msm_drm_init()
	drm/msm/dpu: Fix error return code in dpu_mdss_init()
	mac80211: remove iwlwifi specific workaround NDPs of null_response
	net: bcmgenet: Fix attaching to PYH failed on RPi 4B
	ipv6: exthdrs: do not blindly use init_net
	can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0
	bpf: Do not change gso_size during bpf_skb_change_proto()
	i40e: Fix error handling in i40e_vsi_open
	i40e: Fix autoneg disabling for non-10GBaseT links
	i40e: Fix missing rtnl locking when setting up pf switch
	Revert "ibmvnic: remove duplicate napi_schedule call in open function"
	ibmvnic: set ltb->buff to NULL after freeing
	ibmvnic: free tx_pool if tso_pool alloc fails
	RDMA/cma: Protect RMW with qp_mutex
	net: macsec: fix the length used to copy the key for offloading
	net: phy: mscc: fix macsec key length
	net: atlantic: fix the macsec key length
	ipv6: fix out-of-bound access in ip6_parse_tlv()
	e1000e: Check the PCIm state
	net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs()
	bpfilter: Specify the log level for the kmsg message
	RDMA/cma: Fix incorrect Packet Lifetime calculation
	gve: Fix swapped vars when fetching max queues
	Revert "be2net: disable bh with spin_lock in be_process_mcc"
	Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
	Bluetooth: Fix not sending Set Extended Scan Response
	Bluetooth: Fix Set Extended (Scan Response) Data
	Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event
	clk: actions: Fix UART clock dividers on Owl S500 SoC
	clk: actions: Fix SD clocks factor table on Owl S500 SoC
	clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC
	clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC
	clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare
	clk: si5341: Wait for DEVICE_READY on startup
	clk: si5341: Avoid divide errors due to bogus register contents
	clk: si5341: Check for input clock presence and PLL lock on startup
	clk: si5341: Update initialization magic
	writeback: fix obtain a reference to a freeing memcg css
	net: lwtunnel: handle MTU calculation in forwading
	net: sched: fix warning in tcindex_alloc_perfect_hash
	net: tipc: fix FB_MTU eat two pages
	RDMA/mlx5: Don't access NULL-cleared mpi pointer
	RDMA/core: Always release restrack object
	MIPS: Fix PKMAP with 32-bit MIPS huge page support
	staging: fbtft: Rectify GPIO handling
	staging: fbtft: Don't spam logs when probe is deferred
	ASoC: rt5682: Disable irq on shutdown
	rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread()
	serial: fsl_lpuart: don't modify arbitrary data on lpuart32
	serial: fsl_lpuart: remove RTSCTS handling from get_mctrl()
	serial: 8250_omap: fix a timeout loop condition
	tty: nozomi: Fix a resource leak in an error handling function
	mwifiex: re-fix for unaligned accesses
	iio: adis_buffer: do not return ints in irq handlers
	iio: adis16400: do not return ints in irq handlers
	iio: adis16475: do not return ints in irq handlers
	iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: mxc4005: Fix overread of data and alignment issue.
	iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: chemical: atlas: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe()
	ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup()
	backlight: lm3630a_bl: Put fwnode in error case during ->probe()
	ASoC: rsnd: tidyup loop on rsnd_adg_clk_query()
	Input: hil_kbd - fix error return code in hil_dev_connect()
	perf scripting python: Fix tuple_set_u64()
	mtd: partitions: redboot: seek fis-index-block in the right node
	mtd: rawnand: arasan: Ensure proper configuration for the asserted target
	staging: mmal-vchiq: Fix incorrect static vchiq_instance.
	char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol()
	firmware: stratix10-svc: Fix a resource leak in an error handling path
	tty: nozomi: Fix the error handling path of 'nozomi_card_init()'
	leds: class: The -ENOTSUPP should never be seen by user space
	leds: lm3532: select regmap I2C API
	leds: lm36274: Put fwnode in error case during ->probe()
	leds: lm3692x: Put fwnode in any case during ->probe()
	leds: lm3697: Don't spam logs when probe is deferred
	leds: lp50xx: Put fwnode in error case during ->probe()
	scsi: FlashPoint: Rename si_flags field
	scsi: iscsi: Flush block work before unblock
	mfd: mp2629: Select MFD_CORE to fix build error
	mfd: rn5t618: Fix IRQ trigger by changing it to level mode
	fsi: core: Fix return of error values on failures
	fsi: scom: Reset the FSI2PIB engine for any error
	fsi: occ: Don't accept response from un-initialized OCC
	fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE
	fsi/sbefifo: Fix reset timeout
	visorbus: fix error return code in visorchipset_init()
	iommu/amd: Fix extended features logging
	s390/irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK
	s390: enable HAVE_IOREMAP_PROT
	s390: appldata depends on PROC_SYSCTL
	selftests: splice: Adjust for handler fallback removal
	iommu/dma: Fix IOVA reserve dma ranges
	ASoC: max98373-sdw: use first_hw_init flag on resume
	ASoC: rt1308-sdw: use first_hw_init flag on resume
	ASoC: rt5682-sdw: use first_hw_init flag on resume
	ASoC: rt700-sdw: use first_hw_init flag on resume
	ASoC: rt711-sdw: use first_hw_init flag on resume
	ASoC: rt715-sdw: use first_hw_init flag on resume
	ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test
	ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID
	ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()'
	usb: gadget: f_fs: Fix setting of device and driver data cross-references
	usb: dwc2: Don't reset the core after setting turnaround time
	eeprom: idt_89hpesx: Put fwnode in matching case during ->probe()
	eeprom: idt_89hpesx: Restore printing the unsupported fwnode name
	thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default()
	iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: light: vcnl4000: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	ASoC: fsl_spdif: Fix error handler with pm_runtime_enable
	staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt()
	staging: gdm724x: check for overflow in gdm_lte_netif_rx()
	staging: rtl8712: fix error handling in r871xu_drv_init
	staging: rtl8712: fix memory leak in rtl871x_load_fw_cb
	coresight: core: Fix use of uninitialized pointer
	staging: mt7621-dts: fix pci address for PCI memory range
	serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates
	iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK
	of: Fix truncation of memory sizes on 32-bit platforms
	mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume()
	habanalabs: Fix an error handling path in 'hl_pci_probe()'
	scsi: mpt3sas: Fix error return value in _scsih_expander_add()
	soundwire: stream: Fix test for DP prepare complete
	phy: uniphier-pcie: Fix updating phy parameters
	phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
	extcon: sm5502: Drop invalid register write in sm5502_reg_data
	extcon: max8997: Add missing modalias string
	powerpc/powernv: Fix machine check reporting of async store errors
	ASoC: atmel-i2s: Fix usage of capture and playback at the same time
	configfs: fix memleak in configfs_release_bin_file
	ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake
	ASoC: fsl_spdif: Fix unexpected interrupt after suspend
	leds: as3645a: Fix error return code in as3645a_parse_node()
	leds: ktd2692: Fix an error handling path
	selftests/ftrace: fix event-no-pid on 1-core machine
	serial: 8250: 8250_omap: Disable RX interrupt after DMA enable
	serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs
	powerpc: Offline CPU in stop_this_cpu()
	powerpc/papr_scm: Properly handle UUID types and API
	powerpc/64s: Fix copy-paste data exposure into newly created tasks
	powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable
	ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found
	serial: mvebu-uart: do not allow changing baudrate when uartclk is not available
	serial: mvebu-uart: correctly calculate minimal possible baudrate
	arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
	vfio/pci: Handle concurrent vma faults
	mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled
	mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK
	mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled()
	mm/huge_memory.c: don't discard hugepage if other processes are mapping it
	mm/hugetlb: use helper huge_page_order and pages_per_huge_page
	mm/hugetlb: remove redundant check in preparing and destroying gigantic page
	hugetlb: remove prep_compound_huge_page cleanup
	include/linux/huge_mm.h: remove extern keyword
	mm/z3fold: fix potential memory leak in z3fold_destroy_pool()
	mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page
	lib/math/rational.c: fix divide by zero
	selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random
	selftests/vm/pkeys: handle negative sys_pkey_alloc() return code
	selftests/vm/pkeys: refill shadow register after implicit kernel write
	perf llvm: Return -ENOMEM when asprintf() fails
	csky: fix syscache.c fallthrough warning
	csky: syscache: Fixup duplicate cache flush
	exfat: handle wrong stream entry size in exfat_readdir()
	scsi: fc: Correct RHBA attributes length
	scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd()
	mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion
	fscrypt: don't ignore minor_hash when hash is 0
	fscrypt: fix derivation of SipHash keys on big endian CPUs
	tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status()
	erofs: fix error return code in erofs_read_superblock()
	block: return the correct bvec when checking for gaps
	io_uring: fix blocking inline submission
	mmc: block: Disable CMDQ on the ioctl path
	mmc: vub3000: fix control-request direction
	media: exynos4-is: remove a now unused integer
	scsi: core: Retry I/O for Notify (Enable Spinup) Required error
	crypto: qce - fix error return code in qce_skcipher_async_req_handle()
	s390: preempt: Fix preempt_count initialization
	cred: add missing return error code when set_cred_ucounts() failed
	iommu/dma: Fix compile warning in 32-bit builds
	powerpc/preempt: Don't touch the idle task's preempt_count during hotplug
	Linux 5.10.50

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iec4eab24ea8eb5a6d79739a1aec8432d93a8f82c
2021-07-14 17:35:23 +02:00
Connor Abbott
f5af19889f Bluetooth: btqca: Don't modify firmware contents in-place
commit b43ca51117 upstream.

struct firmware::data is marked const, and when the firmware is
compressed with xz (default at least with Fedora) it's mapped read-only
which results in a crash:

BUG: unable to handle page fault for address: ffffae57c0ca5047
PGD 100000067 P4D 100000067 PUD 1001ce067 PMD 10165a067 PTE 8000000112bba161
Oops: 0003 [#1] SMP NOPTI
CPU: 3 PID: 204 Comm: kworker/u17:0 Not tainted 5.12.1-test+ #1
Hardware name: Dell Inc. XPS 13 9310/0F7M4C, BIOS 1.2.5 12/10/2020
Workqueue: hci0 hci_power_on [bluetooth]
RIP: 0010:qca_download_firmware+0x27c/0x4e0 [btqca]
Code: 1b 75 04 80 48 0c 01 0f b7 c6 8d 54 02 0c 41 39 d7 0f 8e 62 fe ff ff 48 63 c2 4c 01 e8 0f b7 38 0f b7 70 02 66 83 ff 11 75 d3 <80> 48 0c 80 41 83 fc 03 7e 6e 88 58 0d eb ce 41 0f b6 45 0e 48 8b
RSP: 0018:ffffae57c08dfc68 EFLAGS: 00010246
RAX: ffffae57c0ca503b RBX: 000000000000000e RCX: 0000000000000000
RDX: 0000000000000037 RSI: 0000000000000006 RDI: 0000000000000011
RBP: ffff978d9949e000 R08: ffff978d84ed7540 R09: ffffae57c0ca5000
R10: 000000000010cd00 R11: 0000000000000001 R12: 0000000000000005
R13: ffffae57c0ca5004 R14: ffff978d98ca8680 R15: 00000000000016a9
FS:  0000000000000000(0000) GS:ffff9794ef6c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffae57c0ca5047 CR3: 0000000113d5a004 CR4: 0000000000770ee0
PKRU: 55555554
Call Trace:
 qca_uart_setup+0x2cb/0x1390 [btqca]
 ? qca_read_soc_version+0x136/0x220 [btqca]
 qca_setup+0x288/0xab0 [hci_uart]
 hci_dev_do_open+0x1f3/0x780 [bluetooth]
 ? try_to_wake_up+0x1c1/0x4f0
 hci_power_on+0x3f/0x200 [bluetooth]
 process_one_work+0x1ec/0x380
 worker_thread+0x53/0x3e0
 ? process_one_work+0x380/0x380
 kthread+0x11b/0x140
 ? kthread_associate_blkcg+0xa0/0xa0
 ret_from_fork+0x1f/0x30
Modules linked in: llc ip_set nf_tables nfnetlink snd_soc_skl_hda_dsp(+) ip6table_filter snd_soc_hdac_hdmi ip6_tables qrtr_mhi iptable_filter snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic s>
 dell_wmi_sysman(+) dell_smbios snd dcdbas mhi vfat videobuf2_vmalloc i2c_i801 videobuf2_memops videobuf2_v4l2 dell_wmi_descriptor fat wmi_bmof soundcore i2c_smbus videobuf2_common libarc4 mei_me mei hid_se>
 i2c_hid_acpi i2c_hid video pinctrl_tigerlake fuse
CR2: ffffae57c0ca5047

This also seems to fix a failure to suspend due to the firmware
download on bootup getting interrupted by the crash:

Bluetooth: hci0: SSR or FW download time out
PM: dpm_run_callback(): acpi_subsys_suspend+0x0/0x60 returns -110
PM: Device serial0-0 failed to suspend: error -110
PM: Some devices failed to suspend, or early wake event detected

Fixes: 83e8196 ("Bluetooth: btqca: Introduce generic QCA ROME support")
Cc: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Connor Abbott <cwabbott0@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-14 16:55:34 +02:00