4939 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	c194212a03	Merge 5.10.101 into android12-5.10-lts ... Changes in 5.10.101 integrity: check the return value of audit_log_start() ima: Remove ima_policy file before directory ima: Allow template selection with ima_template[_fmt]= after ima_hash= ima: Do not print policy rule with inactive LSM labels mmc: sdhci-of-esdhc: Check for error num after setting mask can: isotp: fix potential CAN frame reception race in isotp_rcv() net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs NFS: Fix initialisation of nfs_client cl_flags field NFSD: Clamp WRITE offsets NFSD: Fix offset type in I/O trace points drm/amdgpu: Set a suitable dev_info.gart_page_size tracing: Propagate is_signed to expression NFS: change nfs_access_get_cached to only report the mask NFSv4 only print the label when its queried nfs: nfs4clinet: check the return value of kstrdup() NFSv4.1: Fix uninitialised variable in devicenotify NFSv4 remove zero number of fs_locations entries error check NFSv4 expose nfs_parse_server_name function NFSv4 handle port presence in fs_location server string x86/perf: Avoid warning for Arch LBR without XSAVE drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer net: sched: Clarify error message when qdisc kind is unknown powerpc/fixmap: Fix VM debug warning on unmap scsi: target: iscsi: Make sure the np under each tpg is unique scsi: ufs: ufshcd-pltfrm: Check the return value of devm_kstrdup() scsi: qedf: Add stag_work to all the vports scsi: qedf: Fix refcount issue when LOGO is received during TMF scsi: pm8001: Fix bogus FW crash for maxcpus=1 scsi: ufs: Treat link loss as fatal error scsi: myrs: Fix crash in error case PM: hibernate: Remove register_nosave_region_late() usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend perf: Always wake the parent event nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() KVM: eventfd: Fix false positive RCU usage warning KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow riscv: fix build with binutils 2.38 ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group ARM: dts: Fix boot regression on Skomer ARM: socfpga: fix missing RESET_CONTROLLER nvme-tcp: fix bogus request completion when failing to send AER ACPI/IORT: Check node revision for PMCG resources PM: s2idle: ACPI: Fix wakeup interrupts handling drm/rockchip: vop: Correct RK3399 VOP register fields ARM: dts: Fix timer regression for beagleboard revision c ARM: dts: meson: Fix the UART compatible strings ARM: dts: meson8: Fix the UART device-tree schema validation ARM: dts: meson8b: Fix the UART device-tree schema validation staging: fbtft: Fix error path in fbtft_driver_module_init() ARM: dts: imx6qdl-udoo: Properly describe the SD card detect phy: xilinx: zynqmp: Fix bus width setting for SGMII ARM: dts: imx7ulp: Fix 'assigned-clocks-parents' typo usb: f_fs: Fix use-after-free for epfile gpio: aggregator: Fix calling into sleeping GPIO controllers drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd. misc: fastrpc: avoid double fput() on failed usercopy netfilter: ctnetlink: disable helper autoassign arm64: dts: meson-g12b-odroid-n2: fix typo 'dio2133' ixgbevf: Require large buffers for build_skb on 82599VF drm/panel: simple: Assign data from panel_dpi_probe() correctly ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE gpio: sifive: use the correct register to read output values bonding: pair enable_port with slave_arr_updates net: dsa: mv88e6xxx: don't use devres for mdiobus net: dsa: ar9331: register the mdiobus under devres net: dsa: bcm_sf2: don't use devres for mdiobus net: dsa: felix: don't use devres for mdiobus net: dsa: lantiq_gswip: don't use devres for mdiobus ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path nfp: flower: fix ida_idx not being released net: do not keep the dst cache when uncloning an skb dst and its metadata net: fix a memleak when uncloning an skb dst and its metadata veth: fix races around rq->rx_notify_masked net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE tipc: rate limit warning for received illegal binding update net: amd-xgbe: disable interrupts during pci removal dpaa2-eth: unregister the netdev before disconnecting from the PHY ice: fix an error code in ice_cfg_phy_fec() ice: fix IPIP and SIT TSO offload net: mscc: ocelot: fix mutex lock error during ethtool stats read net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister vt_ioctl: fix array_index_nospec in vt_setactivate vt_ioctl: add array_index_nospec to VT_ACTIVATE n_tty: wake up poll(POLLRDNORM) on receiving data eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX usb: dwc2: drd: fix soft connect when gadget is unconfigured Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured" net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup usb: ulpi: Move of_node_put to ulpi_dev_release usb: ulpi: Call of_node_put correctly usb: dwc3: gadget: Prevent core from processing stale TRBs usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition USB: gadget: validate interface OS descriptor requests usb: gadget: rndis: check size of RNDIS_MSG_SET command usb: gadget: f_uac2: Define specific wTerminalType usb: raw-gadget: fix handling of dual-direction-capable endpoints USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 USB: serial: option: add ZTE MF286D modem USB: serial: ch341: add support for GW Instek USB2.0-Serial devices USB: serial: cp210x: add NCR Retail IO box id USB: serial: cp210x: add CPI Bulk Coin Recycler id speakup-dectlk: Restore pitch setting phy: ti: Fix missing sentinel for clk_div_table hwmon: (dell-smm) Speed up setting of fan speed Makefile.extrawarn: Move -Wunaligned-access to W=1 can: isotp: fix error path in isotp_sendmsg() to unlock wait queue scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled scsi: lpfc: Reduce log messages seen after firmware download arm64: dts: imx8mq: fix lcdif port node perf: Fix list corruption in perf_cgroup_switch() iommu: Fix potential use-after-free during probe Linux 5.10.101 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic9c80389b155cf05bc1c6a64d0ca92837c83fbb1	2022-02-16 15:16:06 +01:00
Stefan Berger	8027ba480c	ima: Do not print policy rule with inactive LSM labels ... commit 89677197ae upstream. Before printing a policy rule scan for inactive LSM labels in the policy rule. Inactive LSM labels are identified by args_p != NULL and rule == NULL. Fixes: 483ec26eed ("ima: ima/lsm policy rule loading logic bug fixes") Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Cc: <stable@vger.kernel.org> # v5.6+ Acked-by: Christian Brauner <brauner@kernel.org> [zohar@linux.ibm.com: Updated "Fixes" tag] Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:54:16 +01:00
Roberto Sassu	8171c8a99f	ima: Allow template selection with ima_template[_fmt]= after ima_hash= ... commit bb8e52e490 upstream. Commit c2426d2ad5 ("ima: added support for new kernel cmdline parameter ima_template_fmt") introduced an additional check on the ima_template variable to avoid multiple template selection. Unfortunately, ima_template could be also set by the setup function of the ima_hash= parameter, when it calls ima_template_desc_current(). This causes attempts to choose a new template with ima_template= or with ima_template_fmt=, after ima_hash=, to be ignored. Achieve the goal of the commit mentioned with the new static variable template_setup_done, so that template selection requests after ima_hash= are not ignored. Finally, call ima_init_template_list(), if not already done, to initialize the list of templates before lookup_template_desc() is called. Reported-by: Guo Zihua <guozihua@huawei.com> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org Fixes: c2426d2ad5 ("ima: added support for new kernel cmdline parameter ima_template_fmt") Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:54:16 +01:00
Stefan Berger	0795b7100d	ima: Remove ima_policy file before directory ... commit f7333b9572 upstream. The removal of ima_dir currently fails since ima_policy still exists, so remove the ima_policy file before removing the directory. Fixes: 4af4662fa4 ("integrity: IMA policy") Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Cc: <stable@vger.kernel.org> Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:54:16 +01:00
Xiaoke Wang	7fea2e5200	integrity: check the return value of audit_log_start() ... commit 83230351c5 upstream. audit_log_start() returns audit_buffer pointer on success or NULL on error, so it is better to check the return value of it. Fixes: 3323eec921 ("integrity: IMA as an integrity service provider") Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com> Cc: <stable@vger.kernel.org> Reviewed-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:54:16 +01:00
Greg Kroah-Hartman	c3b53fcd90	Merge 5.10.99 into android12-5.10-lts ... Changes in 5.10.99 selinux: fix double free of cond_list on error paths audit: improve audit queue handling when "audit=1" on cmdline ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() ALSA: usb-audio: Correct quirk for VF0770 ALSA: hda: Fix UAF of leds class devs at unbinding ALSA: hda: realtek: Fix race at concurrent COEF updates ALSA: hda/realtek: Add quirk for ASUS GU603 ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows btrfs: fix deadlock between quota disable and qgroup rescan worker drm/nouveau: fix off by one in BIOS boundary checking drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() mm/debug_vm_pgtable: remove pte entry from the page table mm/pgtable: define pte_index so that preprocessor could recognize it mm/kmemleak: avoid scanning potential huge holes block: bio-integrity: Advance seed correctly for larger interval sizes dma-buf: heaps: Fix potential spectre v1 gadget IB/hfi1: Fix AIP early init panic Revert "ASoC: mediatek: Check for error clk pointer" memcg: charge fs_context and legacy_fs_context RDMA/cma: Use correct address when leaving multicast group RDMA/ucma: Protect mc during concurrent multicast leaves IB/rdmavt: Validate remote_addr during loopback atomic tests RDMA/siw: Fix broken RDMA Read Fence/Resume logic. RDMA/mlx4: Don't continue event handler after memory allocation failure iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() spi: bcm-qspi: check for valid cs before applying chip select spi: mediatek: Avoid NULL pointer crash in interrupt spi: meson-spicc: add IRQ check in meson_spicc_probe spi: uniphier: fix reference count leak in uniphier_spi_probe() net: ieee802154: hwsim: Ensure proper channel selection at probe time net: ieee802154: mcr20a: Fix lifs/sifs periods net: ieee802154: ca8210: Stop leaking skb's net: ieee802154: Return meaningful error codes from the netlink helpers net: macsec: Fix offload support for NETDEV_UNREGISTER event net: macsec: Verify that send_sci is on when setting Tx sci explicitly net: stmmac: dump gmac4 DMA registers correctly net: stmmac: ensure PTP time register reads are consistent drm/i915/overlay: Prevent divide by zero bugs in scaling ASoC: fsl: Add missing error handling in pcm030_fabric_probe ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name ASoC: max9759: fix underflow in speaker_gain_control_put() pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line pinctrl: intel: fix unexpected interrupt pinctrl: bcm2835: Fix a few error paths scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. gve: fix the wrong AdminQ buffer queue index check bpf: Use VM_MAP instead of VM_ALLOC for ringbuf selftests/exec: Remove pipe from TEST_GEN_FILES selftests: futex: Use variable MAKE instead of make tools/resolve_btfids: Do not print any commands when building silently rtc: cmos: Evaluate century appropriate Revert "fbcon: Disable accelerated scrolling" fbcon: Add option to enable legacy hardware acceleration perf stat: Fix display of grouped aliased events perf/x86/intel/pt: Fix crash with stop filters in single-range mode x86/perf: Default set FREEZE_ON_SMI for all EDAC/altera: Fix deferred probing EDAC/xgene: Fix deferred probing ext4: prevent used blocks from being allocated during fast commit replay ext4: modify the logic of ext4_mb_new_blocks_simple ext4: fix error handling in ext4_restore_inline_data() ext4: fix error handling in ext4_fc_record_modified_inode() ext4: fix incorrect type issue during replay_del_range net: dsa: mt7530: make NET_DSA_MT7530 select MEDIATEK_GE_PHY cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning selftests: nft_concat_range: add test for reload with no element add/del Linux 5.10.99 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idc1d987b935d86d2a201e0b4a8db801c08c71b98	2022-02-09 12:14:04 +01:00
Vratislav Bendel	f446089a26	selinux: fix double free of cond_list on error paths ... commit 186edf7e36 upstream. On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the cond_list_len to 0 in cond_list_destroy(), making subsequent calls a noop. Also consistently reset the cond_list pointer to NULL after freeing. Cc: stable@vger.kernel.org Signed-off-by: Vratislav Bendel <vbendel@redhat.com> [PM: fix line lengths in the description] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-08 18:30:34 +01:00
Greg Kroah-Hartman	4ec3c2eea5	Merge 5.10.94 into android12-5.10-lts ... Changes in 5.10.94 KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock HID: uhid: Fix worker destroying device without any protection HID: wacom: Reset expected and received contact counts at the same time HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Avoid using stale array indicies to read contact count f2fs: fix to do sanity check in is_alive() nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 mtd: Fixed breaking list in __mtd_del_partition. mtd: rawnand: davinci: Don't calculate ECC when reading page mtd: rawnand: davinci: Avoid duplicated page read mtd: rawnand: davinci: Rewrite function description x86/gpu: Reserve stolen memory for first integrated Intel GPU tools/nolibc: x86-64: Fix startup code bug tools/nolibc: i386: fix initial stack alignment tools/nolibc: fix incorrect truncation of exit code rtc: cmos: take rtc_lock while reading from CMOS media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE media: flexcop-usb: fix control-message timeouts media: mceusb: fix control-message timeouts media: em28xx: fix control-message timeouts media: cpia2: fix control-message timeouts media: s2255: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: redrat3: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: stk1160: fix control-message timeouts media: cec-pin: fix interrupt en/disable handling can: softing_cs: softingcs_probe(): fix memleak on registration failure iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure gpu: host1x: Add back arm_iommu_detach_device() dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller mm_zone: add function to check if managed dma zone exists dma/pool: create dma atomic pool only if dma zone has managed pages mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode drm/ttm: Put BO in its memory manager's lru list Bluetooth: L2CAP: Fix not initializing sk_peer_pid drm/bridge: display-connector: fix an uninitialized pointer in probe() drm: fix null-ptr-deref in drm_dev_init_release() drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure drm/panel: innolux-p079zca: Delete panel on attach() failure drm/rockchip: dsi: Fix unbalanced clock on probe error drm/rockchip: dsi: Hold pm-runtime across bind/unbind drm/rockchip: dsi: Disable PLL clock on bind error drm/rockchip: dsi: Reconfigure hardware on resume() Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails clk: bcm-2835: Pick the closest clock rate clk: bcm-2835: Remove rounding up the dividers drm/vc4: hdmi: Set a default HSM rate wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND wcn36xx: Fix DMA channel enable/disable cycle wcn36xx: Release DMA channel descriptor allocations wcn36xx: Put DXE block into reset before freeing memory wcn36xx: populate band before determining rate on RX wcn36xx: fix RX BD rate mapping for 5GHz legacy rates ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() media: videobuf2: Fix the size printk format media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case media: atomisp: fix inverted logic in buffers_needed() media: atomisp: do not use err var when checking port validity for ISP2400 media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() media: atomisp: fix ifdefs in sh_css.c media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c media: atomisp: add NULL check for asd obtained from atomisp_video_pipe media: atomisp: fix enum formats logic media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() media: aspeed: fix mode-detect always time out at 2nd run media: em28xx: fix memory leak in em28xx_init_dev media: aspeed: Update signal status immediately to ensure sane hw state arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ arm64: dts: meson-gxbb-wetek: fix HDMI in early boot arm64: dts: meson-gxbb-wetek: fix missing GPIO binding fs: dlm: use sk->sk_socket instead of con->sock fs: dlm: don't call kernel_getpeername() in error_report() memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails Bluetooth: stop proccessing malicious adv data ath11k: Fix ETSI regd with weather radar overlap ath11k: clear the keys properly via DISABLE_KEY ath11k: reset RSN/WPA present state for open BSS tee: fix put order in teedev_close_context() fs: dlm: fix build with CONFIG_IPV6 disabled drm/vboxvideo: fix a NULL vs IS_ERR() check arm64: dts: renesas: cat875: Add rx/tx delays media: dmxdev: fix UAF when dvb_register_device() fails crypto: qce - fix uaf on qce_ahash_register_one crypto: qce - fix uaf on qce_skcipher_register_one mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco crypto: qat - fix spelling mistake: "messge" -> "message" crypto: qat - remove unnecessary collision prevention step in PFVF crypto: qat - make pfvf send message direction agnostic crypto: qat - fix undetected PFVF timeout in ACK loop ath11k: Use host CE parameters for CE interrupts configuration arm64: dts: ti: k3-j721e: correct cache-sets info tty: serial: atmel: Check return code of dmaengine_submit() tty: serial: atmel: Call dma_async_issue_pending() mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP mfd: atmel-flexcom: Use .resume_noirq media: rcar-csi2: Correct the selection of hsfreqrange media: imx-pxp: Initialize the spinlock prior to using it media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released media: coda: fix CODA960 JPEG encoder buffer overflow media: venus: pm_helpers: Control core power domain manually media: venus: core, venc, vdec: Fix probe dependency error media: venus: core: Fix a potential NULL pointer dereference in an error handling path media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' thermal/drivers/imx: Implement runtime PM support netfilter: bridge: add support for pppoe filtering arm64: dts: qcom: msm8916: fix MMC controller aliases cgroup: Trace event cgroup id fields should be u64 ACPI: EC: Rework flushing of EC work while suspended to idle thermal/drivers/imx8mm: Enable ADC when enabling monitor drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() arm64: dts: ti: k3-j7200: Fix the L2 cache sets arm64: dts: ti: k3-j721e: Fix the L2 cache sets arm64: dts: ti: k3-j7200: Correct the d-cache-sets info tty: serial: uartlite: allow 64 bit address serial: amba-pl011: do not request memory region twice floppy: Fix hang in watchdog when disk is ejected staging: rtl8192e: return error code from rtllib_softmac_init() staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() Bluetooth: btmtksdio: fix resume failure sched/fair: Fix detection of per-CPU kthreads waking a task sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity bpf: Adjust BTF log size limit. bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) bpf: Remove config check to enable bpf support for branch records arm64: lib: Annotate {clear, copy}_page() as position-independent arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 media: dib8000: Fix a memleak in dib8000_init() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: si2157: Fix "warm" tuner state detection wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma sched/rt: Try to restart rt period timer when rt runtime exceeded drm/msm/dp: displayPort driver need algorithm rational rcu/exp: Mark current CPU as exp-QS in IPI loop second pass mwifiex: Fix possible ABBA deadlock xfrm: fix a small bug in xfrm_sa_len() x86/uaccess: Move variable into switch case statement selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST selftests: harness: avoid false negatives if test has no ASSERTs crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter crypto: stm32/cryp - fix CTR counter carry crypto: stm32/cryp - fix xts and race condition in crypto_engine requests crypto: stm32/cryp - check early input data crypto: stm32/cryp - fix double pm exit crypto: stm32/cryp - fix lrw chaining mode crypto: stm32/cryp - fix bugs and crash in tests crypto: stm32 - Revert broken pm_runtime_resume_and_get changes ath11k: Fix deleting uninitialized kernel timer during fragment cache flush ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors media: dw2102: Fix use after free media: msi001: fix possible null-ptr-deref in msi001_probe() media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() arm64: dts: qcom: c630: Fix soundcard setup arm64: dts: qcom: ipq6018: Fix gpio-ranges property drm/msm/dpu: fix safe status debugfs file drm/bridge: ti-sn65dsi86: Set max register for regmap drm/tegra: vic: Fix DMA API misuse media: hantro: Fix probe func error path xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding usb: ftdi-elan: fix memory leak on device disconnect arm64: dts: marvell: cn9130: add GPIO and SPI aliases arm64: dts: marvell: cn9130: enable CP0 GPIO controllers ARM: dts: armada-38x: Add generic compatible to UART nodes iwlwifi: mvm: fix 32-bit build in FTM iwlwifi: mvm: test roc running status bits before removing the sta mmc: meson-mx-sdhc: add IRQ check mmc: meson-mx-sdio: add IRQ check selinux: fix potential memleak in selinux_add_opt() um: fix ndelay/udelay defines um: virtio_uml: Fix time-travel external time propagation Bluetooth: L2CAP: Fix using wrong mode bpftool: Enable line buffering for stdout backlight: qcom-wled: Validate enabled string indices in DT backlight: qcom-wled: Pass number of elements to read to read_u32_array backlight: qcom-wled: Fix off-by-one maximum with default num_strings backlight: qcom-wled: Override default length with qcom,enabled-strings backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion backlight: qcom-wled: Respect enabled-strings in set_brightness software node: fix wrong node passed to find nargs_prop Bluetooth: hci_qca: Stop IBS timer during BT OFF x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS hwmon: (mr75203) fix wrong power-up delay value x86/mce/inject: Avoid out-of-bounds write when setting flags ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() power: reset: mt6397: Check for null res pointer netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() bpf: Don't promote bogus looking registers after null check. bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone ppp: ensure minimum packet size in ppp_write() rocker: fix a sleeping in atomic bug staging: greybus: audio: Check null pointer fsl/fman: Check for null pointer after calling devm_ioremap Bluetooth: hci_bcm: Check for error irq Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad debugfs: lockdown: Allow reading debugfs files that are not world readable net/mlx5e: Fix page DMA map/unmap attributes net/mlx5e: Don't block routes with nexthop objects in SW Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" net/mlx5: Set command entry semaphore up once got index free lib/mpi: Add the return value check of kcalloc() Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe ax25: uninitialized variable in ax25_setsockopt() netrom: fix api breakage in nr_setsockopt() regmap: Call regmap_debugfs_exit() prior to _init() can: mcp251xfd: add missing newline to printed strings tpm: add request_locality before write TPM_INT_ENABLE tpm_tis: Fix an error handling path in 'tpm_tis_core_init()' can: softing: softing_startstop(): fix set but not used variable warning can: xilinx_can: xcan_probe(): check for error irq pcmcia: fix setting of kthread task states iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing() net: mcs7830: handle usb read errors properly ext4: avoid trim error on fs with small groups ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: hda: Add missing rwsem around snd_ctl_remove() calls RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" RDMA/hns: Validate the pkey index scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd() clk: imx8mn: Fix imx8mn_clko1_sels powerpc/prom_init: Fix improper check of prom_getprop() ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA dt-bindings: thermal: Fix definition of cooling-maps contribution property powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C powerpc/perf: MMCR0 control for PMU registers under PMCC=00 powerpc/perf: move perf irq/nmi handling details into traps.c powerpc/irq: Add helper to set regs->softe powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC powerpc/32s: Fix shift-out-of-bounds in KASAN init clocksource: Reduce clocksource-skew threshold clocksource: Avoid accidental unstable marking of clocksources ALSA: oss: fix compile error when OSS_DEBUG is enabled ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID char/mwave: Adjust io port register size binder: fix handling of error during copy openrisc: Add clone3 ABI wrapper iommu/io-pgtable-arm: Fix table descriptor paddr formatting scsi: ufs: Fix race conditions related to driver data RDMA/qedr: Fix reporting max_{send/recv}_wr attrs PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() powerpc/powermac: Add additional missing lockdep_register_key() RDMA/core: Let ib_find_gid() continue search even after empty entry RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry ASoC: rt5663: Handle device_property_read_u32_array error codes of: unittest: fix warning on PowerPC frame size warning of: unittest: 64 bit dma address test requires arch support clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support mips: fix Kconfig reference to PHYS_ADDR_T_64BIT dmaengine: pxa/mmp: stop referencing config->slave_id iommu/amd: Remove iommu_init_ga() iommu/amd: Restore GA log/tail pointer on host resume ASoC: Intel: catpt: Test dmaengine_submit() result before moving on iommu/iova: Fix race between FQ timeout and teardown scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() phy: uniphier-usb3ss: fix unintended writing zeros to PHY register ASoC: mediatek: Check for error clk pointer ASoC: samsung: idma: Check of ioremap return value misc: lattice-ecp3-config: Fix task hung when firmware load failed counter: stm32-lptimer-cnt: remove iio counter abi arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering arm64: tegra: Remove non existent Tegra194 reset mips: lantiq: add support for clk_set_parent() mips: bcm63xx: add support for clk_set_parent() powerpc/xive: Add missing null check after calling kmalloc ASoC: fsl_mqs: fix MODULE_ALIAS RDMA/cxgb4: Set queue pair state when being queried ASoC: fsl_asrc: refine the check of available clock divider clk: bm1880: remove kfrees on static allocations of: base: Fix phandle argument length mismatch error message ARM: dts: omap3-n900: Fix lp5523 for multi color Bluetooth: Fix debugfs entry leak in hci_register_dev() fs: dlm: filter user dlm messages for kernel locks drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y selftests/bpf: Fix bpf_object leak in skb_ctx selftest ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR media: atomisp: fix try_fmt logic media: atomisp: set per-device's default mode media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure ARM: shmobile: rcar-gen2: Add missing of_node_put() batman-adv: allow netlink usage in unprivileged containers media: atomisp: handle errors at sh_css_create_isp_params() ath11k: Fix crash caused by uninitialized TX ring usb: gadget: f_fs: Use stream_open() for endpoint files drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L HID: apple: Do not reset quirks when the Fn key is not found media: b2c2: Add missing check in flexcop_pci_isr: EDAC/synopsys: Use the quirk for version instead of ddr version ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART drm/amd/display: check top_pipe_to_program pointer drm/amdgpu/display: set vblank_disable_immediate for DC soc: ti: pruss: fix referenced node in error message mlxsw: pci: Add shutdown method in PCI driver drm/bridge: megachips: Ensure both bridges are probed before registration tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown() gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use HSI: core: Fix return freed object in hsi_new_client crypto: jitter - consider 32 LSB for APT mwifiex: Fix skb_over_panic in mwifiex_usb_recv() rsi: Fix use-after-free in rsi_rx_done_handler() rsi: Fix out-of-bounds read in rsi_read_pkt() ath11k: Avoid NULL ptr access during mgmt tx cleanup media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table ACPI: Change acpi_device_always_present() into acpi_device_override_status() ACPI / x86: Allow specifying acpi_device_override_status() quirks by path ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node usb: uhci: add aspeed ast2600 uhci support floppy: Add max size check for user space request x86/mm: Flush global TLB when switching to trampoline page-table drm: rcar-du: Fix CRTC timings when CMM is used media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. media: rcar-vin: Update format alignment constraints media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: m920x: don't use stack on USB reads thunderbolt: Runtime PM activate both ends of the device link iwlwifi: mvm: synchronize with FW after multicast commands iwlwifi: mvm: avoid clearing a just saved session protection id ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work ath10k: Fix tx hanging net-sysfs: update the queue counts in the unregistration path net: phy: prefer 1000baseT over 1000baseKX gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock selftests/ftrace: make kprobe profile testcase description unique ath11k: Avoid false DEADLOCK warning reported by lockdep x86/mce: Allow instrumentation during task work queueing x86/mce: Mark mce_panic() noinstr x86/mce: Mark mce_end() noinstr x86/mce: Mark mce_read_aux() noinstr net: bonding: debug: avoid printing debug logs when bond is not notifying peers bpf: Do not WARN in bpf_warn_invalid_xdp_action() HID: quirks: Allow inverting the absolute X/Y values media: igorplugusb: receiver overflow should be reported media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO audit: ensure userspace is penalized the same as the kernel when under pressure arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus arm64: tegra: Adjust length of CCPLEX cluster MMIO region PM: runtime: Add safety net to supplier device release cpufreq: Fix initialization of min and max frequency QoS requests usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream rtw88: 8822c: update rx settings to prevent potential hw deadlock PM: AVS: qcom-cpr: Use div64_ul instead of do_div iwlwifi: fix leaks/bad data after failed firmware load iwlwifi: remove module loading failure message iwlwifi: mvm: Fix calculation of frame length iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ um: registers: Rename function names to avoid conflicts and build problems ath11k: Fix napi related hang Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES xfrm: rate limit SA mapping change message to user space drm/etnaviv: consider completed fence seqno in hang check jffs2: GC deadlock reading a page that is used in jffs2_write_begin() ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Fix wrong interpretation of PCC address ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 drm/amdgpu: fixup bad vram size on gmc v8 amdgpu/pm: Make sysfs pm attributes as read-only for VFs ACPI: battery: Add the ThinkPad "Not Charging" quirk btrfs: remove BUG_ON() in find_parent_nodes() btrfs: remove BUG_ON(!eie) in find_parent_nodes net: mdio: Demote probed message to debug print mac80211: allow non-standard VHT MCS-10/11 dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() mlxsw: pci: Avoid flow control for EMAD packets net: phy: marvell: configure RGMII delays for 88E1118 net: gemini: allow any RGMII interface mode regulator: qcom_smd: Align probe function with rpmh-regulator serial: pl010: Drop CR register reset on set_termios serial: core: Keep mctrl register state and cached copy in sync random: do not throw away excess input to crng_fast_load parisc: Avoid calling faulthandler_disabled() twice x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs powerpc/6xx: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/btext: add missing of_node_put powerpc/watchdog: Fix missed watchdog reset due to memory ordering race i2c: i801: Don't silently correct invalid transfer size powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: mpc: Correct I2C reset procedure clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB powerpc/powermac: Add missing lockdep_register_key() KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST w1: Misuse of get_user()/put_user() reported by sparse nvmem: core: set size for sysfs bin file dm: fix alloc_dax error handling in alloc_dev scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup ALSA: seq: Set upper limit of processed events MIPS: Loongson64: Use three arguments for slti powerpc/40x: Map 32Mbytes of memory at startup selftests/powerpc/spectre_v2: Return skip code when miss_percent is high powerpc: handle kdump appropriately with crash_kexec_post_notifiers option powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic udf: Fix error handling in udf_new_inode() MIPS: OCTEON: add put_device() after of_find_device_by_node() irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters MIPS: Octeon: Fix build errors using clang scsi: sr: Don't use GFP_DMA ASoC: mediatek: mt8173: fix device_node leak ASoC: mediatek: mt8183: fix device_node leak phy: mediatek: Fix missing check in mtk_mipi_tx_probe rpmsg: core: Clean up resources on announce_create failure. crypto: omap-aes - Fix broken pm_runtime_and_get() usage crypto: stm32/crc32 - Fix kernel BUG triggered in probe() crypto: caam - replace this_cpu_ptr with raw_cpu_ptr ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers tpm: fix NPE on probe for missing device spi: uniphier: Fix a bug that doesn't point to private data correctly xen/gntdev: fix unmap notification order fuse: Pass correct lend value to filemap_write_and_wait_range() serial: Fix incorrect rs485 polarity on uart open cputime, cpuacct: Include guest time in user time in cpuacct.stat tracing/kprobes: 'nmissed' not showed correctly for kretprobe iwlwifi: mvm: Increase the scan timeout guard to 30 seconds s390/mm: fix 2KB pgtable release race device property: Fix fwnode_graph_devcon_match() fwnode leak drm/etnaviv: limit submit sizes drm/nouveau/kms/nv04: use vzalloc for nv04_display drm/bridge: analogix_dp: Make PSR-exit block less parisc: Fix lpa and lpa_user defines powerpc/64s/radix: Fix huge vmap false positive PCI: xgene: Fix IB window setup PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space PCI: pci-bridge-emul: Fix definitions of reserved bits PCI: pci-bridge-emul: Correctly set PCIe capabilities PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device xfrm: fix policy lookup for ipv6 gre packets btrfs: fix deadlock between quota enable and other quota operations btrfs: check the root node for uptodate before returning it btrfs: respect the max size in the header when activating swap file ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error ext4: fix a possible ABBA deadlock due to busy PA ext4: initialize err_blk before calling __ext4_get_inode_loc ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE ext4: set csum seed in tmp inode while migrating to extents ext4: Fix BUG_ON in ext4_bread when write quota data ext4: use ext4_ext_remove_space() for fast commit replay delete range ext4: fast commit may miss tracking unwritten range during ftruncate ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' ext4: don't use the orphan list when migrating an inode drm/radeon: fix error handling in radeon_driver_open_kms of: base: Improve argument length mismatch error firmware: Update Kconfig help text for Google firmware can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message media: rcar-csi2: Optimize the selection PHTW register drm/vc4: hdmi: Make sure the device is powered with CEC media: correct MEDIA_TEST_SUPPORT help text Documentation: dmaengine: Correctly describe dmatest with channel unset Documentation: ACPI: Fix data node reference documentation Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Documentation: fix firewire.rst ABI file path error Bluetooth: hci_sync: Fix not setting adv set duration scsi: core: Show SCMD_LAST in text form dmaengine: uniphier-xdmac: Fix type of address variables RDMA/hns: Modify the mapping attribute of doorbell to device RDMA/rxe: Fix a typo in opcode name dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Revert "net/mlx5: Add retry mechanism to the command entry index allocation" powerpc/cell: Fix clang -Wimplicit-fallthrough warning powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses block: Fix fsync always failed if once failed bpftool: Remove inclusion of utilities.mak from Makefiles xdp: check prog type before updating BPF link perf evsel: Override attr->sample_period for non-libpfm4 events ipv4: update fib_info_cnt under spinlock protection ipv4: avoid quadratic behavior in netns dismantle net/fsl: xgmac_mdio: Add workaround for erratum A-009885 net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries f2fs: compress: fix potential deadlock of compress file f2fs: fix to reserve space for IO align feature af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress clk: Emit a stern warning with writable debugfs enabled clk: si5341: Fix clock HW provider cleanup net/smc: Fix hung_task when removing SMC-R devices net: axienet: increase reset timeout net: axienet: Wait for PhyRstCmplt after core reset net: axienet: reset core on initialization prior to MDIO access net: axienet: add missing memory barriers net: axienet: limit minimum TX ring size net: axienet: Fix TX ring slot available check net: axienet: fix number of TX ring slots for available check net: axienet: fix for TX busy handling net: axienet: increase default TX ring size to 128 HID: vivaldi: fix handling devices not using numbered reports rtc: pxa: fix null pointer dereference vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 virtio_ring: mark ring unused on error taskstats: Cleanup the use of task->exit_code inet: frags: annotate races around fqdir->dead and fqdir->high_thresh netns: add schedule point in ops_exit_list() xfrm: Don't accidentally set RTO_ONLINK in decode_session4() gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() perf script: Fix hex dump character output dmaengine: at_xdmac: Don't start transactions at tx_submit level dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Fix concurrency over xfers_list dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix at_xdmac_lld struct definition perf probe: Fix ppc64 'perf probe add events failed' case devlink: Remove misleading internal_flags from health reporter dump arm64: dts: qcom: msm8996: drop not documented adreno properties net: bonding: fix bond_xmit_broadcast return value error bug net_sched: restore "mpu xxx" handling bcmgenet: add WOL IRQ check net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() net: sfp: fix high power modules without diagnostic monitoring net: mscc: ocelot: fix using match before it is set dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property dt-bindings: display: meson-vpu: Add missing amlogic,canvas property dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7 scripts/dtc: dtx_diff: remove broken example from help text lib82596: Fix IRQ check in sni_82596_probe mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test mtd: nand: bbt: Fix corner case in bad block table handling ath10k: Fix the MTU size on QCA9377 SDIO scripts: sphinx-pre-install: add required ctex dependency scripts: sphinx-pre-install: Fix ctex support on Debian Linux 5.10.94 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I857f2417c899508815a1ba13d1285fd400a1f133	2022-01-27 11:49:22 +01:00
Bernard Zhao	b2b1b490bd	selinux: fix potential memleak in selinux_add_opt() ... [ Upstream commit 2e08df3c7c ] This patch try to fix potential memleak in error branch. Fixes: ba64186233 ("selinux: new helper - selinux_add_opt()") Signed-off-by: Bernard Zhao <bernard@vivo.com> [PM: tweak the subject line, add Fixes tag] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:53:58 +01:00
Greg Kroah-Hartman	a1bb21475e	Merge 5.10.90 into android12-5.10-lts ... Changes in 5.10.90 Input: i8042 - add deferred probe support Input: i8042 - enable deferred probe quirk for ASUS UM325UA tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). tomoyo: use hwight16() in tomoyo_domain_quota_is_ok() parisc: Clear stale IIR value on instruction access rights trap platform/x86: apple-gmux: use resource_size() with res memblock: fix memblock_phys_alloc() section mismatch error recordmcount.pl: fix typo in s390 mcount regex selinux: initialize proto variable in selinux_ip_postroute_compat() scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources net/mlx5e: Wrap the tx reporter dump callback to extract the sq net/mlx5e: Fix ICOSQ recovery flow for XSK udp: using datalen to cap ipv6 udp max gso segments selftests: Calculate udpgso segment count without header adjustment sctp: use call_rcu to free endpoint net/smc: fix using of uninitialized completions net: usb: pegasus: Do not drop long Ethernet frames net: ag71xx: Fix a potential double free in error handling paths net: lantiq_xrx200: fix statistics of received bytes NFC: st21nfca: Fix memory leak in device probe and remove net/smc: improved fix wait on already cleared link net/smc: don't send CDC/LLC message if link not ready net/smc: fix kernel panic caused by race of smc_sock igc: Fix TX timestamp support for non-MSI-X platforms ionic: Initialize the 'lif->dbid_inuse' bitmap net/mlx5e: Fix wrong features assignment in case of error selftests/net: udpgso_bench_tx: fix dst ip argument net/ncsi: check for error return from call to nla_put_u32 fsl/fman: Fix missing put_device() call in fman_port_probe i2c: validate user data in compat ioctl nfc: uapi: use kernel size_t to fix user-space builds uapi: fix linux/nfc.h userspace compilation errors drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled drm/amdgpu: add support for IP discovery gc_info table v2 xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. usb: mtu3: add memory barrier before set GPD's HWO usb: mtu3: fix list_head check warning usb: mtu3: set interval of FS intr and isoc endpoint binder: fix async_free_space accounting for empty parcels scsi: vmw_pvscsi: Set residual data length conditionally Input: appletouch - initialize work before device registration Input: spaceball - fix parsing of movement data packets net: fix use-after-free in tw_timer_handler perf script: Fix CPU filtering of a script's switch events bpf: Add kconfig knob for disabling unpriv bpf by default Linux 5.10.90 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I299d1e939d3b01b5d6f34f7b9ec701d624bbfde3	2022-01-05 13:23:32 +01:00
Tom Rix	4833ad4908	selinux: initialize proto variable in selinux_ip_postroute_compat() ... commit 732bc2ff08 upstream. Clang static analysis reports this warning hooks.c:5765:6: warning: 4th function call argument is an uninitialized value if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ selinux_parse_skb() can return ok without setting proto. The later call to selinux_xfrm_postroute_last() does an early check of proto and can return ok if the garbage proto value matches. So initialize proto. Cc: stable@vger.kernel.org Fixes: eef9b41622 ("selinux: cleanup selinux_xfrm_sock_rcv_skb() and selinux_xfrm_postroute_last()") Signed-off-by: Tom Rix <trix@redhat.com> [PM: typo/spelling and checkpatch.pl description fixes] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-05 12:40:30 +01:00
Tetsuo Handa	0643d9175d	tomoyo: use hwight16() in tomoyo_domain_quota_is_ok() ... [ Upstream commit f702e11076 ] hwight16() is much faster. While we are at it, no need to include "perm =" part into data_race() macro, for perm is a local variable that cannot be accessed by other threads. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-05 12:40:29 +01:00
Dmitry Vyukov	e2048a1f91	tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). ... [ Upstream commit 04e57a2d95 ] If tomoyo is used in a testing/fuzzing environment in learning mode, for lots of domains the quota will be exceeded and stay exceeded for prolonged periods of time. In such cases it's pointless (and slow) to walk the whole acl list again and again just to rediscover that the quota is exceeded. We already have the TOMOYO_DIF_QUOTA_WARNED flag that notes the overflow condition. Check it early to avoid the slowdown. [penguin-kernel] This patch causes a user visible change that the learning mode will not be automatically resumed after the quota is increased. To resume the learning mode, administrator will need to explicitly clear TOMOYO_DIF_QUOTA_WARNED flag after increasing the quota. But I think that this change is generally preferable, for administrator likely wants to optimize the acl list for that domain before increasing the quota, or that domain likely hits the quota again. Therefore, don't try to care to clear TOMOYO_DIF_QUOTA_WARNED flag automatically when the quota for that domain changed. Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-05 12:40:29 +01:00
Greg Kroah-Hartman	8d21bcc704	Merge 5.10.82 into android12-5.10-lts ... Changes in 5.10.82 arm64: zynqmp: Do not duplicate flash partition label property arm64: zynqmp: Fix serial compatible string ARM: dts: sunxi: Fix OPPs node name arm64: dts: allwinner: h5: Fix GPU thermal zone node name arm64: dts: allwinner: a100: Fix thermal zone node name staging: wfx: ensure IRQ is ready before enabling it ARM: dts: NSP: Fix mpcore, mmc node names scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() arm64: dts: rockchip: Disable CDN DP on Pinebook Pro arm64: dts: hisilicon: fix arm,sp805 compatible string RDMA/bnxt_re: Check if the vlan is valid before reporting bus: ti-sysc: Add quirk handling for reinit on context lost bus: ti-sysc: Use context lost quirk for otg usb: musb: tusb6010: check return value after calling platform_get_resource() usb: typec: tipd: Remove WARN_ON in tps6598x_block_read ARM: dts: ux500: Skomer regulator fixes staging: rtl8723bs: remove possible deadlock when disconnect (v2) ARM: BCM53016: Specify switch ports for Meraki MR32 arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property arm64: dts: freescale: fix arm,sp805 compatible string ASoC: SOF: Intel: hda-dai: fix potential locking issue clk: imx: imx6ul: Move csi_sel mux to correct base register ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect scsi: advansys: Fix kernel pointer leak ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec firmware_loader: fix pre-allocated buf built-in firmware use ARM: dts: omap: fix gpmc,mux-add-data type usb: host: ohci-tmio: check return value after calling platform_get_resource() ARM: dts: ls1021a: move thermal-zones node out of soc/ ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash ALSA: ISA: not for M68K tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc MIPS: sni: Fix the build scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() scsi: target: Fix ordered tag handling scsi: target: Fix alua_tg_pt_gps_count tracking iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() powerpc/5200: dts: fix memory node unit name ARM: dts: qcom: fix memory and mdio nodes naming for RB3011 ALSA: gus: fix null pointer dereference on pointer block powerpc/dcr: Use cmplwi instead of 3-argument cmpli powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST sh: check return code of request_irq maple: fix wrong return value of maple_bus_init(). f2fs: fix up f2fs_lookup tracepoints f2fs: fix to use WHINT_MODE sh: fix kconfig unmet dependency warning for FRAME_POINTER sh: math-emu: drop unused functions sh: define __BIG_ENDIAN for math-emu f2fs: compress: disallow disabling compress on non-empty compressed file f2fs: fix incorrect return value in f2fs_sanity_check_ckpt() clk: ingenic: Fix bugs with divided dividers clk/ast2600: Fix soc revision for AHB clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() perf/x86/vlbr: Add c->flags to vlbr event constraints blkcg: Remove extra blkcg_bio_issue_init tracing/histogram: Do not copy the fixed-size char array field over the field size perf bpf: Avoid memory leak from perf_env__insert_btf() perf bench futex: Fix memory leak of perf_cpu_map__new() perf tests: Remove bash construct from record+zstd_comp_decomp.sh drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy. net-zerocopy: Refactor skb frag fast-forward op. tcp: Fix uninitialized access in skb frags array for Rx 0cp. tracing: Add length protection to histogram string copies net: ipa: disable HOLB drop when updating timer net: bnx2x: fix variable dereferenced before check bnxt_en: reject indirect blk offload when hw-tc-offload is off tipc: only accept encrypted MSG_CRYPTO msgs net: reduce indentation level in sk_clone_lock() sock: fix /proc/net/sockstat underflow in sk_clone_lock() net/smc: Make sure the link_id is unique iavf: Fix return of set the new channel count iavf: check for null in iavf_fix_features iavf: free q_vectors before queues in iavf_disable_vf iavf: Fix failure to exit out from last all-multicast mode iavf: prevent accidental free of filter structure iavf: validate pointers iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset iavf: Fix for setting queues to 0 MIPS: generic/yamon-dt: fix uninitialized variable error mips: bcm63xx: add support for clk_get_parent() mips: lantiq: add support for clk_get_parent() platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() net/mlx5: Lag, update tracker when state change event received net/mlx5: E-Switch, Change mode lock from mutex to rw semaphore net/mlx5: E-Switch, return error if encap isn't supported scsi: core: sysfs: Fix hang when device state is set via sysfs net: sched: act_mirred: drop dst for the direction from egress to ingress net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove net: virtio_net_hdr_to_skb: count transport header in UFO i40e: Fix correct max_pkt_size on VF RX queue i40e: Fix NULL ptr dereference on VSI filter sync i40e: Fix changing previously set num_queue_pairs for PFs i40e: Fix ping is lost after configuring ADq on VF i40e: Fix warning message and call stack during rmmod i40e driver i40e: Fix creation of first queue by omitting it if is not power of two i40e: Fix display error code in dmesg NFC: reorganize the functions in nci_request NFC: reorder the logic in nfc_{un,}register_device net: nfc: nci: Change the NCI close sequence NFC: add NCI_UNREG flag to eliminate the race e100: fix device suspend/resume KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr() pinctrl: qcom: sdm845: Enable dual edge errata perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server s390/kexec: fix return code handling net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices arm64: vdso32: suppress error message for 'make mrproper' tun: fix bonding active backup with arp monitoring hexagon: export raw I/O routines for modules hexagon: clean up timer-regs.h tipc: check for null after calling kmemdup ipc: WARN if trying to remove ipc object which is absent mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() s390/kexec: fix memory leak of ipl report buffer block: Check ADMIN before NICE for IOPRIO_CLASS_RT KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load udf: Fix crash after seekdir net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform btrfs: fix memory ordering between normal and ordered work functions parisc/sticon: fix reverse colors cfg80211: call cfg80211_stop_ap when switch from P2P_GO type drm/amd/display: Update swizzle mode enums drm/udl: fix control-message timeout drm/nouveau: Add a dedicated mutex for the clients list drm/nouveau: use drm_dev_unplug() during device removal drm/nouveau: clean up all clients on device removal drm/i915/dp: Ensure sink rate values are always valid drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors scsi: ufs: core: Fix task management completion scsi: ufs: core: Fix task management completion timeout race hugetlbfs: flush TLBs correctly after huge_pmd_unshare RDMA/netlink: Add __maybe_unused to static inline in C file selinux: fix NULL-pointer dereference when hashtab allocation fails ASoC: DAPM: Cover regression by kctl change notification fix usb: max-3421: Use driver data instead of maintaining a list of bound devices ice: Delete always true check of PF pointer fs: export an inode_update_time helper btrfs: update device path inode time instead of bd_inode x86/Kconfig: Fix an unused variable error in dell-smm-hwmon ALSA: hda: hdac_ext_stream: fix potential locking issues ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() Revert "perf: Rework perf_event_exit_event()" Linux 5.10.82 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I56e067875dafc27c2e86fc3b8c47abb3296c6a18	2021-11-26 15:37:44 +01:00
Ondrej Mosnacek	b17dd53cac	selinux: fix NULL-pointer dereference when hashtab allocation fails ... commit dc27f3c5d1 upstream. When the hash table slot array allocation fails in hashtab_init(), h->size is left initialized with a non-zero value, but the h->htable pointer is NULL. This may then cause a NULL pointer dereference, since the policydb code relies on the assumption that even after a failed hashtab_init(), hashtab_map() and hashtab_destroy() can be safely called on it. Yet, these detect an empty hashtab only by looking at the size. Fix this by making sure that hashtab_init() always leaves behind a valid empty hashtab when the allocation fails. Cc: stable@vger.kernel.org Fixes: 03414a49ad ("selinux: do not allocate hashtabs dynamically") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-26 10:39:21 +01:00
Greg Kroah-Hartman	94097f9434	Merge 5.10.81 into android12-5.10-lts ... Changes in 5.10.81 fortify: Explicitly disable Clang support block: Add a helper to validate the block size loop: Use blk_validate_block_size() to validate block size bootconfig: init: Fix memblock leak in xbc_make_cmdline() net: stmmac: add clocks management for gmac driver net: stmmac: platform: fix build error with !CONFIG_PM_SLEEP net: stmmac: fix missing unlock on error in stmmac_suspend() net: stmmac: fix system hang if change mac address after interface ifdown net: stmmac: fix issue where clk is being unprepared twice net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings x86/iopl: Fake iopl(3) CLI/STI usage parisc/entry: fix trace test in syscall exit path PCI/MSI: Destroy sysfs before freeing entries PCI/MSI: Deal with devices lying about their MSI mask capability PCI: Add MSI masking quirk for Nvidia ION AHCI erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() erofs: fix unsafe pagevec reuse of hooked pclusters scripts/lld-version.sh: Rewrite based on upstream ld-version.sh perf/core: Avoid put_page() when GUP fails thermal: Fix NULL pointer dereferences in of_thermal_ functions selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage Linux 5.10.81 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic5ba37cba892391e62596f4c342d36a8f66e4647	2021-11-21 14:29:02 +01:00
Kees Cook	eaafc59005	fortify: Explicitly disable Clang support ... commit a52f8a59ae upstream. Clang has never correctly compiled the FORTIFY_SOURCE defenses due to a couple bugs: Eliding inlines with matching __builtin_* names https://bugs.llvm.org/show_bug.cgi?id=50322 Incorrect __builtin_constant_p() of some globals https://bugs.llvm.org/show_bug.cgi?id=41459 In the process of making improvements to the FORTIFY_SOURCE defenses, the first (silent) bug (coincidentally) becomes worked around, but exposes the latter which breaks the build. As such, Clang must not be used with CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13), and the fortify routines have been rearranged. Update the Kconfig to reflect the reality of the current situation. Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Nick Desaulniers <ndesaulniers@google.com> Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com Cc: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-21 13:46:35 +01:00
Greg Kroah-Hartman	c553d9a246	Merge 5.10.80 into android12-5.10-lts ... Changes in 5.10.80 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform binder: use euid from cred instead of using task binder: use cred instead of task for selinux checks binder: use cred instead of task for getsecid Input: iforce - fix control-message timeout Input: elantench - fix misreporting trackpoint coordinates Input: i8042 - Add quirk for Fujitsu Lifebook T725 libata: fix read log timeout value ocfs2: fix data corruption on truncate scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file scsi: qla2xxx: Fix use after free in eh_abort path mmc: mtk-sd: Add wait dma stop done flow mmc: dw_mmc: Dont wait for DRTO on Write RSP error exfat: fix incorrect loading of i_blocks for large files parisc: Fix set_fixmap() on PA1.x CPUs parisc: Fix ptrace check on syscall return tpm: Check for integer overflow in tpm2_map_response_body() firmware/psci: fix application of sizeof to pointer crypto: s5p-sss - Add error handling in s5p_aes_probe() media: rkvdec: Do not override sizeimage for output format media: ite-cir: IR receiver stop working after receive overflow media: rkvdec: Support dynamic resolution changes media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers media: v4l2-ioctl: Fix check_ext_ctrls ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N ALSA: hda/realtek: Add quirk for ASUS UX550VE ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED ALSA: ua101: fix division by zero at probe ALSA: 6fire: fix control and bulk message timeouts ALSA: line6: fix control and interrupt message timeouts ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ALSA: hda: Free card instance properly at probe errors ALSA: synth: missing check for possible NULL after the call to kstrdup ALSA: timer: Fix use-after-free problem ALSA: timer: Unconditionally unlink slave instances, too ext4: fix lazy initialization next schedule time computation in more granular unit ext4: ensure enough credits in ext4_ext_shift_path_extents ext4: refresh the ext4_ext_path struct after dropping i_data_sem. fuse: fix page stealing x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c x86/cpu: Fix migration safety with X86_BUG_NULL_SEL x86/irq: Ensure PI wakeup handler is unregistered before module unload ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked() ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers cavium: Return negative value when pci_alloc_irq_vectors() fails scsi: qla2xxx: Return -ENOMEM if kzalloc() fails scsi: qla2xxx: Fix unmap of already freed sgl mISDN: Fix return values of the probe function cavium: Fix return values of the probe function sfc: Export fibre-specific supported link modes sfc: Don't use netif_info before net_device setup hyperv/vmbus: include linux/bitops.h ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode reset: socfpga: add empty driver allowing consumers to probe mmc: winbond: don't build on M68K drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 fcnal-test: kill hanging ping/nettest binaries on cleanup bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT bpf: Prevent increasing bpf_jit_limit above max gpio: mlxbf2.c: Add check for bgpio_init failure xen/netfront: stop tx queues during live migration nvmet-tcp: fix a memory leak when releasing a queue spi: spl022: fix Microwire full duplex mode net: multicast: calculate csum of looped-back and forwarded packets watchdog: Fix OMAP watchdog early handling drm: panel-orientation-quirks: Add quirk for GPD Win3 block: schedule queue restart after BLK_STS_ZONE_RESOURCE nvmet-tcp: fix header digest verification r8169: Add device 10ec:8162 to driver r8169 vmxnet3: do not stop tx queues after netif_device_detach() nfp: bpf: relax prog rejection for mtu check through max_pkt_offset net/smc: Fix smc_link->llc_testlink_time overflow net/smc: Correct spelling mistake to TCPF_SYN_RECV rds: stop using dmapool btrfs: clear MISSING device status bit in btrfs_close_one_device btrfs: fix lost error handling when replaying directory deletes btrfs: call btrfs_check_rw_degradable only if there is a missing device KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup ia64: kprobes: Fix to pass correct trampoline address to the handler selinux: fix race condition when computing ocontext SIDs hwmon: (pmbus/lm25066) Add offset coefficients regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell mwifiex: fix division by zero in fw download path ath6kl: fix division by zero in send path ath6kl: fix control-message timeout ath10k: fix control-message timeout ath10k: fix division by zero in send path PCI: Mark Atheros QCA6174 to avoid bus reset rtl8187: fix control-message timeouts evm: mark evm_fixmode as __ro_after_init ifb: Depend on netfilter alternatively to tc wcn36xx: Fix HT40 capability for 2Ghz band wcn36xx: Fix tx_status mechanism wcn36xx: Fix (QoS) null data frame bitrate/modulation PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions mwifiex: Read a PCI register after writing the TX ring write pointer mwifiex: Try waking the firmware until we get an interrupt libata: fix checking of DMA state wcn36xx: handle connection loss indication rsi: fix occasional initialisation failure with BT coex rsi: fix key enabled check causing unwanted encryption for vap_id > 0 rsi: fix rate mask set leading to P2P failure rsi: Fix module dev_oper_mode parameter description perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server perf/x86/intel/uncore: Fix Intel ICX IIO event constraints RDMA/qedr: Fix NULL deref for query_qp on the GSI QP signal: Remove the bogus sigkill_pending in ptrace_stop memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id soc: fsl: dpio: use the combined functions to protect critical zone mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines power: supply: max17042_battery: Prevent int underflow in set_soc_threshold power: supply: max17042_battery: use VFSOC for capacity when no rsns KVM: arm64: Extract ESR_ELx.EC only KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport can: j1939: j1939_can_recv(): ignore messages with invalid source address powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found ring-buffer: Protect ring_buffer_reset() from reentrancy serial: core: Fix initializing and restoring termios speed ifb: fix building without CONFIG_NET_CLS_ACT ALSA: mixer: oss: Fix racy access to slots ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume xen/balloon: add late_initcall_sync() for initial ballooning done ovl: fix use after free in struct ovl_aio_req PCI: pci-bridge-emul: Fix emulation of W1C bits PCI: cadence: Add cdns_plat_pcie_probe() missing return PCI: aardvark: Do not clear status bits of masked interrupts PCI: aardvark: Fix checking for link up via LTSSM state PCI: aardvark: Do not unmask unused interrupts PCI: aardvark: Fix reporting Data Link Layer Link Active PCI: aardvark: Fix configuring Reference clock PCI: aardvark: Fix return value of MSI domain .alloc() method PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge quota: check block number when reading the block in quota file quota: correct error number in free_dqentry() pinctrl: core: fix possible memory leak in pinctrl_enable() coresight: cti: Correct the parameter for pm_runtime_put iio: dac: ad5446: Fix ad5622_write() return value iio: ad5770r: make devicetree property reading consistent USB: serial: keyspan: fix memleak on probe errors serial: 8250: fix racy uartclk update most: fix control-message timeouts USB: iowarrior: fix control-message timeouts USB: chipidea: fix interrupt deadlock power: supply: max17042_battery: Clear status bits in interrupt handler dma-buf: WARN on dmabuf release with pending attachments drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Bluetooth: fix use-after-free error in lock_sock_nested() drm/panel-orientation-quirks: add Valve Steam Deck rcutorture: Avoid problematic critical section nesting on PREEMPT_RT platform/x86: wmi: do not fail if disabling fails MIPS: lantiq: dma: add small delay after reset MIPS: lantiq: dma: reset correct number of channel locking/lockdep: Avoid RCU-induced noinstr fail net: sched: update default qdisc visibility after Tx queue cnt changes rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop smackfs: Fix use-after-free in netlbl_catmap_walk() ath11k: Align bss_chan_info structure with firmware x86: Increase exception stack sizes mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type mwifiex: Properly initialize private structure on interface type changes fscrypt: allow 256-bit master keys with AES-256-XTS drm/amdgpu: Fix MMIO access page fault ath11k: Avoid reg rules update during firmware recovery ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets ath10k: high latency fixes for beacon buffer media: mt9p031: Fix corrupted frame after restarting stream media: netup_unidvb: handle interrupt properly according to the firmware media: atomisp: Fix error handling in probe media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() media: uvcvideo: Set capability in s_param media: uvcvideo: Return -EIO for control errors media: uvcvideo: Set unique vdev name based in type media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() media: s5p-mfc: Add checking to s5p_mfc_probe(). media: imx: set a media_device bus_info string media: mceusb: return without resubmitting URB in case of -EPROTO error. ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK rtw88: fix RX clock gate setting while fifo dump brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet media: rcar-csi2: Add checking to rcsi2_start_receiver() ipmi: Disable some operations during a panic fs/proc/uptime.c: Fix idle time reporting in /proc/uptime ACPICA: Avoid evaluating methods too early during system resume media: ipu3-imgu: imgu_fmt: Handle properly try media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() net-sysfs: try not to restart the syscall if it will fail eventually tracefs: Have tracefs directories not set OTH permission bits by default ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() mmc: moxart: Fix reference count leaks in moxart_probe iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value ACPI: battery: Accept charges over the design capacity as full drm/amdkfd: fix resume error when iommu disabled in Picasso net: phy: micrel: make *-skew-ps check more lenient leaking_addresses: Always print a trailing newline drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture() block: bump max plugged deferred size from 16 to 32 md: update superblock after changing rdev flags in state_store memstick: r592: Fix a UAF bug when removing the driver lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression lib/xz: Validate the value before assigning it to an enum variable workqueue: make sysfs of unbound kworker cpumask more clever tracing/cfi: Fix cmp_entries_* functions signature mismatch mt76: mt7915: fix an off-by-one bound check mwl8k: Fix use-after-free in mwl8k_fw_state_machine() block: remove inaccurate requeue check media: allegro: ignore interrupt if mailbox is not initialized nvmet: fix use-after-free when a port is removed nvmet-rdma: fix use-after-free when a port is removed nvmet-tcp: fix use-after-free when a port is removed nvme: drop scan_lock and always kick requeue list when removing namespaces PM: hibernate: Get block device exclusively in swsusp_check() selftests: kvm: fix mismatched fclose() after popen() selftests/bpf: Fix perf_buffer test on system with offline cpus iwlwifi: mvm: disable RX-diversity in powersave smackfs: use __GFP_NOFAIL for smk_cipso_doi() ARM: clang: Do not rely on lr register for stacktrace gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE gfs2: Cancel remote delete work asynchronously gfs2: Fix glock_hash_walk bugs ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 vrf: run conntrack only in context of lower/physdev for locally generated packets net: annotate data-race in neigh_output() ACPI: AC: Quirk GK45 to skip reading _PSR btrfs: reflink: initialize return value to 0 in btrfs_extent_same() btrfs: do not take the uuid_mutex in btrfs_rm_device spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() wcn36xx: Correct band/freq reporting on RX x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled selftests/core: fix conflicting types compile error for close_range() parisc: fix warning in flush_tlb_all task_stack: Fix end_of_stack() for architectures with upwards-growing stack erofs: don't trigger WARN() when decompression fails parisc/unwind: fix unwinder when CONFIG_64BIT is enabled parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state selftests/bpf: Fix strobemeta selftest regression Bluetooth: fix init and cleanup of sco_conn.timeout_work rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() MIPS: lantiq: dma: fix burst length for DEU objtool: Add xen_start_kernel() to noreturn list x86/xen: Mark cpu_bringup_and_idle() as dead_end_function objtool: Fix static_call list generation drm/v3d: fix wait for TMU write combiner flush virtio-gpu: fix possible memory allocation failure lockdep: Let lock_is_held_type() detect recursive read as read net: net_namespace: Fix undefined member in key_remove_domain() cgroup: Make rebind_subsystems() disable v2 controllers all at once wcn36xx: Fix Antenna Diversity Switching wilc1000: fix possible memory leak in cfg_scan_result() Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync crypto: caam - disable pkc for non-E SoCs rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() net: dsa: rtl8366rb: Fix off-by-one bug ath11k: fix some sleeping in atomic bugs ath11k: Avoid race during regd updates ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status ath11k: Fix memory leak in ath11k_qmi_driver_event_work ath10k: Fix missing frame timestamp for beacon/probe-resp ath10k: sdio: Add missing BH locking around napi_schdule() drm/ttm: stop calling tt_swapin in vm_access arm64: mm: update max_pfn after memory hotplug drm/amdgpu: fix warning for overflow check media: em28xx: add missing em28xx_close_extension media: cxd2880-spi: Fix a null pointer dereference on error handling path media: dvb-usb: fix ununit-value in az6027_rc_query media: v4l2-ioctl: S_CTRL output the right value media: TDA1997x: handle short reads of hdmi info frame. media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' media: radio-wl1273: Avoid card name truncation media: si470x: Avoid card name truncation media: tm6000: Avoid card name truncation media: cx23885: Fix snd_card_free call on null card pointer kprobes: Do not use local variable when creating debugfs file crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency cpuidle: Fix kobject memory leaks in error paths media: em28xx: Don't use ops->suspend if it is NULL ath9k: Fix potential interrupt storm on queue reset PM: EM: Fix inefficient states detection EDAC/amd64: Handle three rank interleaving mode rcu: Always inline rcu_dynticks_task*_{enter,exit}() netfilter: nft_dynset: relax superfluous check on set updates media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() crypto: qat - detect PFVF collision after ACK crypto: qat - disregard spurious PFVF interrupts hwrng: mtk - Force runtime pm ops for sleep ops b43legacy: fix a lower bounds test b43: fix a lower bounds test gve: Recover from queue stall due to missed IRQ mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured mmc: sdhci-omap: Fix context restore memstick: avoid out-of-range warning memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE hwmon: Fix possible memleak in __hwmon_device_register() hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff ath10k: fix max antenna gain unit kernel/sched: Fix sched_fork() access an invalid sched_task_group tcp: switch orphan_count to bare per-cpu counters drm/msm: potential error pointer dereference in init() drm/msm: uninitialized variable in msm_gem_import() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() media: ir_toy: assignment to be16 should be of correct type mmc: mxs-mmc: disable regulator on error and in the remove function platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi mt76: mt76x02: fix endianness warnings in mt76x02_mac.c mt76: mt7915: fix possible infinite loop release semaphore mt76: mt7915: fix sta_rec_wtbl tag len mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req() rsi: stop thread firstly in rsi_91x_init() error handling mwifiex: Send DELBA requests according to spec net: enetc: unmap DMA in enetc_send_cmd() phy: micrel: ksz8041nl: do not use power down mode nvme-rdma: fix error code in nvme_rdma_setup_ctrl PM: hibernate: fix sparse warnings clocksource/drivers/timer-ti-dm: Select TIMER_OF x86/sev: Fix stack type check in vc_switch_off_ist() drm/msm: Fix potential NULL dereference in DPU SSPP smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi KVM: selftests: Add operand to vmsave/vmload/vmrun in svm.c KVM: selftests: Fix nested SVM tests when built with clang bpftool: Avoid leaking the JSON writer prepared for program metadata libbpf: Fix BTF data layout checks and allow empty BTF libbpf: Allow loading empty BTFs libbpf: Fix overflow in BTF sanity checks libbpf: Fix BTF header parsing checks s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() KVM: s390: pv: avoid double free of sida page KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm irq: mips: avoid nested irq_enter() tpm: fix Atmel TPM crash caused by too frequent queries tpm_tis_spi: Add missing SPI ID libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED() tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() spi: spi-rpc-if: Check return value of rpcif_sw_init() samples/kretprobes: Fix return value if register_kretprobe() failed KVM: s390: Fix handle_sske page fault handling libertas_tf: Fix possible memory leak in probe and disconnect libertas: Fix possible memory leak in probe and disconnect wcn36xx: add proper DMA memory barriers in rx path wcn36xx: Fix discarded frames due to wrong sequence number drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits selftests: bpf: Convert sk_lookup ctx access tests to PROG_TEST_RUN selftests/bpf: Fix fd cleanup in sk_lookup test net: amd-xgbe: Toggle PLL settings during rate change net: phylink: avoid mvneta warning when setting pause parameters crypto: pcrypt - Delay write to padata->info selftests/bpf: Fix fclose/pclose mismatch in test_progs udp6: allow SO_MARK ctrl msg to affect routing ibmvnic: don't stop queue in xmit ibmvnic: Process crqs after enabling interrupts cgroup: Fix rootcg cpu.stat guest double counting bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off. bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit. of: unittest: fix EXPECT text for gpio hog errors iio: st_sensors: Call st_sensors_power_enable() from bus drivers iio: st_sensors: disable regulators after device unregistration RDMA/rxe: Fix wrong port_cap_flags ARM: dts: BCM5301X: Fix memory nodes names clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() arm64: dts: rockchip: Fix GPU register width for RK3328 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY RDMA/bnxt_re: Fix query SRQ failure arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe arm64: dts: meson-g12a: Fix the pwm regulator supply properties arm64: dts: meson-g12b: Fix the pwm regulator supply properties bus: ti-sysc: Fix timekeeping_suspended warning on resume ARM: dts: at91: tse850: the emac<->phy interface is rmii scsi: dc395: Fix error case unwinding MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT JFS: fix memleak in jfs_mount arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock arm64: dts: renesas: beacon: Fix Ethernet PHY mode arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000 ALSA: hda: Reduce udelay() at SKL+ position reporting ALSA: hda: Release controller display power during shutdown/reboot ALSA: hda: Fix hang during shutdown due to link reset ALSA: hda: Use position buffer for SKL+ again soundwire: debugfs: use controller id and link_id for debugfs scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp() driver core: Fix possible memory leak in device_link_add() arm: dts: omap3-gta04a4: accelerometer irq fix ASoC: SOF: topology: do not power down primary core during topology removal soc/tegra: Fix an error handling path in tegra_powergate_power_up() memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe clk: at91: check pmc node status before registering syscore ops video: fbdev: chipsfb: use memset_io() instead of memset() powerpc: Refactor is_kvm_guest() declaration to new header powerpc: Rename is_kvm_guest() to check_kvm_guest() powerpc: Reintroduce is_kvm_guest() as a fast-path check powerpc: Fix is_kvm_guest() / kvm_para_available() powerpc: fix unbalanced node refcount in check_kvm_guest() serial: 8250_dw: Drop wrong use of ACPI_PTR() usb: gadget: hid: fix error code in do_config() power: supply: rt5033_battery: Change voltage values to µV power: supply: max17040: fix null-ptr-deref in max17040_probe() scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() RDMA/mlx4: Return missed an error if device doesn't support steering usb: musb: select GENERIC_PHY instead of depending on it staging: most: dim2: do not double-register the same device staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC pinctrl: renesas: checker: Fix off-by-one bug in drive register check ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz ARM: dts: stm32: fix SAI sub nodes register range ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 ASoC: cs42l42: Correct some register default values ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER soc: qcom: rpmhpd: Provide some missing struct member descriptions soc: qcom: rpmhpd: Make power_on actually enable the domain usb: typec: STUSB160X should select REGMAP_I2C iio: adis: do not disabe IRQs in 'adis_init()' scsi: ufs: Refactor ufshcd_setup_clocks() to remove skip_ref_clk scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer serial: imx: fix detach/attach of serial console usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled usb: dwc2: drd: reset current session before setting the new one firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available() soc: qcom: apr: Add of_node_put() before return pinctrl: equilibrium: Fix function addition in multiple groups phy: qcom-qusb2: Fix a memory leak on probe phy: ti: gmii-sel: check of_get_address() for failure phy: qcom-snps: Correct the FSEL_MASK serial: xilinx_uartps: Fix race condition causing stuck TX clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL HID: u2fzero: clarify error check and length calculations HID: u2fzero: properly handle timeouts in usb_submit_urb powerpc/44x/fsp2: add missing of_node_put ASoC: cs42l42: Disable regulators if probe fails ASoC: cs42l42: Use device_property API instead of of_property ASoC: cs42l42: Correct configuring of switch inversion from ts-inv virtio_ring: check desc == NULL when using indirect with packed mips: cm: Convert to bitfield API to fix out-of-bounds access power: supply: bq27xxx: Fix kernel crash on IRQ handler register error apparmor: fix error check rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined nfsd: don't alloc under spinlock in rpc_parse_scope_id i2c: mediatek: fixing the incorrect register offset NFS: Fix dentry verifier races pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds drm/plane-helper: fix uninitialized variable reference PCI: aardvark: Don't spam about PIO Response Status PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge opp: Fix return in _opp_add_static_v2() NFS: Fix deadlocks in nfs_scan_commit_list() fs: orangefs: fix error return code of orangefs_revalidate_lookup() mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation mtd: core: don't remove debugfs directory if device is in use remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()' rtc: rv3032: fix error handling in rv3032_clkout_set_rate() dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro NFS: Fix up commit deadlocks NFS: Fix an Oops in pnfs_mark_request_commit() Fix user namespace leak auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string auxdisplay: ht16k33: Connect backlight to fbdev auxdisplay: ht16k33: Fix frame buffer device blanking soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read netfilter: nfnetlink_queue: fix OOB when mac header was cleared dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) m68k: set a default value for MEMORY_RESERVE watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT ar7: fix kernel builds for compiler test scsi: qla2xxx: Changes to support FCP2 Target scsi: qla2xxx: Relogin during fabric disturbance scsi: qla2xxx: Fix gnl list corruption scsi: qla2xxx: Turn off target reset during issue_lip NFSv4: Fix a regression in nfs_set_open_stateid_locked() i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' xen-pciback: Fix return in pm_ctrl_init() net: davinci_emac: Fix interrupt pacing disable ethtool: fix ethtool msg len calculation for pause stats openrisc: fix SMP tlb flush NULL pointer dereference net: vlan: fix a UAF in vlan_dev_real_dev() ice: Fix replacing VF hardware MAC to existing MAC filter ice: Fix not stopping Tx queues for VFs ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses drm/nouveau/svm: Fix refcount leak bug and missing check against null bug net: phy: fix duplex out of sync problem while changing settings bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed mfd: core: Add missing of_node_put for loop iteration can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable() mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() zram: off by one in read_block_state() perf bpf: Add missing free to bpf_event__print_bpf_prog_info() llc: fix out-of-bound array index in llc_sk_dev_hash() nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions bpf, sockmap: Remove unhash handler for BPF sockmap usage bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding gve: Fix off by one in gve_tx_timeout() seq_file: fix passing wrong private data net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: allow configure ETS bandwidth of all TCs net: stmmac: allow a tc-taprio base-time of zero vsock: prevent unnecessary refcnt inc for nonblocking connect net/smc: fix sk_refcnt underflow on linkdown and fallback cxgb4: fix eeprom len when diagnostics not implemented selftests/net: udpgso_bench_rx: fix port argument ARM: 9155/1: fix early early_iounmap() ARM: 9156/1: drop cc-option fallbacks for architecture selection parisc: Fix backtrace to always include init funtion names MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL x86/mce: Add errata workaround for Skylake SKX37 posix-cpu-timers: Clear task::posix_cputimers_work in copy_process() irqchip/sifive-plic: Fixup EOI failed when masked f2fs: should use GFP_NOFS for directory inodes net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 9p/net: fix missing error check in p9_check_errors memcg: prohibit unconditional exceeding the limit of dying tasks powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks mm, oom: do not trigger out_of_memory from the #PF mfd: dln2: Add cell for initializing DLN2 ADC video: backlight: Drop maximum brightness override for brightness zero s390/cio: check the subchannel validity for dev_busid s390/tape: fix timer initialization in tape_std_assign() s390/ap: Fix hanging ioctl caused by orphaned replies s390/cio: make ccw_device_dma_* more robust mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n drm/sun4i: Fix macros in sun8i_csc.h PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros PCI: aardvark: Fix PCIe Max Payload Size setting SUNRPC: Partial revert of commit 6f9f17287e ath10k: fix invalid dma_addr_t token assignment mmc: moxart: Fix null pointer dereference on pointer host selftests/bpf: Fix also no-alu32 strobemeta selftest arch/cc: Introduce a function to check for confidential computing features x86/sev: Add an x86 version of cc_platform_has() x86/sev: Make the #VC exception stacks part of the default stacks storage soc/tegra: pmc: Fix imbalanced clock disabling in error code path Linux 5.10.80 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I21c750863965fbf584251fa2de3c941ae5922d3f	2021-11-19 11:50:41 +01:00
Greg Kroah-Hartman	706ebf15a1	Merge branch 'android12-5.10' into android12-5.10-lts ... Sync up with android12-5.10 for the following commits: d30938528e ANDROID: GKI: Update symbol list for VIVO 47458bf124 ANDROID: block: export tracepoints e41b116463 ANDROID: setlocalversion: make KMI_GENERATION optional 5dac28a174 BACKPORT: uapi: virtio_ids: add a sound device type ID from OASIS spec 2f3f5731de ANDROID: GKI: Add vendor hook to binder transaction 775cd2119d ANDROID: qcom: Add smp_call_function_single_async to ABI d736cbf8d9 Revert "sched/fair: Keep load_avg and load_sum synced" de0ba4ea3c Revert "sched/pelt: Ensure that *_sum is always synced with *_avg" 8630facf34 Revert "sched/fair: Ensure _sum and _avg values stay consistent" 7a7b5f89d9 ANDROID: locking/rwsem: only clean RWSEM_FLAG_HANDOFF when already set a1a4c80265 UPSTREAM: f2fs: change fiemap way in printing compression chunk cc98cd4a3e ANDROID: GKI: add allowed list file for xiaomi fa9c907453 ANDROID: GKI: Update symbol list ea592f07f6 ANDROID: Update symbol list for mtk a4eacf3227 ANDROID: binder: fix regression in sender_euid 6b7c37f6c4 ANDROID: fips140: use UTS_RELEASE as FIPS version 11db2de0af BACKPORT: binder: use cred instead of task for getsecid 3af7a2f610 BACKPORT: binder: use cred instead of task for selinux checks d492977395 BACKPORT: binder: use euid from cred instead of using task 7e2fbdaeab ANDROID: vendor_hooks: Add hooks for frequency optimization 054a3c228a ANDROID: GKI: Update symbols to symbol list 0db6925868 ANDROID: vendor_hooks: export get_wchan a61d61bab7 ANDROID: vendor_hooks: Add hooks to record the time of the process in various states 6cf4b65244 FROMGIT: dma-buf: acquire name lock before read/write dma_buf.name Due to api additions in android12-5.10, this also adds more api symbols to track: Leaf changes summary: 33 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 19 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 14 Added variables 19 Added functions: [A] 'function int __traceiter_android_vh_cpufreq_fast_switch(void*, cpufreq_policy*, unsigned int, unsigned int)' [A] 'function int __traceiter_android_vh_cpufreq_resolve_freq(void*, cpufreq_policy*, unsigned int, unsigned int)' [A] 'function int __traceiter_android_vh_cpufreq_target(void*, cpufreq_policy*, unsigned int, unsigned int)' [A] 'function int __traceiter_android_vh_sched_stat_runtime_rt(void*, task_struct*, u64)' [A] 'function int __traceiter_block_bio_complete(void*, request_queue*, bio*)' [A] 'function int __traceiter_block_bio_queue(void*, request_queue*, bio*)' [A] 'function int __traceiter_block_getrq(void*, request_queue*, bio*, int)' [A] 'function int __traceiter_block_rq_complete(void*, request*, int, unsigned int)' [A] 'function int __traceiter_block_rq_insert(void*, request_queue*, request*)' [A] 'function int __traceiter_block_rq_issue(void*, request_queue*, request*)' [A] 'function int __traceiter_block_rq_merge(void*, request_queue*, request*)' [A] 'function int __traceiter_block_rq_requeue(void*, request_queue*, request*)' [A] 'function int __traceiter_block_split(void*, request_queue*, bio*, unsigned int)' [A] 'function int __traceiter_sched_stat_runtime(void*, task_struct*, u64, u64)' [A] 'function int dev_change_flags(net_device*, unsigned int, netlink_ext_ack*)' [A] 'function unsigned long int get_wchan(task_struct*)' [A] 'function void* mempool_alloc_pages(gfp_t, void*)' [A] 'function void mempool_free_pages(void*, void*)' [A] 'function int mempool_resize(mempool_t*, int)' 14 Added variables: [A] 'tracepoint __tracepoint_android_vh_cpufreq_fast_switch' [A] 'tracepoint __tracepoint_android_vh_cpufreq_resolve_freq' [A] 'tracepoint __tracepoint_android_vh_cpufreq_target' [A] 'tracepoint __tracepoint_android_vh_sched_stat_runtime_rt' [A] 'tracepoint __tracepoint_block_bio_complete' [A] 'tracepoint __tracepoint_block_bio_queue' [A] 'tracepoint __tracepoint_block_getrq' [A] 'tracepoint __tracepoint_block_rq_complete' [A] 'tracepoint __tracepoint_block_rq_insert' [A] 'tracepoint __tracepoint_block_rq_issue' [A] 'tracepoint __tracepoint_block_rq_merge' [A] 'tracepoint __tracepoint_block_rq_requeue' [A] 'tracepoint __tracepoint_block_split' [A] 'tracepoint __tracepoint_sched_stat_runtime' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I15990841323b2a040b41d8207da3532f3d0db795	2021-11-19 09:15:03 +01:00
Tom Rix	851b622e7b	apparmor: fix error check ... [ Upstream commit d108370c64 ] clang static analysis reports this representative problem: label.c:1463:16: warning: Assigned value is garbage or undefined label->hname = name; ^ ~~~~ In aa_update_label_name(), this the problem block of code if (aa_label_acntsxprint(&name, ...) == -1) return res; On failure, aa_label_acntsxprint() has a more complicated return that just -1. So check for a negative return. It was also noted that the aa_label_acntsxprint() main comment refers to a nonexistent parameter, so clean up the comment. Fixes: f1bd904175 ("apparmor: add the base fns() for domain labels") Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 14:04:22 +01:00
Tetsuo Handa	d337537181	smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi ... [ Upstream commit 0934ad42bb ] syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi() is calling kfree() without removing from the cipso_v4_doi_list list after netlbl_cfg_cipsov4_map_add() returned an error. We need to use netlbl_cfg_cipsov4_del() in order to remove from the list and wait for RCU grace period before kfree(). Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd [1] Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 6c2e8ac095 ("netlabel: Update kernel configuration API") Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 14:04:10 +01:00
Tetsuo Handa	c11aecbe05	smackfs: use __GFP_NOFAIL for smk_cipso_doi() ... [ Upstream commit f91488ee15 ] syzbot is reporting kernel panic at smk_cipso_doi() due to memory allocation fault injection [1]. The reason for need to use panic() was not explained. But since no fix was proposed for 18 months, for now let's use __GFP_NOFAIL for utilizing syzbot resource on other bugs. Link: https://syzkaller.appspot.com/bug?extid=89731ccb6fec15ce1c22 [1] Reported-by: syzbot <syzbot+89731ccb6fec15ce1c22@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 14:03:59 +01:00
Pawan Gupta	3fac6feca9	smackfs: Fix use-after-free in netlbl_catmap_walk() ... [ Upstream commit 0817534ff9 ] Syzkaller reported use-after-free bug as described in [1]. The bug is triggered when smk_set_cipso() tries to free stale category bitmaps while there are concurrent reader(s) using the same bitmaps. Wait for RCU grace period to finish before freeing the category bitmaps in smk_set_cipso(). This makes sure that there are no more readers using the stale bitmaps and freeing them should be safe. [1] https://lore.kernel.org/netdev/000000000000a814c505ca657a4e@google.com/ Reported-by: syzbot+3f91de0b813cc3d19a80@syzkaller.appspotmail.com Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 14:03:53 +01:00
Austin Kim	c7400e2ec8	evm: mark evm_fixmode as __ro_after_init ... commit 32ba540f3c upstream. The evm_fixmode is only configurable by command-line option and it is never modified outside initcalls, so declaring it with __ro_after_init is better. Signed-off-by: Austin Kim <austin.kim@lge.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-18 14:03:46 +01:00
Ondrej Mosnacek	db04fb4111	selinux: fix race condition when computing ocontext SIDs ... commit cbfcd13be5 upstream. Current code contains a lot of racy patterns when converting an ocontext's context structure to an SID. This is being done in a "lazy" fashion, such that the SID is looked up in the SID table only when it's first needed and then cached in the "sid" field of the ocontext structure. However, this is done without any locking or memory barriers and is thus unsafe. Between commits 24ed7fdae6 ("selinux: use separate table for initial SID lookup") and 66f8e2f03c ("selinux: sidtab reverse lookup hash table"), this race condition lead to an actual observable bug, because a pointer to the shared sid field was passed directly to sidtab_context_to_sid(), which was using this location to also store an intermediate value, which could have been read by other threads and interpreted as an SID. In practice this caused e.g. new mounts to get a wrong (seemingly random) filesystem context, leading to strange denials. This bug has been spotted in the wild at least twice, see [1] and [2]. Fix the race condition by making all the racy functions use a common helper that ensures the ocontext::sid accesses are made safely using the appropriate SMP constructs. Note that security_netif_sid() was populating the sid field of both contexts stored in the ocontext, but only the first one was actually used. The SELinux wiki's documentation on the "netifcon" policy statement [3] suggests that using only the first context is intentional. I kept only the handling of the first context here, as there is really no point in doing the SID lookup for the unused one. I wasn't able to reproduce the bug mentioned above on any kernel that includes commit 66f8e2f03c, even though it has been reported that the issue occurs with that commit, too, just less frequently. Thus, I wasn't able to verify that this patch fixes the issue, but it makes sense to avoid the race condition regardless. [1] https://github.com/containers/container-selinux/issues/89 [2] https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/ [3] https://selinuxproject.org/page/NetworkStatements#netifcon Cc: stable@vger.kernel.org Cc: Xinjie Zheng <xinjie@google.com> Reported-by: Sujithra Periasamy <sujithra@google.com> Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-18 14:03:44 +01:00
Todd Kjos	0d9f4ae7cd	binder: use cred instead of task for selinux checks ... commit 52f8869337 upstream. Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used. Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem. Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.") Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-18 14:03:36 +01:00
Todd Kjos	3af7a2f610	BACKPORT: binder: use cred instead of task for selinux checks ... Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used. Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem. Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.") Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Bug: 200688826 (cherry picked from commit 52f8869337) [ refactored to avoid changing KMI: struct binder_proc ] Change-Id: I1664c1f0c2142c17e9ca0d6790bb94de79f531e3	2021-11-11 19:18:33 +00:00
Greg Kroah-Hartman	08ed4cb090	Merge 5.10.67 into android12-5.10-lts ... Changes in 5.10.67 rtc: tps65910: Correct driver module alias io_uring: limit fixed table size by RLIMIT_NOFILE io_uring: place fixed tables under memcg limits io_uring: add ->splice_fd_in checks io_uring: fail links of cancelled timeouts io-wq: fix wakeup race when adding new work btrfs: wake up async_delalloc_pages waiters after submit btrfs: reset replace target device to allocation state on close blk-zoned: allow zone management send operations without CAP_SYS_ADMIN blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN PCI/MSI: Skip masking MSI-X on Xen PV powerpc/perf/hv-gpci: Fix counter value parsing xen: fix setting of max_pfn in shared_info 9p/xen: Fix end of loop tests for list_for_each_entry ceph: fix dereference of null pointer cf selftests/ftrace: Fix requirement check of README file tools/thermal/tmon: Add cross compiling support clk: socfpga: agilex: fix the parents of the psi_ref_clk clk: socfpga: agilex: fix up s2f_user0_clk representation clk: socfpga: agilex: add the bypass register for s2f_usr0 clock pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast pinctrl: ingenic: Fix incorrect pull up/down info soc: qcom: aoss: Fix the out of bound usage of cooling_devs soc: aspeed: lpc-ctrl: Fix boundary check for mmap soc: aspeed: p2a-ctrl: Fix boundary check for mmap arm64: mm: Fix TLBI vs ASID rollover arm64: head: avoid over-mapping in map_memory iio: ltc2983: fix device probe wcn36xx: Ensure finish scan is not requested before start scan crypto: public_key: fix overflow during implicit conversion block: bfq: fix bfq_set_next_ioprio_data() power: supply: max17042: handle fails of reading status register dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() crypto: ccp - shutdown SEV firmware on kexec VMCI: fix NULL pointer dereference when unmapping queue pair media: uvc: don't do DMA on stack media: rc-loopback: return number of emitters rather than error s390/qdio: fix roll-back after timeout on ESTABLISH ccw s390/qdio: cancel the ESTABLISH ccw after timeout Revert "dmaengine: imx-sdma: refine to load context only once" dmaengine: imx-sdma: remove duplicated sdma_load_context libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs ARM: 9105/1: atags_to_fdt: don't warn about stack size f2fs: fix to do sanity check for sb/cp fields correctly PCI/portdrv: Enable Bandwidth Notification only if port supports it PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure PCI: xilinx-nwl: Enable the clock through CCF PCI: aardvark: Configure PCIe resources from 'ranges' DT property PCI: Export pci_pio_to_address() for module use PCI: aardvark: Fix checking for PIO status PCI: aardvark: Fix masking and unmasking legacy INTx interrupts HID: input: do not report stylus battery state as "full" f2fs: quota: fix potential deadlock pinctrl: remove empty lines in pinctrl subsystem pinctrl: armada-37xx: Correct PWM pins definitions scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types IB/hfi1: Adjust pkey entry in index 0 RDMA/iwcm: Release resources if iw_cm module initialization fails docs: Fix infiniband uverbs minor number scsi: BusLogic: Use %X for u32 sized integer rather than %lX pinctrl: samsung: Fix pinctrl bank pin count vfio: Use config not menuconfig for VFIO_NOIOMMU scsi: ufs: Fix memory corruption by ufshcd_read_desc_param() cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards powerpc/stacktrace: Include linux/delay.h RDMA/efa: Remove double QP type assignment RDMA/mlx5: Delete not-available udata check cpuidle: pseries: Mark pseries_idle_proble() as __init f2fs: reduce the scope of setting fsck tag when de->name_len is zero openrisc: don't printk() unconditionally dma-debug: fix debugfs initialization order NFSv4/pNFS: Fix a layoutget livelock loop NFSv4/pNFS: Always allow update of a zero valued layout barrier NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid SUNRPC: Fix potential memory corruption SUNRPC/xprtrdma: Fix reconnection locking SUNRPC query transport's source port sunrpc: Fix return value of get_srcport() scsi: fdomain: Fix error return code in fdomain_probe() pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() powerpc/numa: Consider the max NUMA node for migratable LPAR scsi: smartpqi: Fix an error code in pqi_get_raid_map() scsi: qedi: Fix error codes in qedi_alloc_global_queues() scsi: qedf: Fix error codes in qedf_alloc_global_queues() powerpc/config: Renable MTD_PHYSMAP_OF iommu/vt-d: Update the virtual command related registers HID: i2c-hid: Fix Elan touchpad regression clk: imx8m: fix clock tree update of TF-A managed clocks KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines scsi: ufs: ufs-exynos: Fix static checker warning KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call powerpc/smp: Update cpu_core_map on all PowerPc systems RDMA/hns: Fix QP's resp incomplete assignment fscache: Fix cookie key hashing clk: at91: clk-generated: Limit the requested rate to our range KVM: PPC: Fix clearing never mapped TCEs in realmode soc: mediatek: cmdq: add address shift in jump f2fs: fix to account missing .skipped_gc_rwsem f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() f2fs: fix to unmap pages from userspace process in punch_hole() f2fs: deallocate compressed pages when error happens f2fs: should put a page beyond EOF when preparing a write MIPS: Malta: fix alignment of the devicetree buffer kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y userfaultfd: prevent concurrent API initialization drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET drm/amdgpu: Fix amdgpu_ras_eeprom_init() ASoC: atmel: ATMEL drivers don't need HAS_DMA media: dib8000: rewrite the init prbs logic libbpf: Fix reuse of pinned map on older kernel x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable crypto: mxs-dcp - Use sg_mapping_iter to copy data PCI: Use pci_update_current_state() in pci_enable_device_flags() tipc: keep the skb in rcv queue until the whole data is read net: phy: Fix data type in DP83822 dp8382x_disable_wol() iio: dac: ad5624r: Fix incorrect handling of an optional regulator. iavf: do not override the adapter state in the watchdog task iavf: fix locking of critical sections ARM: dts: qcom: apq8064: correct clock names video: fbdev: kyro: fix a DoS bug by restricting user input netlink: Deal with ESRCH error in nlmsg_notify() Smack: Fix wrong semantics in smk_access_entry() drm: avoid blocking in drm_clients_info's rcu section drm: serialize drm_file.master with a new spinlock drm: protect drm_master pointers in drm_lease.c rcu: Fix macro name CONFIG_TASKS_RCU_TRACE igc: Check if num of q_vectors is smaller than max before array access usb: host: fotg210: fix the endpoint's transactional opportunities calculation usb: host: fotg210: fix the actual_length of an iso packet usb: gadget: u_ether: fix a potential null pointer dereference USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() usb: gadget: composite: Allow bMaxPower=0 if self-powered staging: board: Fix uninitialized spinlock when attaching genpd tty: serial: jsm: hold port lock when reporting modem line changes bus: fsl-mc: fix mmio base address for child DPRCs selftests: firmware: Fix ignored return val of asprintf() warn drm/amd/display: Fix timer_per_pixel unit error media: hantro: vp8: Move noisy WARN_ON to vpu_debug media: platform: stm32: unprepare clocks at handling errors in probe media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe media: atomisp: pci: fix error return code in atomisp_pci_probe() nfp: fix return statement in nfp_net_parse_meta() ethtool: improve compat ioctl handling drm/amdgpu: Fix a printing message drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex bpf/tests: Fix copy-and-paste error in double word test bpf/tests: Do not PASS tests without actually testing the result drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit arm64: dts: allwinner: h6: tanix-tx6: Fix regulator node names video: fbdev: asiliantfb: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: riva: Error out if 'pixclock' equals zero ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() flow_dissector: Fix out-of-bounds warnings s390/jump_label: print real address in a case of a jump label bug s390: make PCI mio support a machine flag serial: 8250: Define RX trigger levels for OxSemi 950 devices xtensa: ISS: don't panic in rs_init hvsi: don't panic on tty_register_driver failure serial: 8250_pci: make setup_port() parameters explicitly unsigned staging: ks7010: Fix the initialization of the 'sleep_status' structure samples: bpf: Fix tracex7 error raised on the missing argument libbpf: Fix race when pinning maps in parallel ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() Bluetooth: skip invalid hci_sync_conn_complete_evt workqueue: Fix possible memory leaks in wq_numa_init() ARM: dts: stm32: Set {bitclock,frame}-master phandles on DHCOM SoM ARM: dts: stm32: Set {bitclock,frame}-master phandles on ST DKx ARM: dts: stm32: Update AV96 adv7513 node per dtbs_check bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() ARM: dts: at91: use the right property for shutdown controller arm64: tegra: Fix Tegra194 PCIe EP compatible string ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output ASoC: Intel: update sof_pcm512x quirks media: imx258: Rectify mismatch of VTS value media: imx258: Limit the max analogue gain to 480 media: v4l2-dv-timings.c: fix wrong condition in two for-loops media: TDA1997x: fix tda1997x_query_dv_timings() return value media: tegra-cec: Handle errors of clk_prepare_enable() gfs2: Fix glock recursion in freeze_go_xmote_bh arm64: dts: qcom: sdm630: Rewrite memory map arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl configuration serial: 8250_omap: Handle optional overrun-throttle-ms property ARM: dts: imx53-ppd: Fix ACHC entry arm64: dts: qcom: ipq8074: fix pci node reg property arm64: dts: qcom: sdm660: use reg value for memory node arm64: dts: qcom: ipq6018: drop '0x' from unit address arm64: dts: qcom: sdm630: don't use underscore in node name arm64: dts: qcom: msm8994: don't use underscore in node name arm64: dts: qcom: msm8996: don't use underscore in node name arm64: dts: qcom: sm8250: Fix epss_l3 unit address nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() drm/msm: mdp4: drop vblank get/put from prepare/complete_commit drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660 drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers thunderbolt: Fix port linking by checking all adapters drm/amd/display: fix missing writeback disablement if plane is removed drm/amd/display: fix incorrect CM/TF programming sequence in dwb selftests/bpf: Fix xdp_tx.c prog section name drm/vmwgfx: fix potential UAF in vmwgfx_surface.c Bluetooth: schedule SCO timeouts with delayed_work Bluetooth: avoid circular locks in sco_sock_connect drm/msm/dp: return correct edid checksum after corrupted edid checksum read net/mlx5: Fix variable type to match 64bit gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() drm/display: fix possible null-pointer dereference in dcn10_set_clock() mac80211: Fix monitor MTU limit so that A-MSDUs get through ARM: tegra: acer-a500: Remove bogus USB VBUS regulators ARM: tegra: tamonten: Fix UART pad setting arm64: tegra: Fix compatible string for Tegra132 CPUs arm64: dts: ls1046a: fix eeprom entries nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data nvme: code command_id with a genctr for use-after-free validation Bluetooth: Fix handling of LE Enhanced Connection Complete opp: Don't print an error if required-opps is missing serial: sh-sci: fix break handling for sysrq iomap: pass writeback errors to the mapping tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD rpc: fix gss_svc_init cleanup on failure selftests/bpf: Fix flaky send_signal test hwmon: (pmbus/ibm-cffps) Fix write bits for LED control staging: rts5208: Fix get_ms_information() heap buffer size net: Fix offloading indirect devices dependency on qdisc order creation kselftest/arm64: mte: Fix misleading output when skipping tests kselftest/arm64: pac: Fix skipping of tests on systems without PAC gfs2: Don't call dlm after protocol is unmounted usb: chipidea: host: fix port index underflow and UBSAN complains lockd: lockd server-side shouldn't set fl_ops drm/exynos: Always initialize mapping in exynos_drm_register_dma() rtl8xxxu: Fix the handling of TX A-MPDU aggregation rtw88: use read_poll_timeout instead of fixed sleep rtw88: wow: build wow function only if CONFIG_PM is on rtw88: wow: fix size access error of probe request octeontx2-pf: Fix NIX1_RX interface backpressure m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch btrfs: tree-log: check btrfs_lookup_data_extent return value soundwire: intel: fix potential race condition during power down ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER ASoC: Intel: Skylake: Fix passing loadable flag for module of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for ZynqMP mmc: sdhci-of-arasan: Check return value of non-void funtions mmc: rtsx_pci: Fix long reads when clock is prescaled selftests/bpf: Enlarge select() timeout for test_maps mmc: core: Return correct emmc response in case of ioctl error cifs: fix wrong release in sess_alloc_buffer() failed path Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" usb: musb: musb_dsps: request_irq() after initializing musb usbip: give back URBs for unsent unlink requests during cleanup usbip:vhci_hcd USB port can get stuck in the disabled state ASoC: rockchip: i2s: Fix regmap_ops hang ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B drm/amdkfd: Account for SH/SE count when setting up cu masks. nfsd: fix crash on LOCKT on reexported NFSv3 iwlwifi: pcie: free RBs during configure iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed iwlwifi: mvm: avoid static queue number aliasing iwlwifi: mvm: fix access to BSS elements iwlwifi: fw: correctly limit to monitor dump iwlwifi: mvm: Fix scan channel flags settings net/mlx5: DR, fix a potential use-after-free bug net/mlx5: DR, Enable QP retransmission parport: remove non-zero check on count selftests/bpf: Fix potential unreleased lock wcn36xx: Fix missing frame timestamp for beacon/probe-resp ath9k: fix OOB read ar9300_eeprom_restore_internal ath9k: fix sleeping in atomic context net: fix NULL pointer reference in cipso_v4_doi_free fix array-index-out-of-bounds in taprio_change net: w5100: check return value after calling platform_get_resource() net: hns3: clean up a type mismatch warning fs/io_uring Don't use the return value from import_iovec(). io_uring: remove duplicated io_size from rw parisc: fix crash with signals and alloca ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() scsi: BusLogic: Fix missing pr_cont() use scsi: qla2xxx: Changes to support kdump kernel scsi: qla2xxx: Sync queue idx with queue_pair_map idx cpufreq: powernv: Fix init_chip_info initialization in numa=off s390/pv: fix the forcing of the swiotlb hugetlb: fix hugetlb cgroup refcounting during vma split mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled mm/hugetlb: initialize hugetlb_usage in mm_init mm,vmscan: fix divide by zero in get_scan_count memcg: enable accounting for pids in nested pid namespaces libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind platform/chrome: cros_ec_proto: Send command again when timeout occurs lib/test_stackinit: Fix static initializer test net: dsa: lantiq_gswip: fix maximum frame length drm/mgag200: Select clock in PLL update functions drm/msi/mdp4: populate priv->kms in mdp4_kms_init drm/dp_mst: Fix return code on sideband message failure drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv drm/amdgpu: Fix BUG_ON assert drm/amd/display: Update number of DCN3 clock states drm/amd/display: Update bounding box states (v2) drm/panfrost: Simplify lock_region calculation drm/panfrost: Use u64 for size in lock_region drm/panfrost: Clamp lock region to Bifrost minimum fanotify: limit number of event merge attempts Linux 5.10.67 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic8df59518265d0cdf724e93e8922cde48fc85ce9	2021-09-30 12:21:03 +02:00
Tianjia Zhang	df19d95141	Smack: Fix wrong semantics in smk_access_entry() ... [ Upstream commit 6d14f5c702 ] In the smk_access_entry() function, if no matching rule is found in the rust_list, a negative error code will be used to perform bit operations with the MAY_ enumeration value. This is semantically wrong. This patch fixes this issue. Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-09-18 13:40:18 +02:00
Greg Kroah-Hartman	2300418cc6	Merge 5.10.65 into android12-5.10-lts ... Changes in 5.10.65 locking/mutex: Fix HANDOFF condition regmap: fix the offset of register error log regulator: tps65910: Silence deferred probe error crypto: mxs-dcp - Check for DMA mapping errors sched/deadline: Fix reset_on_fork reporting of DL tasks power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() sched/deadline: Fix missing clock update in migrate_task_rq_dl() rcu/tree: Handle VM stoppage in stall detection EDAC/mce_amd: Do not load edac_mce_amd module on guests posix-cpu-timers: Force next expiration recalc after itimer reset hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() hrtimer: Ensure timerfd notification for HIGHRES=n udf: Check LVID earlier udf: Fix iocharset=utf8 mount option isofs: joliet: Fix iocharset=utf8 mount option bcache: add proper error unwinding in bcache_device_init blk-throtl: optimize IOPS throttle for large IO scenarios nvme-tcp: don't update queue count when failing to set io queues nvme-rdma: don't update queue count when failing to set io queues nvmet: pass back cntlid on successful completion power: supply: smb347-charger: Add missing pin control activation power: supply: max17042_battery: fix typo in MAx17042_TOFF s390/cio: add dev_busid sysfs entry for each subchannel s390/zcrypt: fix wrong offset index for APKA master key valid state libata: fix ata_host_start() crypto: omap - Fix inconsistent locking of device lists crypto: qat - do not ignore errors from enable_vf2pf_comms() crypto: qat - handle both source of interrupt in VF ISR crypto: qat - fix reuse of completion variable crypto: qat - fix naming for init/shutdown VF to PF notifications crypto: qat - do not export adf_iov_putmsg() fcntl: fix potential deadlock for &fasync_struct.fa_lock udf_get_extendedattr() had no boundary checks. s390/kasan: fix large PMD pages address alignment check s390/pci: fix misleading rc in clp_set_pci_fn() s390/debug: keep debug data on resize s390/debug: fix debug area life cycle s390/ap: fix state machine hang after failure to enable irq power: supply: cw2015: use dev_err_probe to allow deferred probe m68k: emu: Fix invalid free in nfeth_cleanup() sched/numa: Fix is_core_idle() sched: Fix UCLAMP_FLAG_IDLE setting rcu: Fix to include first blocked task in stall warning rcu: Add lockdep_assert_irqs_disabled() to rcu_sched_clock_irq() and callees rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock m68k: Fix invalid RMW_INSNS on CPUs that lack CAS block: return ELEVATOR_DISCARD_MERGE if possible spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config spi: spi-pic32: Fix issue with uninitialized dma_slave_config genirq/timings: Fix error return code in irq_timings_test_irqs() irqchip/loongson-pch-pic: Improve edge triggered interrupt support lib/mpi: use kcalloc in mpi_resize clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel block: nbd: add sanity check for first_minor spi: coldfire-qspi: Use clk_disable_unprepare in the remove function irqchip/gic-v3: Fix priority comparison when non-secure priorities are used crypto: qat - use proper type for vf_mask certs: Trigger creation of RSA module signing key if it's not an RSA key tpm: ibmvtpm: Avoid error message when process gets signal while waiting x86/mce: Defer processing of early errors spi: davinci: invoke chipselect callback blk-crypto: fix check for too-large dun_bytes regulator: vctrl: Use locked regulator_get_voltage in probe path regulator: vctrl: Avoid lockdep warning in enable/disable ops spi: sprd: Fix the wrong WDG_LOAD_VAL spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible EDAC/i10nm: Fix NVDIMM detection drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() drm/gma500: Fix end of loop tests for list_for_each_entry ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe media: TDA1997x: enable EDID support leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally media: cxd2880-spi: Fix an error handling path drm/of: free the right object bpf: Fix a typo of reuseport map in bpf.h. bpf: Fix potential memleak and UAF in the verifier. drm/of: free the iterator object on failure gve: fix the wrong AdminQ buffer overflow check libbpf: Fix the possible memory leak on error ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties i40e: improve locking of mac_filter_hash soc: qcom: rpmhpd: Use corner in power_off libbpf: Fix removal of inner map in bpf_object__create_map gfs2: Fix memory leak of object lsi on error return path firmware: fix theoretical UAF race with firmware cache and resume driver core: Fix error return code in really_probe() ionic: cleanly release devlink instance media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: dvb-usb: Fix error handling in dvb_usb_i2c_init media: go7007: fix memory leak in go7007_usb_probe media: go7007: remove redundant initialization media: rockchip/rga: use pm_runtime_resume_and_get() media: rockchip/rga: fix error handling in probe media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats media: atomisp: fix the uninitialized use and rename "retvalue" Bluetooth: sco: prevent information leak in sco_conn_defer_accept() 6lowpan: iphc: Fix an off-by-one check of array index drm/amdgpu/acp: Make PM domain really work tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos ARM: dts: meson8: Use a higher default GPU clock frequency ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties net/mlx5e: Prohibit inner indir TIRs in IPoIB net/mlx5e: Block LRO if firmware asks for tunneled LRO cgroup/cpuset: Fix a partition bug with hotplug drm: mxsfb: Enable recovery on underflow drm: mxsfb: Increase number of outstanding requests on V4 and newer HW drm: mxsfb: Clear FIFO_CLEAR bit net: cipso: fix warnings in netlbl_cipsov4_add_std Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd arm64: dts: renesas: rzg2: Convert EtherAVB to explicit delay handling arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay devlink: Break parameter notification sequence to be before/after unload/load driver net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() i2c: highlander: add IRQ check leds: lt3593: Put fwnode in any case during ->probe() leds: trigger: audio: Add an activate callback to ensure the initial brightness is set media: em28xx-input: fix refcount bug in em28xx_usb_disconnect media: venus: venc: Fix potential null pointer dereference on pointer fmt PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: PM: Enable PME if it can be signaled from D3cold bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring soc: qcom: smsm: Fix missed interrupts if state changes while masked debugfs: Return error during {full/open}_proxy_open() on rmmod Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow PM: EM: Increase energy calculation precision selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision drm/msm/mdp4: move HW revision detection to earlier phase drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 counter: 104-quad-8: Return error when invalid mode during ceiling_write cgroup/cpuset: Miscellaneous code cleanup cgroup/cpuset: Fix violation of cpuset locking rule ASoC: Intel: Fix platform ID matching Bluetooth: fix repeated calls to sco_sock_kill drm/msm/dsi: Fix some reference counted resource leaks net/mlx5: Register to devlink ingress VLAN filter trap net/mlx5: Fix unpublish devlink parameters ASoC: rt5682: Implement remove callback ASoC: rt5682: Properly turn off regulators if wrong device ID usb: dwc3: meson-g12a: add IRQ check usb: dwc3: qcom: add IRQ check usb: gadget: udc: at91: add IRQ check usb: gadget: udc: s3c2410: add IRQ check usb: phy: fsl-usb: add IRQ check usb: phy: twl6030: add IRQ checks usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse selftests/bpf: Fix test_core_autosize on big-endian machines devlink: Clear whole devlink_flash_notify struct samples: pktgen: add missing IPv6 option to pktgen scripts Bluetooth: Move shutdown callback before flushing tx and rx queue PM: cpu: Make notifier chain use a raw_spinlock_t usb: host: ohci-tmio: add IRQ check usb: phy: tahvo: add IRQ check libbpf: Re-build libbpf.so when libbpf.map changes mac80211: Fix insufficient headroom issue for AMSDU locking/lockdep: Mark local_lock_t locking/local_lock: Add missing owner initialization lockd: Fix invalid lockowner cast after vfs_test_lock nfsd4: Fix forced-expiry locking arm64: dts: marvell: armada-37xx: Extend PCIe MEM space clk: staging: correct reference to config IOMEM to config HAS_IOMEM i2c: synquacer: fix deferred probing firmware: raspberrypi: Keep count of all consumers firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()' usb: gadget: mv_u3d: request_irq() after initializing UDC mm/swap: consider max pages in iomap_swapfile_add_extent lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ Bluetooth: add timeout sanity check to hci_inquiry i2c: iop3xx: fix deferred probing i2c: s3c2410: fix IRQ check i2c: fix platform_get_irq.cocci warnings i2c: hix5hd2: fix IRQ check gfs2: init system threads before freeze lock rsi: fix error code in rsi_load_9116_firmware() rsi: fix an error code in rsi_probe() ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs ASoC: Intel: Skylake: Fix module resource and format selection mmc: sdhci: Fix issue with uninitialized dma_slave_config mmc: dw_mmc: Fix issue with uninitialized dma_slave_config mmc: moxart: Fix issue with uninitialized dma_slave_config bpf: Fix possible out of bound write in narrow load handling CIFS: Fix a potencially linear read overflow i2c: mt65xx: fix IRQ check i2c: xlp9xx: fix main IRQ check usb: ehci-orion: Handle errors of clk_prepare_enable() in probe usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()' tty: serial: fsl_lpuart: fix the wrong mapbase value ASoC: wcd9335: Fix a double irq free in the remove function ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function ASoC: wcd9335: Disable irq on slave ports in the remove function iwlwifi: follow the new inclusive terminology iwlwifi: skip first element in the WTAS ACPI table ice: Only lock to update netdev dev_addr ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() atlantic: Fix driver resume flow. bcma: Fix memory leak for internally-handled cores brcmfmac: pcie: fix oops on failure to resume and reprobe ipv6: make exception cache less predictible ipv4: make exception cache less predictible net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed net: qualcomm: fix QCA7000 checksum handling octeontx2-af: Fix loop in free and unmap counter octeontx2-af: Fix static code analyzer reported issues octeontx2-af: Set proper errorcode for IPv4 checksum errors ipv4: fix endianness issue in inet_rtm_getroute_build_skb() ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha f2fs: guarantee to write dirty data when enabling checkpoint back time: Handle negative seconds correctly in timespec64_to_ns() io_uring: IORING_OP_WRITE needs hash_reg_file set bio: fix page leak bio_add_hw_page failure tty: Fix data race between tiocsti() and flush_to_ldisc() perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op x86/resctrl: Fix a maybe-uninitialized build warning treated as error Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" KVM: s390: index kvm->arch.idle_mask by vcpu_idx KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter ARM: dts: at91: add pinctrl-{names, 0} for all gpios fuse: truncate pagecache on atomic_o_trunc fuse: flush extending writes IMA: remove -Wmissing-prototypes warning IMA: remove the dependency on CRYPTO_MD5 fbmem: don't allow too huge resolutions backlight: pwm_bl: Improve bootloader/kernel device handover clk: kirkwood: Fix a clocking boot regression Linux 5.10.65 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie0b9306ba6ee4193de3200df7cdacaeba152b83e	2021-09-15 14:16:47 +02:00
THOBY Simon	34d099a330	IMA: remove the dependency on CRYPTO_MD5 ... commit 8510505d55 upstream. MD5 is a weak digest algorithm that shouldn't be used for cryptographic operation. It hinders the efficiency of a patch set that aims to limit the digests allowed for the extended file attribute namely security.ima. MD5 is no longer a requirement for IMA, nor should it be used there. The sole place where we still use the MD5 algorithm inside IMA is setting the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5' parameter on the command line. With commit ab60368ab6 ("ima: Fallback to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully when CRYPTO_MD5 is not set: ima: Can not allocate md5 (reason: -2) ima: Allocating md5 failed, going to use default hash algorithm sha256 Remove the CRYPTO_MD5 dependency for IMA. Signed-off-by: THOBY Simon <Simon.THOBY@viveris.fr> Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> [zohar@linux.ibm.com: include commit number in patch description for stable.] Cc: stable@vger.kernel.org # 4.17 Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-15 09:50:48 +02:00
Austin Kim	5cc1ee3135	IMA: remove -Wmissing-prototypes warning ... commit a32ad90426 upstream. With W=1 build, the compiler throws warning message as below: security/integrity/ima/ima_mok.c:24:12: warning: no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes] __init int ima_mok_init(void) Silence the warning by adding static keyword to ima_mok_init(). Signed-off-by: Austin Kim <austin.kim@lge.com> Fixes: 41c89b64d7 ("IMA: create machine owner and blacklist keyrings") Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-15 09:50:48 +02:00
Greg Kroah-Hartman	46f161a1b2	Merge 5.10.59 into android12-5.10-lts ... Changes in 5.10.59 KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag firmware: tee_bnxt: Release TEE shm, session, and context during kexec bpf: Add lockdown check for probe_write_user helper Revert "selftests/resctrl: Use resctrl/info for feature detection" mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM arm64: dts: renesas: rzg2: Add usb2_clksel to RZ/G2 M/N/H arm64: dts: renesas: beacon: Fix USB extal reference arm64: dts: renesas: beacon: Fix USB ref clock references vboxsf: Honor excl flag to the dir-inode create op vboxsf: Make vboxsf_dir_create() return the handle for the created file USB:ehci:fix Kunpeng920 ehci hardware problem ALSA: pcm: Fix mmap breakage without explicit buffer setup ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC ALSA: hda: Add quirk for ASUS Flow x13 ppp: Fix generating ppp unit id when ifname is not specified ovl: prevent private clone if bind mount is not allowed net: xilinx_emaclite: Do not print real IOMEM pointer Linux 5.10.59 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie4ba3880d1be4c29acc83453ad89a621ad046b7c	2021-08-15 14:16:00 +02:00
Daniel Borkmann	d8c3859870	bpf: Add lockdown check for probe_write_user helper ... commit 51e1bb9eea upstream. Back then, commit 96ae522795 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers") added the bpf_probe_write_user() helper in order to allow to override user space memory. Its original goal was to have a facility to "debug, divert, and manipulate execution of semi-cooperative processes" under CAP_SYS_ADMIN. Write to kernel was explicitly disallowed since it would otherwise tamper with its integrity. One use case was shown in cf9b1199de ("samples/bpf: Add test/example of using bpf_probe_write_user bpf helper") where the program DNATs traffic at the time of connect(2) syscall, meaning, it rewrites the arguments to a syscall while they're still in userspace, and before the syscall has a chance to copy the argument into kernel space. These days we have better mechanisms in BPF for achieving the same (e.g. for load-balancers), but without having to write to userspace memory. Of course the bpf_probe_write_user() helper can also be used to abuse many other things for both good or bad purpose. Outside of BPF, there is a similar mechanism for ptrace(2) such as PTRACE_PEEK{TEXT,DATA} and PTRACE_POKE{TEXT,DATA}, but would likely require some more effort. Commit 96ae522795 explicitly dedicated the helper for experimentation purpose only. Thus, move the helper's availability behind a newly added LOCKDOWN_BPF_WRITE_USER lockdown knob so that the helper is disabled under the "integrity" mode. More fine-grained control can be implemented also from LSM side with this change. Fixes: 96ae522795 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-08-15 14:00:25 +02:00
Greg Kroah-Hartman	af3bdb4304	Merge 5.10.58 into android12-5.10-lts ... Changes in 5.10.58 Revert "ACPICA: Fix memory leak caused by _CID repair function" ALSA: seq: Fix racy deletion of subscriber bus: ti-sysc: Fix gpt12 system timer issue with reserved status net: xfrm: fix memory leak in xfrm_user_rcv_msg arm64: dts: ls1028a: fix node name for the sysclk ARM: imx: add missing iounmap() ARM: imx: add missing clk_disable_unprepare() ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms arm64: dts: ls1028: sl28: fix networking for variant 2 ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode ALSA: usb-audio: fix incorrect clock source setting clk: stm32f4: fix post divisor setup for I2S/SAI PLLs ARM: dts: am437x-l4: fix typo in can@0 node omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation scsi: sr: Return correct event when media event code is 3 media: videobuf2-core: dequeue if start_streaming fails ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM dmaengine: imx-dma: configure the generic DMA type to make it work net, gro: Set inner transport header offset in tcp/udp GRO hook net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag net: phy: micrel: Fix detection of ksz87xx switch net: natsemi: Fix missing pci_disable_device() in probe and remove gpio: tqmx86: really make IRQ optional RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently sctp: move the active_key update after sh_keys is added nfp: update ethtool reporting of pauseframe control net: ipv6: fix returned variable type in ip6_skb_dst_mtu net: dsa: qca: ar9331: reorder MDIO write sequence net: sched: fix lockdep_set_class() typo error for sch->seqlock MIPS: check return value of pgtable_pmd_page_ctor mips: Fix non-POSIX regexp bnx2x: fix an error code in bnx2x_nic_load() net: pegasus: fix uninit-value in get_interrupt_interval net: fec: fix use-after-free in fec_drv_remove net: vxge: fix use-after-free in vxge_device_unregister blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit() Bluetooth: defer cleanup of resources in hci_unregister_dev() USB: usbtmc: Fix RCU stall warning USB: serial: option: add Telit FD980 composition 0x1056 USB: serial: ch341: fix character loss at high transfer rates USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback firmware_loader: fix use-after-free in firmware_fallback_sysfs drm/amdgpu/display: fix DMUB firmware version info ALSA: pcm - fix mmap capability check for the snd-dummy driver ALSA: hda/realtek: add mic quirk for Acer SF314-42 ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) ALSA: usb-audio: Fix superfluous autosuspend recovery ALSA: usb-audio: Add registration quirk for JBL Quantum 600 usb: dwc3: gadget: Avoid runtime resume if disabling pullup usb: gadget: remove leaked entry from udc driver list usb: cdns3: Fixed incorrect gadget state usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers usb: gadget: f_hid: fixed NULL pointer dereference usb: gadget: f_hid: idle uses the highest byte for duration usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events usb: otg-fsm: Fix hrtimer list corruption clk: fix leak on devm_clk_bulk_get_all() unwind scripts/tracing: fix the bug that can't parse raw_trace_func tracing / histogram: Give calculation hist_fields a size tracing: Reject string operand in the histogram expression tracing: Fix NULL pointer dereference in start_creating tracepoint: static call: Compare data on transition from 2->1 callees tracepoint: Fix static call function vs data state mismatch arm64: stacktrace: avoid tracing arch_stack_walk() optee: Clear stale cache entries during initialization tee: add tee_shm_alloc_kernel_buf() optee: Fix memory leak when failing to register shm pages optee: Refuse to load the driver under the kdump kernel optee: fix tee out of memory failure seen during kexec reboot tpm_ftpm_tee: Free and unregister TEE shared memory during kexec staging: rtl8723bs: Fix a resource leak in sd_int_dpc staging: rtl8712: get rid of flush_scheduled_work staging: rtl8712: error handling refactoring drivers core: Fix oops when driver probe fails media: rtl28xxu: fix zero-length control request pipe: increase minimum default pipe size to 2 pages ext4: fix potential htree corruption when growing large_dir directories serial: tegra: Only print FIFO error message when an error occurs serial: 8250_mtk: fix uart corruption issue when rx power off serial: 8250: Mask out floating 16/32-bit bus bits MIPS: Malta: Do not byte-swap accesses to the CBUS UART serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts. fpga: dfl: fme: Fix cpu hotplug issue in performance reporting timers: Move clearing of base::timer_running under base:: Lock xfrm: Fix RCU vs hash_resize_mutex lock inversion net/xfrm/compat: Copy xfrm_spdattr_type_t atributes pcmcia: i82092: fix a null pointer dereference bug selinux: correct the return value when loads initial sids bus: ti-sysc: AM3: RNG is GP only Revert "gpio: mpc8xxx: change the gpio interrupt flags." ARM: omap2+: hwmod: fix potential NULL pointer access md/raid10: properly indicate failure when ending a failed write request KVM: x86: accept userspace interrupt only if no event is injected KVM: Do not leak memory for duplicate debugfs directories KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds arm64: vdso: Avoid ISB after reading from cntvct_el0 soc: ixp4xx: fix printing resources interconnect: Fix undersized devress_alloc allocation spi: meson-spicc: fix memory leak in meson_spicc_remove interconnect: Zero initial BW after sync-state interconnect: Always call pre_aggregate before aggregate interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes drm/i915: Correct SFC_DONE register offset soc: ixp4xx/qmgr: fix invalid __iomem access perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest sched/rt: Fix double enqueue caused by rt_effective_prio drm/i915: avoid uninitialised var in eb_parse() libata: fix ata_pio_sector for CONFIG_HIGHMEM reiserfs: add check for root_inode in reiserfs_fill_super reiserfs: check directory items on read from disk virt_wifi: fix error on connect net: qede: Fix end of loop tests for list_for_each_entry alpha: Send stop IPI to send to online CPUs net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset smb3: rc uninitialized in one fallocate path drm/amdgpu/display: only enable aux backlight control for OLED panels arm64: fix compat syscall return truncation Linux 5.10.58 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2533667974c9dff419a14d63e0e8febfb3de80f1	2021-08-12 14:58:34 +02:00
Xiu Jianfeng	f4984f60ac	selinux: correct the return value when loads initial sids ... commit 4c156084da upstream. It should not return 0 when SID 0 is assigned to isids. This patch fixes it. Cc: stable@vger.kernel.org Fixes: e3e0b582c3 ("selinux: remove unused initial SIDs and improve handling") Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> [PM: remove changelog from description] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-08-12 13:22:16 +02:00
Greg Kroah-Hartman	8db62be3c3	Merge 5.10.51 into android12-5.10-lts ... Changes in 5.10.51 drm/mxsfb: Don't select DRM_KMS_FB_HELPER drm/zte: Don't select DRM_KMS_FB_HELPER drm/ast: Fixed CVE for DP501 drm/amd/display: fix HDCP reset sequence on reinitialize drm/amd/amdgpu/sriov disable all ip hw status by default drm/vc4: fix argument ordering in vc4_crtc_get_margins() drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() drm/amd/display: fix use_max_lb flag for 420 pixel formats clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe() hugetlb: clear huge pte during flush function on mips platform atm: iphase: fix possible use-after-free in ia_module_exit() mISDN: fix possible use-after-free in HFC_cleanup() atm: nicstar: Fix possible use-after-free in nicstar_cleanup() net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init() net: mdio: ipq8064: add regmap config to disable REGCACHE drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE reiserfs: add check for invalid 1st journal block drm/virtio: Fix double free on probe failure net: mdio: provide shim implementation of devm_of_mdiobus_register net/sched: cls_api: increase max_reclassify_loop pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE drm/scheduler: Fix hang when sched_entity released drm/sched: Avoid data corruptions udf: Fix NULL pointer dereference in udf_symlink function drm/vc4: Fix clock source for VEC PixelValve on BCM2711 drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co() e100: handle eeprom as little endian igb: handle vlan types with checker enabled igb: fix assignment on big endian machines drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer() clk: renesas: r8a77995: Add ZA2 clock net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet net/mlx5: Fix lag port remapping logic drm: rockchip: add missing registers for RK3188 drm: rockchip: add missing registers for RK3066 net: stmmac: the XPCS obscures a potential "PHY not found" error RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH clk: tegra: Fix refcounting of gate clocks clk: tegra: Ensure that PLLU configuration is applied properly drm: bridge: cdns-mhdp8546: Fix PM reference leak in virtio-net: Add validation for used length ipv6: use prandom_u32() for ID generation MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B) MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER drm/amd/display: Avoid HDCP over-read and corruption drm/amdgpu: remove unsafe optimization to drop preamble ib net: tcp better handling of reordering then loss cases RDMA/cxgb4: Fix missing error code in create_qp() dm space maps: don't reset space map allocation cursor when committing dm writecache: don't split bios when overwriting contiguous cache content dm: Fix dm_accept_partial_bio() relative to zone management commands net: bridge: mrp: Update ring transitions. pinctrl: mcp23s08: fix race condition in irq handler ice: set the value of global config lock timeout longer ice: fix clang warning regarding deadcode.DeadStores virtio_net: Remove BUG() to avoid machine dead net: mscc: ocelot: check return value after calling platform_get_resource() net: bcmgenet: check return value after calling platform_get_resource() net: mvpp2: check return value after calling platform_get_resource() net: micrel: check return value after calling platform_get_resource() net: moxa: Use devm_platform_get_and_ioremap_resource() drm/amd/display: Fix DCN 3.01 DSCCLK validation drm/amd/display: Update scaling settings on modeset drm/amd/display: Release MST resources on switch from MST to SST drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7 drm/amd/display: Fix off-by-one error in DML net: phy: realtek: add delay to fix RXC generation issue selftests: Clean forgotten resources as part of cleanup() net: sgi: ioc3-eth: check return value after calling platform_get_resource() drm/amdkfd: use allowed domain for vmbo validation fjes: check return value after calling platform_get_resource() selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check xfrm: Fix error reporting in xfrm_state_construct. dm writecache: commit just one block, not a full page wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP wl1251: Fix possible buffer overflow in wl1251_cmd_scan cw1200: add missing MODULE_DEVICE_TABLE drm/amdkfd: fix circular locking on get_wave_state drm/amdkfd: Fix circular lock in nocpsch path bpf: Fix up register-based shifts in interpreter to silence KUBSAN ice: fix incorrect payload indicator on PTYPE ice: mark PTYPE 2 as reserved mt76: mt7615: fix fixed-rate tx status reporting net: fix mistake path for netdev_features_strings net: ipa: Add missing of_node_put() in ipa_firmware_load() net: sched: fix error return code in tcf_del_walker() io_uring: fix false WARN_ONCE drm/amdgpu: fix bad address translation for sienna_cichlid drm/amdkfd: Walk through list with dqm lock hold mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode rtl8xxxu: Fix device info for RTL8192EU devices MIPS: add PMD table accounting into MIPS'pmd_alloc_one net: fec: add ndo_select_queue to fix TX bandwidth fluctuations atm: nicstar: use 'dma_free_coherent' instead of 'kfree' atm: nicstar: register the interrupt handler in the right place vsock: notify server to shutdown when client has pending signal RDMA/rxe: Don't overwrite errno from ib_umem_get() iwlwifi: mvm: don't change band on bound PHY contexts iwlwifi: mvm: fix error print when session protection ends iwlwifi: pcie: free IML DMA memory allocation iwlwifi: pcie: fix context info freeing sfc: avoid double pci_remove of VFs sfc: error code if SRIOV cannot be disabled wireless: wext-spy: Fix out-of-bounds warning cfg80211: fix default HE tx bitrate mask in 2G band mac80211: consider per-CPU statistics if present mac80211_hwsim: add concurrent channels scanning support over virtio IB/isert: Align target max I/O size to initiator size media, bpf: Do not copy more entries than user space requested net: ip: avoid OOM kills with large UDP sends over loopback RDMA/cma: Fix rdma_resolve_route() memory leak Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip. Bluetooth: Fix the HCI to MGMT status conversion table Bluetooth: Fix alt settings for incoming SCO with transparent coding format Bluetooth: Shutdown controller after workqueues are flushed or cancelled Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails Bluetooth: L2CAP: Fix invalid access on ECRED Connection response Bluetooth: btusb: Add support USB ALT 3 for WBS Bluetooth: mgmt: Fix the command returns garbage parameter value Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. sched/fair: Ensure _sum and _avg values stay consistent bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc() flow_offload: action should not be NULL when it is referenced sctp: validate from_addr_param return sctp: add size validation when walking chunks MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops MIPS: set mips32r5 for virt extensions selftests/resctrl: Fix incorrect parsing of option "-t" MIPS: MT extensions are not available on MIPS32r1 ath11k: unlock on error path in ath11k_mac_op_add_interface() arm64: dts: rockchip: add rk3328 dwc3 usb controller node arm64: dts: rockchip: Enable USB3 for rk3328 Rock64 loop: fix I/O error on fsync() in detached loop devices mm,hwpoison: return -EBUSY when migration fails io_uring: simplify io_remove_personalities() io_uring: Convert personality_idr to XArray io_uring: convert io_buffer_idr to XArray scsi: iscsi: Fix race condition between login and sync thread scsi: iscsi: Fix iSCSI cls conn state powerpc/mm: Fix lockup on kernel exec fault powerpc/barrier: Avoid collision with clang's __lwsync macro powerpc/powernv/vas: Release reference to tgid during window close drm/amdgpu: Update NV SIMD-per-CU to 2 drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2) drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 drm/vc4: txp: Properly set the possible_crtcs mask drm/vc4: crtc: Skip the TXP drm/vc4: hdmi: Prevent clock unbalance drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info() drm/rockchip: dsi: remove extra component_del() call drm/amd/display: fix incorrrect valid irq check pinctrl/amd: Add device HID for new AMD GPIO controller drm/amd/display: Reject non-zero src_y and src_x for video planes drm/tegra: Don't set allow_fb_modifiers explicitly drm/msm/mdp4: Fix modifier support enabling drm/arm/malidp: Always list modifiers drm/nouveau: Don't set allow_fb_modifiers explicitly drm/i915/display: Do not zero past infoframes.vsc mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode mmc: core: clear flags before allowing to retune mmc: core: Allow UHS-I voltage switch for SDSC cards if supported ata: ahci_sunxi: Disable DIPM arm64: tlb: fix the TTL value of tlb_get_level cpu/hotplug: Cure the cpusets trainwreck clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround fpga: stratix10-soc: Add missing fpga_mgr_free() call ASoC: tegra: Set driver_name=tegra for all machine drivers i40e: fix PTP on 5Gb links qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute ipmi/watchdog: Stop watchdog timer when the current action is 'none' thermal/drivers/int340x/processor_thermal: Fix tcc setting ubifs: Fix races between xattr_{set|get} and listxattr operations power: supply: ab8500: Fix an old bug mfd: syscon: Free the allocated name field of struct regmap_config nvmem: core: add a missing of_node_put lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE selftests/lkdtm: Fix expected text for CR4 pinning extcon: intel-mrfld: Sync hardware and software state on init seq_buf: Fix overflow in seq_buf_putmem_hex() rq-qos: fix missed wake-ups in rq_qos_throttle try two tracing: Simplify & fix saved_tgids logic tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe coresight: Propagate symlink failure coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() dm zoned: check zone capacity dm writecache: flush origin device when writing and cache is full dm btree remove: assign new_root only when removal succeeds PCI: Leave Apple Thunderbolt controllers on for s2idle or standby PCI: aardvark: Fix checking for PIO Non-posted Request PCI: aardvark: Implement workaround for the readback value of VEND_ID media: subdev: disallow ioctl for saa6588/davinci media: dtv5100: fix control-request directions media: zr364xx: fix memory leak in zr364xx_start_readpipe media: gspca/sq905: fix control-request direction media: gspca/sunplus: fix zero-length control requests media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function dm writecache: write at least 4k when committing pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() drm/ast: Remove reference to struct drm_device.pdev jfs: fix GPF in diFree smackfs: restrict bytes count in smk_set_cipso() ext4: fix memory leak in ext4_fill_super f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances Linux 5.10.51 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Icb10fed733a0050848ecc23db13ae3d134895acd	2021-07-19 17:29:53 +02:00
Tetsuo Handa	3780348c1a	smackfs: restrict bytes count in smk_set_cipso() ... commit 49ec114a6e upstream. Oops, I failed to update subject line. From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Date: Mon, 12 Apr 2021 22:25:06 +0900 Subject: smackfs: restrict bytes count in smk_set_cipso() Commit 7ef4c19d24 ("smackfs: restrict bytes count in smackfs write functions") missed that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Reported-by: syzbot <syzbot+77c53db50c9fff774e8e@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-19 09:45:03 +02:00
Minchan Kim	f38371821c	selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC ... [ Upstream commit 648f2c6100 ] In the field, we have seen lots of allocation failure from the call path below. 06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0 ... ... 06-03 13:29:12.999 1010315 31557 31557 W Call trace: 06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8 06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c 06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430 06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390 06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4 06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4 06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184 06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0 06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460 06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0 06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0 .. .. 06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 Based on [1], selinux is tolerate for failure of memory allocation. Then, use __GFP_NOWARN together. [1] 476accbe2f ("selinux: use GFP_NOWAIT in the AVC kmem_caches") Signed-off-by: Minchan Kim <minchan@kernel.org> [PM: subj fix, line wraps, normalized commit refs] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-19 09:44:49 +02:00
Greg Kroah-Hartman	2df0fb4a4b	Merge 5.10.50 into android12-5.10-lts ... Changes in 5.10.50 Bluetooth: hci_qca: fix potential GPF Bluetooth: btqca: Don't modify firmware contents in-place Bluetooth: Remove spurious error message ALSA: usb-audio: fix rate on Ozone Z90 USB headset ALSA: usb-audio: Fix OOB access at proc output ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire ALSA: usb-audio: scarlett2: Fix wrong resume call ALSA: intel8x0: Fix breakage at ac97 clock measurement ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 ALSA: hda/realtek: Add another ALC236 variant support ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC media: dvb-usb: fix wrong definition Input: usbtouchscreen - fix control-request directions net: can: ems_usb: fix use-after-free in ems_usb_disconnect() usb: gadget: eem: fix echo command packet response issue usb: renesas-xhci: Fix handling of unknown ROM state USB: cdc-acm: blacklist Heimann USB Appset device usb: dwc3: Fix debugfs creation flow usb: typec: Add the missed altmode_id_remove() in typec_register_altmode() xhci: solve a double free problem while doing s4 gfs2: Fix underflow in gfs2_page_mkwrite gfs2: Fix error handling in init_statfs ntfs: fix validity check for file name attribute selftests/lkdtm: Avoid needing explicit sub-shell copy_page_to_iter(): fix ITER_DISCARD case iov_iter_fault_in_readable() should do nothing in xarray case Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl crypto: nx - Fix memcpy() over-reading in nonce crypto: ccp - Annotate SEV Firmware file names arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode ARM: dts: ux500: Fix LED probing ARM: dts: at91: sama5d4: fix pinctrl muxing btrfs: send: fix invalid path for unlink operations after parent orphanization btrfs: compression: don't try to compress if we don't have enough pages btrfs: clear defrag status of a root if starting transaction fails ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle ext4: fix kernel infoleak via ext4_extent_header ext4: fix overflow in ext4_iomap_alloc() ext4: return error code when ext4_fill_flex_info() fails ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit ext4: remove check for zero nr_to_scan in ext4_es_scan() ext4: fix avefreec in find_group_orlov ext4: use ext4_grp_locked_error in mb_find_extent can: bcm: delay release of struct bcm_op after synchronize_rcu() can: gw: synchronize rcu operations before removing gw job entry can: isotp: isotp_release(): omit unintended hrtimer restart on socket release can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path mac80211: remove iwlwifi specific workaround that broke sta NDP tx SUNRPC: Fix the batch tasks count wraparound. SUNRPC: Should wake up the privileged task firstly. bus: mhi: Wait for M2 state during system resume mm/gup: fix try_grab_compound_head() race with split_huge_page() perf/smmuv3: Don't trample existing events with global filter KVM: nVMX: Handle split-lock #AC exceptions that happen in L2 KVM: PPC: Book3S HV: Workaround high stack usage with clang KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk s390/cio: dont call css_wait_for_slow_path() inside a lock s390: mm: Fix secure storage access exception handling f2fs: Prevent swap file in LFS mode clk: agilex/stratix10/n5x: fix how the bypass_reg is handled clk: agilex/stratix10: remove noc_clk clk: agilex/stratix10: fix bypass representation rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path iio: frequency: adf4350: disable reg and clk on error in adf4350_probe() iio: light: tcs3472: do not free unallocated IRQ iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR iio: ltr501: ltr501_read_ps(): add missing endianness conversion iio: accel: bma180: Fix BMA25x bandwidth register values serial: mvebu-uart: fix calculation of clock divisor serial: sh-sci: Stop dmaengine transfer in sci_stop_tx() serial_cs: Add Option International GSM-Ready 56K/ISDN modem serial_cs: remove wrong GLOBETROTTER.cis entry ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() ssb: sdio: Don't overwrite const buffer if block_write fails rsi: Assign beacon rate settings to the correct rate_info descriptor field rsi: fix AP mode with WPA failure due to encrypted EAPOL tracing/histograms: Fix parsing of "sym-offset" modifier tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing seq_buf: Make trace_seq_putmem_hex() support data longer than 8 powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi() loop: Fix missing discard support when using LOOP_CONFIGURE evm: Execute evm_inode_init_security() only when an HMAC key is loaded evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded fuse: Fix crash in fuse_dentry_automount() error path fuse: Fix crash if superblock of submount gets killed early fuse: Fix infinite loop in sget_fc() fuse: ignore PG_workingset after stealing fuse: check connected before queueing on fpq->io fuse: reject internal errno thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure spi: Make of_register_spi_device also set the fwnode Add a reference to ucounts for each cred staging: media: rkvdec: fix pm_runtime_get_sync() usage count media: marvel-ccic: fix some issues when getting pm_runtime media: mdk-mdp: fix pm_runtime_get_sync() usage count media: s5p: fix pm_runtime_get_sync() usage count media: am437x: fix pm_runtime_get_sync() usage count media: sh_vou: fix pm_runtime_get_sync() usage count media: mtk-vcodec: fix PM runtime get logic media: s5p-jpeg: fix pm_runtime_get_sync() usage count media: sunxi: fix pm_runtime_get_sync() usage count media: sti/bdisp: fix pm_runtime_get_sync() usage count media: exynos4-is: fix pm_runtime_get_sync() usage count media: exynos-gsc: fix pm_runtime_get_sync() usage count spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() spi: omap-100k: Fix the length judgment problem regulator: uniphier: Add missing MODULE_DEVICE_TABLE sched/core: Initialize the idle task with preemption disabled hwrng: exynos - Fix runtime PM imbalance on error crypto: nx - add missing MODULE_DEVICE_TABLE media: sti: fix obj-$(config) targets media: cpia2: fix memory leak in cpia2_usb_probe media: cobalt: fix race condition in setting HPD media: hevc: Fix dependent slice segment flags media: pvrusb2: fix warning in pvr2_i2c_core_done media: imx: imx7_mipi_csis: Fix logging of only error event counters crypto: qat - check return code of qat_hal_rd_rel_reg() crypto: qat - remove unused macro in FW loader crypto: qce: skcipher: Fix incorrect sg count for dma transfers arm64: perf: Convert snprintf to sysfs_emit sched/fair: Fix ascii art by relpacing tabs media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to set xvclk on/off media: bt878: do not schedule tasklet when it is not setup media: em28xx: Fix possible memory leak of em28xx struct media: hantro: Fix .buf_prepare media: cedrus: Fix .buf_prepare media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release media: bt8xx: Fix a missing check bug in bt878_probe media: st-hva: Fix potential NULL pointer dereferences crypto: hisilicon/sec - fixup 3des minimum key size declaration Makefile: fix GDB warning with CONFIG_RELR media: dvd_usb: memory leak in cinergyt2_fe_attach memstick: rtsx_usb_ms: fix UAF mmc: sdhci-sprd: use sdhci_sprd_writew mmc: via-sdmmc: add a check against NULL pointer dereference spi: meson-spicc: fix a wrong goto jump for avoiding memory leak. spi: meson-spicc: fix memory leak in meson_spicc_probe crypto: shash - avoid comparing pointers to exported functions under CFI media: dvb_net: avoid speculation from net slot media: siano: fix device register error path media: imx-csi: Skip first few frames from a BT.656 source hwmon: (max31790) Report correct current pwm duty cycles hwmon: (max31790) Fix pwmX_enable attributes drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe() KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors btrfs: fix error handling in __btrfs_update_delayed_inode btrfs: abort transaction if we fail to update the delayed inode btrfs: sysfs: fix format string for some discard stats btrfs: don't clear page extent mapped if we're not invalidating the full page btrfs: disable build on platforms having page size 256K locking/lockdep: Fix the dep path printing for backwards BFS lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage() KVM: s390: get rid of register asm usage regulator: mt6358: Fix vdram2 .vsel_mask regulator: da9052: Ensure enough delay time for .set_voltage_time_sel media: Fix Media Controller API config checks ACPI: video: use native backlight for GA401/GA502/GA503 HID: do not use down_interruptible() when unbinding devices EDAC/ti: Add missing MODULE_DEVICE_TABLE ACPI: processor idle: Fix up C-state latency if not ordered hv_utils: Fix passing zero to 'PTR_ERR' warning lib: vsprintf: Fix handling of number field widths in vsscanf Input: goodix - platform/x86: touchscreen_dmi - Move upside down quirks to touchscreen_dmi.c platform/x86: touchscreen_dmi: Add an extra entry for the upside down Goodix touchscreen on Teclast X89 tablets platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of TM800A550L tablets ACPI: EC: Make more Asus laptops use ECDT _GPE block_dump: remove block_dump feature in mark_inode_dirty() blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter blk-mq: clear stale request in tags->rq[] before freeing one request pool fs: dlm: cancel work sync othercon random32: Fix implicit truncation warning in prandom_seed_state() open: don't silently ignore unknown O-flags in openat2() drivers: hv: Fix missing error code in vmbus_connect() fs: dlm: fix memory leak when fenced ACPICA: Fix memory leak caused by _CID repair function ACPI: bus: Call kobject_put() in acpi_init() error path ACPI: resources: Add checks for ACPI IRQ override block: fix race between adding/removing rq qos and normal IO platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures" platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15" platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() nvme-pci: fix var. type for increasing cq_head nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst() EDAC/Intel: Do not load EDAC driver when running as a guest PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() cifs: improve fallocate emulation ACPI: EC: trust DSDT GPE for certain HP laptop clocksource: Retry clock read if long delays detected clocksource: Check per-CPU clock synchronization when marked unstable tpm_tis_spi: add missing SPI device ID entries ACPI: tables: Add custom DSDT file as makefile prerequisite HID: wacom: Correct base usage for capacitive ExpressKey status bits cifs: fix missing spinlock around update to ses->status mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device block: fix discard request merge kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() ia64: mca_drv: fix incorrect array size calculation writeback, cgroup: increment isw_nr_in_flight before grabbing an inode spi: Allow to have all native CSs in use along with GPIOs spi: Avoid undefined behaviour when counting unused native CSs media: venus: Rework error fail recover logic media: s5p_cec: decrement usage count if disabled media: hantro: do a PM resume earlier crypto: ixp4xx - dma_unmap the correct address crypto: ixp4xx - update IV after requests crypto: ux500 - Fix error return code in hash_hw_final() sata_highbank: fix deferred probing pata_rb532_cf: fix deferred probing media: I2C: change 'RST' to "RSET" to fix multiple build errors sched/uclamp: Fix wrong implementation of cpu.uclamp.min sched/uclamp: Fix locking around cpu_util_update_eff() kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n' pata_octeon_cf: avoid WARN_ON() in ata_host_activate() evm: fix writing <securityfs>/evm overflow x86/elf: Use _BITUL() macro in UAPI headers crypto: sa2ul - Fix leaks on failure paths with sa_dma_init() crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe() crypto: ccp - Fix a resource leak in an error handling path media: rc: i2c: Fix an error message pata_ep93xx: fix deferred probing locking/lockdep: Reduce LOCKDEP dependency list media: rkvdec: Fix .buf_prepare media: exynos4-is: Fix a use after free in isp_video_release media: au0828: fix a NULL vs IS_ERR() check media: tc358743: Fix error return code in tc358743_probe_of() media: gspca/gl860: fix zero-length control requests m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK crypto: nitrox - fix unchecked variable in nitrox_register_interrupts crypto: omap-sham - Fix PM reference leak in omap sham ops crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit crypto: sm2 - remove unnecessary reset operations crypto: sm2 - fix a memory leak in sm2 mmc: usdhi6rol0: fix error return code in usdhi6_probe() arm64: consistently use reserved_pg_dir arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan media: subdev: remove VIDIOC_DQEVENT_TIME32 handling media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx hwmon: (lm70) Use device_get_match_data() hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI" hwmon: (max31722) Remove non-standard ACPI device IDs hwmon: (max31790) Fix fan speed reporting for fan7..12 KVM: nVMX: Sync all PGDs on nested transition with shadow paging KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level() perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set regulator: hi655x: Fix pass wrong pointer to config.driver_data btrfs: clear log tree recovering status if starting transaction fails x86/sev: Make sure IRQs are disabled while GHCB is active x86/sev: Split up runtime #VC handler for correct state tracking sched/rt: Fix RT utilization tracking during policy change sched/rt: Fix Deadline utilization tracking during policy change sched/uclamp: Fix uclamp_tg_restrict() lockdep: Fix wait-type for empty stack lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING spi: spi-sun6i: Fix chipselect/clock bug crypto: nx - Fix RCU warning in nx842_OF_upd_status psi: Fix race between psi_trigger_create/destroy media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev media: video-mux: Skip dangling endpoints PM / devfreq: Add missing error code in devfreq_add_device() ACPI: PM / fan: Put fan device IDs into separate header file block: avoid double io accounting for flush request nvme-pci: look for StorageD3Enable on companion ACPI device instead ACPI: sysfs: Fix a buffer overrun problem with description_show() mark pstore-blk as broken clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG extcon: extcon-max8997: Fix IRQ freeing at error path ACPI: APEI: fix synchronous external aborts in user-mode blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() blk-wbt: make sure throttle is enabled properly ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros ACPI: bgrt: Fix CFI violation cpufreq: Make cpufreq_online() call driver->offline() on errors blk-mq: update hctx->dispatch_busy in case of real scheduler ocfs2: fix snprintf() checking dax: fix ENOMEM handling in grab_mapping_entry() mm/debug_vm_pgtable/basic: add validation for dirtiness after write protect mm/debug_vm_pgtable/basic: iterate over entire protection_map[] mm/debug_vm_pgtable: ensure THP availability via has_transparent_hugepage() swap: fix do_swap_page() race with swapoff mm/shmem: fix shmem_swapin() race with swapoff mm: memcg/slab: properly set up gfp flags for objcg pointer array mm: page_alloc: refactor setup_per_zone_lowmem_reserve() mm/page_alloc: fix counting of managed_pages xfrm: xfrm_state_mtu should return at least 1280 for ipv6 drm/bridge/sii8620: fix dependency on extcon drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable() drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect() drm/ast: Fix missing conversions to managed API video: fbdev: imxfb: Fix an error message net: mvpp2: Put fwnode in error case during ->probe() net: pch_gbe: Propagate error from devm_gpio_request_one() pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command drm/vmwgfx: Fix cpu updates of coherent multisample surfaces net: qrtr: ns: Fix error return code in qrtr_ns_init() clk: meson: g12a: fix gp0 and hifi ranges net: ftgmac100: add missing error return code in ftgmac100_probe() drm: rockchip: set alpha_en to 0 if it is not used drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() drm/rockchip: dsi: move all lane config except LCDC mux to bind() drm/rockchip: lvds: Fix an error handling path drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result mptcp: fix pr_debug in mptcp_token_new_connect mptcp: generate subflow hmac after mptcp_finish_join() RDMA/srp: Fix a recently introduced memory leak RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats RDMA/rtrs: Do not reset hb_missed_max after re-connection RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object RDMA/rtrs-srv: Fix memory leak when having multiple sessions RDMA/rtrs-clt: Check if the queue_depth has changed during a reconnection RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats ehea: fix error return code in ehea_restart_qps() clk: tegra30: Use 300MHz for video decoder by default xfrm: remove the fragment check for ipv6 beet mode net/sched: act_vlan: Fix modify to allow 0 RDMA/core: Sanitize WQ state received from the userspace drm/pl111: depend on CONFIG_VEXPRESS_CONFIG RDMA/rxe: Fix failure during driver load drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends drm/vc4: hdmi: Fix error path of hpd-gpios clk: vc5: fix output disabling when enabling a FOD drm: qxl: ensure surf.data is ininitialized tools/bpftool: Fix error return code in do_batch() ath10k: go to path err_unsupported when chip id is not supported ath10k: add missing error return code in ath10k_pci_probe() wireless: carl9170: fix LEDS build errors & warnings ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others clk: imx8mq: remove SYS PLL 1/2 clock gates wcn36xx: Move hal_buf allocation to devm_kmalloc in probe ssb: Fix error return code in ssb_bus_scan() brcmfmac: fix setting of station info chains bitmask brcmfmac: correctly report average RSSI in station info brcmfmac: Fix a double-free in brcmf_sdio_bus_reset brcmsmac: mac80211_if: Fix a resource leak in an error handling path cw1200: Revert unnecessary patches that fix unreal use-after-free bugs ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n() ath10k: Fix an error code in ath10k_add_interface() ath11k: send beacon template after vdev_start/restart during csa netlabel: Fix memory leak in netlbl_mgmt_add_common RDMA/mlx5: Don't add slave port to unaffiliated list netfilter: nft_exthdr: check for IPv6 packet before further processing netfilter: nft_osf: check for TCP packet before further processing netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols RDMA/rxe: Fix qp reference counting for atomic ops selftests/bpf: Whitelist test_progs.h from .gitignore xsk: Fix missing validation for skb and unaligned mode xsk: Fix broken Tx ring validation bpf: Fix libelf endian handling in resolv_btfids RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr samples/bpf: Fix Segmentation fault for xdp_redirect command samples/bpf: Fix the error return code of xdp_redirect's main() mt76: fix possible NULL pointer dereference in mt76_tx mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb() net: ethernet: aeroflex: fix UAF in greth_of_remove net: ethernet: ezchip: fix UAF in nps_enet_remove net: ethernet: ezchip: fix error handling vrf: do not push non-ND strict packets with a source LLA through packet taps again net: sched: add barrier to ensure correct ordering for lockless qdisc tls: prevent oversized sendfile() hangs by ignoring MSG_MORE netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic pkt_sched: sch_qfq: fix qfq_change_class() error path xfrm: Fix xfrm offload fallback fail case iwlwifi: increase PNVM load timeout rtw88: 8822c: fix lc calibration timing vxlan: add missing rcu_read_lock() in neigh_reduce() ip6_tunnel: fix GRE6 segmentation net/ipv4: swap flow ports when validating source net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues tc-testing: fix list handling ieee802154: hwsim: Fix memory leak in hwsim_add_one ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() bpf: Fix null ptr deref with mixed tail calls and subprogs drm/msm: Fix error return code in msm_drm_init() drm/msm/dpu: Fix error return code in dpu_mdss_init() mac80211: remove iwlwifi specific workaround NDPs of null_response net: bcmgenet: Fix attaching to PYH failed on RPi 4B ipv6: exthdrs: do not blindly use init_net can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0 bpf: Do not change gso_size during bpf_skb_change_proto() i40e: Fix error handling in i40e_vsi_open i40e: Fix autoneg disabling for non-10GBaseT links i40e: Fix missing rtnl locking when setting up pf switch Revert "ibmvnic: remove duplicate napi_schedule call in open function" ibmvnic: set ltb->buff to NULL after freeing ibmvnic: free tx_pool if tso_pool alloc fails RDMA/cma: Protect RMW with qp_mutex net: macsec: fix the length used to copy the key for offloading net: phy: mscc: fix macsec key length net: atlantic: fix the macsec key length ipv6: fix out-of-bound access in ip6_parse_tlv() e1000e: Check the PCIm state net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs() bpfilter: Specify the log level for the kmsg message RDMA/cma: Fix incorrect Packet Lifetime calculation gve: Fix swapped vars when fetching max queues Revert "be2net: disable bh with spin_lock in be_process_mcc" Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid Bluetooth: Fix not sending Set Extended Scan Response Bluetooth: Fix Set Extended (Scan Response) Data Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event clk: actions: Fix UART clock dividers on Owl S500 SoC clk: actions: Fix SD clocks factor table on Owl S500 SoC clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare clk: si5341: Wait for DEVICE_READY on startup clk: si5341: Avoid divide errors due to bogus register contents clk: si5341: Check for input clock presence and PLL lock on startup clk: si5341: Update initialization magic writeback: fix obtain a reference to a freeing memcg css net: lwtunnel: handle MTU calculation in forwading net: sched: fix warning in tcindex_alloc_perfect_hash net: tipc: fix FB_MTU eat two pages RDMA/mlx5: Don't access NULL-cleared mpi pointer RDMA/core: Always release restrack object MIPS: Fix PKMAP with 32-bit MIPS huge page support staging: fbtft: Rectify GPIO handling staging: fbtft: Don't spam logs when probe is deferred ASoC: rt5682: Disable irq on shutdown rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread() serial: fsl_lpuart: don't modify arbitrary data on lpuart32 serial: fsl_lpuart: remove RTSCTS handling from get_mctrl() serial: 8250_omap: fix a timeout loop condition tty: nozomi: Fix a resource leak in an error handling function mwifiex: re-fix for unaligned accesses iio: adis_buffer: do not return ints in irq handlers iio: adis16400: do not return ints in irq handlers iio: adis16475: do not return ints in irq handlers iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: mxc4005: Fix overread of data and alignment issue. iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: chemical: atlas: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe() ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() backlight: lm3630a_bl: Put fwnode in error case during ->probe() ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() Input: hil_kbd - fix error return code in hil_dev_connect() perf scripting python: Fix tuple_set_u64() mtd: partitions: redboot: seek fis-index-block in the right node mtd: rawnand: arasan: Ensure proper configuration for the asserted target staging: mmal-vchiq: Fix incorrect static vchiq_instance. char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() firmware: stratix10-svc: Fix a resource leak in an error handling path tty: nozomi: Fix the error handling path of 'nozomi_card_init()' leds: class: The -ENOTSUPP should never be seen by user space leds: lm3532: select regmap I2C API leds: lm36274: Put fwnode in error case during ->probe() leds: lm3692x: Put fwnode in any case during ->probe() leds: lm3697: Don't spam logs when probe is deferred leds: lp50xx: Put fwnode in error case during ->probe() scsi: FlashPoint: Rename si_flags field scsi: iscsi: Flush block work before unblock mfd: mp2629: Select MFD_CORE to fix build error mfd: rn5t618: Fix IRQ trigger by changing it to level mode fsi: core: Fix return of error values on failures fsi: scom: Reset the FSI2PIB engine for any error fsi: occ: Don't accept response from un-initialized OCC fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE fsi/sbefifo: Fix reset timeout visorbus: fix error return code in visorchipset_init() iommu/amd: Fix extended features logging s390/irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK s390: enable HAVE_IOREMAP_PROT s390: appldata depends on PROC_SYSCTL selftests: splice: Adjust for handler fallback removal iommu/dma: Fix IOVA reserve dma ranges ASoC: max98373-sdw: use first_hw_init flag on resume ASoC: rt1308-sdw: use first_hw_init flag on resume ASoC: rt5682-sdw: use first_hw_init flag on resume ASoC: rt700-sdw: use first_hw_init flag on resume ASoC: rt711-sdw: use first_hw_init flag on resume ASoC: rt715-sdw: use first_hw_init flag on resume ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' usb: gadget: f_fs: Fix setting of device and driver data cross-references usb: dwc2: Don't reset the core after setting turnaround time eeprom: idt_89hpesx: Put fwnode in matching case during ->probe() eeprom: idt_89hpesx: Restore printing the unsupported fwnode name thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default() iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: light: vcnl4000: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: fsl_spdif: Fix error handler with pm_runtime_enable staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt() staging: gdm724x: check for overflow in gdm_lte_netif_rx() staging: rtl8712: fix error handling in r871xu_drv_init staging: rtl8712: fix memory leak in rtl871x_load_fw_cb coresight: core: Fix use of uninitialized pointer staging: mt7621-dts: fix pci address for PCI memory range serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK of: Fix truncation of memory sizes on 32-bit platforms mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() habanalabs: Fix an error handling path in 'hl_pci_probe()' scsi: mpt3sas: Fix error return value in _scsih_expander_add() soundwire: stream: Fix test for DP prepare complete phy: uniphier-pcie: Fix updating phy parameters phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() extcon: sm5502: Drop invalid register write in sm5502_reg_data extcon: max8997: Add missing modalias string powerpc/powernv: Fix machine check reporting of async store errors ASoC: atmel-i2s: Fix usage of capture and playback at the same time configfs: fix memleak in configfs_release_bin_file ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake ASoC: fsl_spdif: Fix unexpected interrupt after suspend leds: as3645a: Fix error return code in as3645a_parse_node() leds: ktd2692: Fix an error handling path selftests/ftrace: fix event-no-pid on 1-core machine serial: 8250: 8250_omap: Disable RX interrupt after DMA enable serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs powerpc: Offline CPU in stop_this_cpu() powerpc/papr_scm: Properly handle UUID types and API powerpc/64s: Fix copy-paste data exposure into newly created tasks powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found serial: mvebu-uart: do not allow changing baudrate when uartclk is not available serial: mvebu-uart: correctly calculate minimal possible baudrate arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART vfio/pci: Handle concurrent vma faults mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled() mm/huge_memory.c: don't discard hugepage if other processes are mapping it mm/hugetlb: use helper huge_page_order and pages_per_huge_page mm/hugetlb: remove redundant check in preparing and destroying gigantic page hugetlb: remove prep_compound_huge_page cleanup include/linux/huge_mm.h: remove extern keyword mm/z3fold: fix potential memory leak in z3fold_destroy_pool() mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page lib/math/rational.c: fix divide by zero selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random selftests/vm/pkeys: handle negative sys_pkey_alloc() return code selftests/vm/pkeys: refill shadow register after implicit kernel write perf llvm: Return -ENOMEM when asprintf() fails csky: fix syscache.c fallthrough warning csky: syscache: Fixup duplicate cache flush exfat: handle wrong stream entry size in exfat_readdir() scsi: fc: Correct RHBA attributes length scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion fscrypt: don't ignore minor_hash when hash is 0 fscrypt: fix derivation of SipHash keys on big endian CPUs tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status() erofs: fix error return code in erofs_read_superblock() block: return the correct bvec when checking for gaps io_uring: fix blocking inline submission mmc: block: Disable CMDQ on the ioctl path mmc: vub3000: fix control-request direction media: exynos4-is: remove a now unused integer scsi: core: Retry I/O for Notify (Enable Spinup) Required error crypto: qce - fix error return code in qce_skcipher_async_req_handle() s390: preempt: Fix preempt_count initialization cred: add missing return error code when set_cred_ucounts() failed iommu/dma: Fix compile warning in 32-bit builds powerpc/preempt: Don't touch the idle task's preempt_count during hotplug Linux 5.10.50 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iec4eab24ea8eb5a6d79739a1aec8432d93a8f82c	2021-07-14 17:35:23 +02:00
Mimi Zohar	912d16a2d7	evm: fix writing <securityfs>/evm overflow ... [ Upstream commit 49219d9b87 ] EVM_SETUP_COMPLETE is defined as 0x80000000, which is larger than INT_MAX. The "-fno-strict-overflow" compiler option properly prevents signaling EVM that the EVM policy setup is complete. Define and read an unsigned int. Fixes: f00d797507 ("EVM: Allow userspace to signal an RSA key has been loaded") Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-14 16:56:04 +02:00
Roberto Sassu	53124265fc	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded ... commit 9acc89d31f upstream. EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs. Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation. Fixes: ae1ba1676b ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.16.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:55:46 +02:00
Roberto Sassu	7b84c7d7e2	evm: Execute evm_inode_init_security() only when an HMAC key is loaded ... commit 9eea290429 upstream. evm_inode_init_security() requires an HMAC key to calculate the HMAC on initial xattrs provided by LSMs. However, it checks generically whether a key has been loaded, including also public keys, which is not correct as public keys are not suitable to calculate the HMAC. Originally, support for signature verification was introduced to verify a possibly immutable initial ram disk, when no new files are created, and to switch to HMAC for the root filesystem. By that time, an HMAC key should have been loaded and usable to calculate HMACs for new files. More recently support for requiring an HMAC key was removed from the kernel, so that signature verification can be used alone. Since this is a legitimate use case, evm_inode_init_security() should not return an error when no HMAC key has been loaded. This patch fixes this problem by replacing the evm_key_loaded() check with a check of the EVM_INIT_HMAC flag in evm_initialized. Fixes: 26ddabfe96 ("evm: enable EVM when X509 certificate is loaded") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.5.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:55:46 +02:00
Greg Kroah-Hartman	194be71cc6	Merge 5.10.47 into android12-5.10-lts ... Changes in 5.10.47 module: limit enabling module.sig_enforce Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue." Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell." drm: add a locked version of drm_is_current_master drm/nouveau: wait for moving fence after pinning v2 drm/radeon: wait for moving fence after pinning drm/amdgpu: wait for moving fence after pinning ARM: 9081/1: fix gcc-10 thumb2-kernel regression mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk MIPS: generic: Update node names to avoid unit addresses arm64: Ignore any DMA offsets in the max_zone_phys() calculation arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required spi: spi-nxp-fspi: move the register operation after the clock enable Revert "PCI: PM: Do not read power state in pci_enable_device_flags()" drm/vc4: hdmi: Move the HSM clock enable to runtime_pm drm/vc4: hdmi: Make sure the controller is powered in detect x86/entry: Fix noinstr fail in __do_fast_syscall_32() x86/xen: Fix noinstr fail in exc_xen_unknown_trap() locking/lockdep: Improve noinstr vs errors perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context perf/x86/intel/lbr: Zero the xstate buffer on allocation dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc() dmaengine: xilinx: dpdma: Add missing dependencies to Kconfig dmaengine: xilinx: dpdma: Limit descriptor IDs to 16 bits mac80211: remove warning in ieee80211_get_sband() mac80211_hwsim: drop pending frames on stop cfg80211: call cfg80211_leave_ocb when switching away from OCB dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() dmaengine: mediatek: free the proper desc in desc_free handler dmaengine: mediatek: do not issue a new desc if one is still current dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma net: ipv4: Remove unneed BUG() function mac80211: drop multicast fragments net: ethtool: clear heap allocations for ethtool function inet: annotate data race in inet_send_prepare() and inet_dgram_connect() ping: Check return value of function 'ping_queue_rcv_skb' net: annotate data race in sock_error() inet: annotate date races around sk->sk_txhash net/packet: annotate data race in packet_sendmsg() net: phy: dp83867: perform soft reset and retain established link riscv32: Use medany C model for modules net: caif: fix memory leak in ldisc_open net/packet: annotate accesses to po->bind net/packet: annotate accesses to po->ifindex r8152: Avoid memcpy() over-reading of ETH_SS_STATS sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS r8169: Avoid memcpy() over-reading of ETH_SS_STATS KVM: selftests: Fix kvm_check_cap() assertion net: qed: Fix memcpy() overflow of qed_dcbx_params() mac80211: reset profile_periodicity/ema_ap mac80211: handle various extensible elements correctly recordmcount: Correct st_shndx handling PCI: Add AMD RS690 quirk to enable 64-bit DMA net: ll_temac: Add memory-barriers for TX BD access net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY perf/x86: Track pmu in per-CPU cpu_hw_events pinctrl: stm32: fix the reported number of GPIO lines per bank i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving i801_access gpiolib: cdev: zero padding during conversion to gpioline_info_changed scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART) nilfs2: fix memory leak in nilfs_sysfs_delete_device_group s390/stack: fix possible register corruption with stack switch helper KVM: do not allow mapping valid but non-reference-counted pages i2c: robotfuzz-osif: fix control-request directions ceph: must hold snap_rwsem when filling inode for async create kthread_worker: split code for canceling the delayed work timer kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate() x86/fpu: Make init_fpstate correct with optimized XSAVE mm: add VM_WARN_ON_ONCE_PAGE() macro mm/rmap: remove unneeded semicolon in page_not_mapped() mm/rmap: use page_not_mapped in try_to_unmap() mm, thp: use head page in __migration_entry_wait() mm/thp: fix __split_huge_pmd_locked() on shmem migration entry mm/thp: make is_huge_zero_pmd() safe and quicker mm/thp: try_to_unmap() use TTU_SYNC for safe splitting mm/thp: fix vma_address() if virtual address below file offset mm/thp: fix page_address_in_vma() on file THP tails mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split mm: page_vma_mapped_walk(): use page for pvmw->page mm: page_vma_mapped_walk(): settle PageHuge on entry mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block mm: page_vma_mapped_walk(): crossing page table boundary mm: page_vma_mapped_walk(): add a level of indentation mm: page_vma_mapped_walk(): use goto instead of while (1) mm: page_vma_mapped_walk(): get vma_address_end() earlier mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() mm, futex: fix shared futex pgoff on shmem huge page KVM: SVM: Call SEV Guest Decommission if ASID binding fails swiotlb: manipulate orig_addr when tlb_addr has offset netfs: fix test for whether we can skip read when writing beyond EOF Revert "drm: add a locked version of drm_is_current_master" certs: Add EFI_CERT_X509_GUID support for dbx entries certs: Move load_system_certificate_list to a common function certs: Add ability to preload revocation certs integrity: Load mokx variables into the blacklist keyring Linux 5.10.47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I68f731ad78a5db003c41093e4faf59f6f9f2e446	2021-06-30 19:38:46 +02:00
Eric Snowberg	1573d595e2	integrity: Load mokx variables into the blacklist keyring ... [ Upstream commit ebd9c2ae36 ] During boot the Secure Boot Forbidden Signature Database, dbx, is loaded into the blacklist keyring. Systems booted with shim have an equivalent Forbidden Signature Database called mokx. Currently mokx is only used by shim and grub, the contents are ignored by the kernel. Add the ability to load mokx into the blacklist keyring during boot. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/ Link: https://lore.kernel.org/r/20210122181054.32635-5-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/ # v3 Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-30 08:47:30 -04:00
Eric Snowberg	45109066f6	certs: Add EFI_CERT_X509_GUID support for dbx entries ... [ Upstream commit 56c5812623 ] This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_X509_GUID entries. Currently when EFI_CERT_X509_GUID are contained in the dbx, the entries are skipped. Add support for EFI_CERT_X509_GUID dbx entries. When a EFI_CERT_X509_GUID is found, it is added as an asymmetrical key to the .blacklist keyring. Anytime the .platform keyring is used, the keys in the .blacklist keyring are referenced, if a matching key is found, the key will be rejected. [DH: Made the following changes: - Added to have a config option to enable the facility. This allows a Kconfig solution to make sure that pkcs7_validate_trust() is enabled.[1][2] - Moved the functions out from the middle of the blacklist functions. - Added kerneldoc comments.] Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: Randy Dunlap <rdunlap@infradead.org> cc: Mickaël Salaün <mic@digikod.net> cc: Arnd Bergmann <arnd@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/20200901165143.10295-1-eric.snowberg@oracle.com/ # rfc Link: https://lore.kernel.org/r/20200909172736.73003-1-eric.snowberg@oracle.com/ # v2 Link: https://lore.kernel.org/r/20200911182230.62266-1-eric.snowberg@oracle.com/ # v3 Link: https://lore.kernel.org/r/20200916004927.64276-1-eric.snowberg@oracle.com/ # v4 Link: https://lore.kernel.org/r/20210122181054.32635-2-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428672051.677100.11064981943343605138.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433310942.902181.4901864302675874242.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529605075.163428.14625520893961300757.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/bc2c24e3-ed68-2521-0bf4-a1f6be4a895d@infradead.org/ [1] Link: https://lore.kernel.org/r/20210225125638.1841436-1-arnd@kernel.org/ [2] Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-30 08:47:30 -04:00
Bram Bonné	9d55580966	ANDROID: selinux: modify RTM_GETNEIGH{TBL} ... Map the permission gating RTM_GETNEIGH/RTM_GETNEIGHTBL messages to a new permission so that it can be distinguished from the other netlink route permissions in selinux policy. The new permission is triggered by a flag set in system images T and up. This change is intended to be backported to all kernels that a T system image can run on top of. Bug: 171572148 Test: atest NetworkInterfaceTest Test: atest CtsSelinuxTargetSdkCurrentTestCases Test: atest bionic-unit-tests-static Test: On Cuttlefish, run combinations of: - Policy bit set or omitted (see https://r.android.com/1701847) - This patch applied or omitted - App having nlmsg_readneigh permission or not Verify that only the combination of this patch + the policy bit being set + the app not having the nlmsg_readneigh permission prevents the app from sending RTM_GETNEIGH messages. Change-Id: I4bcfce4decb34ea9388eeedfc4be67403de8a980 Signed-off-by: Bram Bonné <brambonne@google.com> (cherry picked from commit fac07550bd)	2021-06-23 14:06:26 +00:00
Minchan Kim	46e579716d	FROMGIT: selinux: use __GFP_NOWARN with GFP_NOWAIT ... In the field, we have seen lots of allocation failure from the call path below. 06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0 ... ... 06-03 13:29:12.999 1010315 31557 31557 W Call trace: 06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8 06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c 06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430 06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390 06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4 06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4 06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184 06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0 06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460 06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0 06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0 .. .. 06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 Based on [1], selinux is tolerate for failure of memory allocation. Then, use __GFP_NOWARN together. [1] 476accbe2f, selinux: use GFP_NOWAIT in the AVC kmem_caches Signed-off-by: Minchan Kim <minchan@kernel.org> Signed-off-by: Minchan Kim <minchan@google.com> (cherry picked from commit 648f2c6100 https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git for next) Change-Id: I1d45e662363ace6131453f8854071e2ff018f445 Bug: 190615082	2021-06-18 11:01:08 -07:00
Greg Kroah-Hartman	76002c201f	Merge 5.10.38 into android12-5.10 ... Changes in 5.10.38 KEYS: trusted: Fix memory leak on object td tpm: fix error return code in tpm2_get_cc_attrs_tbl() tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() tpm, tpm_tis: Reserve locality in tpm_tis_resume() KVM: x86/mmu: Remove the defunct update_pte() paging hook KVM/VMX: Invoke NMI non-IST entry instead of IST entry ACPI: PM: Add ACPI ID of Alder Lake Fan PM: runtime: Fix unpaired parent child_count for force_resume cpufreq: intel_pstate: Use HWP if enabled by platform firmware kvm: Cap halt polling at kvm->max_halt_poll_ns ath11k: fix thermal temperature read fs: dlm: fix debugfs dump fs: dlm: add errno handling to check callback fs: dlm: check on minimum msglen size fs: dlm: flush swork on shutdown tipc: convert dest node's address to network order ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath net: stmmac: Set FIFO sizes for ipq806x ASoC: rsnd: core: Check convert rate in rsnd_hw_params Bluetooth: Fix incorrect status handling in LE PHY UPDATE event i2c: bail out early when RDWR parameters are wrong ALSA: hdsp: don't disable if not enabled ALSA: hdspm: don't disable if not enabled ALSA: rme9652: don't disable if not enabled ALSA: bebob: enable to deliver MIDI messages for multiple ports Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default Bluetooth: initialize skb_queue_head at l2cap_chan_create() net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports net: bridge: when suppression is enabled exclude RARP packets Bluetooth: check for zapped sk before connecting selftests/powerpc: Fix L1D flushing tests for Power10 powerpc/32: Statically initialise first emergency context net: hns3: remediate a potential overflow risk of bd_num_list net: hns3: add handling for xmit skb with recursive fraglist ip6_vti: proper dev_{hold|put} in ndo_[un]init methods ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet ice: handle increasing Tx or Rx ring sizes Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip. ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055 i2c: Add I2C_AQ_NO_REP_START adapter quirk MIPS: Loongson64: Use _CACHE_UNCACHED instead of _CACHE_UNCACHED_ACCELERATED coresight: Do not scan for graph if none is present IB/hfi1: Correct oversized ring allocation mac80211: clear the beacon's CRC after channel switch pinctrl: samsung: use 'int' for register masks in Exynos rtw88: 8822c: add LC calibration for RTL8822C mt76: mt7615: support loading EEPROM for MT7613BE mt76: mt76x0: disable GTK offloading mt76: mt7915: fix txpower init for TSSI off chips fuse: invalidate attrs when page writeback completes virtiofs: fix userns cuse: prevent clone iwlwifi: pcie: make cfg vs. trans_cfg more robust powerpc/mm: Add cond_resched() while removing hpte mappings ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() Revert "iommu/amd: Fix performance counter initialization" iommu/amd: Remove performance counter pre-initialization test drm/amd/display: Force vsync flip when reconfiguring MPCC selftests: Set CC to clang in lib.mk if LLVM is set kconfig: nconf: stop endless search loops ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740 ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume sctp: Fix out-of-bounds warning in sctp_process_asconf_param() flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target() powerpc/smp: Set numa node before updating mask ASoC: rt286: Generalize support for ALC3263 codec ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user() net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule samples/bpf: Fix broken tracex1 due to kprobe argument change powerpc/pseries: Stop calling printk in rtas_stop_self() drm/amd/display: fixed divide by zero kernel crash during dsc enablement drm/amd/display: add handling for hdcp2 rx id list validation drm/amdgpu: Add mem sync flag for IB allocated by SA mt76: mt7615: fix entering driver-own state on mt7663 crypto: ccp: Free SEV device if SEV init fails wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth powerpc/iommu: Annotate nested lock for lockdep iavf: remove duplicate free resources calls net: ethernet: mtk_eth_soc: fix RX VLAN offload selftests: mlxsw: Increase the tolerance of backlog buildup selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test kbuild: generate Module.symvers only when vmlinux exists bnxt_en: Add PCI IDs for Hyper-V VF devices. ia64: module: fix symbolizer crash on fdescr watchdog: rename __touch_watchdog() to a better descriptive name watchdog: explicitly update timestamp when reporting softlockup watchdog/softlockup: remove logic that tried to prevent repeated reports watchdog: fix barriers when printing backtraces from all CPUs ASoC: rt286: Make RT286_SET_GPIO_* readable and writable thermal: thermal_of: Fix error return code of thermal_of_populate_bind_params() f2fs: move ioctl interface definitions to separated file f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE f2fs: fix to allow migrating fully valid segment f2fs: fix panic during f2fs_resize_fs() f2fs: fix a redundant call to f2fs_balance_fs if an error occurs remoteproc: qcom_q6v5_mss: Replace ioremap with memremap remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc() PCI: Release OF node in pci_scan_device()'s error path ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook f2fs: fix to align to section for fallocate() on pinned file f2fs: fix to update last i_size if fallocate partially succeeds PCI: endpoint: Make *_get_first_free_bar() take into account 64 bit BAR PCI: endpoint: Add helper API to get the 'next' unreserved BAR PCI: endpoint: Make *_free_bar() to return error codes on failure PCI: endpoint: Fix NULL pointer dereference for ->get_features() f2fs: fix to avoid touching checkpointed data in get_victim() f2fs: fix to cover __allocate_new_section() with curseg_lock f2fs: Fix a hungtask problem in atomic write f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block() rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() NFS: nfs4_bitmask_adjust() must not change the server global bitmasks NFS: Fix attribute bitmask in _nfs42_proc_fallocate() NFSv4.2: Always flush out writes in nfs42_proc_fallocate() NFS: Deal correctly with attribute generation counter overflow PCI: endpoint: Fix missing destroy_workqueue() pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() NFSv4.2 fix handling of sr_eof in SEEK's reply SUNRPC: Move fault injection call sites SUNRPC: Remove trace_xprt_transmit_queued SUNRPC: Handle major timeout in xprt_adjust_timeout() thermal/drivers/tsens: Fix missing put_device error NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting nfsd: ensure new clients break delegations rtc: fsl-ftm-alarm: add MODULE_TABLE() dmaengine: idxd: Fix potential null dereference on pointer status dmaengine: idxd: fix dma device lifetime dmaengine: idxd: fix cdev setup and free device lifetime issues SUNRPC: fix ternary sign expansion bug in tracing pwm: atmel: Fix duty cycle calculation in .get_state() xprtrdma: Avoid Receive Queue wrapping xprtrdma: Fix cwnd update ordering xprtrdma: rpcrdma_mr_pop() already does list_del_init() swiotlb: Fix the type of index ceph: fix inode leak on getattr error in __fh_to_dentry scsi: qla2xxx: Prevent PRLI in target mode scsi: ufs: core: Do not put UFS power into LPM if link is broken scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend scsi: ufs: core: Narrow down fast path in system suspend path rtc: ds1307: Fix wday settings for rx8130 net: hns3: fix incorrect configuration for igu_egu_hw_err net: hns3: initialize the message content in hclge_get_link_mode() net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet() net: hns3: fix for vxlan gpe tx checksum bug net: hns3: use netif_tx_disable to stop the transmit queue net: hns3: disable phy loopback setting in hclge_mac_start_phy sctp: do asoc update earlier in sctp_sf_do_dupcook_a RISC-V: Fix error code returned by riscv_hartid_to_cpuid() sunrpc: Fix misplaced barrier in call_decode libbpf: Fix signed overflow in ringbuf_process_ring block/rnbd-clt: Change queue_depth type in rnbd_clt_session to size_t block/rnbd-clt: Check the return value of the function rtrs_clt_query ethernet:enic: Fix a use after free bug in enic_hard_start_xmit sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b netfilter: xt_SECMARK: add new revision to fix structure layout xsk: Fix for xp_aligned_validate_desc() when len == chunk_size net: stmmac: Clear receive all(RA) bit when promiscuous mode is off drm/radeon: Fix off-by-one power_state index heap overwrite drm/radeon: Avoid power table parsing memory leaks arm64: entry: factor irq triage logic into macros arm64: entry: always set GIC_PRIO_PSR_I_SET during entry khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page() ksm: fix potential missing rmap_item for stable_node mm/gup: check every subpage of a compound page during isolation mm/gup: return an error on migration failure mm/gup: check for isolation errors ethtool: fix missing NLM_F_MULTI flag when dumping net: fix nla_strcmp to handle more then one trailing null character smc: disallow TCP_ULP in smc_setsockopt() netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check netfilter: nftables: Fix a memleak from userdata error path in new objects can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path can: mcp251x: fix resume from sleep before interface was brought up can: m_can: m_can_tx_work_queue(): fix tx_skb race condition sched: Fix out-of-bound access in uclamp sched/fair: Fix unfairness caused by missing load decay fs/proc/generic.c: fix incorrect pde_is_permanent check kernel: kexec_file: fix error return code of kexec_calculate_store_digests() kernel/resource: make walk_system_ram_res() find all busy IORESOURCE_SYSTEM_RAM resources kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources netfilter: nftables: avoid overflows in nft_hash_buckets() i40e: fix broken XDP support i40e: Fix use-after-free in i40e_client_subtask() i40e: fix the restart auto-negotiation after FEC modified i40e: Fix PHY type identifiers for 2.5G and 5G adapters mptcp: fix splat when closing unaccepted socket f2fs: avoid unneeded data copy in f2fs_ioc_move_range() ARC: entry: fix off-by-one error in syscall number validation ARC: mm: PAE: use 40-bit physical page mask ARC: mm: Use max_high_pfn as a HIGHMEM zone border powerpc/64s: Fix crashes when toggling stf barrier powerpc/64s: Fix crashes when toggling entry flush barrier hfsplus: prevent corruption in shrinking truncate squashfs: fix divide error in calculate_skip() userfaultfd: release page in error path to avoid BUG_ON kasan: fix unit tests with CONFIG_UBSAN_LOCAL_BOUNDS enabled mm/hugetlb: fix F_SEAL_FUTURE_WRITE blk-iocost: fix weight updates of inner active iocgs arm64: mte: initialize RGSR_EL1.SEED in __cpu_setup arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache() btrfs: fix race leading to unpersisted data and metadata on fsync drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected drm/amd/display: Initialize attribute for hdcp_srm sysfs file drm/i915: Avoid div-by-zero on gen2 kvm: exit halt polling on need_resched() as well KVM: LAPIC: Accurately guarantee busy wait for timer to expire when using hv_timer drm/msm/dp: initialize audio_comp when audio starts KVM: x86: Cancel pvclock_gtod_work on module removal KVM: x86: Prevent deadlock against tk_core.seq dax: Add an enum for specifying dax wakup mode dax: Add a wakeup mode parameter to put_unlocked_entry() dax: Wake up all waiters after invalidating dax entry xen/unpopulated-alloc: consolidate pgmap manipulation xen/unpopulated-alloc: fix error return code in fill_list() perf tools: Fix dynamic libbpf link usb: dwc3: gadget: Free gadget structure only after freeing endpoints iio: light: gp2ap002: Fix rumtime PM imbalance on error iio: proximity: pulsedlight: Fix rumtime PM imbalance on error iio: hid-sensors: select IIO_TRIGGERED_BUFFER under HID_SENSOR_IIO_TRIGGER usb: fotg210-hcd: Fix an error message hwmon: (occ) Fix poll rate limiting usb: musb: Fix an error message ACPI: scan: Fix a memory leak in an error handling path kyber: fix out of bounds access when preempted nvmet: add lba to sect conversion helpers nvmet: fix inline bio check for bdev-ns nvmet-rdma: Fix NULL deref when SEND is completed with error f2fs: compress: fix to free compress page correctly f2fs: compress: fix race condition of overwrite vs truncate f2fs: compress: fix to assign cc.cluster_idx correctly nbd: Fix NULL pointer in flush_workqueue blk-mq: plug request for shared sbitmap blk-mq: Swap two calls in blk_mq_exit_queue() usb: dwc3: omap: improve extcon initialization usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield usb: xhci: Increase timeout for HC halt usb: dwc2: Fix gadget DMA unmap direction usb: core: hub: fix race condition about TRSMRCY of resume usb: dwc3: gadget: Enable suspend events usb: dwc3: gadget: Return success always for kick transfer in ep queue usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4 usb: typec: ucsi: Put fwnode in any case during ->probe() xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI xhci: Do not use GFP_KERNEL in (potentially) atomic context xhci: Add reset resume quirk for AMD xhci controller. iio: gyro: mpu3050: Fix reported temperature value iio: tsl2583: Fix division by a zero lux_val cdc-wdm: untangle a circular dependency between callback and softint xen/gntdev: fix gntdev_mmap() error exit path KVM: x86: Emulate RDPID only if RDTSCP is supported KVM: x86: Move RDPID emulation intercept to its own enum KVM: nVMX: Always make an attempt to map eVMCS after migration KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported KVM: VMX: Disable preemption when probing user return MSRs Revert "iommu/vt-d: Remove WO permissions on second-level paging entries" Revert "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL" iommu/vt-d: Preset Access/Dirty bits for IOVA over FL iommu/vt-d: Remove WO permissions on second-level paging entries mm: fix struct page layout on 32-bit systems MIPS: Reinstate platform `__div64_32' handler MIPS: Avoid DIVU in `__div64_32' is result would be zero MIPS: Avoid handcoded DIVU in `__div64_32' altogether clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940 ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address ARM: 9012/1: move device tree mapping out of linear region ARM: 9020/1: mm: use correct section size macro to describe the FDT virtual address ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section usb: typec: tcpm: Fix error while calculating PPS out values kobject_uevent: remove warning in init_uevent_argv() drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp drm/i915: Read C0DRB3/C1DRB3 as 16 bits again drm/i915/overlay: Fix active retire callback alignment drm/i915: Fix crash in auto_retire clk: exynos7: Mark aclk_fsys1_200 as critical media: rkvdec: Remove of_match_ptr() i2c: mediatek: Fix send master code at more than 1MHz dt-bindings: media: renesas,vin: Make resets optional on R-Car Gen1 dt-bindings: serial: 8250: Remove duplicated compatible strings debugfs: Make debugfs_allow RO after init ext4: fix debug format string warning nvme: do not try to reconfigure APST when the controller is not live ASoC: rsnd: check all BUSIF status when error Linux 5.10.38 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia32e01283b488a38be48015c58a0e481f09aaf65	2021-05-20 15:35:25 +02:00
Colin Ian King	31c9a4b24d	KEYS: trusted: Fix memory leak on object td ... commit 83a775d5f9 upstream. Two error return paths are neglecting to free allocated object td, causing a memory leak. Fix this by returning via the error return path that securely kfree's td. Fixes clang scan-build warning: security/keys/trusted-keys/trusted_tpm1.c:496:10: warning: Potential memory leak [unix.Malloc] Cc: stable@vger.kernel.org Fixes: 5df16caada ("KEYS: trusted: Fix incorrect handling of tpm_get_random()") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-19 10:12:50 +02:00