5260 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	4ea7053789	Merge 5.15.108 into android14-5.15 ... Changes in 5.15.108 Revert "pinctrl: amd: Disable and mask interrupts on resume" ALSA: emu10k1: fix capture interrupt handler unlinking ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard ALSA: i2c/cs8427: fix iec958 mixer control deactivation ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() ALSA: emu10k1: don't create old pass-through playback device on Audigy ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Bluetooth: Fix race condition in hidp_session_thread btrfs: print checksum type and implementation at mount time btrfs: fix fast csum implementation detection fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace mtdblock: tolerate corrected bit-flips mtd: rawnand: meson: fix bitmask for length in command word mtd: rawnand: stm32_fmc2: remove unsupported EDO mode mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min KVM: arm64: PMU: Restore the guest's EL0 event counting after migration drm/i915/dsi: fix DSS CTL register offsets for TGL+ clk: sprd: set max_register according to mapping range RDMA/irdma: Fix memory leak of PBLE objects RDMA/irdma: Increase iWARP CM default rexmit count RDMA/irdma: Add ipv4 check to irdma_find_listener() IB/mlx5: Add support for 400G_8X lane speed RDMA/cma: Allow UD qp_type to join multicast only bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition niu: Fix missing unwind goto in niu_alloc_channels() tcp: restrict net.ipv4.tcp_app_win drm/armada: Fix a potential double free in an error handling path qlcnic: check pci_reset_function result net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() sctp: fix a potential overflow in sctp_ifwdtsn_skip RDMA/core: Fix GID entry ref leak when create_ah fails udp6: fix potential access to stale information net: macb: fix a memory corruption in extended buffer descriptor mode skbuff: Fix a race between coalescing and releasing SKBs libbpf: Fix single-line struct definition output in btf_dump ARM: 9290/1: uaccess: Fix KASAN false-positives power: supply: cros_usbpd: reclassify "default case!" as debug wifi: mwifiex: mark OF related data as maybe unused i2c: imx-lpi2c: clean rx/tx buffers upon new message i2c: hisi: Avoid redundant interrupts efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F verify_pefile: relax wrapper length check asymmetric_keys: log on fatal failures in PE/pkcs7 wifi: iwlwifi: mvm: fix mvmtxq->stopped handling ACPI: resource: Add Medion S17413 to IRQ override quirk counter: stm32-lptimer-cnt: Provide defines for clock polarities counter: stm32-timer-cnt: Provide defines for slave mode selection counter: Internalize sysfs interface code counter: 104-quad-8: Fix Synapse action reported for Index signals tracing: Add trace_array_puts() to write into instance tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance i915/perf: Replace DRM_DEBUG with driver specific drm_dbg call drm/i915: fix race condition UAF in i915_perf_add_config_ioctl riscv: add icache flush for nommu sigreturn trampoline net: sfp: initialize sfp->i2c_block_size at sfp allocation net: phy: nxp-c45-tja11xx: add remove callback net: phy: nxp-c45-tja11xx: fix unsigned long multiplication overflow scsi: ses: Handle enclosure with just a primary component gracefully x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() mptcp: use mptcp_schedule_work instead of open-coding it mptcp: stricter state check in mptcp_worker ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size ubi: Fix deadlock caused by recursively holding work_sem powerpc/papr_scm: Update the NUMA distance table for the target node sched/fair: Move calculate of avg_load to a better location sched/fair: Fix imbalance overflow x86/rtc: Remove __init for runtime functions i2c: ocores: generate stop condition after timeout in polling mode nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S50 nvme-pci: avoid the deepest sleep state on ZHITAI TiPro7000 SSDs nvme-pci: Crucial P2 has bogus namespace ids nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM610 nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM760 nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD kexec: turn all kexec_mutex acquisitions into trylocks panic, kexec: make __crash_kexec() NMI safe counter: fix docum. build problems after filename change counter: Add the necessary colons and indents to the comments of counter_compi nvme-pci: avoid the deepest sleep state on ZHITAI TiPro5000 SSDs Linux 5.15.108 Change-Id: Icdb539c68f2ea04d37818cb4fe66b08384b77609 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-25 16:02:54 +00:00
Steven Rostedt (Google)	6b337a13c1	tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance ... [ Upstream commit 9d52727f80 ] If a trace instance has a failure with its snapshot code, the error message is to be written to that instance's buffer. But currently, the message is written to the top level buffer. Worse yet, it may also disable the top level buffer and not the instance that had the issue. Link: https://lkml.kernel.org/r/20230405022341.688730321@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Ross Zwisler <zwisler@google.com> Fixes: 2824f50332 ("tracing: Make the snapshot trigger work with instances") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-20 12:13:55 +02:00
Steven Rostedt (Google)	1403518ed0	tracing: Add trace_array_puts() to write into instance ... [ Upstream commit d503b8f747 ] Add a generic trace_array_puts() that can be used to "trace_puts()" into an allocated trace_array instance. This is just another variant of trace_array_printk(). Link: https://lkml.kernel.org/r/20230207173026.584717290@goodmis.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Ross Zwisler <zwisler@google.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Stable-dep-of: 9d52727f80 ("tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-20 12:13:55 +02:00
Greg Kroah-Hartman	82dadab157	Merge 5.15.107 into android14-5.15 ... Changes in 5.15.107 ocfs2: ocfs2_mount_volume does cleanup job before return error ocfs2: rewrite error handling of ocfs2_fill_super ocfs2: fix memory leak in ocfs2_mount_volume() NFSD: Fix sparse warning NFSD: pass range end to vfs_fsync_range() instead of count RDMA/irdma: Do not request 2-level PBLEs for CQ alloc platform/x86: int3472: Split into 2 drivers platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode iavf: return errno code instead of status code iavf/iavf_main: actually log ->src mask when talking about it serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards serial: exar: Add support for Sealevel 7xxxC serial cards bpf: hash map, avoid deadlock with suitable hash mask gpio: GPIO_REGMAP: select REGMAP instead of depending on it Drivers: vmbus: Check for channel allocation before looking up relids pwm: cros-ec: Explicitly set .polarity in .get_state() pwm: sprd: Explicitly set .polarity in .get_state() KVM: s390: pv: fix external interruption loop not always detected wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta net: qrtr: combine nameservice into main module net: qrtr: Fix a refcount bug in qrtr_recvmsg() NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL icmp: guard against too small mtu net: don't let netpoll invoke NAPI if in xmit context net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit sctp: check send stream number after wait_for_sndbuf net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT ipv6: Fix an uninit variable access bug in __ip6_make_skb() platform/x86: think-lmi: Fix memory leak when showing current settings platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings platform/x86: think-lmi: Clean up display of current_value on Thinkstation gpio: davinci: Add irq chip flag to skip set wake net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe net: stmmac: fix up RX flow hash indirection table when setting channels sunrpc: only free unix grouplist after RCU settles NFSD: callback request does not use correct credential for AUTH_SYS ice: fix wrong fallback logic for FDIR ice: Reset FDIR counter in FDIR init stage ethtool: reset #lanes when lanes is omitted gve: Secure enough bytes in the first TX desc for all TCP pkts kbuild: refactor single builds of *.ko usb: xhci: tegra: fix sleep in atomic call xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu usb: cdnsp: Fixes error: uninitialized symbol 'len' usb: dwc3: pci: add support for the Intel Meteor Lake-S USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs usb: typec: altmodes/displayport: Fix configure initial pin assignment USB: serial: option: add Telit FE990 compositions USB: serial: option: add Quectel RM500U-CN modem iio: adis16480: select CONFIG_CRC32 iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip iio: dac: cio-dac: Fix max DAC write value check for 12-bit iio: light: cm32181: Unregister second I2C client if present tty: serial: sh-sci: Fix transmit end interrupt handler tty: serial: sh-sci: Fix Rx on RZ/G2L SCI tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() nilfs2: fix sysfs interface lifetime dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN ALSA: hda/realtek: Add quirk for Clevo X370SNW coresight: etm4x: Do not access TRCIDR1 for identification coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug iio: adc: ad7791: fix IRQ flags scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() smb3: allow deferred close timeout to be configurable smb3: lower default deferred close timeout to address perf regression cifs: sanitize paths in cifs_update_super_prepath. perf/core: Fix the same task check in perf_event_set_output ftrace: Mark get_lock_parent_ip() __always_inline ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() fs: drop peer group ids under namespace lock can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events tracing: Free error logs of tracing instances ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() mm: vmalloc: avoid warn_alloc noise caused by fatal signal drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path drm/nouveau/disp: Support more modes by checking with lower bpc ring-buffer: Fix race while reader and writer are on the same page mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() drm/bridge: lt9611: Fix PLL being unable to lock mm: take a page reference when removing device exclusive entries kbuild: fix single directory build ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown bpftool: Print newline before '}' for struct with padding only fields Linux 5.15.107 Change-Id: I88efacf4aaf63d4b21429eef2350c78da7e2528e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-17 11:31:12 +00:00
Zheng Yejian	cbe5f7fed7	ring-buffer: Fix race while reader and writer are on the same page ... commit 6455b6163d upstream. When user reads file 'trace_pipe', kernel keeps printing following logs that warn at "cpu_buffer->reader_page->read > rb_page_size(reader)" in rb_get_reader_page(). It just looks like there's an infinite loop in tracing_read_pipe(). This problem occurs several times on arm64 platform when testing v5.10 and below. Call trace: rb_get_reader_page+0x248/0x1300 rb_buffer_peek+0x34/0x160 ring_buffer_peek+0xbc/0x224 peek_next_entry+0x98/0xbc __find_next_entry+0xc4/0x1c0 trace_find_next_entry_inc+0x30/0x94 tracing_read_pipe+0x198/0x304 vfs_read+0xb4/0x1e0 ksys_read+0x74/0x100 __arm64_sys_read+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Then I dump the vmcore and look into the problematic per_cpu ring_buffer, I found that tail_page/commit_page/reader_page are on the same page while reader_page->read is obviously abnormal: tail_page == commit_page == reader_page == { .write = 0x100d20, .read = 0x8f9f4805, // Far greater than 0xd20, obviously abnormal!!! .entries = 0x10004c, .real_end = 0x0, .page = { .time_stamp = 0x857257416af0, .commit = 0xd20, // This page hasn't been full filled. // .data[0...0xd20] seems normal. } } The root cause is most likely the race that reader and writer are on the same page while reader saw an event that not fully committed by writer. To fix this, add memory barriers to make sure the reader can see the content of what is committed. Since commit a0fcaaed0c ("ring-buffer: Fix race between reset page and reading page") has added the read barrier in rb_get_reader_page(), here we just need to add the write barrier. Link: https://lore.kernel.org/linux-trace-kernel/20230325021247.2923907-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: 77ae365eca ("ring-buffer: make lockless") Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:48:26 +02:00
Steven Rostedt (Google)	33d5d4e67a	tracing: Free error logs of tracing instances ... commit 3357c6e429 upstream. When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger # cat instances/foo/error_log [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=x ^ # rmdir instances/foo Then check for memory leaks: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff88810d8ec700 (size 192): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... backtrace: [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 [<00000000b2938940>] tracing_log_err+0x277/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff888170c35a00 (size 32): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... backtrace: [<000000006a747de5>] __kmalloc+0x4d/0x160 [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc The problem is that the error log needs to be freed when the instance is removed. Link: https://lore.kernel.org/lkml/76134d9f-a5ba-6a0d-37b3-28310b4a1e91@alu.unizg.hr/ Link: https://lore.kernel.org/linux-trace-kernel/20230404194504.5790b95f@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Thorsten Leemhuis <regressions@leemhuis.info> Cc: Ulf Hansson <ulf.hansson@linaro.org> Cc: Eric Biggers <ebiggers@kernel.org> Fixes: 2f754e771b ("tracing: Have the error logs show up in the proper instances") Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:48:25 +02:00
Zheng Yejian	33a503b7c3	ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() ... commit 2a2d8c51de upstream. Syzkaller report a WARNING: "WARN_ON(!direct)" in modify_ftrace_direct(). Root cause is 'direct->addr' was changed from 'old_addr' to 'new_addr' but not restored if error happened on calling ftrace_modify_direct_caller(). Then it can no longer find 'direct' by that 'old_addr'. To fix it, restore 'direct->addr' to 'old_addr' explicitly in error path. Link: https://lore.kernel.org/linux-trace-kernel/20230330025223.1046087-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Cc: <mhiramat@kernel.org> Cc: <mark.rutland@arm.com> Cc: <ast@kernel.org> Cc: <daniel@iogearbox.net> Fixes: 8a141dd7f7 ("ftrace: Fix modify_ftrace_direct.") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-13 16:48:24 +02:00
Greg Kroah-Hartman	83e0304b4e	Merge 5.15.106 into android14-5.15 ... Changes in 5.15.106 fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY usb: dwc3: gadget: move cmd_endtransfer to extra function usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC kernel: kcsan: kcsan_test: build without structleak plugin kcsan: avoid passing -g for test ksmbd: don't terminate inactive sessions after a few seconds bus: imx-weim: fix branch condition evaluates to a garbage value xfrm: Zero padding when dumping algos and encap ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds md: avoid signed overflow in slot_store() x86/PVH: obtain VGA console info in Dom0 net: hsr: Don't log netdev_err message on unknown prp dst node ALSA: asihpi: check pao in control_message() ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() fbdev: tgafb: Fix potential divide by zero sched_getaffinity: don't assume 'cpumask_size()' is fully initialized fbdev: nvidia: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: au1200fb: Fix potential divide by zero tools/power turbostat: Fix /dev/cpu_dma_latency warnings tools/power turbostat: fix decoding of HWP_STATUS tracing: Fix wrong return in kprobe_event_gen_test.c ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() mips: bmips: BCM6358: disable RAC flush for TP1 ALSA: usb-audio: Fix recursive locking at XRUN during syncing platform/x86: think-lmi: add missing type attribute platform/x86: think-lmi: use correct possible_values delimiters platform/x86: think-lmi: only display possible_values if available platform/x86: think-lmi: Add possible_values for ThinkStation mtd: rawnand: meson: invalidate cache on polling ECC bit SUNRPC: fix shutdown of NFS TCP client socket sfc: ef10: don't overwrite offload features at NIC reset scsi: megaraid_sas: Fix crash after a double completion scsi: mpt3sas: Don't print sense pool info twice ptp_qoriq: fix memory leak in probe() net: dsa: microchip: ksz8863_smi: fix bulk access r8169: fix RTL8168H and RTL8107E rx crc error regulator: Handle deferred clk net/net_failover: fix txq exceeding warning net: stmmac: don't reject VLANs when IFF_PROMISC is set drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write s390/vfio-ap: fix memory leak in vfio_ap device driver loop: suppress uevents while reconfiguring the device loop: LOOP_CONFIGURE: send uevents for partitions net: mvpp2: classifier flow fix fragmentation flags net: mvpp2: parser fix QinQ net: mvpp2: parser fix PPPoE smsc911x: avoid PHY being resumed when interface is not up ice: add profile conflict check for AVF FDIR ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() ALSA: ymfpci: Create card with device-managed snd_devm_card_new() ALSA: ymfpci: Fix BUG_ON in probe function net: ipa: compute DMA pool size properly i40e: fix registers dump after run ethtool adapter self test bnxt_en: Fix reporting of test result in ethtool selftest bnxt_en: Fix typo in PCI id to device description string mapping bnxt_en: Add missing 200G link speed reporting net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only net: ethernet: mtk_eth_soc: fix flow block refcounting logic pinctrl: ocelot: Fix alt mode for ocelot iommu/vt-d: Allow zero SAGAW if second-stage not supported Input: alps - fix compatibility with -funsigned-char Input: focaltech - use explicitly signed char type cifs: prevent infinite recursion in CIFSGetDFSRefer() cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table btrfs: fix race between quota disable and quota assign ioctls btrfs: scan device in non-exclusive mode zonefs: Always invalidate last cached page on append write can: j1939: prevent deadlock by moving j1939_sk_errqueue() xen/netback: don't do grant copy across page boundary net: phy: dp83869: fix default value for tx-/rx-internal-delay pinctrl: amd: Disable and mask interrupts on resume pinctrl: at91-pio4: fix domain name assignment powerpc: Don't try to copy PPR for task with NULL pt_regs NFSv4: Fix hangs when recovering open state after a server reboot ALSA: hda/conexant: Partial revert of a quirk for Lenovo ALSA: usb-audio: Fix regression on detection of Roland VS-100 ALSA: hda/realtek: Add quirks for some Clevo laptops ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z xtensa: fix KASAN report for show_stack rcu: Fix rcu_torture_read ftrace event drm/etnaviv: fix reference leak when mmaping imported buffer drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub KVM: arm64: Disable interrupts while walking userspace PTs s390/uaccess: add missing earlyclobber annotations to __clear_user() KVM: VMX: Move preemption timer <=> hrtimer dance to common x86 KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32 KVM: x86: Purge "highest ISR" cache when updating APICv state zonefs: Fix error message in zonefs_file_dio_append() selftests/bpf: Test btf dump for struct with padding only fields libbpf: Fix BTF-to-C converter's padding logic selftests/bpf: Add few corner cases to test padding handling of btf_dump libbpf: Fix btf_dump's packed struct determination hsr: ratelimit only when errors are printed x86/PVH: avoid 32-bit build warning when obtaining VGA console info Linux 5.15.106 Change-Id: I3197b16c9f82b9bd6a17d4637a00b15e9bd5b873 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-05 14:15:04 +00:00
Anton Gusev	5362344e1c	tracing: Fix wrong return in kprobe_event_gen_test.c ... [ Upstream commit bc4f359b3b ] Overwriting the error code with the deletion result may cause the function to return 0 despite encountering an error. Commit b111545d26 ("tracing: Remove the useless value assignment in test_create_synth_event()") solves a similar issue by returning the original error code, so this patch does the same. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru Signed-off-by: Anton Gusev <aagusev@ispras.ru> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-05 11:24:54 +02:00
Greg Kroah-Hartman	aa7f85d696	Merge 5.15.105 into android14-5.15 ... Changes in 5.15.105 interconnect: qcom: osm-l3: fix icc_onecell_data allocation perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output perf: fix perf_event_context->time tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr serial: fsl_lpuart: Fix comment typo tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API tty: serial: fsl_lpuart: fix race on RX DMA shutdown serial: 8250: SERIAL_8250_ASPEED_VUART should depend on ARCH_ASPEED serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it kthread: add the helper function kthread_run_on_cpu() trace/hwlat: make use of the helper function kthread_run_on_cpu() trace/hwlat: Do not start per-cpu thread if it is already running net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes xsk: Add missing overflow check in xdp_umem_reg iavf: fix inverted Rx hash condition leading to disabled hash iavf: fix non-tunneled IPv6 UDP packet type and hashing intel/igbvf: free irq on the error path in igbvf_request_msix() igbvf: Regard vf reset nack as success igc: fix the validation logic for taprio's gate list i2c: imx-lpi2c: check only for enabled interrupt flags i2c: hisi: Only use the completion interrupt to finish the transfer scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() net: dsa: b53: mmap: fix device tree support net: usb: smsc95xx: Limit packet length to skb->len qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info xirc2ps_cs: Fix use after free bug in xirc2ps_detach net: phy: Ensure state transitions are processed from phy_stop() net: mdio: fix owner field for mdio buses registered using device-tree net: mdio: fix owner field for mdio buses registered using ACPI drm/i915/gt: perform uc late init after probe error injection net: qcom/emac: Fix use after free bug in emac_remove due to race condition net/ps3_gelic_net: Fix RX sk_buff length net/ps3_gelic_net: Use dma_mapping_error octeontx2-vf: Add missing free for alloc_percpu bootconfig: Fix testcase to increase max node keys: Do not cache key in task struct if key is requested from kernel thread iavf: fix hang on reboot with ice i40e: fix flow director packet filter programming bpf: Adjust insufficient default bpf_jit_limit net/mlx5e: Set uplink rep as NETNS_LOCAL net/mlx5: Fix steering rules cleanup net/mlx5: Read the TC mapping of all priorities on ETS query net/mlx5: E-Switch, Fix an Oops in error handling code net: dsa: tag_brcm: legacy: fix daisy-chained switches atm: idt77252: fix kmemleak when rmmod idt77252 erspan: do not use skb_mac_header() in ndo_start_xmit() net/sonic: use dma_mapping_error() for error check nvme-tcp: fix nvme_tcp_term_pdu to match spec hvc/xen: prevent concurrent accesses to the shared ring ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES ksmbd: fix possible refcount leak in smb2_open() gve: Cache link_speed value from device net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case net: mdio: thunder: Add missing fwnode_handle_put() Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl thread_info: Add helpers to snapshot thread flags entry: Snapshot thread flags entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up hwmon: fix potential sensor registration fail if of_node is missing hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs scsi: qla2xxx: Synchronize the IOCB count to be in order scsi: qla2xxx: Perform lockless command completion in abort path uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Disable interrupt auto clear for rings thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Use const qualifier for `ring_interrupt_index` thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable riscv: Bump COMMAND_LINE_SIZE value to 1024 drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded ca8210: fix mac_len negative array access HID: intel-ish-hid: ipc: Fix potential use-after-free in work function m68k: Only force 030 bus error if PC not in exception table selftests/bpf: check that modifier resolves after pointer scsi: target: iscsi: Fix an error message in iscsi_check_key() scsi: hisi_sas: Check devm_add_action() return value scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() scsi: lpfc: Avoid usage of list iterator variable after loop scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 net: usb: qmi_wwan: add Telit 0x1080 composition sh: sanitize the flags on sigreturn net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress cifs: empty interface list when server doesn't support query interfaces cifs: print session id while listing open files scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR usb: dwc2: fix a devres leak in hw_enable upon suspend resume usb: gadget: u_audio: don't let userspace block driver unbind efi: sysfb_efi: Fix DMI quirks not working for simpledrm mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP fscrypt: destroy keyring after security_sb_delete() fsverity: Remove WQ_UNBOUND from fsverity read workqueue lockd: set file_lock start and end when decoding nlm4 testargs arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name igb: revert rtnl_lock() that causes deadlock dm thin: fix deadlock when swapping to thin device usb: typec: tcpm: fix warning when handle discover_identity message usb: cdns3: Fix issue with using incorrect PCI device function usb: cdnsp: Fixes issue with redundant Status Stage usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: chipidea: core: fix possible concurrent when switch role usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() kfence: avoid passing -g for test KVM: x86: hyper-v: Avoid calling kvm_make_vcpus_request_mask() with vcpu_mask==NULL ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount wifi: mac80211: fix qos on mesh interfaces nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found drm/meson: fix missing component unbind on bind errors drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi drm/i915/active: Fix missing debug object activation drm/i915: Preserve crtc_state->inherited during state clearing riscv: mm: Fix incorrect ASID argument when flushing TLB riscv: Handle zicsr/zifencei issues between clang and binutils tee: amdtee: fix race condition in amdtee_open_session firmware: arm_scmi: Fix device node validation for mailbox transport i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() dm stats: check for and propagate alloc_percpu failure dm crypt: add cond_resched() to dmcrypt_write() dm crypt: avoid accessing uninitialized tasklet sched/fair: sanitize vruntime of entity being placed sched/fair: Sanitize vruntime of entity being migrated mm: kfence: fix using kfence_metadata without initialization in show_object() ocfs2: fix data corruption after failed write NFSD: fix use-after-free in __nfs42_ssc_open() Linux 5.15.105 Change-Id: I79851567ddb8856f76486b164b96a2456f08df29 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-04 15:14:14 +00:00
Tero Kristo	2ebe231aba	trace/hwlat: Do not start per-cpu thread if it is already running ... [ Upstream commit 08697bca9b ] The hwlatd tracer will end up starting multiple per-cpu threads with the following script: #!/bin/sh cd /sys/kernel/debug/tracing echo 0 > tracing_on echo hwlat > current_tracer echo per-cpu > hwlat_detector/mode echo 100000 > hwlat_detector/width echo 200000 > hwlat_detector/window echo 1 > tracing_on To fix the issue, check if the hwlatd thread for the cpu is already running, before starting a new one. Along with the previous patch, this avoids running multiple instances of the same CPU thread on the system. Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/ Link: https://lkml.kernel.org/r/20230310100451.3948583-3-tero.kristo@linux.intel.com Cc: stable@vger.kernel.org Fixes: f46b16520a ("trace/hwlat: Implement the per-cpu mode") Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com> Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:47:43 +02:00
Cai Huoqing	7743dd873f	trace/hwlat: make use of the helper function kthread_run_on_cpu() ... [ Upstream commit ff78f6679d ] Replace kthread_create_on_cpu/wake_up_process() with kthread_run_on_cpu() to simplify the code. Link: https://lkml.kernel.org/r/20211022025711.3673-7-caihuoqing@baidu.com Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Cc: Bernard Metzler <bmt@zurich.ibm.com> Cc: Daniel Bristot de Oliveira <bristot@kernel.org> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Doug Ledford <dledford@redhat.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Joel Fernandes (Google) <joel@joelfernandes.org> Cc: Josh Triplett <josh@joshtriplett.org> Cc: Lai Jiangshan <jiangshanlai@gmail.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: "Paul E . McKenney" <paulmck@kernel.org> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Stable-dep-of: 08697bca9b ("trace/hwlat: Do not start per-cpu thread if it is already running") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:47:42 +02:00
Costa Shulyupin	bde1ae2407	tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr ... [ Upstream commit 71c7a30442 ] There is a problem with the behavior of hwlat in a container, resulting in incorrect output. A warning message is generated: "cpumask changed while in round-robin mode, switching to mode none", and the tracing_cpumask is ignored. This issue arises because the kernel thread, hwlatd, is not a part of the container, and the function sched_setaffinity is unable to locate it using its PID. Additionally, the task_struct of hwlatd is already known. Ultimately, the function set_cpus_allowed_ptr achieves the same outcome as sched_setaffinity, but employs task_struct instead of PID. Test case: # cd /sys/kernel/tracing # echo 0 > tracing_on # echo round-robin > hwlat_detector/mode # echo hwlat > current_tracer # unshare --fork --pid bash -c 'echo 1 > tracing_on' # dmesg -c Actual behavior: [573502.809060] hwlat_detector: cpumask changed while in round-robin mode, switching to mode none Link: https://lore.kernel.org/linux-trace-kernel/20230316144535.1004952-1-costa.shul@redhat.com Cc: Masami Hiramatsu <mhiramat@kernel.org> Fixes: 0330f7aa8e ("tracing: Have hwlat trace migrate across tracing_cpumask CPUs") Signed-off-by: Costa Shulyupin <costa.shul@redhat.com> Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:47:41 +02:00
Greg Kroah-Hartman	bc17a51fee	Merge 5.15.104 into android14-5.15 ... Changes in 5.15.104 xfrm: Allow transport-mode states with AF_UNSPEC selector drm/panfrost: Don't sync rpm suspension after mmu flushing cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_nat: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Fix a procfs host directory removal regression tcp: tcp_make_synack() can be called from process context nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode vdpa_sim: not reset state in vdpasim_queue_ready vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready PCI: s390: Fix use-after-free of PCI resources with per-function hotplug drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area drm/i915/display/psr: Handle plane and pipe restrictions at every page flip drm/i915/display: clean up comments drm/i915/psr: Use calculated io and fast wake lines net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() qed/qed_dev: guard against a possible division by zero net: dsa: mt7530: remove now incorrect comment regarding port 5 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used loop: Fix use-after-free issues net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition net/smc: fix deadlock triggered by cancel_delayed_work_syn() net: usb: smsc75xx: Limit packet length to skb->len drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc block: null_blk: Fix handling of fake timeout request nvme: fix handling single range discard request nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL ice: xsk: disable txq irq before flushing hw net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 ravb: avoid PHY being resumed when interface is not up sh_eth: avoid PHY being resumed when interface is not up ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net/iucv: Fix size of interrupt data selftests: net: devlink_port_split.py: skip test if no suitable device available qed/qed_mng_tlv: correctly zero out ->min instead of ->hour ethernet: sun: add check for the mdesc_grab() bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: tmp512: drop of_match_ptr for ID table kconfig: Update config changed flag before calling callback hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command jffs2: correct logic when creating a hole in jffs2_write_begin ext4: fail ext4_iget if special inode unallocated ext4: update s_journal_inum if it changes after journal replay ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access net/9p: fix bug in client create for .L sh: intc: Avoid spurious sizeof-pointer-div warning drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes ext4: fix possible double unlock when moving a directory tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted serial: 8250_em: Fix UART port type serial: 8250_fsl: fix handle_irq locking firmware: xilinx: don't make a sleepable memory allocation from an atomic context s390/ipl: add missing intersection check to ipl_report handling interconnect: fix mem leak when freeing nodes interconnect: exynos: fix node leak in probe PM QoS error path tracing: Make splice_read available again tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something cifs: Fix smb2_set_path_size() KVM: nVMX: add missing consistency checks for CR0 and CR4 ALSA: hda: intel-dsp-config: add MTL PCI id ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro Revert "riscv: mm: notify remote harts about mmu cache updates" riscv: asid: Fixup stale TLB entry cause application crash drm/shmem-helper: Remove another errant put in error path drm/sun4i: fix missing component unbind on bind errors drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume mptcp: fix possible deadlock in subflow_error_report mptcp: add ro_after_init for tcp{,v6}_prot_override mptcp: avoid setting TCP_CLOSE state twice mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() ftrace: Fix invalid address access in lookup_rec() when index is 0 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 ice: avoid bonding causing auxiliary plug/unplug under RTNL lock mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mmc: sdhci_am654: lower power-on failed message severity fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks trace/hwlat: Do not wipe the contents of per-cpu thread data net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit cpuidle: psci: Iterate backwards over list in psci_pd_remove() x86/mce: Make sure logged MCEs are processed after sysfs update x86/mm: Fix use of uninitialized buffer in sme_enable() x86/resctrl: Clear staged_config[] before and after it is used drm/i915: Don't use stolen memory for ring buffers with LLC drm/i915/active: Fix misuse of non-idle barriers as fence trackers io_uring: avoid null-ptr-deref in io_arm_poll_handler PCI: Unify delay handling for reset and resume PCI/DPC: Await readiness of secondary bus after reset HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own perf: Fix check before add_event_to_groups() in perf_group_detach() Linux 5.15.104 Change-Id: Ibe292ef3acc57f5ff1ab272fc99756aa49f68c62 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-23 17:34:39 +00:00
Tero Kristo	f3de497826	trace/hwlat: Do not wipe the contents of per-cpu thread data ... commit 4c42f5f0d1 upstream. Do not wipe the contents of the per-cpu kthread data when starting the tracer, as this will completely forget about already running instances and can later start new additional per-cpu threads. Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/ Link: https://lkml.kernel.org/r/20230310100451.3948583-2-tero.kristo@linux.intel.com Cc: stable@vger.kernel.org Fixes: f46b16520a ("trace/hwlat: Implement the per-cpu mode") Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com> Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:31:35 +01:00
Chen Zhongjin	2a0d71fabf	ftrace: Fix invalid address access in lookup_rec() when index is 0 ... commit ee92fa4433 upstream. KASAN reported follow problem: BUG: KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modprobe CPU: 2 Comm: modprobe Call trace: kasan_report __asan_load8 lookup_rec ftrace_location arch_check_ftrace_location check_kprobe_address_safe register_kprobe When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a pg which is newly added to ftrace_pages_start in ftrace_process_locs(). Before the first pg->index++, index is 0 and accessing pg->records[-1].ip will cause this problem. Don't check the ip when pg->index is 0. Link: https://lore.kernel.org/linux-trace-kernel/20230309080230.36064-1-chenzhongjin@huawei.com Cc: stable@vger.kernel.org Fixes: 9644302e33 ("ftrace: Speed up search by skipping pages by address") Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:31:35 +01:00
Steven Rostedt (Google)	2846bf67cd	tracing: Check field value in hist_field_name() ... commit 9f116f76fa upstream. The function hist_field_name() cannot handle being passed a NULL field parameter. It should never be NULL, but due to a previous bug, NULL was passed to the function and the kernel crashed due to a NULL dereference. Mark Rutland reported this to me on IRC. The bug was fixed, but to prevent future bugs from crashing the kernel, check the field and add a WARN_ON() if it is NULL. Link: https://lkml.kernel.org/r/20230302020810.762384440@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Reported-by: Mark Rutland <mark.rutland@arm.com> Fixes: c6afad49d1 ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers") Tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:31:33 +01:00
Sung-hun Kim	2dd00dbc6a	tracing: Make splice_read available again ... commit e400be674a upstream. Since the commit 36e2c7421f ("fs: don't allow splice read/write without explicit ops") is applied to the kernel, splice() and sendfile() calls on the trace file (/sys/kernel/debug/tracing /trace) return EINVAL. This patch restores these system calls by initializing splice_read in file_operations of the trace file. This patch only enables such functionalities for the read case. Link: https://lore.kernel.org/linux-trace-kernel/20230314013707.28814-1-sfoon.kim@samsung.com Cc: stable@vger.kernel.org Fixes: 36e2c7421f ("fs: don't allow splice read/write without explicit ops") Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:31:32 +01:00
Greg Kroah-Hartman	4403c58acc	Merge 5.15.100 into android14-5.15 ... Changes in 5.15.100 net/sched: Retire tcindex classifier auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() fs/jfs: fix shift exponent db_agl2size negative objtool: Fix memory leak in create_static_call_sections() pwm: sifive: Reduce time the controller lock is held pwm: sifive: Always let the first pwm_apply_state succeed pwm: stm32-lp: fix the check on arr and cmp registers update f2fs: use memcpy_{to,from}_page() where possible fs: f2fs: initialize fsdata in pagecache_write() f2fs: allow set compression option of files without blocks um: vector: Fix memory leak in vector_config ubi: ensure that VID header offset + VID header size <= alloc, size ubifs: Fix build errors as symbol undefined ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted ubifs: Rectify space budget for ubifs_xrename() ubifs: Fix wrong dirty space budget for dirty inode ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 ubifs: Reserve one leb for each journal head while doing budget ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() ubifs: Fix memory leak in alloc_wbufs() ubi: Fix possible null-ptr-deref in ubi_free_volume() ubifs: Re-statistic cleaned znode count if commit failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed f2fs: fix to avoid potential memory corruption in __update_iostat_latency() ext4: use ext4_fc_tl_mem in fast-commit replay path netfilter: nf_tables: allow to fetch set elements when table has an owner x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list um: virtio_uml: free command if adding to virtqueue failed um: virtio_uml: mark device as unregistered when breaking it um: virtio_uml: move device breaking into workqueue um: virt-pci: properly remove PCI device from bus watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path watchdog: Fix kmemleak in watchdog_cdev_register watchdog: pcwd_usb: Fix attempting to access uninitialized memory watchdog: sbsa_wdog: Make sure the timeout programming is within the limits netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() netfilter: ebtables: fix table blob use-after-free netfilter: x_tables: fix percpu counter block leak on error path when creating new netns ipv6: Add lwtunnel encap size of all siblings in nexthop calculation sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop octeontx2-pf: Use correct struct reference in test condition net: fix __dev_kfree_skb_any() vs drop monitor 9p/xen: fix version parsing 9p/xen: fix connection sequence 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() net/mlx5e: Verify flow_source cap before using it net/mlx5: Geneve, Fix handling of Geneve object id as error code nfc: fix memory leak of se_io context in nfc_genl_se_io net/sched: transition act_pedit to rcu and percpu stats net/sched: act_pedit: fix action bind logic net/sched: act_mpls: fix action bind logic net/sched: act_sample: fix action bind logic ARM: dts: spear320-hmi: correct STMPE GPIO compatible tcp: tcp_check_req() can be called from process context vc_screen: modify vcs_size() handling in vcs_read() rtc: sun6i: Always export the internal oscillator genirq: Refactor accessors to use irq_data_get_affinity_mask genirq: Add and use an irq_data_update_affinity helper scsi: ipr: Work around fortify-string warning rtc: allow rtc_read_alarm without read_alarm callback loop: loop_set_status_from_info() check before assignment ASoC: adau7118: don't disable regulators on device unbind ASoC: zl38060: Remove spurious gpiolib select ASoC: zl38060 add gpiolib dependency ASoC: mediatek: mt8195: add missing initialization thermal: intel: quark_dts: fix error pointer dereference thermal: intel: BXT_PMIC: select REGMAP instead of depending on it tracing: Add NULL checks for buffer in ring_buffer_free_read_page() kernel/printk/index.c: fix memory leak with using debugfs_lookup() firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak IB/hfi1: Update RMT size calculation iommu/amd: Fix error handling for pdev_pri_ats_enable() media: uvcvideo: Remove format descriptions media: uvcvideo: Handle cameras with invalid descriptors media: uvcvideo: Handle errors from calls to usb_string media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 media: uvcvideo: Silence memcpy() run-time false positive warnings USB: fix memory leak with using debugfs_lookup() staging: emxx_udc: Add checks for dma_alloc_coherent() tty: fix out-of-bounds access in tty_driver_lookup_tty() tty: serial: fsl_lpuart: disable the CTS when send break signal serial: sc16is7xx: setup GPIO controller later in probe mei: bus-fixup:upon error print return values of send and receive tools/iio/iio_utils:fix memory leak iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() PCI: loongson: Prevent LS7A MRRS increases USB: dwc3: fix memory leak with using debugfs_lookup() USB: chipidea: fix memory leak with using debugfs_lookup() USB: uhci: fix memory leak with using debugfs_lookup() USB: sl811: fix memory leak with using debugfs_lookup() USB: fotg210: fix memory leak with using debugfs_lookup() USB: isp116x: fix memory leak with using debugfs_lookup() USB: isp1362: fix memory leak with using debugfs_lookup() USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup() usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math USB: ene_usb6250: Allocate enough memory for full object usb: uvc: Enumerate valid values for color matching usb: gadget: uvc: Make bSourceID read/write PCI: Align extra resources for hotplug bridges properly PCI: Take other bus devices into account when distributing resources tty: pcn_uart: fix memory leak with using debugfs_lookup() misc: vmw_balloon: fix memory leak with using debugfs_lookup() drivers: base: component: fix memory leak with using debugfs_lookup() drivers: base: dd: fix memory leak with using debugfs_lookup() kernel/fail_function: fix memory leak with using debugfs_lookup() PCI: loongson: Add more devices that need MRRS quirk PCI: Add ACS quirk for Wangxun NICs phy: rockchip-typec: Fix unsigned comparison with less than zero soundwire: cadence: Remove wasted space in response_buf soundwire: cadence: Drain the RX FIFO after an IO timeout net: tls: avoid hanging tasks on the tx_lock x86/resctl: fix scheduler confusion with 'current' drm/display/dp_mst: Fix down/up message handling after sink disconnect drm/display/dp_mst: Fix down message handling after a packet reception error Bluetooth: hci_sock: purge socket queues in the destruct() callback media: uvcvideo: Fix race condition with usb_kill_urb drm/virtio: Fix error code in virtio_gpu_object_shmem_init() Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()" scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API malidp: Fix NULL vs IS_ERR() checking usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails Linux 5.15.100 Change-Id: If8949c57602ea5475c2f68a78d0d2e421d7969f2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-21 10:16:45 +00:00
Greg Kroah-Hartman	ea8aebc48c	Merge 5.15.99 into android14-5.15 ... Changes in 5.15.99 HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers powerpc/mm: Rearrange if-else block to avoid clang warning ARM: OMAP2+: Fix memory leak in realtime_counter_init() arm64: dts: qcom: qcs404: use symbol names for PCIe resets arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings arm64: dts: imx8m: Align SoC unique ID node unit address ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name arm64: dts: qcom: sc7180: correct SPMI bus address cells arm64: dts: qcom: sc7280: correct SPMI bus address cells arm64: dts: meson-gx: Fix Ethernet MAC address unit name arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address arm64: dts: msm8992-bullhead: add memory hole region arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges arm64: dts: qcom: ipq8074: fix Gen3 PCIe node arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names arm64: dts: meson: remove CPU opps below 1GHz for G12A boards ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() ARM: bcm2835_defconfig: Enable the framebuffer ARM: s3c: fix s3c64xx_set_timer_source prototype arm64: dts: ti: k3-j7200: Fix wakeup pinmux range ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip locking/rwsem: Optimize down_read_trylock() under highly contended case locking/rwsem: Disable preemption in all down_read*() and up_read() code paths arm64: dts: renesas: beacon-renesom: Fix gpio expander reference arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference ARM: dts: imx7s: correct iomuxc gpr mux controller cells arm64: dts: mt8192: Fix CPU map for single-cluster SoC arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node blk-mq: avoid sleep in blk_mq_alloc_request_hctx blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx blk-mq: correct stale comment of .get_budget arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions s390/dasd: Fix potential memleak in dasd_eckd_init() sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() sched/rt: pick_next_rt_entity(): check list_entry x86/perf/zhaoxin: Add stepping check for ZXC KEYS: asymmetric: Fix ECDSA use via keyctl uapi arm64: dts: qcom: pmk8350: Specify PBS register for PON arm64: dts: qcom: pmk8350: Use the correct PON compatible block: bio-integrity: Copy flags when bio_integrity_payload is cloned wifi: rsi: Fix memory leak in rsi_coex_attach() wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() libbpf: Fix btf__align_of() by taking into account field offsets wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: ipw2200: fix memory leak in ipw_wdev_init() wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() crypto: x86/ghash - fix unaligned access in ghash_setkey() ACPICA: Drop port I/O validation for some regions genirq: Fix the return type of kstat_cpu_irqs_sum() rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() lib/mpi: Fix buffer overrun when SG is too long crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 ACPICA: nsrepair: handle cases without a return value correctly thermal/drivers/tsens: Drop msm8976-specific defines thermal/drivers/tsens: Add compat string for the qcom,msm8960 thermal/drivers/tsens: Sort out msm8976 vs msm8956 data thermal/drivers/tsens: fix slope values for msm8939 thermal/drivers/tsens: limit num_sensors to 9 for msm8939 wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU wifi: orinoco: check return value of hermes_write_wordrec() wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function ath9k: hif_usb: simplify if-if to if-else ath9k: htc: clean up statistics macros wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() ACPI: battery: Fix missing NUL-termination with large strings crypto: ccp - Failure on re-initialization due to duplicate sysfs filename crypto: essiv - Handle EBUSY correctly crypto: seqiv - Handle EBUSY correctly powercap: fix possible name leak in powercap_register_zone() x86: Mark stop_this_cpu() __noreturn x86/microcode: Rip out the OLD_INTERFACE x86/microcode: Default-disable late loading x86/microcode: Print previous version of microcode after reload x86/microcode: Add a parameter to microcode_check() to store CPU capabilities x86/microcode: Check CPU capabilities after late microcode update correctly x86/microcode: Adjust late loading result reporting message crypto: xts - Handle EBUSY correctly leds: led-class: Add missing put_device() to led_put() crypto: ccp - Refactor out sev_fw_alloc() crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware bpftool: profile online CPUs instead of possible mt76: mt7915: fix polling firmware-own status net/mlx5: Enhance debug print in page allocation failure irqchip: Fix refcount leak in platform_irqchip_probe irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe s390/mem_detect: fix detect_memory() error handling s390/vmem: fix empty page tables cleanup under KASAN net: add sock_init_data_uid() tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid OPP: fix error checking in opp_migrate_dentry() Bluetooth: L2CAP: Fix potential user-after-free Bluetooth: hci_qca: get wakeup status from serdev device handle s390/ap: fix status returned by ap_aqic() s390/ap: fix status returned by ap_qact() libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() rds: rds_rm_zerocopy_callback() correct order for list_add_tail() crypto: rsa-pkcs1pad - Use akcipher_request_complete m68k: /proc/hardware should depend on PROC_FS RISC-V: time: initialize hrtimer based broadcast clock event device wifi: iwl3945: Add missing check for create_singlethread_workqueue wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() selftests/bpf: Fix out-of-srctree build ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models ACPI: resource: Do IRQ override on all TongFang GMxRGxx crypto: crypto4xx - Call dma_unmap_page when done wifi: mac80211: make rate u32 in sta_set_rate_info_rx() thermal/drivers/hisi: Drop second sensor hi3660 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error bpf: Fix global subprog context argument resolution logic irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts selftests/net: Interpret UDP_GRO cmsg data as an int value l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() net: bcmgenet: fix MoCA LED control selftest: fib_tests: Always cleanup before exit sefltests: netdevsim: wait for devlink instance after netns removal drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/bridge: megachips: Fix error handling in i2c_register_driver() drm/vkms: Fix memory leak in vkms_init() drm/vkms: Fix null-ptr-deref in vkms_release() drm/vc4: dpi: Add option for inverting pixel clock and output enable drm/vc4: dpi: Fix format mapping for RGB565 drm: tidss: Fix pixel format definition gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() hwmon: (ftsteutates) Fix scaling of measurements drm/msm/hdmi: Add missing check for alloc_ordered_workqueue pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups drm/vc4: hvs: Set AXI panic modes drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 drm/vc4: hdmi: Correct interlaced timings again drm/msm: clean event_thread->worker in case of an error scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription scsi: qla2xxx: Fix exchange oversubscription scsi: qla2xxx: Fix exchange oversubscription for management commands ASoC: fsl_sai: Update to modern clocking terminology ASoC: fsl_sai: initialize is_dsp_mode flag drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() ALSA: hda/ca0132: minor fix for allocation size drm/msm/gem: Add check for kmalloc drm/msm/dpu: Disallow unallocated resources to be returned drm/bridge: lt9611: fix sleep mode setup drm/bridge: lt9611: fix HPD reenablement drm/bridge: lt9611: fix polarity programming drm/bridge: lt9611: fix programming of video modes drm/bridge: lt9611: fix clock calculation drm/bridge: lt9611: pass a pointer to the of node drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags drm/msm/dsi: Allow 2 CTRLs on v2.5.0 drm/msm: use strscpy instead of strncpy drm/msm/dpu: Add check for cstate drm/msm/dpu: Add check for pstates drm/msm/mdp5: Add check for kzalloc pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() pinctrl: mediatek: fix coding style pinctrl: mediatek: Initialize variable pullen and pullup to zero pinctrl: mediatek: Initialize variable *buf to zero gpu: host1x: Don't skip assigning syncpoints to channels drm/tegra: firewall: Check for is_addr_reg existence in IMM check drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: Drop unbalanced obj unref drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc drm/mediatek: Clean dangling pointer on bind error path ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() gpio: vf610: connect GPIO label to dev name spi: dw_bt1: fix MUX_MMIO dependencies ASoC: mchp-spdifrx: fix controls which rely on rsr register ASoC: mchp-spdifrx: fix return value in case completion times out ASoC: mchp-spdifrx: fix controls that works with completion mechanism ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() ASoC: rsnd: fixup #endif position ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() ASoC: dt-bindings: meson: fix gx-card codec node regex hwmon: (ltc2945) Handle error case in ltc2945_value_store drm/amdgpu: fix enum odm_combine_mode mismatch scsi: mpt3sas: Fix a memory leak scsi: aic94xx: Add missing check for dma_map_single() HID: multitouch: Add quirks for flipped axes HID: retain initial quirks set up when creating HID devices ASoC: codecs: Change bulk clock voting to optional voting in digital codecs ASoC: codecs: rx-macro: move clk provider to managed variants ASoC: codecs: tx-macro: move clk provider to managed variants ASoC: codecs: rx-macro: move to individual clks from bulk ASoC: codecs: tx-macro: move to individual clks from bulk ASoC: codecs: lpass: fix incorrect mclk rate spi: bcm63xx-hsspi: Fix multi-bit mode setting hwmon: (mlxreg-fan) Return zero speed for broken fan ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init dm: remove flush_scheduled_work() during local_exit() NFSv4: keep state manager thread active if swap is enabled nfs4trace: fix state manager flag printing NFS: fix disabling of swap spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared HID: bigben: use spinlock to protect concurrent accesses HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to safely schedule workers hid: bigben_probe(): validate report count drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() nfsd: fix race to check ls_layouts cifs: Fix lost destroy smbd connection when MR allocate failed cifs: Fix warning and UAF when destroy the MR list gfs2: jdata writepage fix perf llvm: Fix inadvertent file creation leds: led-core: Fix refcount leak in of_led_get() perf inject: Use perf_data__read() for auxtrace perf intel-pt: Add documentation for Event Trace and TNT disable perf intel-pt: Add link to the perf wiki's Intel PT page perf intel-pt: Add support for emulated ptwrite perf intel-pt: Do not try to queue auxtrace data on pipe perf tools: Fix auto-complete on aarch64 sparc: allow PM configs for sparc32 COMPILE_TEST selftests/ftrace: Fix bash specific "==" operator printf: fix errname.c list objtool: add UACCESS exceptions for __tsan_volatile_read/write mfd: cs5535: Don't build on UML mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 dmaengine: HISI_DMA should depend on ARCH_HISI iio: light: tsl2563: Do not hardcode interrupt trigger type usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() i2c: designware: fix i2c_dw_clk_rate() return size to be u32 soundwire: cadence: Don't overflow the command FIFOs driver core: fix potential null-ptr-deref in device_add() kobject: modify kobject_get_path() to take a const * kobject: Fix slab-out-of-bounds in fill_kobj_path() alpha/boot/tools/objstrip: fix the check for ELF header media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL media: uvcvideo: Remove s_ctrl and g_ctrl media: uvcvideo: refactor __uvc_ctrl_add_mapping media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS media: uvcvideo: Use control names from framework media: uvcvideo: Check controls flags before accessing them media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR coresight: cti: Prevent negative values of enable count coresight: cti: Add PM runtime call in enable_store ACPI: resource: Add helper function acpi_dev_get_memory_resources() usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources() usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count PCI/IOV: Enlarge virtfn sysfs name buffer PCI: switchtec: Return -EFAULT for copy_to_user() errors tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" eeprom: idt_89hpesx: Fix error handling in idt_init() applicom: Fix PCI device refcount leak in applicom_init() firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF misc/mei/hdcp: Use correct macros to initialize uuid_le driver core: fix resource leak in device_add() drivers: base: transport_class: fix possible memory leak drivers: base: transport_class: fix resource leak when transport_add_device() fails firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle fotg210-udc: Add missing completion handler dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers usb: early: xhci-dbc: Fix a potential out-of-bound memory access tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case RDMA/cxgb4: add null-ptr-check after ip_dev_find() usb: musb: mediatek: don't unregister something that wasn't registered usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link() usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func usb: gadget: configfs: remove using list iterator after loop body as a ptr usb: gadget: configfs: Restrict symlink creation is UDC already binded iommu/vt-d: Set No Execute Enable bit in PASID table entry power: supply: remove faulty cooling logic RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() usb: max-3421: Fix setting of I/O pins RDMA/irdma: Cap MSIX used to online CPUs + 1 serial: fsl_lpuart: fix RS485 RTS polariy inverse issue tty: serial: imx: Handle RS485 DE signal active high tty: serial: imx: disable Ageing Timer interrupt request irq dmaengine: dw-edma: Fix readq_ch() return value truncation phy: rockchip-typec: fix tcphy_get_mode error case iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() iommu: Fix error unwind in iommu_group_alloc() dmaengine: sf-pdma: pdma_desc memory leak fix dmaengine: dw-axi-dmac: Do not dereference NULL structure iommu/vt-d: Fix error handling in sva enable/disable paths iommu/vt-d: Remove duplicate identity domain flag iommu/vt-d: Check FL and SL capability sanity in scalable mode iommu/vt-d: Use second level for GPA->HPA translation iommu/vt-d: Allow to use flush-queue when first level is default IB/hfi1: Fix math bugs in hfi1_can_pin_pages() IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers media: ti: cal: fix possible memory leak in cal_ctx_create() media: platform: ti: Add missing check for devm_regulator_get powerpc: Remove linker flag from KBUILD_AFLAGS s390/vdso: remove -nostdlib compiler flag s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 builddeb: clean generated package content media: max9286: Fix memleak in max9286_v4l2_register() media: ov2740: Fix memleak in ov2740_init_controls() media: ov5675: Fix memleak in ov5675_init_controls() media: i2c: ov772x: Fix memleak in ov772x_probe() media: i2c: imx219: Split common registers from mode tables media: i2c: imx219: Fix binning for RAW8 capture media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data media: v4l2-jpeg: ignore the unknown APP14 marker media: imx-jpeg: Apply clk_bulk api instead of operating specific clk media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: i2c: ov7670: 0 instead of -EINVAL was returned media: usb: siano: Fix use after free bugs caused by do_submit_urb media: saa7134: Use video_unregister_device for radio_dev rpmsg: glink: Avoid infinite loop on intent for missing channel udf: Define EFSCORRUPTED error code ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy blk-iocost: fix divide by 0 error in calc_lcoefs() trace/blktrace: fix memory leak with using debugfs_lookup() wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug wifi: ath11k: debugfs: fix to work with multiple PCI devices thermal: intel: Fix unsigned comparison with less than zero timers: Prevent union confusion from unexpected restart_syscall() x86/bugs: Reset speculation control settings on init wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds wifi: mt7601u: fix an integer underflow inet: fix fast path in __inet_hash_connect() ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB ice: add missing checks for PF vsi type ACPI: Don't build ACPICA with '-Os' thermal: intel: intel_pch: Add support for Wellsburg PCH clocksource: Suspend the watchdog temporarily when high read latency detected crypto: hisilicon: Wipe entire pool on error net: bcmgenet: Add a check for oversized packets m68k: Check syscall_trace_enter() return code netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() tools/power/x86/intel-speed-select: Add Emerald Rapid quirk wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup ACPI: video: Fix Lenovo Ideapad Z570 DMI match net/mlx5: fw_tracer: Fix debug print coda: Avoid partial allocation of sig_inputArgs uaccess: Add minimum bounds check on kernel buffer size s390/idle: mark arch_cpu_idle() noinstr time/debug: Fix memory leak with using debugfs_lookup() PM: domains: fix memory leak with using debugfs_lookup() PM: EM: fix memory leak with using debugfs_lookup() Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE hv_netvsc: Check status in SEND_RNDIS_PKT completion message scm: add user copy checks to put_cmsg() drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write drm/amd/display: Fix potential null-deref in dm_resume drm/omap: dsi: Fix excessive stack usage HID: Add Mapping for System Microphone Mute drm/tiny: ili9486: Do not assume 8-bit only SPI controllers drm/radeon: free iio for atombios when driver shutdown scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Revert "fbcon: don't lose the console font across generic->chip driver switch" drm: amd: display: Fix memory leakage drm/msm/dsi: Add missing check for alloc_ordered_workqueue docs/scripts/gdb: add necessary make scripts_gdb step ASoC: soc-compress: Reposition and add pcm_mutex ASoC: kirkwood: Iterate over array indexes instead of using pointer math regulator: max77802: Bounds check regulator id against opmode regulator: s5m8767: Bounds check id indexing into arrays gfs2: Improve gfs2_make_fs_rw error handling hwmon: (coretemp) Simplify platform device handling pinctrl: at91: use devm_kasprintf() to avoid potential leaks scsi: snic: Fix memory leak with using debugfs_lookup() HID: logitech-hidpp: Don't restart communication if not necessary drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 dm thin: add cond_resched() to various workqueue loops dm cache: add cond_resched() to various workqueue loops nfsd: zero out pointers after putting nfsd_files on COPY setup error drm/shmem-helper: Revert accidental non-GPL export wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu firmware: coreboot: framebuffer: Ignore reserved pixel color bits block: don't allow multiple bios for IOCB_NOWAIT issue rtc: pm8xxx: fix set-alarm race ipmi:ssif: resend_msg() cannot fail ipmi_ssif: Rename idle state and check s390/extmem: return correct segment type in __segment_load() s390: discard .interp section s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/kprobes: fix current_kprobe never cleared after kprobes reenter cifs: Fix uninitialized memory read in smb3_qfs_tcon() btrfs: hold block group refcount during async discard locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath ksmbd: fix wrong data area length for smb2 lock request ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length ARM: dts: exynos: correct HDMI phy compatible in Exynos4 hfs: fix missing hfs_bnode_get() in __hfs_bnode_create fs: hfsplus: fix UAF issue in hfsplus_put_super exfat: fix reporting fs error when reading dir beyond EOF exfat: fix unexpected EOF while reading dir exfat: redefine DIR_DELETED as the bad cluster number exfat: fix inode->i_blocks for non-512 byte sector size device fs: dlm: don't set stop rx flag after node reset fs: dlm: move sending fin message into state change handling fs: dlm: send FIN ack back in right cases f2fs: fix information leak in f2fs_move_inline_dirents() f2fs: fix cgroup writeback accounting with fs-layer encryption ocfs2: fix defrag path triggering jbd2 ASSERT ocfs2: fix non-auto defrag path not working issue selftests/landlock: Skip overlayfs tests when not supported selftests/landlock: Test ptrace as much as possible with Yama udf: Truncate added extents on failed expansion udf: Do not bother merging very long extents udf: Do not update file length for failed writes to inline files udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy udf: Fix file corruption when appending just after end of preallocated extent RDMA/siw: Fix user page pinning accounting KVM: Destroy target device if coalesced MMIO unregistration fails KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() KVM: SVM: hyper-v: placate modpost section mismatch error KVM: s390: disable migration mode when dirty tracking is disabled x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/AMD: Fix mixed steppings support x86/speculation: Allow enabling STIBP with legacy IBRS Documentation/hw-vuln: Document the interaction between IBRS and STIBP brd: return 0/-error from brd_insert_page() ima: Align ima_file_mmap() parameters with mmap_file LSM hook irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Look for existing mapping only once irqdomain: Drop bogus fwspec-mapping error handling irqdomain: Fix domain registration race crypto: qat - fix out-of-bounds read io_uring: handle TIF_NOTIFY_RESUME when checking for task_work io_uring: mark task TASK_RUNNING before handling resume/task work io_uring: add a conditional reschedule to the IOPOLL cancelation loop io_uring/rsrc: disallow multi-source reg buffers io_uring: remove MSG_NOSIGNAL from recvmsg io_uring/poll: allow some retries for poll triggering spuriously ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC jbd2: fix data missing when reusing bh which is ready to be checkpointed ext4: optimize ea_inode block expansion ext4: refuse to create ea block when umounted mtd: spi-nor: sfdp: Fix index value for SCCR dwords mtd: spi-nor: spansion: Consider reserved bits in CFR5 register mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type dm: send just one event on resize, not two dm: add cond_resched() to dm_wq_work() wifi: rtl8xxxu: Use a longer retry limit of 48 wifi: ath11k: allow system suspend to survive ath11k wifi: cfg80211: Fix use after free for wext qede: fix interrupt coalescing configuration thermal: intel: powerclamp: Fix cur_state for multi package system dm flakey: fix logic when corrupting a bio dm flakey: don't corrupt the zero page dm flakey: fix a bug with 32-bit highmem systems ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: exynos: correct TMU phandle in Exynos4210 ARM: dts: exynos: correct TMU phandle in Exynos4 ARM: dts: exynos: correct TMU phandle in Odroid XU3 family ARM: dts: exynos: correct TMU phandle in Exynos5250 ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Odroid HC1 fuse: add inode/permission checks to fileattr_get/fileattr_set rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ceph: update the time stamps and try to drop the suid/sgid alpha: fix FEN fault handling dax/kmem: Fix leak of memory-hotplug resources mips: fix syscall_get_nr media: ipu3-cio2: Fix PM runtime usage_count in driver unbind remoteproc/mtk_scp: Move clk ops outside send_lock docs: gdbmacros: print newest record mm: memcontrol: deprecate charge moving mm/thp: check and bail out if page in deferred queue already ktest.pl: Give back console on Ctrt^C on monitor ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Add RUN_TIMEOUT option with default unlimited ring-buffer: Handle race between rb_move_tail and rb_check_pages tools/bootconfig: fix single & used for logical condition scsi: qla2xxx: Fix link failure in NPIV environment scsi: qla2xxx: Check if port is online before sending ELS scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Remove unintended flag clearing scsi: qla2xxx: Fix erroneous link down scsi: qla2xxx: Remove increment of interface err cnt scsi: ses: Don't attach if enclosure has no components scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() RISC-V: add a spin_shadow_stack declaration riscv: mm: fix regression due to update_mmu_cache change riscv: jump_label: Fixup unaligned arch_static_branch function riscv, mm: Perform BPF exhandler fixup on page fault riscv: ftrace: Remove wasted nops for !RISCV_ISA_C riscv: ftrace: Reduce the detour code size to half MIPS: DTS: CI20: fix otg power gpio PCI/PM: Observe reset delay irrespective of bridge_d3 PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: Avoid FLR for AMD FCH AHCI adapters iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode vfio/type1: prevent underflow of locked_vm via exec() vfio/type1: track locked_vm per dma vfio/type1: restore locked_vm drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv drm/radeon: Fix eDP for single-display iMac11,2 drm/i915: Don't use BAR mappings for ring buffers with LLC drm/edid: fix AVI infoframe aspect ratio handling perf intel-pt: pkt-decoder: Add CFE and EVD packets qede: avoid uninitialized entries in coal_entry array media: uvcvideo: Fix memory leak of object map on error exit path iommu/vt-d: Fix an unbalanced rcu_read_lock/rcu_read_unlock() arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY wifi: ath9k: use proper statements in conditionals kbuild: Port silent mode detection to future gnu make. Linux 5.15.99 Change-Id: I52781008c0a83946c09698b9b5625a5f7ee2e545 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-17 13:35:31 +00:00
Vincent Donnefort	c8d86d177a	ANDROID: ring-buffer: Fix ring_buffer_read_page for external writers ... No shortcut is possible for reading a page without removing it from the ring-buffer. The reader needs to be moved and its timestamp updated. Bug: 249050813 Change-Id: I80fbc1e265500e419278346e2973df2488b7e8b3 Signed-off-by: Vincent Donnefort <vdonnefort@google.com>	2023-03-14 13:02:13 +00:00
Jia-Ju Bai	ba279dc7e4	tracing: Add NULL checks for buffer in ring_buffer_free_read_page() ... [ Upstream commit 3e4272b995 ] In a previous commit 7433632c9f, buffer, buffer->buffers and buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL, and thus the related checks are added. However, in the same call stack, these variables are also used in ring_buffer_free_read_page(): tracing_buffers_release() ring_buffer_wake_waiters(iter->array_buffer->buffer) cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit ring_buffer_free_read_page(iter->array_buffer->buffer) cpu_buffer = buffer->buffers[cpu] -> No check Thus, to avod possible null-pointer derefernces, the related checks should be added. These results are reported by a static tool designed by myself. Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 13:57:32 +01:00
Mukesh Ojha	d41db100bc	ring-buffer: Handle race between rb_move_tail and rb_check_pages ... commit 8843e06f67 upstream. It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: <TASK> ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140 __do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to Zheng Yejian] Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com Cc: <mhiramat@kernel.org> Cc: stable@vger.kernel.org Fixes: 1039221cc2 ("ring-buffer: Do not disable recording when there is an iterator") Reported-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-10 09:40:10 +01:00
Greg Kroah-Hartman	a2e4b48d6f	trace/blktrace: fix memory leak with using debugfs_lookup() ... [ Upstream commit 83e8864fee ] When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: Jens Axboe <axboe@kernel.dk> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.org Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:39:47 +01:00
Greg Kroah-Hartman	6bdcdef440	Merge 5.15.94 into android14-5.15 ... Changes in 5.15.94 mm/migration: return errno when isolate_huge_page failed migrate: hugetlb: check for hugetlb shared PMD in node migration btrfs: limit device extents to the device size btrfs: zlib: zero-initialize zlib workspace ALSA: hda/realtek: Add Positivo N14KP6-TG ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw of/address: Return an error when no valid dma-ranges are found can: j1939: do not wait 250 ms if the same addr was already claimed xfrm: compat: change expression for switch in xfrm_xlate64 IB/hfi1: Restore allocated resources on failed copyout xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() IB/IPoIB: Fix legacy IPoIB due to wrong number of queues RDMA/irdma: Fix potential NULL-ptr-dereference RDMA/usnic: use iommu_map_atomic() under spin_lock() xfrm: fix bug with DSCP copy to v6 from v4 tunnel net: phylink: move phy_device_free() to correctly release phy device bonding: fix error checking in bond_debug_reregister() net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY ionic: clean interrupt before enabling queue to avoid credit race uapi: add missing ip/ipv6 header dependencies for linux/stddef.h ice: Do not use WQ_MEM_RECLAIM flag for workqueue net: dsa: mt7530: don't change PVC_EG_TAG when CPU port becomes VLAN-aware net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" net/mlx5e: Move repeating clear_bit in mlx5e_rx_reporter_err_rq_cqe_recover net/mlx5e: Introduce the mlx5e_flush_rq function net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change net/mlx5: Bridge, fix ageing of peer FDB entries net/mlx5e: IPoIB, Show unknown speed instead of error net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers net/mlx5: fw_tracer, Zero consumer index when reloading the tracer net/mlx5: Serialize module cleanup with reload and remove igc: Add ndo_tx_timeout support rds: rds_rm_zerocopy_callback() use list_first_entry() selftests: forwarding: lib: quote the sysctl values ALSA: pci: lx6464es: fix a debug loop riscv: stacktrace: Fix missing the first frame ASoC: topology: Return -ENOMEM on memory allocation failure pinctrl: mediatek: Fix the drive register definition of some Pins pinctrl: aspeed: Fix confusing types in return value pinctrl: single: fix potential NULL dereference spi: dw: Fix wrong FIFO level setting for long xfers pinctrl: intel: Restore the pins that used to be in Direct IRQ mode cifs: Fix use-after-free in rdata->read_into_pages() net: USB: Fix wrong-direction WARNING in plusb.c mptcp: be careful on subflow status propagation on errors btrfs: free device in btrfs_close_devices for a single device filesystem usb: core: add quirk for Alcor Link AK9563 smartcard reader usb: typec: altmodes/displayport: Fix probe pin assign check clk: ingenic: jz4760: Update M/N/OD calculation algorithm ceph: flush cap releases when the session is flushed riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch rtmutex: Ensure that the top waiter is always woken up arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive Fix page corruption caused by racy check in __free_pages drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini drm/i915: Initialize the obj flags for shmem objects drm/i915: Fix VBT DSI DVO port handling x86/speculation: Identify processors vulnerable to SMT RSB predictions KVM: x86: Mitigate the cross-thread return address predictions bug Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions Linux 5.15.94 Change-Id: I46aca6bfb09ef8e68122a41734968906982b2a5f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-15 15:06:07 +00:00
Shiju Jose	70f37b3118	tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw ... commit 3e46d910d8 upstream. poll() and select() on per_cpu trace_pipe and trace_pipe_raw do not work since kernel 6.1-rc6. This issue is seen after the commit 42fb0a1e84 ("tracing/ring-buffer: Have polling block on watermark"). This issue is firstly detected and reported, when testing the CXL error events in the rasdaemon and also erified using the test application for poll() and select(). This issue occurs for the per_cpu case, when calling the ring_buffer_poll_wait(), in kernel/trace/ring_buffer.c, with the buffer_percent > 0 and then wait until the percentage of pages are available. The default value set for the buffer_percent is 50 in the kernel/trace/trace.c. As a fix, allow userspace application could set buffer_percent as 0 through the buffer_percent_fops, so that the task will wake up as soon as data is added to any of the specific cpu buffer. Link: https://lore.kernel.org/linux-trace-kernel/20230202182309.742-2-shiju.jose@huawei.com Cc: <mhiramat@kernel.org> Cc: <mchehab@kernel.org> Cc: <linux-edac@vger.kernel.org> Cc: stable@vger.kernel.org Fixes: 42fb0a1e84 ("tracing/ring-buffer: Have polling block on watermark") Signed-off-by: Shiju Jose <shiju.jose@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-14 19:17:57 +01:00
Greg Kroah-Hartman	31ab29c89a	Merge 5.15.93 into android14-5.15 ... Changes in 5.15.93 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() ASoC: Intel: boards: fix spelling in comments ASoC: Intel: bytcht_es8316: move comment to the right place ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() bpf: Support <8-byte scalar spill and refill bpf: Fix to preserve reg parent/live fields when copying range info bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX drm/vc4: hdmi: make CEC adapter name unique scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" vhost/net: Clear the pending messages when the backend is removed WRITE is "data source", not destination... READ is "data destination", not source... fix iov_iter_bvec() "direction" argument fix "direction" argument of iov_iter_kvec() ice: Prevent set_channel from changing queues while RDMA active qede: execute xdp_do_flush() before napi_complete_done() virtio-net: execute xdp_do_flush() before napi_complete_done() dpaa_eth: execute xdp_do_flush() before napi_complete_done() dpaa2-eth: execute xdp_do_flush() before napi_complete_done() sfc: correctly advertise tunneled IPv6 segmentation net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC" block, bfq: replace 0/1 with false/true in bic apis block, bfq: fix uaf for bfqq in bic_set_bfqq() netrom: Fix use-after-free caused by accept on already connected socket drm/i915/guc: Fix locking when searching for a hung request drm/i915/adlp: Fix typo for reference clock netfilter: br_netfilter: disable sabotage_in hook after first suppression squashfs: harden sanity check in squashfs_read_xattr_id_table net: phy: meson-gxl: Add generic dummy stubs for MMD register access ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address riscv: kprobe: Fixup kernel panic when probing an illegal position igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ata: libata: Fix sata_down_spd_limit() when no link speed is reported selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking virtio-net: Keep stop() to follow mirror sequence of open() net: openvswitch: fix flow memory leak in ovs_flow_cmd_new efi: fix potential NULL deref in efi_mem_reserve_persistent i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU i2c: mxs: suppress probe-deferral error message scsi: target: core: Fix warning on RT kernels perf/x86/intel: Add Emerald Rapids scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress i2c: rk3x: fix a bunch of kernel-doc warnings platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF net/x25: Fix to not accept on connected socket drm/amd/display: Fix timing not changning when freesync video is enabled iio: adc: stm32-dfsdm: fill module aliases usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Input: i8042 - add Clevo PCX0DX to i8042 quirk table fbcon: Check font dimension limits net: qrtr: free memory on error path in radix_tree_insert() watchdog: diag288_wdt: do not use stack buffers for hardware data watchdog: diag288_wdt: fix __diag288() inline assembly ALSA: hda/realtek: Add Acer Predator PH315-54 efi: Accept version 2 of memory attributes table iio: hid: fix the retval in accel_3d_capture_sample iio: hid: fix the retval in gyro_3d_capture_sample iio: adc: berlin2-adc: Add missing of_node_put() in error path iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix incorrect ODR mode readback iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix MAGN sensor scale and unit nvmem: qcom-spmi-sdam: fix module autoloading parisc: Fix return code of pdc_iodc_print() parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case riscv: disable generation of unwind tables mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm/swapfile: add cond_resched() in get_swap_pages() highmem: round down the address passed to kunmap_flush_on_unmap() Squashfs: fix handling and sanity checking of xattr_ids count drm/i915: Fix potential bit_17 double-free nvmem: core: initialise nvmem->id early nvmem: core: remove nvmem_config wp_gpio nvmem: core: fix cell removal on error serial: 8250_dma: Fix DMA Rx completion race serial: 8250_dma: Fix DMA Rx rearm race phy: qcom-qmp-combo: disable runtime PM on unbind phy: qcom-qmp-combo: fix memleak on probe deferral phy: qcom-qmp-usb: fix memleak on probe deferral phy: qcom-qmp-combo: fix broken power on phy: qcom-qmp-combo: fix runtime suspend bpf: Fix incorrect state pruning for <8B spill/fill bpf: Do not reject when the stack read size is different from the tracked scalar size iio:adc:twl6030: Enable measurement of VAC powerpc/imc-pmu: Revert nest_init_lock to being a mutex fs/ntfs3: Validate attribute data and valid sizes ovl: Use "buf" flexible array for memcpy() destination fbdev: smscufx: fix error handling code in ufx_usb_probe f2fs: fix to do sanity check on i_extra_isize in is_alive() wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads gfs2: Cosmetic gfs2_dinode_{in,out} cleanup gfs2: Always check inode size of inline inodes bpf: Skip invalid kfunc call in backtrack_insn Linux 5.15.93 Change-Id: If66b499d7def443925e1cd9631e119ae9397af45 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-09 13:35:59 +00:00
Yonghong Song	b7abeb6916	bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ... [ Upstream commit bdb7fdb0ac ] In current bpf_send_signal() and bpf_send_signal_thread() helper implementation, irq_work is used to handle nmi context. Hao Sun reported in [1] that the current task at the entry of the helper might be gone during irq_work callback processing. To fix the issue, a reference is acquired for the current task before enqueuing into the irq_work so that the queued task is still available during irq_work callback processing. [1] https://lore.kernel.org/bpf/20230109074425.12556-1-sunhao.th@gmail.com/ Fixes: 8b401f9ed2 ("bpf: implement bpf_send_signal() helper") Tested-by: Hao Sun <sunhao.th@gmail.com> Reported-by: Hao Sun <sunhao.th@gmail.com> Signed-off-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/r/20230118204815.3331855-1-yhs@fb.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-09 11:26:33 +01:00
Greg Kroah-Hartman	c45adc3d89	Merge 5.15.92 into android14-5.15 ... Changes in 5.15.92 ARM: dts: imx: Fix pca9547 i2c-mux node name ARM: dts: vf610: Fix pca9548 i2c-mux node names arm64: dts: freescale: Fix pca954x i2c-mux node names arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI firmware: arm_scmi: Clear stale xfer->hdr.status bpf: Skip task with pid=1 in send_signal_common() erofs/zmap.c: Fix incorrect offset calculation blk-cgroup: fix missing pd_online_fn() while activating policy HID: playstation: sanity check DualSense calibration data. dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() ext4: fix bad checksum after online resize extcon: usbc-tusb320: fix kernel-doc warning ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt tools: fix ARRAY_SIZE defines in tools and selftests hdrs selftests/vm: remove ARRAY_SIZE define from individual tests selftests: Provide local define of __cpuid_count() net: fix NULL pointer in skb_segment_list net: mctp: purge receive queues on sk destruction Linux 5.15.92 Change-Id: Ia09e2a458fdd8f6f527e5d2ecff18cbb40c6ef10 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-06 10:45:01 +00:00
Hao Sun	0dfef50313	bpf: Skip task with pid=1 in send_signal_common() ... [ Upstream commit a3d81bc1ea ] The following kernel panic can be triggered when a task with pid=1 attaches a prog that attempts to send killing signal to itself, also see [1] for more details: Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b CPU: 3 PID: 1 Comm: systemd Not tainted 6.1.0-09652-g59fe41b5255f #148 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x100/0x178 lib/dump_stack.c:106 panic+0x2c4/0x60f kernel/panic.c:275 do_exit.cold+0x63/0xe4 kernel/exit.c:789 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x2460/0x2600 kernel/signal.c:2858 arch_do_signal_or_restart+0x78/0x5d0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd So skip task with pid=1 in bpf_send_signal_common() to avoid the panic. [1] https://lore.kernel.org/bpf/20221222043507.33037-1-sunhao.th@gmail.com Signed-off-by: Hao Sun <sunhao.th@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Stanislav Fomichev <sdf@google.com> Link: https://lore.kernel.org/bpf/20230106084838.12690-1-sunhao.th@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-06 07:59:00 +01:00
Greg Kroah-Hartman	e3d8fe0993	Merge 5.15.91 into android14-5.15 ... Changes in 5.15.91 memory: tegra: Remove clients SID override programming memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux ARM: imx: add missing of_node_put() HID: intel_ish-hid: Add check for ishtp_dma_tx_map arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity soc: imx8m: Fix incorrect check for of_clk_get_by_name() reset: uniphier-glue: Use reset_control_bulk API reset: uniphier-glue: Fix possible null-ptr-deref EDAC/highbank: Fix memory leak in highbank_mc_probe() firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Harden shared memory access in fetch_notification tomoyo: fix broken dependency on *.conf.default RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Remove user expected buffer invalidate race affs: initialize fsdata in affs_truncate() PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() arm64: dts: qcom: msm8992: Don't use sfpb mutex arm64: dts: qcom: msm8992-libra: Add CPU regulators arm64: dts: qcom: msm8992-libra: Fix the memory map phy: ti: fix Kconfig warning and operator precedence NFSD: fix use-after-free in nfsd4_ssc_setup_dul() ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb gpio: use raw spinlock for gpio chip shadowed data gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid pinctrl/rockchip: Use temporary variable for struct device pinctrl/rockchip: add error handling for pull/drive register getters pinctrl: rockchip: fix reading pull type on rk3568 net: stmmac: Fix queue statistics reading net/sched: sch_taprio: fix possible use-after-free l2tp: Serialize access to sk_user_data with sk_callback_lock l2tp: Don't sleep and disable BH under writer-side sk_callback_lock l2tp: convert l2tp_tunnel_list to idr l2tp: close all race conditions in l2tp_tunnel_register() octeontx2-pf: Avoid use of GFP_KERNEL in atomic context net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() pinctrl: rockchip: fix mux route data for rk3568 HID: revert CHERRY_MOUSE_000C quirk usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request Bluetooth: Fix possible deadlock in rfcomm_sk_state_change net: ipa: disable ipa interrupt during suspend net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding virtio-net: correctly enable callback during start_xmit l2tp: prevent lockdep issue in l2tp_tunnel_register() HID: betop: check shape of output reports cifs: fix potential deadlock in cache_refresh_path() dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() phy: phy-can-transceiver: Skip warning if no "max-bitrate" drm/amd/display: fix issues with driver unload nvme-pci: fix timeout request state check tcp: avoid the lookup process failing to get sk in ehash table octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt ptdma: pt_core_execute_cmd() should use spinlock device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array selftests/net: toeplitz: fix race on tpacket_v3 block close net: dsa: microchip: ksz9477: port map correction in ALU table entry register thermal/core: Remove duplicate information when an error occurs thermal/core: Rename 'trips' to 'num_trips' thermal: Validate new state in cur_state_store() thermal/core: fix error code in __thermal_cooling_device_register() thermal: core: call put_device() only after device_register() fails net: stmmac: enable all safety features by default tcp: fix rate_app_limited to default to 1 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist kcsan: test: don't put the expect array on the stack cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist ASoC: fsl_micfil: Correct the number of steps on SX controls net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard s390: expicitly align _edata and _end symbols on page boundary perf/x86/msr: Add Emerald Rapids perf/x86/intel/uncore: Add Emerald Rapids cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id r8152: add vendor/device ID pair for Microsoft Devkit platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK lockref: stop doing cpu_relax in the cmpxchg loop firmware: coreboot: Check size of table entry and use flex-array drm/i915: Allow switching away via vga-switcheroo if uninitialized Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" drm/i915: Remove unused variable x86: ACPI: cstate: Optimize C3 entry on AMD CPUs fs: reiserfs: remove useless new_opts in reiserfs_remount sysctl: add a new register_sysctl_init() interface kernel/panic: move panic sysctls to its own file panic: unset panic_on_warn inside panic() ubsan: no need to unset panic_on_warn in ubsan_epilogue() kasan: no need to unset panic_on_warn in end_report() exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() ia64: make IA64_MCA_RECOVERY bool instead of tristate panic: Separate sysctl logic from CONFIG_SMP exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Bluetooth: hci_sync: cancel cmd_timer if hci_open failed drm/amdgpu: complete gfxoff allow signal during suspend without delay scsi: hpsa: Fix allocation size for scsi_host_alloc() KVM: SVM: fix tsc scaling cache logic module: Don't wait for GOING modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect i2c: mv64xxx: Remove shutdown method from driver i2c: mv64xxx: Add atomic_xfer method to driver ksmbd: add smbd max io size parameter ksmbd: add max connections parameter ksmbd: do not sign response to session request for guest login ksmbd: downgrade ndr version error message to debug ksmbd: limit pdu length size according to connection status ovl: fail on invalid uid/gid mapping at copy up KVM: x86/vmx: Do not skip segment attributes if unusable bit is set KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation thermal: intel: int340x: Protect trip temperature from concurrent updates ipv6: fix reachability confirmation with proxy_ndp ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info net: mana: Fix IRQ name - add PCI and queue number scsi: ufs: core: Fix devfreq deadlocks i2c: designware: use casting of u64 in clock multiplication to avoid overflow netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path drm/i915/selftest: fix intel_selftest_modify_policy argument types netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope riscv/kprobe: Fix instruction simulation of JALR nvme: fix passthrough csi check gpio: mxc: Unlock on error path in mxc_flip_edge() ravb: Rename "no_ptp_cfg_active" and "ptp_cfg_active" variables net: ravb: Fix lack of register setting after system resumed for Gen3 net: ravb: Fix possible hang if RIS2_QFF1 happen net: mctp: mark socks as dead on unhash, prevent re-add thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net/tg3: resolve deadlock in tg3_reset_task() during EEH net: mdio-mux-meson-g12a: force internal PHY off on mux switch treewide: fix up files incorrectly marked executable tools: gpio: fix -c option of gpio-event-mon Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data kbuild: Allow kernel installation packaging to override pkg-config block: fix and cleanup bio_check_ro x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int Linux 5.15.91 Change-Id: I3349d802533097ac86e5c680fbd40c00c9719ec7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 09:38:19 +00:00
Natalia Petrova	592ba7116f	trace_events_hist: add check for return value of 'create_hist_field' ... commit 8b152e9150 upstream. Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20230111120409.4111-1-n.petrova@fintech.ru Cc: stable@vger.kernel.org Fixes: 30350d65ac ("tracing: Add variable support to hist triggers") Signed-off-by: Natalia Petrova <n.petrova@fintech.ru> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-01 08:27:23 +01:00
Steven Rostedt (Google)	b0af180514	tracing: Make sure trace_printk() can output as soon as it can be used ... commit 3bb06eb6e9 upstream. Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and "ftrace_dump_on_oops" is set on the kernel command line, all you get will be: [ 0.456075] <idle>-0 0dN.2. 347519us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough. Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful. Link: https://lkml.kernel.org/r/20230104161412.019f6c55@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Fixes: e725c731e3 ("tracing: Split tracing initialization into two for early initialization") Reported-by: "Joel Fernandes (Google)" <joel@joelfernandes.org> Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-01 08:27:23 +01:00
Vincent Donnefort	a7640ce6cf	ANDROID: KVM: arm64: RAW interface to the nVHE hyp tracing ... This interface intends to be used by userspace tools to store raw version of events. In such case, the kernel does not decode anything. Bug: 229972309 Change-Id: Ib1fca21a34a308ad1361240ef598033ecab3b4ad Signed-off-by: Vincent Donnefort <vdonnefort@google.com>	2023-01-27 11:11:25 +00:00
Vincent Donnefort	13188635cc	ANDROID: ring-buffer: Introducing external writer support ... The ring buffer is convenient: it has a page granularity and its format is already supported by userspace tools such as trace-cmd. It is a natural solution to store events that would come from outside the kernel such as a hypervisor. In that case, where a writer is external to the kernel, the latter would only be responsible for the allocation and to read back the ring buffer. The allocation is done with the newly introduced function which just needs a size and a set of callbacks (notice only the overwrite mode is supported at the moment): ring_buffer_alloc_ext(unsigned long size, struct ring_buffer_ext_cb *cb) The callbacks given to this allocator enables communication with the external writer: (*swap_reader)(int cpu): Ask the writer to swap the current reader page with the head. (*update_footers)(int cpu): Ask the writer to update material in the page footers. Each page from the ring buffer has indeed a footer in which statistics and page status can be retrieved. This allows the kernel to update its view on the ring buffer, following a reader page swap or a footers update. After the trace_buffer is allocated, a helper serializes the relevant information into a structure that can be easily sent to the external writer: trace_buffer_pack(struct trace_buffer *trace_buffer, struct trace_buffer_pack *pack) The footer and pack description can be found in the newly introduced header file include/linux/ring_buffer_ext.h. When the kernel is writing to the ring buffer, it can wake up quite easily the reader. That's not the case when the writer is external. A new function allows polling for reading the ring buffer: ring_buffer_poke(struct trace_buffer *buffer, int cpu) A ring-buffer allocated for an external writer will forbid any writing (the whole design of the ring buffer mandates a single writer) and will also prevent extending or extracting pages. When I presented this work to the tracingsummit, rosted@ told me he saw some overlapping with an idea he had to enable him to map the tracing buffers in userspace. We designed together a solution that would enable both features. Problem now, if on one hand, the development of the new design has started already... it would nonetheless impose a significant revamp of this patchset, which wouldn't make it to Android14. Nothing technically wrong with anything here, but sending it to LKML wouldn't make sense, as I know already this isn't as "reusable" as the version agreed upon. Bug: 229972309 Change-Id: Iafcc1e2683a7460c94de3db116878c303601df64 Signed-off-by: Vincent Donnefort <vdonnefort@google.com>	2023-01-27 11:11:24 +00:00
Vincent Donnefort	39f43996ba	ANDROID: ring-buffer: Expose buffer_data_page material ... In preparation for allowing the write of ring-buffer compliant pages outside of ring_buffer.c move to the header, struct buffer_data_page and timestamp encoding functions. When I presented this work to the tracingsummit, rosted@ told me he saw some overlapping with an idea he had to enable him to map the tracing buffers in userspace. We designed together a solution that would enable both features. Problem now, if on one hand, the development of the new design has started already... it would nonetheless impose a significant revamp of this patchset, which wouldn't make it to Android14. Nothing technically wrong with anything here, but sending it to LKML wouldn't make sense, as I know already this isn't as "reusable" as the version agreed upon. Bug: 229972309 Change-Id: Icf3329bd899a3dd91279d1bbadaf2dc4e243455c Signed-off-by: Vincent Donnefort <vdonnefort@google.com>	2023-01-27 11:11:24 +00:00
Greg Kroah-Hartman	efae08b654	Merge 5.15.87 into android14-5.15 ... Changes in 5.15.87 usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init cifs: fix oops during encryption Revert "selftests/bpf: Add test for unstable CT lookup API" nvme-pci: fix doorbell buffer value endianness nvme-pci: fix mempool alloc size nvme-pci: fix page size checks ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA ACPI: resource: do IRQ override on LENOVO IdeaPad ACPI: resource: do IRQ override on XMG Core 15 ACPI: resource: do IRQ override on Lenovo 14ALC7 block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq ata: ahci: Fix PCS quirk application for suspend nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition nvmet: don't defer passthrough commands with trivial effects to the workqueue fs/ntfs3: Validate BOOT record_size fs/ntfs3: Add overflow check for attribute size fs/ntfs3: Validate data run offset fs/ntfs3: Add null pointer check to attr_load_runs_vcn fs/ntfs3: Fix memory leak on ntfs_fill_super() error path fs/ntfs3: Add null pointer check for inode operations fs/ntfs3: Validate attribute name offset fs/ntfs3: Validate buffer length while parsing index fs/ntfs3: Validate resident attribute name fs/ntfs3: Fix slab-out-of-bounds read in run_unpack soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15 fs/ntfs3: Validate index root when initialize NTFS security fs/ntfs3: Use __GFP_NOWARN allocation at wnd_init() fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_fill_super() fs/ntfs3: Delete duplicate condition in ntfs_read_mft() fs/ntfs3: Fix slab-out-of-bounds in r_page objtool: Fix SEGFAULT powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtas: avoid scheduling in rtas_os_term() HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: plantronics: Additional PIDs for double volume key presses quirk pstore: Properly assign mem_type property pstore/zone: Use GFP_ATOMIC to allocate zone buffer hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount binfmt: Fix error return code in load_elf_fdpic_binary() ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ALSA: line6: correct midi status byte when receiving data from podxt ALSA: line6: fix stack overflow in line6_midi_transmit pnode: terminate at peers of source mfd: mt6360: Add bounds checking in Regmap read/write call-backs md: fix a crash in mempool_free mm, compaction: fix fast_isolate_around() to stay within boundaries f2fs: should put a page when checking the summary info f2fs: allow to read node block after shutdown mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING tpm: acpi: Call acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails kcsan: Instrument memcpy/memset/memmove with newer Clang ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire rcu-tasks: Simplify trc_read_check_handler() atomic operations net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO net/af_packet: make sure to pull mac header media: stv0288: use explicitly signed char soc: qcom: Select REMAP_MMIO for LLCC driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them jbd2: use the correct print format perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D perf/x86/intel/uncore: Clear attr_update properly arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength selftests: Use optional USERCFLAGS and USERLDFLAGS PM/devfreq: governor: Add a private governor_data for governor cpufreq: Init completion before kobject_init_and_add() ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops fs: dlm: fix sock release if listen fails fs: dlm: retry accept() until -EAGAIN or error returns mptcp: mark ops structures as ro_after_init mptcp: remove MPTCP 'ifdef' in TCP SYN cookies dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: resume even if in FAIL mode dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' perf/core: Call LSM hook after copying perf_event_attr of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values KVM: VMX: Resume guest immediately when injecting #GP on ECREATE KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 x86/microcode/intel: Do not retry microcode reloading on the APs ftrace/x86: Add back ftrace_expected for ftrace bug reports x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK tracing: Fix race where eprobes can be called before the event tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE tracing/hist: Fix wrong return value in parse_action_params() tracing/probes: Handle system names with hyphens tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line staging: media: tegra-video: fix chan->mipi value on error staging: media: tegra-video: fix device_node use after free ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options rtc: ds1347: fix value written to century register block: mq-deadline: Do not break sequential write streams to zoned HDDs md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk wifi: wilc1000: sdio: fix module autoloading ASoC: jz4740-i2s: Handle independent FIFO flush bits ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection() ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument riscv: mm: notify remote harts about mmu cache updates crypto: n2 - add missing hash statesize crypto: ccp - Add support for TEE for PCI ID 0x14CA driver core: Fix bus_type.match() error handling in __driver_attach() phy: qcom-qmp-combo: fix sc8180x reset iommu/amd: Fix ivrs_acpihid cmdline parsing code remoteproc: core: Do pm_relax when in RPROC_OFFLINE state parisc: led: Fix potential null-ptr-deref in start_task() device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor drm/i915/dsi: fix VBT send packet port selection for dual link DSI drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() ext4: silence the warning when evicting inode with dioread_nolock ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: remove trailing newline from ext4_msg() message fs: ext4: initialize fsdata in pagecache_write() ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: check and assert if marking an no_delete evicting inode dirty ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: fix leaking uninitialized memory in fast-commit journal ext4: fix uninititialized value in 'ext4_evict_inode' ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: avoid BUG_ON when creating xattrs ext4: fix kernel BUG in 'ext4_write_inline_data_end()' ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area drm/amdgpu: handle polaris10/11 overlap asics (v2) drm/amdgpu: make display pinning more flexible (v2) block: mq-deadline: Fix dd_finish_request() for zoned devices tracing: Fix issue of missing one synthetic field ext4: remove unused enum EXT4_FC_COMMIT_FAILED ext4: use ext4_debug() instead of jbd_debug() ext4: introduce EXT4_FC_TAG_BASE_LEN helper ext4: factor out ext4_fc_get_tl() ext4: fix potential out of bound read in ext4_fc_replay_scan() ext4: disable fast-commit of encrypted dir operations ext4: don't set up encryption key during jbd2 transaction ext4: add missing validation of fast-commit record lengths ext4: fix unaligned memory access in ext4_fc_reserve_space() ext4: fix off-by-one errors in fast-commit block filling ARM: renumber bits related to _TIF_WORK_MASK phy: qcom-qmp-combo: fix out-of-bounds clock access btrfs: replace strncpy() with strscpy() btrfs: move missing device handling in a dedicate function btrfs: fix extent map use-after-free when handling missing device in read_one_chunk x86/mce: Get rid of msr_ops x86/MCE/AMD: Clear DFR errors found in THR handler media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data ravb: Fix "failed to switch device to config mode" message during unbind ext4: goto right label 'failed_mount3a' ext4: correct inconsistent error msg in nojournal mode mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption drm/i915/migrate: don't check the scratch page drm/i915/migrate: fix offset calculation drm/i915/migrate: fix length calculation SUNRPC: ensure the matching upcall is in-flight upon downcall btrfs: fix an error handling path in btrfs_defrag_leaves() bpf: pull before calling skb_postpull_rcsum() drm/panfrost: Fix GEM handle creation ref-counting netfilter: nf_tables: consolidate set description netfilter: nf_tables: add function to create set stateful expressions netfilter: nf_tables: perform type checking for existing sets vmxnet3: correctly report csum_level for encapsulated packet netfilter: nf_tables: honor set timeout and garbage collection updates veth: Fix race with AF_XDP exposing old or uninitialized descriptors nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: hns3: refactor hns3_nic_reuse_page() net: hns3: extract macro to simplify ring stats update code net: hns3: fix miss L3E checking for rx packet net: hns3: fix VF promisc mode not update when mac table full net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure net: dsa: mv88e6xxx: depend on PTP conditionally nfc: Fix potential resource leaks vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() vhost/vsock: Fix error handling in vhost_vsock_init() vringh: fix range used in iotlb_translate() vhost: fix range used in translate_desc() vdpa_sim: fix vringh initialization in vdpasim_queue_ready() net/mlx5: E-Switch, properly handle ingress tagged packets on VST net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path net/mlx5: Avoid recovery in probe flows net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default net/mlx5e: TC, Refactor mlx5e_tc_add_flow_mod_hdr() to get flow attr net/mlx5e: Always clear dest encap in neigh-update-del net/mlx5e: Fix hw mtu initializing at XDP SQ allocation net: amd-xgbe: add missed tasklet_kill net: ena: Fix toeplitz initial hash value net: ena: Don't register memory info on XDP exchange net: ena: Account for the number of processed bytes in XDP net: ena: Use bitmask to indicate packet redirection net: ena: Fix rx_copybreak value update net: ena: Set default value for RX interrupt moderation net: ena: Update NUMA TPH hint register upon NUMA node update net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device RDMA/mlx5: Fix validation of max_rd_atomic caps for DC drm/meson: Reduce the FIFO lines held when AFBC is not used filelock: new helper: vfs_inode_has_locks ceph: switch to vfs_inode_has_locks() to fix file lock bug gpio: sifive: Fix refcount leak in sifive_gpio_probe net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop net: sparx5: Fix reading of the MAC address netfilter: ipset: fix hash:net,port,net hang with /0 subnet netfilter: ipset: Rework long task execution when adding/deleting entries perf tools: Fix resources leak in perf_data__open_dir() drm/imx: ipuv3-plane: Fix overlay plane width fs/ntfs3: don't hold ni_lock when calling truncate_setsize() drivers/net/bonding/bond_3ad: return when there's no aggregator octeontx2-pf: Fix lmtst ID used in aura free usb: rndis_host: Secure rndis_query check against int overflow perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet nvme: fix multipath crash caused by flush request when blktrace is enabled io_uring: check for valid register opcode earlier nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it nvme: also return I/O command effects from nvme_command_effects btrfs: check superblock to ensure the fs was not modified at thaw time x86/kexec: Fix double-free of elf header buffer x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB block: don't allow splitting of a REQ_NOWAIT bio io_uring: fix CQ waiting timeout handling thermal: int340x: Add missing attribute for data rate base riscv: uaccess: fix type of 0 variable on error in get_user() riscv, kprobes: Stricter c.jr/c.jalr decoding drm/i915/gvt: fix gvt debugfs destroy drm/i915/gvt: fix vgpu debugfs clean in remove hfs/hfsplus: use WARN_ON for sanity check hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling ksmbd: fix infinite loop in ksmbd_conn_handler_loop() ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob Revert "ACPI: PM: Add support for upcoming AMD uPEP HID AMDI007" mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 ext4: don't allow journal inode to have encrypt flag selftests: set the BUILD variable to absolute path btrfs: make thaw time super block check to also verify checksum net: hns3: fix return value check bug of rx copybreak mbcache: Avoid nesting of cache->c_list_lock under bit locks efi: random: combine bootloader provided RNG seed with RNG protocol output io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() drm/mgag200: Fix PLL setup for G200_SE_A rev >=4 Linux 5.15.87 Change-Id: I06fb376627506652ed60c04d56074956e6e075a0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 13:13:15 +00:00
Greg Kroah-Hartman	962d1816e1	Merge 5.15.86 into android14-5.15 ... Changes in 5.15.86 drm/amd/display: Manually adjust strobe for DCN303 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable arm64: dts: qcom: msm8996: Add MSM8996 Pro support arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name arm64: dts: qcom: sm8250: correct LPASS pin pull down soc: qcom: llcc: make irq truly optional arm64: dts: qcom: Correct QMP PHY child node name arm64: dts: qcom: sm8150: fix UFS PHY registers arm64: dts: qcom: sm8250: fix UFS PHY registers arm64: dts: qcom: sm8350: fix UFS PHY registers arm64: dts: qcom: sm8250: drop bogus DP PHY clock soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm64: dts: qcom: sm6125: fix SDHCI CQE reg names arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm64: Treat ESR_ELx as a 64-bit register arm64: mm: kfence: only handle translation faults perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes arm64: dts: mt6779: Fix devicetree build warnings arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC seccomp: Move copy_seccomp() to no failure path. pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() ovl: store lower path in ovl_inode ovl: use ovl_copy_{real,upper}attr() wrappers ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/fair: Removed useless update of p->recent_used_cpu sched/core: Introduce sched_asym_cpucap_active() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix TIF_NOTIFY_SIGNAL handling alpha: fix syscall entry in !AUDUT_SYSCALL case x86/sgx: Reduce delay and interference of enclave release PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() thermal: core: fix some possible name leaks in error paths irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() SUNRPC: Return true/false (not 1/0) from bool functions NFSD: Finish converting the NFSv2 GETACL result encoder nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file debugfs: fix error when writing negative value to atomic_t debugfs file rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Access registers according to spec mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem mips: ralink: mt7621: soc queries and tests as functions mips: ralink: mt7621: do not use kzalloc too early futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state cpu/hotplug: Do not bail-out in DYING/STARTING sections clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/chrome: cros_ec_typec: Cleanup switch handle return paths platform/chrome: cros_ec_typec: zero out stale pointers platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used lockd: set other missing fields when unlocking files fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open platform/mellanox: mlxbf-pmc: Fix event typo wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros ata: add/use ata_taskfile::{error|status} fields ata: libata: fix NCQ autosense logic ipmi: kcs: Poll OBF briefly to reduce OBE latency drm/amdgpu/powerplay/psm: Fix memory leak in power state init media: v4l2-ctrls: Fix off-by-one error in integer menu control check media: coda: jpeg: Add check for kmalloc media: adv748x: afe: Select input port when initializing AFE media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() soreuseport: Fix socket selection for SO_INCOMING_CPU. media: exynos4-is: don't rely on the v4l2_async_subdev internals libbpf: Btf dedup identical struct test needs check for nested structs/arrays can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: make use of units.h in assignment of frequency can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: drop unused GPIO support drm/msm/hdmi: use devres helper for runtime PM management bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack bfq: fix waker_bfqq inconsistency crash drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() libbpf: Fix uninitialized warning in btf_dump_dump_type_data nvmet: only allocate a single slab for bvecs regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() nvme: return err on nvme_init_non_mdts_limits fail regulator: qcom-rpmh: Fix PMR735a S3 regulator spec drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() block: clear ->slave_dir when dropping the main slave_dir reference wifi: ath10k: Fix return value in ath10k_pci_init() drm/msm/a6xx: Fix speed-bin detection vs probe-defer mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Fix the number of bytes for the dummy cycles bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes pinctrl: k210: call of_node_put() ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: remove call to memset before free device/resource/connection drbd: destroy workqueue when drbd device was freed ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: replace osc_hdmi with dummy clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx8mn: fix imx8mn_enet_phy_sels clocks list pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/amdkfd: Fix memory leakage ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED Input: wistron_btns - disable on UML bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails mt76: stop the radar detector after leaving dfs channel wifi: mt76: mt7921: fix reporting of TX AGGR histogram wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: lpass-sc7180: Fix pm_runtime usage clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). hsr: Avoid double remove of a node. hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_pci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() mmc: renesas_sdhi: alway populate SCC pointer memstick: ms_block: Add error handling support for add_disk() memstick/ms_block: Add check for alloc_ordered_workqueue mmc: core: Normalize the error handling branch in sd_read_ext_regs() regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled bpf: Do not zero-extend kfunc return values clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: stmmac: fix possible memory leak in stmmac_dvr_probe() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() af_unix: call proto_unregister() in the error path in af_unix_init() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts can: m_can: Call the RAM init directly from m_can_chip_config can: tcan4x5x: Fix use of register error status mask net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 i40e: Fix the inability to attach XDP program on downed interface net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: hisilicon/qm - fix missing destroy qp_idr crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix to invalidate dcc->f2fs_issue_discard in error path f2fs: fix normal discard process f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super() RDMA/irdma: Report the correct link speed scsi: qla2xxx: Fix set-but-not-used variable warnings RDMA/siw: Fix immediate work request flush to completion queue IB/mad: Don't call to function that might sleep while in atomic context PCI: vmd: Disable MSI remapping after suspend RDMA/restrack: Release MR restrack when delete RDMA/core: Make sure "ib_port" is valid when access sysfs node RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq dt-bindings: visconti-pcie: Fix interrupts array max constraints scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: efct: Fix possible memleak in efct_device_init() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_ PCI: mt7621: Add sentinel to quirks table orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix AH attr queried by query_qp RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix error code of CMD crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RISC-V: Align the shadow stack drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating serial: 8250_bcm7271: Fix error handling in brcmuart_init() class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails usb: typec: tipd: Fix spurious fwnode_handle_put in error path extcon: usbc-tusb320: Add support for mode setting and reset extcon: usbc-tusb320: Add support for TUSB320L usb: typec: Factor out non-PD fwnode properties extcon: usbc-tusb320: Factor out extcon into dedicated functions extcon: usbc-tusb320: Add USB TYPE-C support extcon: usbc-tusb320: Update state on probe even if no IRQ pending serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: stm32: move dma_request_chan() before clk_prepare_enable() serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update coresight: trbe: remove cpuhp instance node before remove cpuhp state usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences gpiolib: make struct comments into real kernel docs gpiolib: protect the GPIO device against being dropped while in use by user-space i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log ksmbd: Fix resource leak in ksmbd_session_rpc_open() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 thermal/drivers/qcom/lmh: Fix irq handler return value fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: geode: don't build on UML fbdev: uvesafb: don't build on UML fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol power: supply: z2_battery: Fix possible memleak in z2_batt_probe() HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info perf stat: Refactor __run_perf_stat() common code perf stat: Do not delay the workload with --delay RDMA/siw: Fix pointer cast warning fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() overflow: Implement size_t saturating arithmetic helpers fs/ntfs3: Harden against integer overflows iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size iommu/rockchip: fix permission bits in page table entries v2 phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm pwm: mediatek: always use bus clock for PWM on MT7622 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: pm8008: Remove driver data structure pm8008_data mfd: pm8008: Fix return value check in pm8008_probe() netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() block, bfq: fix possible uaf for 'bfqq->bic' selftests/bpf: Add test for unstable CT lookup API net: enetc: avoid buffer leaks on xdp_do_redirect() failure nfc: pn533: Clear nfc_target before being used unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() r6040: Fix kmemleak in probe and remove igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: allow BaseTime 0 enrollment for Qbv igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key soc: mediatek: pm-domains: Fix the power glitch issue arm64: dts: mt8183: Fix Mali GPU clock skbuff: Account for tail adjustment during pull operations mailbox: mpfs: read the system controller's status mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() HID: amd_sfh: Add missing check for dma_alloc_coherent rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() jfs: Fix fortify moan in symlink fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 media: imx-jpeg: Disable useless interrupt to avoid kernel panic brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields ipv6/sit: use DEV_STATS_INC() to avoid data-races mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed drm/amd/display: Use the largest vready_offset in pipe group libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on wifi: mt76: do not run mt76u_status_worker if the device is not running mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() crypto: hisilicon/hpre - fix resource leak in remove process scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs scsi: ufs: Reduce the START STOP UNIT timeout scsi: elx: libefc: Fix second parameter type in state callbacks hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() tools/include: Add _RET_IP_ and math definitions to kernel.h KVM: selftests: Fix build regression by using accessor function hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: cdnsp: fix lack of ZLP for ep0 usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq arm64: dts: qcom: sm8250: fix USB-DP PHY registers usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout xhci: Prevent infinite loop in transaction errors recovery for streams HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw loop: Fix the max_loop commandline argument treatment when it is set to 0 9p: set req refcount to zero to avoid uninitialized usage security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 reiserfs: Add missing calls to reiserfs_security_free() iio: fix memory leak in iio_device_register_eventset() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable floppy: Fix memory leak in do_floppy_init() gcov: add support for checksum field fbdev: fbcon: release buffer when fbcon_do_set_font() failed ovl: fix use inode directly in rcu-walk mode btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range scsi: qla2xxx: Fix crash when I/O abort times out net: stmmac: fix errno when create_singlethread_workqueue() fails media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code pwm: tegra: Fix 32 bit build Linux 5.15.86 Change-Id: Ic157edd6a65abf4a3167b5d227edeb0564f1be4e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 12:52:16 +00:00
Zheng Yejian	394514ddf9	tracing: Fix issue of missing one synthetic field ... commit ff4837f7fe upstream. The maximum number of synthetic fields supported is defined as SYNTH_FIELDS_MAX which value currently is 64, but it actually fails when try to generate a synthetic event with 64 fields by executing like: # echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\ int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;\ int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\ int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\ int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;\ int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\ int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\ int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;\ int v63; int v64" >> /sys/kernel/tracing/synthetic_events Correct the field counting to fix it. Link: https://lore.kernel.org/linux-trace-kernel/20221207091557.3137904-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Cc: stable@vger.kernel.org Fixes: c9e759b1e8 ("tracing: Rework synthetic event command parsing") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> [Fix conflict due to lack of c24be24aed] Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:59:03 +01:00
Yang Jihong	4f5de49d8c	tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line ... commit c1ac03af6e upstream. print_trace_line may overflow seq_file buffer. If the event is not consumed, the while loop keeps peeking this event, causing a infinite loop. Link: https://lkml.kernel.org/r/20221129113009.182425-1-yangjihong1@huawei.com Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: stable@vger.kernel.org Fixes: 088b1e427d ("ftrace: pipe fixes") Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:55 +01:00
Steven Rostedt (Google)	17becbc4dd	tracing/probes: Handle system names with hyphens ... commit 575b76cb88 upstream. When creating probe names, a check is done to make sure it matches basic C standard variable naming standards. Basically, starts with alphabetic or underline, and then the rest of the characters have alpha-numeric or underline in them. But system names do not have any true naming conventions, as they are created by the TRACE_SYSTEM macro and nothing tests to see what they are. The "xhci-hcd" trace events has a '-' in the system name. When trying to attach a eprobe to one of these trace points, it fails because the system name does not follow the variable naming convention because of the hyphen, and the eprobe checks fail on this. Allow hyphens in the system name so that eprobes can attach to the "xhci-hcd" trace events. Link: https://lore.kernel.org/all/Y3eJ8GiGnEvVd8%2FN@macondo/ Link: https://lore.kernel.org/linux-trace-kernel/20221122122345.160f5077@gandalf.local.home Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: stable@vger.kernel.org Fixes: 5b7a962209 ("tracing/probe: Check event/group naming rule at parsing") Reported-by: Rafael Mendonca <rafaelmendsr@gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:55 +01:00
Zheng Yejian	2442e655a6	tracing/hist: Fix wrong return value in parse_action_params() ... commit 2cc6a52888 upstream. When number of synth fields is more than SYNTH_FIELDS_MAX, parse_action_params() should return -EINVAL. Link: https://lore.kernel.org/linux-trace-kernel/20221207034635.2253990-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Cc: stable@vger.kernel.org Fixes: c282a386a3 ("tracing: Add 'onmatch' hist trigger action support") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:55 +01:00
Masami Hiramatsu (Google)	2a81ff5ce8	tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE ... commit e25e43a4e5 upstream. Both CONFIG_OSNOISE_TRACER and CONFIG_HWLAT_TRACER partially enables the CONFIG_TRACER_MAX_TRACE code, but that is complicated and has introduced a bug; It declares tracing_max_lat_fops data structure outside of #ifdefs, but since it is defined only when CONFIG_TRACER_MAX_TRACE=y or CONFIG_HWLAT_TRACER=y, if only CONFIG_OSNOISE_TRACER=y, that declaration comes to a definition(!). To fix this issue, and do not repeat the similar problem, makes CONFIG_OSNOISE_TRACER and CONFIG_HWLAT_TRACER enables the CONFIG_TRACER_MAX_TRACE always. It has there benefits; - Fix the tracing_max_lat_fops bug - Simplify the #ifdefs - CONFIG_TRACER_MAX_TRACE code is fully enabled, or not. Link: https://lore.kernel.org/linux-trace-kernel/167033628155.4111793.12185405690820208159.stgit@devnote3 Fixes: 424b650f35 ("tracing: Fix missing osnoise tracer on max_latency") Cc: Daniel Bristot de Oliveira <bristot@kernel.org> Cc: stable@vger.kernel.org Reported-by: David Howells <dhowells@redhat.com> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Link: https://lore.kernel.org/all/166992525941.1716618.13740663757583361463.stgit@warthog.procyon.org.uk/ (original thread and v1) Link: https://lore.kernel.org/all/202212052253.VuhZ2ulJ-lkp@intel.com/T/#u (v1 error report) Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:55 +01:00
Steven Rostedt (Google)	fe8c35c6ff	tracing: Fix race where eprobes can be called before the event ... commit d5f30a7da8 upstream. The flag that tells the event to call its triggers after reading the event is set for eprobes after the eprobe is enabled. This leads to a race where the eprobe may be triggered at the beginning of the event where the record information is NULL. The eprobe then dereferences the NULL record causing a NULL kernel pointer bug. Test for a NULL record to keep this from happening. Link: https://lore.kernel.org/linux-trace-kernel/20221116192552.1066630-1-rafaelmendsr@gmail.com/ Link: https://lore.kernel.org/all/20221117214249.2addbe10@gandalf.local.home/ Cc: stable@vger.kernel.org Fixes: 7491e2c442 ("tracing: Add a probe that attaches to trace events") Reported-by: Rafael Mendonca <rafaelmendsr@gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:54 +01:00
Zheng Yejian	15697f6533	tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' ... commit 82470f7d90 upstream. When generate a synthetic event with many params and then create a trace action for it [1], kernel panic happened [2]. It is because that in trace_action_create() 'data->n_params' is up to SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx' keeps indices into array 'hist_data->var_refs' for each synthetic event param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX (current value is 16), so out-of-bound write happened when 'data->n_params' more than 16. In this case, 'data->match_data.event' is overwritten and eventually cause the panic. To solve the issue, adjust the length of 'data->var_ref_idx' to be SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write. [1] # cd /sys/kernel/tracing/ # echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\ int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;\ int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\ int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\ int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;\ int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\ int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\ int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;\ int v63" >> synthetic_events # echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="bash"' >> \ events/sched/sched_waking/trigger # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid)" >> events/sched/sched_switch/trigger [2] BUG: unable to handle page fault for address: ffff91c900000000 PGD 61001067 P4D 61001067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 322 Comm: bash Tainted: G W 6.1.0-rc8+ #229 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0 Call Trace: <TASK> __find_event_file+0x55/0x90 action_create+0x76c/0x1060 event_hist_trigger_parse+0x146d/0x2060 ? event_trigger_write+0x31/0xd0 trigger_process_regex+0xbb/0x110 event_trigger_write+0x6b/0xd0 vfs_write+0xc8/0x3e0 ? alloc_fd+0xc0/0x160 ? preempt_count_add+0x4d/0xa0 ? preempt_count_add+0x70/0xa0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1d1d0cf077 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 RSP: 002b:00007ffcebb0e568 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000143 RCX: 00007f1d1d0cf077 RDX: 0000000000000143 RSI: 00005639265aa7e0 RDI: 0000000000000001 RBP: 00005639265aa7e0 R08: 000000000000000a R09: 0000000000000142 R10: 000056392639c017 R11: 0000000000000246 R12: 0000000000000143 R13: 00007f1d1d1ae6a0 R14: 00007f1d1d1aa4a0 R15: 00007f1d1d1a98a0 </TASK> Modules linked in: CR2: ffff91c900000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0 Link: https://lore.kernel.org/linux-trace-kernel/20221207035143.2278781-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Cc: stable@vger.kernel.org Fixes: d380dcde9a ("tracing: Fix now invalid var_ref_vals assumption in trace action") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:53 +01:00
Zheng Yejian	a44102d36a	tracing/hist: Fix issue of losting command info in error_log ... [ Upstream commit 608c6ed333 ] When input some constructed invalid 'trigger' command, command info in 'error_log' are lost [1]. The root cause is that there is a path that event_hist_trigger_parse() is recursely called once and 'last_cmd' which save origin command is cleared, then later calling of hist_err() will no longer record origin command info: event_hist_trigger_parse() { last_cmd_set() // <1> 'last_cmd' save origin command here at first create_actions() { onmatch_create() { action_create() { trace_action_create() { trace_action_create_field_var() { create_field_var_hist() { event_hist_trigger_parse() { // <2> recursely called once hist_err_clear() // <3> 'last_cmd' is cleared here } hist_err() // <4> No longer find origin command!!! Since 'glob' is empty string while running into the recurse call, we can trickly check it and bypass the call of hist_err_clear() to solve it. [1] # cd /sys/kernel/tracing # echo "my_synth_event int v1; int v2; int v3;" >> synthetic_events # echo 'hist:keys=pid' >> events/sched/sched_waking/trigger # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid1)" >> events/sched/sched_switch/trigger # cat error_log [ 8.405018] hist:sched:sched_switch: error: Couldn't find synthetic event Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.816902] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.816902] hist:sched:sched_switch: error: Couldn't parse field variable Command: hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) ^ [ 8.999880] : error: Couldn't find field Command: ^ [ 8.999880] : error: Couldn't parse field variable Command: ^ [ 8.999880] : error: Couldn't find field Command: ^ [ 8.999880] : error: Couldn't create histogram for field Command: ^ Link: https://lore.kernel.org/linux-trace-kernel/20221207135326.3483216-1-zhengyejian1@huawei.com Cc: <mhiramat@kernel.org> Cc: <zanussi@kernel.org> Fixes: f404da6e1d ("tracing: Add 'last error' error facility for hist triggers") Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:31 +01:00
Yang Jihong	ce61a877c7	blktrace: Fix output non-blktrace event when blk_classic option enabled ... [ Upstream commit f596da3efa ] When the blk_classic option is enabled, non-blktrace events must be filtered out. Otherwise, events of other types are output in the blktrace classic format, which is unexpected. The problem can be triggered in the following ways: # echo 1 > /sys/kernel/debug/tracing/options/blk_classic # echo 1 > /sys/kernel/debug/tracing/events/enable # echo blk > /sys/kernel/debug/tracing/current_tracer # cat /sys/kernel/debug/tracing/trace_pipe Fixes: c71a896154 ("blktrace: add ftrace plugin") Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Link: https://lore.kernel.org/r/20221122040410.85113-1-yangjihong1@huawei.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:18 +01:00
Greg Kroah-Hartman	b3d82fd3de	Merge 5.15.82 into android14-5.15 ... Changes in 5.15.82 arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored drm/i915: Create a dummy object for gen6 ppgtt drm/i915/gt: Use i915_vm_put on ppgtt_create error paths erofs: fix order >= MAX_ORDER warning due to crafted negative i_size btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino btrfs: free btrfs_path before copying inodes to userspace spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code drm/amdgpu: update drm_display_info correctly when the edid is read drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" iio: health: afe4403: Fix oob read in afe4403_read_raw iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw iio: light: rpr0521: add missing Kconfig dependencies bpf, perf: Use subprog name when reporting subprog ksymbol scripts/faddr2line: Fix regression in name resolution on ppc64le ARM: at91: rm9200: fix usb device clock id libbpf: Handle size overflow for ringbuf mmap hwmon: (ltc2947) fix temperature scaling hwmon: (ina3221) Fix shunt sum critical calculation hwmon: (i5500_temp) fix missing pci_disable_device() hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails bpf: Do not copy spin lock field from user in bpf_selem_alloc nvmem: rmem: Fix return value check in rmem_read() of: property: decrement node refcount in of_fwnode_get_reference_args() ixgbevf: Fix resource leak in ixgbevf_init_module() i40e: Fix error handling in i40e_init_module() fm10k: Fix error handling in fm10k_init_module() iavf: remove redundant ret variable iavf: Fix error handling in iavf_init_module() e100: Fix possible use after free in e100_xmit_prepare net/mlx5: DR, Rename list field in matcher struct to list_node net/mlx5: DR, Fix uninitialized var warning net/mlx5: Fix uninitialized variable bug in outlen_write() net/mlx5e: Fix use-after-free when reverting termination table can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() can: cc770: cc770_isa_probe(): add missing free_cc770dev() can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods can: m_can: Add check for devm_clk_get qlcnic: fix sleep-in-atomic-context bugs caused by msleep aquantia: Do not purge addresses when setting the number of rings wifi: cfg80211: fix buffer overflow in elem comparison wifi: cfg80211: don't allow multi-BSSID in S1G wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration net: phy: fix null-ptr-deref while probe() failed net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() net: net_netdev: Fix error handling in ntb_netdev_init_module() net/9p: Fix a potential socket leak in p9_socket_open net: ethernet: nixge: fix NULL dereference net: wwan: iosm: fix kernel test robot reported error net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type dsa: lan9303: Correct stat name tipc: re-fetch skb cb after tipc_msg_validate net: hsr: Fix potential use-after-free net: mdiobus: fix unbalanced node reference count afs: Fix fileserver probe RTT handling net: tun: Fix use-after-free in tun_detach() packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE sctp: fix memory leak in sctp_stream_outq_migrate() net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed hwmon: (coretemp) Check for null before removing sysfs attrs hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() riscv: vdso: fix section overlapping under some conditions riscv: mm: Proper page permissions after initmem free ALSA: dice: fix regression for Lexicon I-ONIX FW810S error-injection: Add prompt for function error injection tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 pinctrl: intel: Save and restore pins in "direct IRQ" mode v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails net: stmmac: Set MAC's flow control register to reflect current settings mmc: mmc_test: Fix removal of debugfs file mmc: core: Fix ambiguous TRIM and DISCARD arg mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check mmc: sdhci-sprd: Fix no reset data and command after voltage switch mmc: sdhci: Fix voltage switch delay drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame drm/amdgpu: enable Vangogh VCN indirect sram mode drm/i915: Fix negative value passed as remaining time drm/i915: Never return 0 if not all requests retired tracing/osnoise: Fix duration type tracing: Fix race where histograms can be called before the event tracing: Free buffers when a used dynamic event is removed io_uring: update res mask in io_poll_check_events io_uring: fix tw losing poll events io_uring: cmpxchg for poll arm refs release io_uring: make poll refs more robust io_uring/poll: fix poll_refs race with cancelation KVM: x86/mmu: Fix race condition in direct_page_fault ASoC: ops: Fix bounds check for _sx controls pinctrl: single: Fix potential division by zero riscv: Sync efi page table's kernel mappings before switching riscv: fix race when vmap stack overflow riscv: kexec: Fixup irq controller broken in kexec crash path nvme: fix SRCU protection of nvme_ns_head list iommu/vt-d: Fix PCI device refcount leak in has_external_pci() iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() mm: __isolate_lru_page_prepare() in isolate_migratepages_block() mm: migrate: fix THP's mapcount on isolation parisc: Increase FRAME_WARN to 2048 bytes on parisc Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled selftests: net: add delete nexthop route warning test selftests: net: fix nexthop warning cleanup double ip typo ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference ipv4: Fix route deletion when nexthop info is not specified serial: stm32: Factor out GPIO RTS toggling into separate function serial: stm32: Use TC interrupt to deassert GPIO RTS in RS485 mode serial: stm32: Deassert Transmit Enable on ->rs485_config() i2c: npcm7xx: Fix error handling in npcm_i2c_init() i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set ACPI: HMAT: remove unnecessary variable initialization ACPI: HMAT: Fix initiator registration for single-initiator systems Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" char: tpm: Protect tpm_pm_suspend with locks Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() ipc/sem: Fix dangling sem_array access in semtimedop race proc: avoid integer type confusion in get_proc_long proc: proc_skip_spaces() shouldn't think it is working on C strings Linux 5.15.82 Change-Id: I1631261fcfd321674c546c41628bb3283e02f1a5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-12-08 16:43:35 +00:00
Steven Rostedt (Google)	417d5ea6e7	tracing: Free buffers when a used dynamic event is removed ... commit 4313e5a613 upstream. After 65536 dynamic events have been added and removed, the "type" field of the event then uses the first type number that is available (not currently used by other events). A type number is the identifier of the binary blobs in the tracing ring buffer (known as events) to map them to logic that can parse the binary blob. The issue is that if a dynamic event (like a kprobe event) is traced and is in the ring buffer, and then that event is removed (because it is dynamic, which means it can be created and destroyed), if another dynamic event is created that has the same number that new event's logic on parsing the binary blob will be used. To show how this can be an issue, the following can crash the kernel: # cd /sys/kernel/tracing # for i in `seq 65536`; do echo 'p:kprobes/foo do_sys_openat2 $arg1:u32' > kprobe_events # done For every iteration of the above, the writing to the kprobe_events will remove the old event and create a new one (with the same format) and increase the type number to the next available on until the type number reaches over 65535 which is the max number for the 16 bit type. After it reaches that number, the logic to allocate a new number simply looks for the next available number. When an dynamic event is removed, that number is then available to be reused by the next dynamic event created. That is, once the above reaches the max number, the number assigned to the event in that loop will remain the same. Now that means deleting one dynamic event and created another will reuse the previous events type number. This is where bad things can happen. After the above loop finishes, the kprobes/foo event which reads the do_sys_openat2 function call's first parameter as an integer. # echo 1 > kprobes/foo/enable # cat /etc/passwd > /dev/null # cat trace cat-2211 [005] .... 2007.849603: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849620: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849838: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849880: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196 # echo 0 > kprobes/foo/enable Now if we delete the kprobe and create a new one that reads a string: # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' > kprobe_events And now we can the trace: # cat trace sendmail-1942 [002] ..... 530.136320: foo: (do_sys_openat2+0x0/0x240) arg1= cat-2046 [004] ..... 530.930817: foo: (do_sys_openat2+0x0/0x240) arg1="������������������������������������������������������������������������������������������������" cat-2046 [004] ..... 530.930961: foo: (do_sys_openat2+0x0/0x240) arg1="������������������������������������������������������������������������������������������������" cat-2046 [004] ..... 530.934278: foo: (do_sys_openat2+0x0/0x240) arg1="������������������������������������������������������������������������������������������������" cat-2046 [004] ..... 530.934563: foo: (do_sys_openat2+0x0/0x240) arg1="������������������������������������������������������������������������������������������������" bash-1515 [007] ..... 534.299093: foo: (do_sys_openat2+0x0/0x240) arg1="kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk���������@��4Z����;Y�����U And dmesg has: ================================================================== BUG: KASAN: use-after-free in string+0xd4/0x1c0 Read of size 1 at addr ffff88805fdbbfa0 by task cat/2049 CPU: 0 PID: 2049 Comm: cat Not tainted 6.1.0-rc6-test+ #641 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016 Call Trace: <TASK> dump_stack_lvl+0x5b/0x77 print_report+0x17f/0x47b kasan_report+0xad/0x130 string+0xd4/0x1c0 vsnprintf+0x500/0x840 seq_buf_vprintf+0x62/0xc0 trace_seq_printf+0x10e/0x1e0 print_type_string+0x90/0xa0 print_kprobe_event+0x16b/0x290 print_trace_line+0x451/0x8e0 s_show+0x72/0x1f0 seq_read_iter+0x58e/0x750 seq_read+0x115/0x160 vfs_read+0x11d/0x460 ksys_read+0xa9/0x130 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fc2e972ade2 Code: c0 e9 b2 fe ff ff 50 48 8d 3d b2 3f 0a 00 e8 05 f0 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007ffc64e687c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2e972ade2 RDX: 0000000000020000 RSI: 00007fc2e980d000 RDI: 0000000000000003 RBP: 00007fc2e980d000 R08: 00007fc2e980c010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020f00 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 </TASK> The buggy address belongs to the physical page: page:ffffea00017f6ec0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5fdbb flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000 0000000000000000 ffffea00017f6ec8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88805fdbbe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805fdbbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88805fdbbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805fdbc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805fdbc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== This was found when Zheng Yejian sent a patch to convert the event type number assignment to use IDA, which gives the next available number, and this bug showed up in the fuzz testing by Yujie Liu and the kernel test robot. But after further analysis, I found that this behavior is the same as when the event type numbers go past the 16bit max (and the above shows that). As modules have a similar issue, but is dealt with by setting a "WAS_ENABLED" flag when a module event is enabled, and when the module is freed, if any of its events were enabled, the ring buffer that holds that event is also cleared, to prevent reading stale events. The same can be done for dynamic events. If any dynamic event that is being removed was enabled, then make sure the buffers they were enabled in are now cleared. Link: https://lkml.kernel.org/r/20221123171434.545706e3@gandalf.local.home Link: https://lore.kernel.org/all/20221110020319.1259291-1-zhengyejian1@huawei.com/ Cc: stable@vger.kernel.org Cc: Andrew Morton <akpm@linux-foundation.org> Depends-on: e18eb8783e ("tracing: Add tracing_reset_all_online_cpus_unlocked() function") Depends-on: 5448d44c38 ("tracing: Add unified dynamic event framework") Depends-on: 6212dd2968 ("tracing/kprobes: Use dyn_event framework for kprobe events") Depends-on: 065e63f951 ("tracing: Only have rmmod clear buffers that its events were active in") Depends-on: 575380da8b ("tracing: Only clear trace buffer on module unload if event was traced") Fixes: 77b44d1b7c ("tracing/kprobes: Rename Kprobe-tracer to kprobe-event") Reported-by: Zheng Yejian <zhengyejian1@huawei.com> Reported-by: Yujie Liu <yujie.liu@intel.com> Reported-by: kernel test robot <yujie.liu@intel.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:28:43 +01:00
Steven Rostedt (Google)	52fc245d15	tracing: Fix race where histograms can be called before the event ... commit ef38c79a52 upstream. commit 94eedf3dde ("tracing: Fix race where eprobes can be called before the event") fixed an issue where if an event is soft disabled, and the trigger is being added, there's a small window where the event sees that there's a trigger but does not see that it requires reading the event yet, and then calls the trigger with the record == NULL. This could be solved with adding memory barriers in the hot path, or to make sure that all the triggers requiring a record check for NULL. The latter was chosen. Commit 94eedf3dde set the eprobe trigger handle to check for NULL, but the same needs to be done with histograms. Link: https://lore.kernel.org/linux-trace-kernel/20221118211809.701d40c0f8a757b0df3c025a@kernel.org/ Link: https://lore.kernel.org/linux-trace-kernel/20221123164323.03450c3a@gandalf.local.home Cc: Tom Zanussi <zanussi@kernel.org> Cc: stable@vger.kernel.org Fixes: 7491e2c442 ("tracing: Add a probe that attaches to trace events") Reported-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:28:43 +01:00