Adding the following symbols to abi_gki_aarch64_pixel:
- mbox_request_channel_byname
Bug: 368167673
Change-Id: I031522377372a25bf5f9e97eb4832173463de390
Signed-off-by: David Chiang <davidchiang@google.com>
Update symbol list for honor in android/abi_gki_aarch64_honor
Bug: 365506689
Change-Id: I604163b979660eaedbc13d3da5c9e3cdb8275e50
Signed-off-by: jiangxinpei <jiangxinpei@honor.corp-partner.google.com>
When an LMK (Low Memory Killer) occurs, it is crucial for us to identify
the underlying cause of low memory. Based on past experiences, memory
leaks are often the root cause in such situations. The purpose of this
function is to assist us in identifying which application or type of
memory is experiencing memory leaks, thereby enabling us to effectively
locate and address the memory leakage issue.
Bug: 365506689
Bug: 346707562
Change-Id: I5d7d6bdbca30660f2a552211fd8aff40d3550df7
Signed-off-by: jiangxinpei <jiangxinpei@honor.corp-partner.google.com>
(cherry picked from commit d61134668c2d37846a6cea3e1ab3c237f2c7bc99)
Update symbol list for honor in android/abi_gki_aarch64_honor
Bug: 365506454
Change-Id: I5d9a7a41da2a6f97998fadbbcb447db53b873bcc
Signed-off-by: jiangxinpei <jiangxinpei@honor.corp-partner.google.com>
Export binder_alloc_copy_from_buffer, allow vendor modules perform more operations
on binder transaction and improve user operation fluency and timeliness experience.
Bug: 365506454
Bug: 343139379
Change-Id: I4353763099d854a62d0b70b003fbaca00e2c76e4
Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com>
(cherry picked from commit d8db83d94e14b48819bba18cb975943c237e33df)
Keep atomic file clean while updating and make it dirtied during commit
in order to avoid unnecessary and excessive inode updates in the previous
fix.
Fixes: 4bf78322346f ("f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag")
Change-Id: I2a29d047fa4233632876c61cf909340d1f60c26d
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Bug: 352181300
(cherry picked from commit fccaa81de87e80b1809906f7e438e5766fbdc172
https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
Change-Id: I5970e56a5318804cfebea340b5b19d6e0a66dc01
Signed-off-by: Daeho Jeong <daehojeong@google.com>
These symbols are required to use custom driver
for writing data into Serial device
using common TTY drivers for basic data trasmit via UART/SPI.
INFO: 2 function symbol(s) added
'int serdev_device_write(struct serdev_device*, const unsigned char*, size_t, long)'
'void serdev_device_write_wakeup(struct serdev_device*)'
Bug: 356635235
Change-Id: Ia365485ad4b533e5e2826add9182bc98b5563f81
Signed-off-by: iabdullah <imrankhan.abdullah@harman.com>
Remove symbols obsoleted since including CONFIG_SERIAL_8250_BCM7271
Bug: 365149220
Change-Id: Id35a1c68e27359fa5e8a2d90cfa7be5346875ebf
Signed-off-by: Pierre Couillaud <pierre@broadcom.com>
[ Upstream commit cfa1a2329a691ffd991fcf7248a57d752e712881 ]
The BPF ring buffer internally is implemented as a power-of-2 sized circular
buffer, with two logical and ever-increasing counters: consumer_pos is the
consumer counter to show which logical position the consumer consumed the
data, and producer_pos which is the producer counter denoting the amount of
data reserved by all producers.
Each time a record is reserved, the producer that "owns" the record will
successfully advance producer counter. In user space each time a record is
read, the consumer of the data advanced the consumer counter once it finished
processing. Both counters are stored in separate pages so that from user
space, the producer counter is read-only and the consumer counter is read-write.
One aspect that simplifies and thus speeds up the implementation of both
producers and consumers is how the data area is mapped twice contiguously
back-to-back in the virtual memory, allowing to not take any special measures
for samples that have to wrap around at the end of the circular buffer data
area, because the next page after the last data page would be first data page
again, and thus the sample will still appear completely contiguous in virtual
memory.
Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for
book-keeping the length and offset, and is inaccessible to the BPF program.
Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ`
for the BPF program to use. Bing-Jhong and Muhammad reported that it is however
possible to make a second allocated memory chunk overlapping with the first
chunk and as a result, the BPF program is now able to edit first chunk's
header.
For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size
of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to
bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in
[0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, lets
allocate a chunk B with size 0x3000. This will succeed because consumer_pos
was edited ahead of time to pass the `new_prod_pos - cons_pos > rb->mask`
check. Chunk B will be in range [0x3008,0x6010], and the BPF program is able
to edit [0x3010,0x6010]. Due to the ring buffer memory layout mentioned
earlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same data
pages. This means that chunk B at [0x4000,0x4008] is chunk A's header.
bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header's pg_off to then
locate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunk
B modified chunk A's header, then bpf_ringbuf_commit() refers to the wrong
page and could cause a crash.
Fix it by calculating the oldest pending_pos and check whether the range
from the oldest outstanding record to the newest would span beyond the ring
buffer size. If that is the case, then reject the request. We've tested with
the ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh)
before/after the fix and while it seems a bit slower on some benchmarks, it
is still not significantly enough to matter.
Bug: 349976340
Fixes: 457f44363a ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
Co-developed-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Co-developed-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20240621140828.18238-1-daniel@iogearbox.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit d1b9df0435)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I57847858a13e15118ef18a00257e45f96597e938
This config option was not requested by any partner and has non-zero
overhead on process creation. Disable it.
Bug: 191150949
Bug: 365466166
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: Ia9547c989c22246c46ed9624a0707c6369ee4de0
Add symbol list for unisoc in android/abi_gki_aarch64_honor
Bug: 332656187
Change-Id: Idaac6034d436d888d1cd61adc926f7eaca2eb51e
Signed-off-by: jiangxinpei <jiangxinpei@honor.corp-partner.google.com>
(cherry picked from commit 8d957bd1cdfc8e9de23e15b0ba3ef4d431e99aeb)
The patches to support binder's frozen notification feature break the
KMI. This change fixes such issues by (1) moving proc->delivered_freeze
into the existing proc_wrapper struction, (2) dropping the frozen stats
support and (3) amending the STG due to a harmless enum binder_work_type
addition.
These are the reported KMI issues fixed by this patch:
function symbol 'int __traceiter_binder_transaction_received(void*, struct binder_transaction*)' changed
CRC changed from 0x74e9c98b to 0xfe0f8640
type 'struct binder_proc' changed
byte size changed from 584 to 632
member 'struct list_head delivered_death' changed
offset changed by 256
member 'struct list_head delivered_freeze' was added
13 members ('u32 max_threads' .. 'u64 android_oem_data1') changed
offset changed by 384
type 'struct binder_thread' changed
byte size changed from 464 to 496
2 members ('atomic_t tmp_ref' .. 'bool is_dead') changed
offset changed by 224
4 members ('struct task_struct* task' .. 'enum binder_prio_state prio_state') changed
offset changed by 256
type 'struct binder_stats' changed
byte size changed from 216 to 244
member changed from 'atomic_t br[21]' to 'atomic_t br[23]'
type changed from 'atomic_t[21]' to 'atomic_t[23]'
number of elements changed from 21 to 23
member changed from 'atomic_t bc[19]' to 'atomic_t bc[22]'
offset changed from 672 to 736
type changed from 'atomic_t[19]' to 'atomic_t[22]'
number of elements changed from 19 to 22
member changed from 'atomic_t obj_created[7]' to 'atomic_t obj_created[8]'
offset changed from 1280 to 1440
type changed from 'atomic_t[7]' to 'atomic_t[8]'
number of elements changed from 7 to 8
member changed from 'atomic_t obj_deleted[7]' to 'atomic_t obj_deleted[8]'
offset changed from 1504 to 1696
type changed from 'atomic_t[7]' to 'atomic_t[8]'
number of elements changed from 7 to 8
type 'enum binder_work_type' changed
enumerator 'BINDER_WORK_FROZEN_BINDER' (10) was added
enumerator 'BINDER_WORK_CLEAR_FREEZE_NOTIFICATION' (11) was added
Bug: 363013421
Change-Id: If9f1f14a2eda215a4c9cb0823c50c8e0e8079ef1
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Frozen processes present a significant challenge in binder transactions.
When a process is frozen, it cannot, by design, accept and/or respond to
binder transactions. As a result, the sender needs to adjust its
behavior, such as postponing transactions until the peer process
unfreezes. However, there is currently no way to subscribe to these
state change events, making it impossible to implement frozen-aware
behaviors efficiently.
Introduce a binder API for subscribing to frozen state change events.
This allows programs to react to changes in peer process state,
mitigating issues related to binder transactions sent to frozen
processes.
Implementation details:
For a given binder_ref, the state of frozen notification can be one of
the followings:
1. Userspace doesn't want a notification. binder_ref->freeze is null.
2. Userspace wants a notification but none is in flight.
list_empty(&binder_ref->freeze->work.entry) = true
3. A notification is in flight and waiting to be read by userspace.
binder_ref_freeze.sent is false.
4. A notification was read by userspace and kernel is waiting for an ack.
binder_ref_freeze.sent is true.
When a notification is in flight, new state change events are coalesced into
the existing binder_ref_freeze struct. If userspace hasn't picked up the
notification yet, the driver simply rewrites the state. Otherwise, the
notification is flagged as requiring a resend, which will be performed
once userspace acks the original notification that's inflight.
See https://r.android.com/3070045 for how userspace is going to use this
feature.
Signed-off-by: Yu-Ting Tseng <yutingtseng@google.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240709070047.4055369-4-yutingtseng@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 363013421
(cherry picked from commit d579b04a52a183db47dfcb7a44304d7747d551e1
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-next)
Change-Id: I5dd32abba932ca7d03ae58660143e075ed778b81
[cmllamas: fix merge conflicts due to missing 0567461a7a]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
CPU being an int, we need to check if it is negative to ensure no
out-of-bounds access. Make it unsigned.
Bug: 229972309
Change-Id: I987a66d83c7bf3143a6ba287e929cd52de549850
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
The process exit time is mainly caused by freeing its swp_entrys. When
low memory triggers to kill lots of processes exit simultaneously, there
is a problem of CPU high load occupied by the exiting processes.
This feature is used to asynchronously maintain and release the
swp_entrys of the exiting process to accelerate the efficiency of the
exiting process.
Bug: 364480846
Bug: 340798358
Change-Id: I6fc0b813e7ac6a0796e08ce7a17d5ff3ab2b799b
Signed-off-by: Justin Jiang <justinjiang@vivo.corp-partner.google.com>
Attaching/detaching of a device to multiple PM domains has started to
become a common operation for many drivers, typically during ->probe() and
->remove(). In most cases, this has lead to lots of boilerplate code in the
drivers.
To fixup up the situation, let's introduce a pair of helper functions,
dev_pm_domain_attach|detach_list(), that driver can use instead of the
open-coding. Note that, it seems reasonable to limit the support for these
helpers to DT based platforms, at it's the only valid use case for now.
Suggested-by: Daniel Baluta <daniel.baluta@nxp.com>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Tested-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20240130123951.236243-2-ulf.hansson@linaro.org
Bug: 323966425
Change-Id: Ib0cc368d9eac3a9615b75ca5954d81ab6b14b4b2
(cherry picked from commit 161e16a5e50a82d219b3df3ce32286b0a2ae08bd)
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
Clang warns (or errors with CONFIG_WERROR=y):
drivers/opp/of.c:1081:28: error: multiple unsequenced modifications to 'val' [-Werror,-Wunsequenced]
1081 | .freq = be32_to_cpup(val++) * 1000,
| ^
1082 | .u_volt = be32_to_cpup(val++),
| ~~
1 error generated.
There is no sequence point in a designated initializer. Move back to
separate variables for the creation of the values, so that there are
sequence points between each evaluation and increment of val.
Fixes: 75bbc92c09d8 ("OPP: Add dev_pm_opp_add_dynamic() to allow more flexibility")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Bug: 323966425
Change-Id: I870855263a0db8e35bcf8f150f5e05b2cfbdbc6b
(cherry picked from commit 184ff4f721638e37a5a5907bf98962b6d9318ef6)
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
To enable the performance level to be used for OPPs, let's convert into
using the dev_pm_opp_add_dynamic() API when creating them. This will be
particularly useful for the SCMI performance domain, as shown through
subsequent changes.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20230925131715.138411-9-ulf.hansson@linaro.org
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Bug: 323966425
Change-Id: I0d831c1e923d64e3e88e42acf4f4f16587c21696
(cherry picked from commit 5a6a104193520dc3b66ad2c7d823e00b50734ab6)
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
At this point the level (performance state) for an OPP is currently limited
to be requested for a device that is attached to a PM domain. Moreover,
the device needs to have the so called required-opps assigned to it, which
are based upon OPP tables being described in DT.
To extend the support beyond required-opps and DT, let's enable the level
to be set for all OPPs. More precisely, if the requested OPP has a valid
level let's try to request it through the device's optional PM domain, via
calling dev_pm_domain_set_performance_state().
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ Viresh: Handle NULL opp in _set_opp_level() ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Bug: 323966425
Change-Id: I6176127586d50324fbb96f099ddad60bb3c910e5
(cherry picked from commit 0025ff64ffcf6bd6ece5484e7818401f77bf115f)
[nikunj: Resolved minor conflict in drivers/opp/core.c ]
[anantg: Use dev_pm_genpd_set_performance_state in drivers/opp/core.c ]
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
Let's extend the dev_pm_opp_data with a level variable, to allow users to
specify a corresponding level (performance state) for a dynamically added
OPP.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Bug: 323966425
Change-Id: I1cc007355fd53f26d29b88ad0d9fa2d56a1e4e9d
(cherry picked from commit 3166383da081461244918aeed7ad028ef11b17cc)
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
The dev_pm_opp_add() API is limited to add dynamic OPPs with a frequency
and a voltage level. To enable more flexibility, let's add a new API,
dev_pm_opp_add_dynamic() that's takes a struct dev_pm_opp_data* instead of
a list of in-parameters.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Bug: 323966425
Change-Id: I37e08f4b4c9f42e1f8c42a876d46d89447fda7a1
(cherry picked from commit 248a38d5cc3f3505e6cfbbc0514435c9f1ba00af)
[anantg: Kept dev_pm_opp_add() as an exported API to maintain the ABI]
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
Most scmi_perf_proto_ops are already using an "u32 domain" as an
in-parameter to indicate what performance domain we shall operate upon.
However, some of the ops are using a "struct device *dev", which means that
an additional OF parsing is needed each time the perf ops gets called, to
find the corresponding domain-id.
To avoid the above, but also to make the code more consistent, let's
replace the in-parameter "struct device *dev" with an "u32 domain". Note
that, this requires us to make some corresponding changes to the scmi
cpufreq driver, so let's do that too.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20230825112633.236607-5-ulf.hansson@linaro.org
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Bug: 323966425
Change-Id: I524cfe6d5f28382d407b6323a1fce63620cc089b
(cherry picked from commit 39dfa5b9e1f0fa63b811a0a87f1c2fb9c76a0456)
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
The OF parsing of the clock domain specifier seems to better belong in the
scmi cpufreq driver, rather than being implemented behind the generic
->device_domain_id() perf protocol ops.
To prepare to remove the ->device_domain_id() ops, let's implement the OF
parsing in the scmi cpufreq driver instead.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20230825112633.236607-4-ulf.hansson@linaro.org
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Bug: 323966425
Change-Id: I7b777bc375373f5a716afd38ca23ece5e2750606
(cherry picked from commit e336baa4193ecc788a06c0c4659e400bb53689b4)
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
Similar to other protocol ops, it's useful for an scmi module driver to get
some generic information of a performance domain. Therefore, let's add a
new callback to provide this information. The information is currently
limited to the name of the performance domain and whether the set-level
operation is supported, although this can easily be extended if we find the
need for it.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20230825112633.236607-3-ulf.hansson@linaro.org
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Bug: 323966425
Change-Id: Ica11495c1ba40c646cf835418788795e6671e7db
(cherry picked from commit 3d99ed60721bf2e108c8fc660775766057689a92)
[nikunj: Resolved minor conflict in drivers/firmware/arm_scmi/perf.c ]
[anantg: Resolved minor conflict in drivers/firmware/arm_scmi/perf.c ]
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
Similar to other protocol ops, it's useful for an scmi module driver to get
the number of supported performance domains, hence let's make this
available by adding a new perf protocol callback. Note that, a user is
being added from subsequent changes.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20230825112633.236607-2-ulf.hansson@linaro.org
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Bug: 323966425
Change-Id: Idc17b94ead5ec08c58df9dcf2194d730b0eef175
(cherry picked from commit e9090e70e618cd62ab7bf2914511e5eea31a2535)
[nikunj: Resolved minor conflict in drivers/firmware/arm_scmi/perf.c ]
Signed-off-by: Nikunj Kela <quic_nkela@quicinc.com>
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
Export shrink_slab to module for do shrink-memory action.
Bug: 363907036
Change-Id: Ia96e6595186927c1fe31a6504675b8762154c0a6
Signed-off-by: huangshaobo1 <huangshaobo1@xiaomi.corp-partner.google.com>
[ Upstream commit 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10 ]
Lion Ackermann reported that there is a race condition between namespace cleanup
in ipset and the garbage collection of the list:set type. The namespace
cleanup can destroy the list:set type of sets while the gc of the set type is
waiting to run in rcu cleanup. The latter uses data from the destroyed set which
thus leads use after free. The patch contains the following parts:
- When destroying all sets, first remove the garbage collectors, then wait
if needed and then destroy the sets.
- Fix the badly ordered "wait then remove gc" for the destroy a single set
case.
- Fix the missing rcu locking in the list:set type in the userspace test
case.
- Use proper RCU list handlings in the list:set type.
The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
Bug: 347636817
Fixes: 97f7cf1cd80e (netfilter: ipset: fix performance regression in swap operation)
Reported-by: Lion Ackermann <nnamrec@gmail.com>
Tested-by: Lion Ackermann <nnamrec@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 390b353d1a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I92a8681d8a0f475aa20c34c17daa222d02cf7935
Add initial symbol list for sunxi.
Bug: 363322588
Signed-off-by: Aran Dalton <arda@allwinnertech.com>
Change-Id: I1f9ab11c8d583b6905bf55420c6bc7d22be67346
In commit cfcd544a99 ("usb: typec: tcpm: unregister existing source
caps before re-registration"), quilt, and git, applied the diff to the
incorrect function, which would cause bad problems if exercised in a
device with these capabilities.
Fix this all up to be in the correct function.
Fixes: cfcd544a99 ("usb: typec: tcpm: unregister existing source caps before re-registration")
Reported-by: Charles Yo <charlesyo@google.com>
Cc: Kyle Tso <kyletso@google.com>
Cc: Amit Sunil Dhamne <amitsd@google.com>
Cc: Ondrej Jirman <megi@xff.cz>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/linux-usb/2024083008-granddad-unmoving-828c@gregkh/
Bug: 363121994
[ note, only 1/3 of the upstream commit is needed here due to half
already being present due to manual UPSTREAM changes made to the tree,
and a second follow-up fix not being merged from LTS here yet - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I33b07fcb8d1e64e7f0424b9a7b7d056aa9e44b2f
[ Upstream commit affc18fdc694190ca7575b9a86632a73b9fe043d ]
q->bands will be assigned to qopt->bands to execute subsequent code logic
after kmalloc. So the old q->bands should not be used in kmalloc.
Otherwise, an out-of-bounds write will occur.
Bug: 349777785
Fixes: c2999f7fb0 ("net: sched: multiq: don't call qdisc_put() while holding tree lock")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Acked-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 0f208fad86)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iec8413c39878596795420ae58bbe6974890cf2de
